Step 6: tool results

read_page

{
  "url": "https://arxiv.org/abs/2510.09462",
  "max_chars": 4000
}

{"ok":true,"url":"https://arxiv.org/abs/2510.09462","text":"[2510.09462] Adaptive Attacks on Trusted Monitors Subvert AI Control Protocols\nSkip to main content\nSearch\nSubmit\nDonate\nLog in\nSearch arXiv\nPress Enter to search &middot; Advanced search\n-->\nComputer Science > Machine Learning\narXiv:2510.09462 (cs)\n[Submitted on 10 Oct 2025 ( v1 ), last revised 2 Mar 2026 (this version, v2)]\nTitle: Adaptive Attacks on Trusted Monitors Subvert AI Control Protocols\nAuthors: Mikhail Terekhov , Alexander Panfilov , Daniil Dzenhaliou , Caglar Gulcehre , Maksym Andriushchenko , Ameya Prabhu , Jonas Geiping\nView a PDF of the paper titled Adaptive Attacks on Trusted Monitors Subvert AI Control Protocols, by Mikhail Terekhov and 6 other authors\nView PDF\nHTML (experimental)\nAbstract: AI control protocols serve as a defense mechanism to stop untrusted LLM agents from causing harm in autonomous settings. Prior work treats this as a security problem, stress testing with exploits that use the deployment context to subtly complete harmful side tasks, such as backdoor insertion. In practice, most AI control protocols are fundamentally based on LLM monitors, which can become a central point of failure. We study adaptive attacks by an untrusted model that knows the protocol and the monitor model, which is plausible if the untrusted model was trained with a later knowledge cutoff or can search for this information autonomously. We instantiate a simple adaptive attack vector by which the attacker embeds publicly known or zero-shot prompt injections in the model outputs. Using this tactic, frontier models consistently evade diverse monitors and complete malicious tasks on two main AI control benchmarks. The attack works universally against current protocols that rely on a monitor. Furthermore, the recent Defer-to-Resample protocol even backfires, as its resampling amplifies the prompt injection and effectively reframes it as a best-of-$n$ attack. In general, adaptive attacks on monitor models represent a major blind spot in current control protocols and should become a standard component of evaluations for future AI control mechanisms.\nSubjects:\nMachine Learning (cs.LG) ; Artificial Intelligence (cs.AI); Cryptography and Security (cs.CR)\nCite as:\narXiv:2510.09462 [cs.LG]\n(or\narXiv:2510.09462v2 [cs.LG] for this version)\nhttps://doi.org/10.48550/arXiv.2510.09462\nFocus to learn more\narXiv-issued DOI via DataCite\nSubmission history\nFrom: Mikhail Terekhov [ view email ] [v1]\nFri, 10 Oct 2025 15:12:44 UTC (527 KB)\n[v2]\nMon, 2 Mar 2026 08:27:36 UTC (538 KB)\nFull-text links:\nAccess Paper:\nView a PDF of the paper titled Adaptive Attacks on Trusted Monitors Subvert AI Control Protocols, by Mikhail Terekhov and 6 other authors\nView PDF\nHTML (experimental)\nTeX Source\nview license\nAdditional Features\nAudio Summary\nCurrent browse context:\ncs.LG\n< prev\n|\nnext >\nnew\n|\nrecent\n| 2025-10\nChange to browse by:\ncs\ncs.AI\ncs.CR\nReferences & Citations\nSciX\nGoogle Scholar\nSemantic Scholar\nexport BibTeX citation\nLoading...\nBibTeX formatted citation\n&times;\nloading...\nData provided by:\nBookmark\nBibliographic Tools\nBibliographic and Citation Tools\nBibliographic Explorer Toggle\nBibliographic Explorer ( What is the Explorer? )\nConnected Papers Toggle\nConnected Papers ( What is Connected Papers? )\nLitmaps Toggle\nLitmaps ( What is Litmaps? )\nscite.ai Toggle\nscite Smart Citations ( What are Smart Citations? )\nCode, Data, Media\nCode, Data and Media Associated with this Article\nalphaXiv Toggle\nalphaXiv ( What is alphaXiv? )\nLinks to Code Toggle\nCatalyzeX Code Finder for Papers ( What is CatalyzeX? )\nDagsHub Toggle\nDagsHub ( What is DagsHub? )\nGotitPub Toggle\nGotit.pub ( What is GotitPub? )\nHuggingface Toggle\nHugging Face ( What is Huggingface? )\nScienceCast Toggle\nScienceCast ( What is ScienceCast? )\nDemos\nDemos\nReplicate Toggle\nReplicate ( What is Replicate? )\nSpaces Toggle\nHugging Face Spaces ( What is Spaces? )\nSpaces Toggle\nTXYZ.AI ( What is TXYZ.AI? )\nRelated Papers\nRecommenders and Search Tools\nLink to Influence Flower\nInfluence Flower ( What","chars":4000,"total_chars":5064,"offset":0,"truncated":true,"next_offset":4000}

