Step 12: tool results

read_arxiv_source

{
  "file": "experiments.tex",
  "offset": 20000,
  "arxiv_id": "2508.19461",
  "max_chars": 9000
}

{"ok":true,"arxiv_id":"2508.19461","file":"experiments.tex","kind":"text","text":"ir experimental set-up and test how the difference in MMLU-Pro score between the agent and monitor models correlates to their reliability for monitoring agent behaviors, as measured by the AUC score. \n\n\\paragraph{Setup.} We use Claude 3.6 Sonnet, Claude Sonnet 4, Gemini 2.5 Flash, and Gemini 2.5 Pro as \\emph{aware} agents. Each agent uses CoT obfuscation as their evasion strategy. For monitors, we employ Claude 3.6 Haiku, Claude 3.6 Sonnet, Claude 3.7 Sonnet, Claude Sonnet 4, Gemini 2.5 Pro, Gemini 2.5 Flash, GPT-4o, GPT-4o-mini, o3, and o4-mini, resulting in a total of 36 attacker-monitor pairs. We use each monitor LLM to build the 4 types of monitoring systems as mentioned in Section~\\ref{sec:method:monitors}. We use SHADE-Arena as the dataset and environment.\n\n\n\n\nIn Figure~\\ref{fig:aware_attacker_shadearena_scaling_law}, we plot the AUC-ROC scores for each agent-monitor pairs against the difference of their MMLU Pro scores. For each monitor type, we fit a line to the corresponding data points. \n\n\n\\paragraph{Summary of Findings.} First, we observe that the reliability of a monitor is correlated with its relative advantage in MMLU-Pro score compared to the backbone LLM of the agent. However, the strength of this association varies across monitor types—\\textbf{with the hybrid monitor exhibiting the weakest association with the capability gap}. Notably, even with weaker models such as GPT-4o-mini and Claude 3.6 Haiku, we achieve a monitoring AUC exceeding 0.85 against all agents. Second, \\textbf{the reliability scores of the hybrid monitor consistently surpass those of the baseline, hierarchical, and sequential monitors by a substantial margin}, indicating that the sequential and hierarchical approaches are complementary and can be effectively combined into a more powerful hybrid monitor. \n\nOverall, our results show that while it is challenging for a single weak LLM to reliably monitor a stronger LLM, a well-designed ensemble of weaker monitors (e.g., the hybrid approach) can yield a significantly more reliable monitoring system.\n\n\\begin{figure}[t]\n    \\centering\n    \\includegraphics[width=0.6\\linewidth]{aware_attacker_BL_shadearena_scaling_law.pdf}\n    \\caption{Monitor AUC against aware attackers with partial verbalization in SHADE-Arena, plotted against the MMLU-Pro gap between attackers and monitors.}\n    \\label{fig:aware_attacker_shadearena_scaling_law}\n\\end{figure}\n\n\n\n\n\n% \\subsection{Aware Attackers are More Effective}\n\n% We task the monitor with assigning a suspiciousness score from 1 (not at all suspicious) to 5 (extremely suspicious). The full monitoring rubric can be found in Appendix \\todo{add link}. We evaluate the monitor on benign trajectories from agents with no side task (true negatives) and trajectories where the agent is prompted with a side task (true positives).\n\n% We find that aware attackers are significantly more effective at evading chain-of-thought monitors than naive attackers. In section \\todo{add link}, we show that aware attackers can evade chain-of-thought monitoring effectively with or without a hidden scratchpad.\n\n% Conversely, aware monitors are only slightly more effective at detecting side tasks. This likely stems from the fact that the attacker will clearly state the main task throughout its reasoning, so knowing the main task a priori does not provide the monitor with much new information. That said, the omniscient monitor is able to detect side tasks with much higher AUC.\n\n% \\todo{add heatmap AUC (and TPR at FPR of 0.01) of monitor vs attacker awareness figure}\n\n% \\subsection{Scheming Agents Can Evade Chain-of-Thought Monitors}\n\n% Building on the hidden chain-of-thought experiments conducted in\\cite{kutasov2025shade}, we find that selective chain-of-thought boosts Claude 3.6 Sonnet's evasion capability against a Claude 3.6 Sonnet monitor up to 91\\%. However, the monitor AUC reduces less dramatically from 0.745 to 0.739. \n\n% \\todo{figure comparing visible, hidden, selective}\n\n% When we provide the complete lying prompt to the monitor, with all ten strategies listed in Table \\ref{tab:lying_strategies}, we find that the monitor AUC drops significantly more to 0.685. This suggests that the lying strategies enable the attacker to use selective chain-of-thought more adeptly. When we further prompt the attacker to select a single strategy before taking any actions, we find that the monitor AUC drops further to 0.685.