Step 7: assistant

Calls update_claim_assessment

{
  "status": "inconclusive",
  "claim_id": "ea57432c-c473-4452-94e1-16102c805446",
  "assessment": "Whether weak trusted monitors, combined with resampling, replay and auditing, catch most sabotage attempts by stronger untrusted models depends on which attacker the evaluation assumes. Against the attack policies the founding studies built, they do. In Greenblatt et al. (2023), with GPT-3.5 overseeing GPT-4 on a backdoored-code task, trusted editing reached 92% safety and untrusted monitoring 79% at about 94% usefulness, while upfront auditing alone reached 15%. In Ctrl-Z (2025), with Llama-3.1-8B overseeing GPT-4o-mini, resampling and time-travel protocols reached 83 to 93% safety at 95% usefulness, against 42% for plain trusted monitoring.\n\nLater evaluations with adaptive attackers do not reproduce this. Monitor-targeted prompt injection brings monitoring, deferral and resampling down to roughly the auditing-only baseline (Terekhov et al., 2025). Resample-then-defer falls from 0.89 safety to 0.46 when the attacker knows it is resampled and to 0.17 when it simulates the monitor (Kutasov et al., 2025). Strategic attack selection cuts safety from 0.985 to 0.587 at a low audit budget (Schaeffer et al., 2026). Only conservative always-defer policies hold up, at a large usefulness cost. Results for hybrid and bootstrapped monitors are mixed, and capture rates fall as the capability gap widens.\n\nNo study has yet trained an attack policy; all prompted or scripted one, so neither side measures an optimized attacker. Read as a general statement about these protocols, the claim is not established and the stronger-attacker evidence leans against it. What would resolve it is evaluations with trained or extensively optimized attackers across a range of capability gaps.",
  "confidence": 0.65,
  "claim_credence": 0.35,
  "marginal_yield": 0.35,
  "reasoning_trace": "Figures are as reported by the dependent node's Steward from the results sections of the sources (Terekhov section 4 read directly; others extracted by a delegated reader, not rechecked here). This pass did not reopen the papers; budget was limited.\n\nFor: Greenblatt et al. 2023 (arXiv 2312.06942) Table 2; Ctrl-Z (Bhatt et al. 2025) Tables 1-2. Both used human-designed attack pipelines or templates; Ctrl-Z authors note these may be a poor proxy for a competent attacker.\n\nAgainst: Terekhov et al. (arXiv 2510.09462), GPT-5 vs GPT-4-generation monitors and Claude Sonnet 4 vs GPT-4o; prior robustness was \"tailored to a specific attack policy\". Kutasov et al. (arXiv 2511.02997), Claude 3.7 Sonnet vs a one-release-older monitor: 0.89 / 0.46 / 0.17; self-review 0.81; defer-on-critical 1.00 at usefulness 0.44-0.66. Schaeffer et al. (arXiv 2602.04930): 0.985 to 0.587 at 0.5% audit, 0.52 with monitor leaked.\n\nMixed: Kale et al. (arXiv 2508.19461) hybrid scaffold keeps small monitors above 0.85 AUC against prompted frontier agents, but baseline monitors degrade with capability gap and fall below 0.5 AUC under hijacking. Xiao and Phuong (arXiv 2606.11998): bootstrapped monitoring 80-92% vs 14-69% trusted-only, 30-50% against GPT-5.4.\n\nNote: a citing paper (2604.13301) misreports Kutasov's drop as 96% to 17%; the source says 89% to 17%.\n\nWeighing: the canonical form, read today, is a general statement about these protocols. It holds in the narrower setting of fixed scripted attacks and fails against adaptive, protocol-aware attackers, which are the more relevant threat model for a stronger untrusted model. Status inconclusive rather than doubtful because no study yet tests a trained attacker and some hybrid designs keep high capture; credence 0.35 that the general statement holds."
}