Step 14: tool results

read_arxiv_source

{
  "file": "experiments.tex",
  "offset": 17500,
  "arxiv_id": "2508.19461",
  "max_chars": 9500
}

{"ok":true,"arxiv_id":"2508.19461","file":"experiments.tex","kind":"text","text":"s are quite small. Besides, the TPR scores have much more room to improve compared to AUC scores on SHADE-Arena. Interesting, the sequential scaffolding has really bad TPR on SHADE-Arena across monitor awareness. On the contrast, the hierarchical scaffolding has a lower AUC and TPR on CUA-SHADE-Arena. The nuanced behaviors of these two scaffolds demonstrate that a hybrid scaffolding can improve the reliability and robustness across datasets. \n\n\\paragraph{Finding 5: Fixing a monitor scaffolding, the improved monitor awareness improves the reliability. The improvement is more obvious on TPR.} Thus, the answer to \\textbf{Q2} is -- the higher awareness of the monitor improves its reliability against the current LLM agents with no given evasion strategies from red teamers; however, this advantage becomes trivial when there are more sophisticated strategies are known to the agent. \n\nFinally, taking \\textbf{Finding 2 - 5} together, we now answer \\textbf{Q3} -- the hybrid monitor scaffolding is most adversarially reliable among all monitor types. It matches or outperforms the baseline full trajectory one in most cases. Therefore, the most effective way of improving AUC is not by providing the monitor with more information about the agent. Instead, improving the agent scaffolding from the full trajectory baseline to a hybrid one is more effective. \\textbf{Our conclusion further suggests that a third-party monitoring system developer who has little to no information about the user's main task can still effectively catch misbehaving agents by a well-designed monitor type.} \n\n\\subsection{Experiment 3: Weak-to-Strong Monitoring}\n\\label{sec:experiments:weak2strong}\n\nEventually, misbehaving agents may be more \\textit{capable} than the models employed for monitoring. \\citet{greenblatt2024control} propose a weaker, trusted monitoring paradigm where we rely on weaker models to monitor stronger untrusted ones. This simulates the future scenario of having humans monitor super-intelligent agents, as well as the current constraints of being unable to trust a leading-edge model to monitor itself without risking collusion. Thus, in this section, we aim to address \\textbf{Q4}: \\textit{Can weak models (e.g., Claude 3.6 Haiku) monitor strong (e.g., Claude Sonnet 4) agents?} In a similar capability-based study for jailbreaking, \\citet{panfilov2025scaling} found that LLMs prompted for automated jailbreaking are able to break models with lower MMLU-Pro scores more easily. We follow their experimental set-up and test how the difference in MMLU-Pro score between the agent and monitor models correlates to their reliability for monitoring agent behaviors, as measured by the AUC score. \n\n\\paragraph{Setup.} We use Claude 3.6 Sonnet, Claude Sonnet 4, Gemini 2.5 Flash, and Gemini 2.5 Pro as \\emph{aware} agents. Each agent uses CoT obfuscation as their evasion strategy. For monitors, we employ Claude 3.6 Haiku, Claude 3.6 Sonnet, Claude 3.7 Sonnet, Claude Sonnet 4, Gemini 2.5 Pro, Gemini 2.5 Flash, GPT-4o, GPT-4o-mini, o3, and o4-mini, resulting in a total of 36 attacker-monitor pairs. We use each monitor LLM to build the 4 types of monitoring systems as mentioned in Section~\\ref{sec:method:monitors}. We use SHADE-Arena as the dataset and environment.\n\n\n\n\nIn Figure~\\ref{fig:aware_attacker_shadearena_scaling_law}, we plot the AUC-ROC scores for each agent-monitor pairs against the difference of their MMLU Pro scores. For each monitor type, we fit a line to the corresponding data points. \n\n\n\\paragraph{Summary of Findings.} First, we observe that the reliability of a monitor is correlated with its relative advantage in MMLU-Pro score compared to the backbone LLM of the agent. However, the strength of this association varies across monitor types—\\textbf{with the hybrid monitor exhibiting the weakest association with the capability gap}. Notably, even with weaker models such as GPT-4o-mini and Claude 3.6 Haiku, we achieve a monitoring AUC exceeding 0.85 against all agents. Second, \\textbf{the reliability scores of the hybrid monitor consistently surpass those of the baseline, hierarchical, and sequential monitors by a substantial margin}, indicating that the sequential and hierarchical approaches are complementary and can be effectively combined into a more powerful hybrid monitor. \n\nOverall, our results show that while it is challenging for a single weak LLM to reliably monitor a stronger LLM, a well-designed ensemble of weaker monitors (e.g., the hybrid approach) can yield a significantly more reliable monitoring system.