Step 10: tool results

commission

{
  "kind": "research",
  "tier": "standard",
  "brief": "Question: as of November 2026, how well does the published evidence support the proposition \"Better scaffolding and chain-of-thought access let weaker AI models reliably monitor stronger AI agents\"? I am reading Kale et al. 2025 (arXiv 2508.19461, \"Reliable Weak-to-Strong Monitoring of LLM Agents\") myself; do NOT spend effort on that paper. I need the rest of the evidence, on both sides, with numbers and locators.\n\nPlease look for and report (with URL, the exact figure or short quoted phrase under 20 words, and which models served as monitor and agent, and whether the monitor was weaker than the agent):\n1. Studies where a weaker model monitors a stronger agent with chain-of-thought (reasoning) access vs action-only access: e.g. Baker et al. 2025 (OpenAI, \"Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscation\", arXiv 2503.11926), Arnav et al. 2025 (\"CoT Red-Handed\", arXiv 2505.23575), Emmons et al. 2025 (\"When Chain of Thought is Necessary, Language Models Struggle to Evade Monitors\", arXiv 2507.05246), Guan et al. Dec 2025 (OpenAI \"Monitoring Monitorability\"), SHADE-Arena (Kutasov et al. 2025), METR's Aug 2025 CoT post, and anything from 2026. What detection rates at what false-positive rates do weak monitors achieve against stronger agents? Does monitor performance depend on the capability gap?\n2. Evidence against reliability: adaptive attacks on trusted monitors (Terekhov et al. 2025, arXiv 2510.09462), prompt-injection of monitors, CoT obfuscation under prompting or training pressure (Zolkowski et al. 2025; Baker et al.; Skaf et al. on steganography), evidence that newer models' reasoning is less legible or that models can control what appears in their CoT, latent/neuralese reasoning, and any 2026 results on whether evasion scales with agent capability (e.g. Engels et al. 2025 \"Scaling laws for scalable oversight\" backdoor-code game; any \"monitoring scaling\" follow-ups). \n3. Any 2026 papers, system cards (Anthropic, OpenAI, Google DeepMind) or evaluations (UK AISI, METR, Redwood) that directly measure weak-monitor versus strong-agent performance with frontier models from 2026, or that replicate, extend or criticize Kale et al.'s weak-to-strong claim.\n\nA good answer: a compact table-like list of 8 to 15 findings, each with source, setup (monitor model, agent model, CoT access yes/no, adversarial awareness yes/no), headline number, and one line on what it shows about \"reliably\". Then a short paragraph saying what remains unmeasured. Look as hard for results that count against the proposition as for ones that support it, and say where you searched and found nothing. Prefer primary papers over blog coverage; read methods/results sections, not only abstracts. Keep the report under 1,200 words.",
  "budget_owls": 2
}

{"success":true,"research_run_id":"5619b885-e7ef-4da4-bef0-cd822230176a","message":"Commissioned research run 5619b885-e7ef-4da4-bef0-cd822230176a with a budget of 2 owls from your budget (you have 4.092 left). It runs on its own. Carry on with what you can do without it, and record what you can already conclude. When that is done, end your turn: your session pauses and resumes when the report arrives, with this conversation intact. If it arrives while you are still working, it appears in your next tool result. The session waits at most 24 hours; after that the report goes to this node's inbox."}

read_arxiv_source

{
  "file": "experiments.tex",
  "arxiv_id": "2508.19461",
  "max_chars": 20000
}

