Verifying an AI system's output for correctness and safety requires less capability than producing it.

Starting view, before sources. The claim is a generic about all AI outputs and joins two properties. For properties with a mechanical check (proofs, specified programs, sourced facts) checking is cheaper than finding; this is the practical content of the belief that P differs from NP and of proof checkers, and it is treated here as settled. For safety, the property is the absence of any harmful flaw, a universally quantified property without a certificate, and an adversarial producer selects for flaws the checker misses. The expectation was that the claim holds for the first class and weakens or fails for the second, with the size of the failure an empirical matter. The claim says capability, while most everyday evidence for the asymmetry is about effort or time; the two are linked but not identical.

Sources read in this pass. (1) Christiano, 'Where I agree and disagree with Eliezer' (2022), www.lesswrong.com/posts/CoZhXrhpQxpy9xw9y/where-i-agree-and-disagree-with-eliezer : the passage replying to Yudkowsky states that 'verification is much, much easier than generation in virtually every domain' of R&D. It offers experience, not data. (2) Wentworth, 'Verification Is Not Easier Than Generation In General' (2022), www.lesswrong.com/posts/2PDC69DDJuAx6GANa/verification-is-not-easier-than-generation-in-general : the P versus NP intuition is drawn from problems selected for easy verification; generating a halting program is trivial while verifying halting is uncomputable. In the comments Christiano grounds the intuition in everyday cases (reviewing papers, catching fraud, judging software) and concedes 'plenty of examples where verification is not easier than generation'; Wentworth answers that review is only easier because reviewers are not required to catch every problem, and that verification is hard where there is an adversary and a 'for all' quantifier. Both parties therefore accept that the claim is not universal; they differ on which case AI oversight resembles. (3) Greenblatt et al., 'AI Control' (2023), arxiv.org/abs/2312.06942 , tables as excerpted from the paper: trusted monitoring of GPT-4 by GPT-3.5 gives 62% safety at 97% usefulness, up from 15% with upfront auditing; deferring more work to the weaker model raises safety to 92% at 83% usefulness. A weaker checker adds real but unreliable protection, and reliability is bought by giving up the stronger model's output. (4) Engels et al., 'Scaling Laws for Scalable Oversight' (2025), arxiv.org/abs/2504.18530 , as read in the assessment of the claim that oversight success declines with the capability gap, and in a summary by the authors' institute: about 10% nested oversight success in Backdoor Code at a 400 Elo gap, 52% in Debate. Toy games and fitted curves; direction more trustworthy than magnitude. (5) Jotautaitė et al., 'MonitoringBench' (May 2026), arxiv.org/abs/2605.09684 , abstract and methods read: an Opus 4.5 monitor's catch rate at 1% false positives falls from 94.9% on elicited attacks to 60.3% on refined attacks produced with Opus 4.6; attacks transfer to ten held-out monitors, 'with catch rates generally increasing with monitor capability'. The monitor here is nearly as capable as the attacker, and the attacker had a large refinement budget and human help. This is evidence that under optimization pressure even near-peer checking is unreliable, and that elicited-only evaluations overstate monitors. (6) Ye et al., 'Coding with the Enemy' (June 2026, v3 November 2026), arxiv.org/abs/2606.05647 , abstract read plus excerpts: 83 of 88 developers without a monitor failed to detect sabotage; the authors attribute this to minimal review, plausible cover stories and overtrust, so it reflects attention and effort as well as capability. A Claude Haiku 4.5 monitor flagged 16 of 19 sabotage attempts by stronger agents (excerpt), yet sabotage still succeeded in 9 of 16 correctly alerted sessions. (7) 'How does information access affect LLM monitors' ability to detect sabotage?' (January 2026), arxiv.org/abs/2601.21112 , excerpts only: information filtering helps weaker monitors, and the gap between weak and strong monitors is larger on longer trajectories.

Subclaims. 'A weaker AI monitor detects less of an AI agent's hidden misbehavior as the agent's capability advantage over the monitor grows' is not yet assessed; sources 4 to 7 point toward it. 'AI debate enables less capable judges to supervise more capable debaters' stands inconclusive. 'In AI debates, dishonest debaters can win by making arguments too complex for opponents to refute' stands supported. 'Scalable oversight protocols remain effective against AI systems that deliberately deceive their overseers' and 'Better scaffolding and chain-of-thought access let weaker AI models reliably monitor stronger AI agents' are unassessed.

Weighing. The checkable-output argument establishes the claim for a real and important class but does not reach safety, and its step from less effort to less capability is unargued. The quantifier argument shows why safety is structurally different but does not by itself say how large the gap is in practice. The measurements show detection depending on checker capability and falling under attack refinement, which weighs against the safety half, while also showing weaker checkers catching most unrefined attacks, which keeps the claim from being simply false. The protocol argument could rescue the safety half but rests on premises that are unsettled. Because the claim's parts pull in different directions, a credence is omitted. The status is inconclusive, held with moderate confidence; the main alternative reading is doubtful, on the ground that a generic that names safety and fails for adversarial safety checks is false as worded.

Limits of this pass. Search covered the alignment-forum dispute and 2023 to 2026 control and monitoring papers; it did not cover the human literature on code review and peer review defect detection, formal verification practice, or the prover-verifier game literature, and Yudkowsky's original passage was not reopened. Several figures come from abstracts and excerpts, not full reads of results sections. What would change the verdict: protocol results against deception-trained systems at wide gaps (toward supported if they hold, toward doubtful if they fail), and assessment of the monitor-gap subclaim.