On the claim: More capable AI agents can evade weaker trusted monitors using adaptive attacks such as prompt injection.

These two unassessed nodes appear to state one proposition. One says more capable AI agents can evade weaker trusted monitors using adaptive attacks such as prompt injection; the other says untrusted models aware of the monitor can evade monitor-based control protocols through adaptive attacks such as prompt injection. Both were minted on the same day as premises of arguments about adaptive evasion of weaker monitors (under the claim on scaffolded weak-to-strong monitoring and under the claim on oversight against deliberate deception), and the argument evaluations that cite them point to the same evidence: published prompt-injection and adaptive-attack results on control benchmarks. Nothing seems able to bear on one without bearing equally on the other, since in the control setting the untrusted model is the more capable one and the trusted monitor the weaker. If the Curator judges that "more capable" versus "aware of the monitor" marks a real difference in what bears on them, a recorded lateral link would do instead.

The proposal says two nodes state one proposition: that a more capable AI agent can evade a weaker trusted monitor through adaptive attacks such as prompt injection, and that an untrusted model aware of the monitor can evade monitor-based control protocols through such attacks. It argues that in the control setting the untrusted model is the more capable one and the monitor the weaker, and that both nodes draw on the same evidence, namely published prompt-injection and adaptive-attack results on control benchmarks. I read both claim records. The merge target carries an assessment resting on Terekhov et al. and Ge-Wang et al., which are the benchmark results the proposal names. I did not open those papers, because the question here is identity and not truth.

The case is plausible and well formed, and it states its own fallback, a lateral link. It is not clearly decisive, though. The two wordings differ in what could bear on them. The first turns on a capability gap and on monitors in general. The second turns on the model's awareness of the monitor and on whole protocols, which can include defer-to-trusted or resampling. Evidence about scaling with the capability gap bears on the first and not the second. Evidence about protocol-level defences bears on the second and not the first. A less capable but monitor-aware model could also evade, and a more capable but unaware one might not. Whether these differences matter is a judgment about identity under §2. That judgment belongs to the Curator, who adjudicates merges, and not to the review gate.

I admit the case for adjudication. The Curator should decide between three outcomes: a merge, a lateral link, or a rewording of one node so that the two are distinct. This acceptance admits the case only. It does not change either node.