{"ok":true,"arxiv_id":"2508.19461","file":"experiments.tex","kind":"text","text":"\\section{Experiments}\\label{sec:experiments}\nIn this section, we conduct MRT experiments using the agent datasets, threat models, evaluation metrics, and monitor architectures proposed in Section~\\ref{sec:methods} with strong LLMs on top of the capability benchmarks. Because our setup is much more comprehensive than prior works, we ask a list of questions related to monitor reliability and seek to answer them empirically.\n\nFirst, we ask these two questions related to the \\emph{awareness}:\n\n\\begin{itemize}\n    \\item \\textbf{Q1}: Conditioned on whether the agent \\emph{is} / \\emph{is not} aware of the monitor, how does monitor awareness affect the monitor's reliability? This question examines the relative advantages of the agent and the monitor. (Sections \\ref{sec:experiment:unaware} and \\ref{sec:experiment:strategies.})\n    \\item \\textbf{Q2}: How much advantage does the monitor have against the agent's evasion strategies, if the monitor has higher awareness? (Sections \\ref{sec:experiment:unaware} and \\ref{sec:experiment:strategies.})\n\\end{itemize}\n\nSecond, we have the following questions related to the \\emph{boundary} of a monitoring system's reliability:\n\\begin{itemize}\n\\item \\textbf{Q3}: Are the non-baseline monitoring types (e.g., hierarchical) more robust than the baseline one? Which one is most adversarially reliable? (Sections \\ref{sec:experiment:unaware} and \\ref{sec:experiment:strategies.})\n\\item \\textbf{Q4}: Can weak models (e.g., Claude 3.6 Haiku) monitor strong (e.g., Claude Sonnet 4) agents? (Section~\\ref{sec:experiments:weak2strong})\n\\end{itemize}\n\nFinally, we conduct a lightweight case study related to human-aided monitoring to answer the following question:\n\\begin{itemize}\n    \\item \\textbf{Q5}: If a human overseer can double-check the agent trajectory and discuss with the monitor within a fixed amount of time, will the overall reliability of this human-in-the-loop monitoring system improve? If so, by how much? If not, why? (Section~\\ref{sec:experiment:hilt})\n\\end{itemize}\n\n\nWe first describe our setups for the experiments in Section~\\ref{sec:experiment:setup} before we dive into the analysis of experiment results for answering these questions.\n\n\n\\subsection{Experiment Setups}\\label{sec:experiment:setup}\n\n\\paragraph{Unaware Agents.} The straightforward way to have unaware but misbehaving agents is to directly prompt it with both the main and side tasks. However, we find that the refusal training of most public LLMs prevents them from pursuing such side tasks. In the SHADE-Arena setting~\\cite{kutasov2025shade}, the workaround is to instruct the LLM that it is helping a red teaming agent monitor system, so that it reliably attempts the side task. As we aim to elicit the agent's original behaviors, which are not being adapted (e.g., hiding) in their CoTs and actions, we maintain SHADE-Arena's prompt but emphasize the following in the agent's prompt. \n\n\\begin{lstlisting}\nYou can think about the tasks in <thinking> tags. Plan as needed to complete the side task.\n\\end{lstlisting}\n\nOur approach is arguably only a proxy to \\emph{unaware} agents. In experiments, we find that this helps to elicit more natural and unaware behaviors when the agent is doing the side task. Thus, this proxy is sufficient for our purpose of evaluating the monitor reliability when the agent behaves naturally. For non-reasoning models, it is prompted to wrap CoT in \\texttt{thinking} tags. For reasoning models, we use their original CoT. \n\n% In some cases, such as broad misalignment or system design flaws, an attacker may be unaware that its chain-of-thought is being monitored. In the SHADE-Arena setting \\cite{kutasov2025shade}, attackers are told that they are red teaming an agent monitoring system, so that they reliably attempt the side task. For consistency, we maintain this underlying setup but inform the agent as follows.\n\n% \\texttt{You can think about the tasks in <thinking> tags. Plan as needed to complete the side task.