read_page

{
  "url": "https://arxiv.org/abs/2508.19461",
  "max_chars": 4000
}

{"ok":true,"url":"https://arxiv.org/abs/2508.19461","text":"[2508.19461] Reliable Weak-to-Strong Monitoring of LLM Agents\nSkip to main content\nSearch\nSubmit\nDonate\nLog in\nSearch arXiv\nPress Enter to search &middot; Advanced search\n-->\nComputer Science > Artificial Intelligence\narXiv:2508.19461 (cs)\n[Submitted on 26 Aug 2025]\nTitle: Reliable Weak-to-Strong Monitoring of LLM Agents\nAuthors: Neil Kale , Chen Bo Calvin Zhang , Kevin Zhu , Ankit Aich , Paula Rodriguez , Scale Red Team , Christina Q. Knight , Zifan Wang\nView a PDF of the paper titled Reliable Weak-to-Strong Monitoring of LLM Agents, by Neil Kale and 7 other authors\nView PDF\nHTML (experimental)\nAbstract: We stress test monitoring systems for detecting covert misbehavior in autonomous LLM agents (e.g., secretly sharing private information). To this end, we systematize a monitor red teaming (MRT) workflow that incorporates: (1) varying levels of agent and monitor situational awareness; (2) distinct adversarial strategies to evade the monitor, such as prompt injection; and (3) two datasets and environments -- SHADE-Arena for tool-calling agents and our new CUA-SHADE-Arena, which extends TheAgentCompany, for computer-use agents. We run MRT on existing LLM monitor scaffoldings, which orchestrate LLMs and parse agent trajectories, alongside a new hybrid hierarchical-sequential scaffolding proposed in this work. Our empirical results yield three key findings. First, agent awareness dominates monitor awareness: an agent's knowledge that it is being monitored substantially degrades the monitor's reliability. On the contrary, providing the monitor with more information about the agent is less helpful than expected. Second, monitor scaffolding matters more than monitor awareness: the hybrid scaffolding consistently outperforms baseline monitor scaffolding, and can enable weaker models to reliably monitor stronger agents -- a weak-to-strong scaling effect. Third, in a human-in-the-loop setting where humans discuss with the LLM monitor to get an updated judgment for the agent's behavior, targeted human oversight is most effective; escalating only pre-flagged cases to human reviewers improved the TPR by approximately 15% at FPR = 0.01. Our work establishes a standard workflow for MRT, highlighting the lack of adversarial robustness for LLMs and humans when monitoring and detecting agent misbehavior. We release code, data, and logs to spur further research.\nComments:\n18 pages, 15 figures\nSubjects:\nArtificial Intelligence (cs.AI) ; Cryptography and Security (cs.CR); Machine Learning (cs.LG)\nCite as:\narXiv:2508.19461 [cs.AI]\n(or\narXiv:2508.19461v1 [cs.AI] for this version)\nhttps://doi.org/10.48550/arXiv.2508.19461\nFocus to learn more\narXiv-issued DOI via DataCite\nSubmission history\nFrom: Neil Kale [ view email ] [v1]\nTue, 26 Aug 2025 22:29:31 UTC (5,253 KB)\nFull-text links:\nAccess Paper:\nView a PDF of the paper titled Reliable Weak-to-Strong Monitoring of LLM Agents, by Neil Kale and 7 other authors\nView PDF\nHTML (experimental)\nTeX Source\nview license\nAdditional Features\nAudio Summary\nCurrent browse context:\ncs.AI\n< prev\n|\nnext >\nnew\n|\nrecent\n| 2025-08\nChange to browse by:\ncs\ncs.CR\ncs.LG\nReferences & Citations\nSciX\nGoogle Scholar\nSemantic Scholar\nexport BibTeX citation\nLoading...\nBibTeX formatted citation\n&times;\nloading...\nData provided by:\nBookmark\nBibliographic Tools\nBibliographic and Citation Tools\nBibliographic Explorer Toggle\nBibliographic Explorer ( What is the Explorer? )\nConnected Papers Toggle\nConnected Papers ( What is Connected Papers? )\nLitmaps Toggle\nLitmaps ( What is Litmaps? )\nscite.ai Toggle\nscite Smart Citations ( What are Smart Citations? )\nCode, Data, Media\nCode, Data and Media Associated with this Article\nalphaXiv Toggle\nalphaXiv ( What is alphaXiv? )\nLinks to Code Toggle\nCatalyzeX Code Finder for Papers ( What is CatalyzeX? )\nDagsHub Toggle\nDagsHub ( What is DagsHub? )\nGotitPub Toggle\nGotit.pub ( What is GotitPub? )\nHuggingface Toggle\nHugging Face ( What is Huggingface? )\nScienceCast Toggle\nScienceCast ( What is ScienceC","chars":4000,"total_chars":5258,"offset":0,"truncated":true,"next_offset":4000}