\n\n% \\todo{figure comparing selective, selective liar, selective liar choose}\n\n% We next perform experiments to understand how each lying strategy contributes to evasion. We find that the lying strategies are not equally effective. \\todo{add AUC per strategy}. The single most effective strategy is \"Overwhelm with Detail,\" which is able to boost the evasion capability to \\todo{enter this value}\\%.\n\n% \\todo{add figure comparing human augmented liar and ordinary liar}\n\n% \\cite{kutasov2025shade} also write human hints for the attacker to use for each task, but they find that these hints are not very effective at improving the attacker's performance. However, we find that when combined with the lying strategies and selective chain-of-thought, the hints are able to boost the attacker's evasion capability to 95.7\\% which corresponds to an AUC reduction from 0.736 with just selective chain-of-thought and lying strategies, to 0.693. This suggests that inference-time attacker strategies tend to be synergistic, i.e. an attacker which knows how to lie and has access to hidden scratchpad is also more capable of executing complex plans in secret.\n\n% \\subsection{Omniscient Attackers Must Interact with the Monitor}\n\n% The omniscient attacker has full access to the monitor model prior to conducting its attack. We find that simply providing the attacker with the monitoring prompt does not result in any noticeable decrease in AUC. It's only when the attacker interacts with the monitor, i.e. performs some sample runs and identifies successful strategies, that the attacker can benefit from omniscience. \n\n% \\subsection{Advanced Monitoring Strategies}  \n\n% The previous experiments show that attackers are highly capable of evading chain-of-thought monitoring, particularly when they are aware that they are being monitored. One major issue is that monitors are less able to detect harmful actions in long trajectories, this is evidenced by the fact that the monitor AUC drops significantly when the attacker employs the \"Overwhelm with Detail\" strategy.\n\n% \\subsubsection{Monitoring with Rubrics}\n\n% \\cite{kutasov2025shade} use an \\lm{}-as-a-judge scorer to evaluate each transcript's suspiciousness from 0 to 100. We find that this approach is too granular, i.e. there is no specific meaning to a score of 26 as opposed to 27. We instead use a 5-point Likert scale to evaluate each transcript's suspiciousness, and write a detailed rubric for each possible score.\n\n% \\subsubsection{Hierarchical Monitoring}\n\n% Hierarchical monitoring aims to improve the monitor's ability to detect harmful actions in long trajectories by chunking the trajectories into manageable pieces. We find that it somewhat improves the aware monitor's AUC, with a chunk size of 5 achieving an AUC of 0.730 over the baseline of 0.715. However, this does not translate to an improvement in TPR at low FPR.\n\n% \\todo{add figure comparing AUC for hierarchical 3,5,7 with different chunk sizes}\n\n% However, we find a promising result. The suspiciousness score of the original monitor drops off significantly as the attacker trajectories get longer. However, the scores remain significantly higher for the hierarchical monitor. \n\n% \\todo{add figure comparing suspiciousness scores vs conversation length for original and hierarchical 3,5,7 monitors}\n\n% \\subsubsection{Action-Only Monitoring}\n\n% We also try a simple action-only monitoring strategy, but we find that action-only monitoring does not significantly improve the monitor's AUC. While this appears to contradict the results posed by \\cite{arnav2025redhanded}, we note that their tasks only involved code sabotage, and were generally much simpler environments. They further note that for subtle tasks, action-only monitoring is not as effective as chain-of-thought monitoring. \n\n% \\todo{add figure comparing action-only and chain-of-thought monitoring AUCs similar to Arnav figure 3}\n\n% \\subsubsection{Sequential Monitoring} We also try a novel monitoring approach that monitors the agent's actions in sequential chunks. This approach is motivated by the fact that the hierarchical monitor is able to parse long trajectories, but loses significant context and is vulnerable to attacks that synchronize across distant steps.\n\n% We find that the sequential monitor achieves an AUC of 0.793, which is significantly higher than the AUC of the original monitor (0.721).\n\n% \\todo{add figure comparing sequential 3,5,7 monitors AUCs}\n\n% \\subsubsection{Joint Monitoring} \\cite{arnav2025redhanded} find that a joint monitoring approach that takes the","chars":9000,"total_chars":43675,"offset":20000,"truncated":true,"next_offset":29000}