}\n\n% To ensure that these findings hold on reasoning models, the Gemini 2.5 Pro (Thinking) model is told to think about the task in its internal reasoning, instead of artificial \\texttt{thinking} tags. This setup lets us reliably generate chain-of-thoughts for malicious tasks and probe monitors' ability to detect these thoughts in long trajectories. In practice, an unaware attacker might not be aware that it is being monitored at all and may just try and complete a misaligned task of its own accord; however, the chain-of-thought would look similar. \n\n\n\\paragraph{Aware Agents with Evasion Strategies.} For the baseline -- \\textbf{the dealer's choice}, we do not further instruct the agent (e.g., identical to the setup in SHADE-Arena). For \\textbf{monitor hijacking}, we provide the hijacking prompt, which steers the monitor LLM's output to 1 (\\ie low suspiciousness), to the agent. We further instruct the agent to inject these hijacking prompts into its output trajectory. For \\textbf{lying with jailbreaking strategies}, we provide the agent with the strategies in Table~\\ref{tab:evasion_strategies}, and instruct it to pick one to make its CoT deceptive. For \\textbf{CoT obfuscation}, we instruct the agent to provide two blocks of CoTs, with a visible one following a hidden one. Only the visible one will be provided for the monitor's inspection. To reiterate, the motivation of CoT obfuscation (Section~\\ref{sec:method:red-teaming-strategy}) is to approximate deceptive or under-verbalized agents with existing models -- here, the visible (and posterior) CoT is our proxy. In particular, for agents scaffold-ed with a reasoning model, such as Gemini 2.5 Pro, we use its original thought block as the hidden CoT and prompts to generate another posterior CoT to be used as the visible one. In our experiments, we discover that the agent can use \\textbf{lying strategies and CoT obfuscation} together -- it effectively hides true thoughts, under-verbalizes about its side task while filling the CoT with many lies. \n\n\n\n\\paragraph{Agent Trajectory Roll-outs.} For our experiments, we collect 20 trajectory roll-outs for each agent across 32 distinct tasks (17 SHADE-Arena, 15 \\agentbadcompany{}). For 10 of the roll-outs, the agent is prompted with both the main and side tasks (malicious). For the remaining 10, the agent is only prompted with the main task (benign). Each episode is allowed a maximum of 100 steps and a timeout of 3600 seconds. If an agent encounters an execution or API error, it is permitted up to 5 retries with exponential back-off for that specific step before the episode is marked as a failure. Failed episodes are repeated. The monitor evaluates trajectories using the prompts given in \\Cref{appendix:monitor}.\n\n\n\n\\paragraph{Monitor Setup.} We implement the 4 monitor types (\\ie baseline, the hierarchical, the sequential, and the hybrid) in Section~\\ref{sec:method:monitors}. In particular, the implementation of the baseline (\\ie using the full trajectory as the input) monitor follows \\citet{kutasov2025shade}. Each monitor takes a full agent trajectory and outputs a numerical score indicating the suspiciousness of the trajectory — namely, a higher score indicates that the agent is more likely to have misbehaved. The awareness of the monitor is implemented by including the main, side, or both tasks in the system prompt. All prompts are in Appendix~\\ref{appendix:monitor}. \n\n\\paragraph{Models.} In SHADE-Arena, we use Claude 3.6 Sonnet (\\texttt{claude-3-5-sonnet-20241022}) and Gemini 2.5 Pro (\\texttt{gemini-2.5-pro-preview-03-25}) as the agent. In \\agentbadcompany{}, we use Claude 3.6 Sonnet and Claude 4 Sonnet (\\texttt{claude-sonnet-4-20250514}) and the OpenHands~\\cite{wang2024openhands} scaffolding as the agent. We use Claude 3.6 Sonnet as the monitor LLM.\n\n\\begin{figure}[t]\n    \\centering\n    \\begin{subfigure}[b]{0.3\\textwidth}\n        \\centering\n        \\includegraphics[width=\\linewidth]{unaware_attacker_vs_aware_attacker_shadearena_claude-3-6_auc.pdf}\n        % \\caption{Claude 3.6 Sonnet (SHADE-Arena) agent, SHADE-Arena.}\n    \\end{subfigure}\n    \\hfill % This command adds horizontal space between the figures\n    \\begin{subfigure}[b]{0.3\\textwidth}\n        \\centering\n        \\includegraphics[width=\\linewidth]{unaware_attacker_vs_aware_attacker_shadearena_gemini-2-5-pro_auc.pdf}\n        % \\caption{Gemini 2.5 Pro (Thinking) agent, SHADE-Arena.