\n\n\\begin{figure}[t]\n    \\centering\n    \\includegraphics[width=0.6\\linewidth]{aware_attacker_BL_shadearena_scaling_law.pdf}\n    \\caption{Monitor AUC against aware attackers with partial verbalization in SHADE-Arena, plotted against the MMLU-Pro gap between attackers and monitors.}\n    \\label{fig:aware_attacker_shadearena_scaling_law}\n\\end{figure}\n\n\n\n\n\n% \\subsection{Aware Attackers are More Effective}\n\n% We task the monitor with assigning a suspiciousness score from 1 (not at all suspicious) to 5 (extremely suspicious). The full monitoring rubric can be found in Appendix \\todo{add link}. We evaluate the monitor on benign trajectories from agents with no side task (true negatives) and trajectories where the agent is prompted with a side task (true positives).\n\n% We find that aware attackers are significantly more effective at evading chain-of-thought monitors than naive attackers. In section \\todo{add link}, we show that aware attackers can evade chain-of-thought monitoring effectively with or without a hidden scratchpad.\n\n% Conversely, aware monitors are only slightly more effective at detecting side tasks. This likely stems from the fact that the attacker will clearly state the main task throughout its reasoning, so knowing the main task a priori does not provide the monitor with much new information. That said, the omniscient monitor is able to detect side tasks with much higher AUC.\n\n% \\todo{add heatmap AUC (and TPR at FPR of 0.01) of monitor vs attacker awareness figure}\n\n% \\subsection{Scheming Agents Can Evade Chain-of-Thought Monitors}\n\n% Building on the hidden chain-of-thought experiments conducted in\\cite{kutasov2025shade}, we find that selective chain-of-thought boosts Claude 3.6 Sonnet's evasion capability against a Claude 3.6 Sonnet monitor up to 91\\%. However, the monitor AUC reduces less dramatically from 0.745 to 0.739. \n\n% \\todo{figure comparing visible, hidden, selective}\n\n% When we provide the complete lying prompt to the monitor, with all ten strategies listed in Table \\ref{tab:lying_strategies}, we find that the monitor AUC drops significantly more to 0.685. This suggests that the lying strategies enable the attacker to use selective chain-of-thought more adeptly. When we further prompt the attacker to select a single strategy before taking any actions, we find that the monitor AUC drops further to 0.685.\n\n% \\todo{figure comparing selective, selective liar, selective liar choose}\n\n% We next perform experiments to understand how each lying strategy contributes to evasion. We find that the lying strategies are not equally effective. \\todo{add AUC per strategy}. The single most effective strategy is \"Overwhelm with Detail,\" which is able to boost the evasion capability to \\todo{enter this value}\\%.\n\n% \\todo{add figure comparing human augmented liar and ordinary liar}\n\n% \\cite{kutasov2025shade} also write human hints for the attacker to use for each task, but they find that these hints are not very effective at improving the attacker's performance. However, we find that when combined with the lying strategies and selective chain-of-thought, the hints are able to boost the attacker's evasion capability to 95.7\\% which corresponds to an AUC reduction from 0.736 with just selective chain-of-thought and lying strategies, to 0.693. This suggests that inference-time attacker strategies tend to be synergistic, i.e. an attacker which knows how to lie and has access to hidden scratchpad is also more capable of executing complex plans in secret.\n\n% \\subsection{Omniscient Attackers Must Interact with the Monitor}\n\n% The omniscient attacker has full access to the monitor model prior to conducting its attack. We find that simply providing the attacker with the monitoring prompt does not result in any noticeable decrease in AUC. It's only when the attacker interacts with the monitor, i.e. performs some sample runs and identifies successful strategies, that the attacker can benefit from omniscience. \n\n% \\subsection{Advanced Monitoring Strategies}  \n\n% The previous experiments show that attackers are highly capable of evading chain-of-thought monitoring, particularly when they are aware that they are being monitored. One major issue is that monitors are less able to detect harmful actions in long trajectories, this is evidenced by the fact that the monitor AUC drops significantly when the attacker employs the \"Overwhelm with Detail\" strategy.\n\n% \\subsubsection{Monitoring with Rubrics}\n\n% \\cite{kutasov2025shade} use an \\lm{}-as-a-judge scorer to evaluate each transcript's suspiciousness from 0 to 100. We find that this approach is too granular, i.e. there is no specific meaning to a score of 26 as opposed to 27. We instead use a 5-point Likert scale to evaluate each transcript's suspiciousness, and write a detailed rubric for each possible score.\n\n% \\subsubsection{Hierarchical Monitoring}\n\n% Hierarchical monitoring aims to improve the monitor's abi","chars":9500,"total_chars":43675,"offset":17500,"truncated":true,"next_offset":27000}