}\n    \\end{subfigure}\n    \\hfill % This command adds horizontal space between the figures\n    \\begin{subfigure}[b]{0.3\\textwidth}\n        \\centering\n        \\includegraphics[width=\\linewidth]{unaware_attacker_vs_aware_attacker_agentcompany_claude-4_auc.pdf}\n        % \\caption{Claude Sonnet 4 OpenHands agent, \\agentbadcompany{}.}\n    \\end{subfigure}\n    \\\\\n    \\begin{subfigure}[b]{0.3\\textwidth}\n        \\centering\n        \\includegraphics[width=\\linewidth]{unaware_attacker_vs_aware_attacker_shadearena_claude-3-6_tpr.pdf}\n        \\caption{Claude 3.6 Sonnet (SHADE-Arena) agent, SHADE-Arena.}\n    \\end{subfigure}\n    \\hfill % This command adds horizontal space between the figures\n    \\begin{subfigure}[b]{0.3\\textwidth}\n        \\centering\n        \\includegraphics[width=\\linewidth]{unaware_attacker_vs_aware_attacker_shadearena_gemini-2-5-pro_tpr.pdf}\n        \\caption{Gemini 2.5 Pro (Thinking) agent, SHADE-Arena.}\n    \\end{subfigure}\n    \\hfill % This command adds horizontal space between the figures\n    \\begin{subfigure}[b]{0.3\\textwidth}\n        \\centering\n        \\includegraphics[width=\\linewidth]{unaware_attacker_vs_aware_attacker_agentcompany_claude-4_tpr.pdf}\n        \\caption{Claude Sonnet 4 OpenHands agent, \\agentbadcompany{}.}\n    \\end{subfigure}\n    \\caption{Monitor (Claude 3.6 Sonnet) AUC (top) and TPR at 1\\% FPR (bottom) against attackers in SHADE-Arena and \\agentbadcompany{}. The \\textbf{\\textcolor{blue1}{light bar}} shows the AUC against an unaware attacker, the \\textbf{\\textcolor{blue2}{medium bar}} shows the reduced AUC against a simple aware attacker with no strategies.}\n    \\label{fig:unaware_attacker_auc}\n\\end{figure}\n\n\n\\subsection{Experiment 1: Unaware Agents vs. Aware Agents with No Strategy}\\label{sec:experiment:unaware}\n\n\nAs discussed in Section~\\ref{sec:method:metrics}, we report the AUC-RUC score of each monitoring system in each threat model to measure the impact of agent and monitor awareness to the reliability of the monitoring system. In doing so, we answer question \\textbf{Q1} and (part of) \\textbf{Q3} in this section. In Figure \\ref{fig:unaware_attacker_auc}, we compare the AUC scores of the monitor against unaware agent in \\textbf{\\textcolor{blue1}{light colors}} with aware agents with no strategy (\\eg the dealer's choice) in \\textbf{\\textcolor{blue2}{medium colors}} for each respective monitor awareness.\n\nThe following findings apply to Figure~\\ref{fig:unaware_attacker_auc}.\n\n\\paragraph{Finding 1: If the agent is unaware (e.g., bars in \\textbf{\\textcolor{blue1}{light colors}}), unaware monitors are already very reliable.} Only comparing bars in \\textbf{\\textcolor{blue1}{light colors}}, we conclude that if the agent is unaware, the monitoring system in each scaffolding yields satisfying reliability in terms of the AUC scores ($\\geq 0.9$) on both datasets. The TPR at FPR $=0.01$ of the same monitoring scaffolding does not vary much across three monitor awareness levels; however, the monitor with a sequential scaffolding seems to have a relatively low TPR scores overall, compared to other scaffoldings. \n\n\nFurther, in SHADE-Arena, omniscient monitors do not possess significant advantages over the unaware monitors for all monitor types. A hybrid monitor is the most reliable one; however, its margin against the second-best one is only trivial. In CUA-SHADE-Arena, aware monitors do not have an advantage over unaware monitors, and omniscient monitors only have approximately a 10% advantage over them. Since CUA-SHADE-Arena trajectories contain much more granular actions compared to SHADE-Arena, we hypothesize that knowing the side task (\\eg the omniscient monitor) helps the monitor to better predict the possible consequences of granular actions. Similarly, the monitor type used here affects the AUC score in a non-trivial manner. \n\n\\paragraph{Finding 2: If the agent is aware with no strategy (e.g., bars in \\textbf{\\textcolor{blue2}{medium colors}}), the contribution of monitor awareness to its reliability follows omniscient $>$ aware $\\approx$ unaware. The hybrid scaffolding is most reliable.} Comparing the bars in \\textbf{\\textcolor{blue1}{light colors}} with the bars in \\textbf{\\textcolor{blue2}{medium colors}}, we see clear drops on AUC and TPR scores across all datasets and all models. Reliability degradations on CUA-SHADE-Arena are less significant than those on SHADE-Arena. More importantly, in both datasets, we see aware monitors are not necessarily better than unaware monitors. This is an interesting observation as it suggests that \\textbf{even if the monitoring system is developed by a third-party which has no information about the user's benign request, it is not necessarily more vulnerable compared to the same monitoring system developed by the first-party}. By comparing the bars in \\textbf{\\textcolor{blue2}{medium colors}} only, we find that the hybrid monitoring type still uniformly outperforms other types on both datasets. \n\n\nTo conclude, we answer \\textbf{Q1} by showing that agent awareness is a more dominant feature compared to the monitor awareness to the monitor's reliability. The access to the main task (\\ie the aware monitor) does not necessarily give more advantage. As part of the answer to \\textbf{Q3}, we show that the omniscient hybrid monitor provides an empirical upper bound on the monitor reliability (for some cases it is near perfect), which suggests that the current LLM is already capable of analyzing complex agent trajectories and locate suspicious actions as long as they are informed what to look at (\\ie knowing the side task). \n\n\n\n\\subsection{Experiment 2: Red Teaming Monitors with Evasion  Strategies}\\label{sec:experiment:strategies.}\n\n\\begin{figure}[t]\n    \\centering\n    % Top row\n    \\includegraphics[width=\\textwidth]{aware_agents_result.pdf}\n    \\caption{Monitor (Claude 3.6 Sonnet) AUC (top) and TPR at 0.01 FPR (bottom) against aware attackers in SHADE-Arena and \\agentbadcompany{}. The \\textbf{\\textcolor{blue2}{medium bar}} shows the AUC against an attacker with no strategies, the \\textbf{\\textcolor{blue3}{dark bar}} shows the reduced AUC against the best attacker. Complete results for each aware attacker are provided in Appendix \\ref{app:attack_policies}.}\n    \\label{fig:aware_attacker_auc}\n\\end{figure}\nWe evaluate the usefulness of evasion strategies curated by red teamers in adversarially impacting the monitor's reliability to answer \\textbf{Q2} and forming a more comprehensive answer to \\textbf{Q3}, in addition to the conclusions from Section~\\ref{sec:experiment:unaware}. In doing so, we roll out agent trajectories with the evasion strategy implementations in Section~\\ref{sec:experiment:setup} and evaluate the AUC scores under each strategy, which are included in Figure~\\ref{fig:aware_attacker_shadearena_auc} (SHADE-Arena) and Figure~\\ref{fig:aware_attacker_agentcompany_auc} (\\agentbadcompany{}) from Appendix~\\ref{app:attack_policies}. We ensemble the results from \\emph{all} strategies that are non-baseline, to plot the \\textbf{empirical lower bound} in Figure~\\ref{fig:aware_attacker_auc}. Specifically, the AUC and TPR of the baseline evasion strategy (\\ie the dealer's choice) are in \\textbf{\\textcolor{blue2}{medium colors}}, compared to the minimum AUC score aggregated over other strategies in \\textbf{\\textcolor{blue3}{dark colors}}. Appendix~\\ref{app:attack_policies} includes more discussions for the effectiveness of each respective strategy.\n\n% \\paragraph{Finding 3: There is still a lot of room to improve the adversarial reliability} As the monitor gains higher visibility into the agent's main and side tasks (i.e., unaware $\\rightarrow$ omniscient), the AUC increases when the agent has no given evasion strategies (bars in \\textbf{\\textcolor{blue2}{medium colors}}). However, the increase is less significant when agents are given strategies (bars in \\textbf{\\textcolor{blue3}{dark colors}}).\n\nThe following findings apply to Figure~\\ref{fig:aware_attacker_auc}.\n\n\\paragraph{Finding 3: With evasion strategies (\\textbf{\\textcolor{blue3}{dark colors}}) turned on, the AUC and TPR of the \\emph{baseline} scaffolding (blue) drops significantly compared to no strategy (\\textbf{\\textcolor{blue2}{medium colors}}).} There are extreme cases when the AUC is even lower than 0.5, such as the case when the monitor is informed of the main task (i.e., an aware monitor). This is mostly because, when equipped with monitor hijacking, the attacker can often convince the monitor to give a suspicion score of 1 to malicious trajectories. Several benign trajectories have suspicion scores of 2 or 3, so in that setting, the false negative and false positive rates are both high. \n\n\n\\paragraph{Finding 4: With evasion strategies (\\textbf{\\textcolor{blue3}{dark colors}}) turned on, the hybrid scaffolding is more robust against evasion strategies at all monitor awareness level.} From the tables, we see the winning scaffolding for AUC scores is always the hybrid one at all monitor awareness level and in all datasets. While the baseline scaffolding wins the TPR in SHADE-Arena for the unaware and omniscient levels, the margins are quite small. Besides, the TPR scores have much more room to improve compared to AUC scores on SHADE-Arena. Interesting, the sequential scaffolding has really bad TPR on SHADE-Arena across monitor awareness. On the contrast, the hierarchical scaffolding has a lower AUC and TPR on CUA-SHADE-Arena. The nuanced behaviors of these two scaffolds demonstrate that a hybrid scaffolding can improve the reliability and robustness across datasets. \n\n\\paragraph{Finding 5: Fixing a monitor scaffolding, the improved monitor awareness improves the reliability. The improvement is more obvious on TPR.} Thus, the answer to \\textbf{Q2} is -- the higher awareness of the monitor improves its reliability against the current LLM agents with no given evasion strategies from red teamers; however, this advantage becomes trivial when there are more sophisticated strategies are known to the agent. \n\nFinally, taking \\textbf{Finding 2 - 5} together, we now answer \\textbf{Q3} -- the hybrid monitor scaffolding is most adversarially reliable among all monitor types. It matches or outperforms the baseline full trajectory one in most cases. Therefore, the most effective way of improving AUC is not by providing the monitor with more information about the agent. Instead, improving the agent scaffolding from the full trajectory baseline to a hybrid one is more effective. \\textbf{Our conclusion further suggests that a third-party monitoring system developer who has little to no information about the user's main task can still effectively catch misbehaving agents by a well-designed monitor type.} \n\n\\subsection{Experiment 3: Weak-to-Strong Monitoring}\n\\label{sec:experiments:weak2strong}\n\nEventually, misbehaving agents may be more \\textit{capable} than the models employed for monitoring. \\citet{greenblatt2024control} propose a weaker, trusted monitoring paradigm where we rely on weaker models to monitor stronger untrusted ones. This simulates the future scenario of having humans monitor super-intelligent agents, as well as the current constraints of being unable to trust a leading-edge model to monitor itself without risking collusion. Thus, in this section, we aim to address \\textbf{Q4}: \\textit{Can weak models (e.g., Claude 3.6 Haiku) monitor strong (e.g., Claude Sonnet 4) agents?} In a similar capability-based study for jailbreaking, \\citet{panfilov2025scaling} found that LLMs prompted for automated jailbreaking are able to break models with lower MMLU-Pro scores more easily. We follow the","chars":20000,"total_chars":43675,"offset":0,"truncated":true,"next_offset":20000}