Step 22: tool results

read_page

{
  "url": "https://arxiv.org/abs/2605.09684",
  "max_chars": 3200
}

{"ok":true,"url":"https://arxiv.org/abs/2605.09684","text":"[2605.09684] MonitoringBench: Semi-Automated Red-Teaming for Agent Monitoring\nSkip to main content\nSearch\nSubmit\nDonate\nLog in\nSearch arXiv\nPress Enter to search &middot; Advanced search\n-->\nComputer Science > Cryptography and Security\narXiv:2605.09684 (cs)\n[Submitted on 10 May 2026]\nTitle: MonitoringBench: Semi-Automated Red-Teaming for Agent Monitoring\nAuthors: Monika Jotautaitė , Maria Angelica Martinez , Ollie Matthews , Tyler Tracy\nView a PDF of the paper titled MonitoringBench: Semi-Automated Red-Teaming for Agent Monitoring, by Monika Jotautait\\.e and 3 other authors\nView PDF\nHTML (experimental)\nAbstract: We introduce a red-teaming methodology that exposes harder-to-catch attacks for coding-agent monitors, suggesting that current practices may under-elicit attacks and overstate monitor performance. We identify three challenges with current red-teaming. First, mode collapse in attack generation, which we reduce with a novel attack taxonomy for broader coverage. Second, a conceive-execute gap: frontier LLMs can propose strong attack ideas or execute them, but not all at once. We mitigate this by decomposing attack construction into strategy generation, execution, and post-hoc trajectory refinement. Third, manual elicitation is costly to scale, which we address with our semi-automated red-teaming pipeline. Applied to BashArena, an AI control setting for tool-using coding agents, this pipeline produces MonitoringBench, a benchmark of 2,644 attack trajectories for evaluating monitor capabilities and failure modes. Our pipeline produces more diverse and stronger attacks: Opus-4.5 monitor's catch rate falls from 94.9\\% on elicited-only Opus attacks to 60.3\\% on our best refined attacks, with larger drops for several mid-tier monitors. Attacks optimized against three development monitors generalize to ten held-out monitors, with catch rates generally increasing with monitor capability. Using this benchmark, we provide a snapshot of the current monitor capabilities and find that frontier monitors often detect suspicious actions but fall for persuasion or fail to calibrate suspiciousness scores appropriately, suggesting tractable paths for improvement. MonitoringBench provides both a static benchmark for current tool-use monitors and a reusable methodology for refreshing these evaluations as agents and monitors improve.\nSubjects:\nCryptography and Security (cs.CR) ; Artificial Intelligence (cs.AI)\nCite as:\narXiv:2605.09684 [cs.CR]\n(or\narXiv:2605.09684v1 [cs.CR] for this version)\nhttps://doi.org/10.48550/arXiv.2605.09684\nFocus to learn more\narXiv-issued DOI via DataCite\nSubmission history\nFrom: Monika Jotautaitė [ view email ] [v1]\nSun, 10 May 2026 18:04:31 UTC (2,724 KB)\nFull-text links:\nAccess Paper:\nView a PDF of the paper titled MonitoringBench: Semi-Automated Red-Teaming for Agent Monitoring, by Monika Jotautait\\.e and 3 other authors\nView PDF\nHTML (experimental)\nTeX Source\nview license\nAdditional Features\nAudio Summary\nCurrent browse context:\ncs.CR\n< prev\n|\nnext >\nnew\n|\nrecent\n| 2026-05\nChange to browse by:\ncs\ncs.AI\nReferences & Citations\nSciX\nGoogle Scholar\nSemantic Scholar\nexport BibTeX citation\nLoading...\nBibTeX formatted citation\n&times;","chars":3200,"total_chars":5202,"offset":0,"truncated":true,"next_offset":3200}

read_page

{
  "url": "https://arxiv.org/abs/2510.09462",
  "max_chars": 3000
}

{"ok":true,"url":"https://arxiv.org/abs/2510.09462","text":"[2510.09462] Adaptive Attacks on Trusted Monitors Subvert AI Control Protocols\nSkip to main content\nSearch\nSubmit\nDonate\nLog in\nSearch arXiv\nPress Enter to search &middot; Advanced search\n-->\nComputer Science > Machine Learning\narXiv:2510.09462 (cs)\n[Submitted on 10 Oct 2025 ( v1 ), last revised 2 Mar 2026 (this version, v2)]\nTitle: Adaptive Attacks on Trusted Monitors Subvert AI Control Protocols\nAuthors: Mikhail Terekhov , Alexander Panfilov , Daniil Dzenhaliou , Caglar Gulcehre , Maksym Andriushchenko , Ameya Prabhu , Jonas Geiping\nView a PDF of the paper titled Adaptive Attacks on Trusted Monitors Subvert AI Control Protocols, by Mikhail Terekhov and 6 other authors\nView PDF\nHTML (experimental)\nAbstract: AI control protocols serve as a defense mechanism to stop untrusted LLM agents from causing harm in autonomous settings. Prior work treats this as a security problem, stress testing with exploits that use the deployment context to subtly complete harmful side tasks, such as backdoor insertion. In practice, most AI control protocols are fundamentally based on LLM monitors, which can become a central point of failure. We study adaptive attacks by an untrusted model that knows the protocol and the monitor model, which is plausible if the untrusted model was trained with a later knowledge cutoff or can search for this information autonomously. We instantiate a simple adaptive attack vector by which the attacker embeds publicly known or zero-shot prompt injections in the model outputs. Using this tactic, frontier models consistently evade diverse monitors and complete malicious tasks on two main AI control benchmarks. The attack works universally against current protocols that rely on a monitor. Furthermore, the recent Defer-to-Resample protocol even backfires, as its resampling amplifies the prompt injection and effectively reframes it as a best-of-$n$ attack. In general, adaptive attacks on monitor models represent a major blind spot in current control protocols and should become a standard component of evaluations for future AI control mechanisms.\nSubjects:\nMachine Learning (cs.LG) ; Artificial Intelligence (cs.AI); Cryptography and Security (cs.CR)\nCite as:\narXiv:2510.09462 [cs.LG]\n(or\narXiv:2510.09462v2 [cs.LG] for this version)\nhttps://doi.org/10.48550/arXiv.2510.09462\nFocus to learn more\narXiv-issued DOI via DataCite\nSubmission history\nFrom: Mikhail Terekhov [ view email ] [v1]\nFri, 10 Oct 2025 15:12:44 UTC (527 KB)\n[v2]\nMon, 2 Mar 2026 08:27:36 UTC (538 KB)\nFull-text links:\nAccess Paper:\nView a PDF of the paper titled Adaptive Attacks on Trusted Monitors Subvert AI Control Protocols, by Mikhail Terekhov and 6 other authors\nView PDF\nHTML (experimental)\nTeX Source\nview license\nCurrent browse context:\ncs.LG\n< prev\n|\nnext >\nnew\n|\nrecent\n| 2025-10\nChange to browse by:\ncs\ncs.AI\ncs.CR\nReferences & Citations\nNASA ADS\nGoogle Scholar\nSemantic Scholar\nexport BibTeX citation\nLoading...\nBibTeX formatted citation\n&times;\nloading...\nData provided by:\nBoo","chars":3000,"total_chars":5061,"offset":0,"truncated":true,"next_offset":3000}

read_page

{
  "url": "https://arxiv.org/abs/2505.23575",
  "max_chars": 3000
}

{"ok":true,"url":"https://arxiv.org/abs/2505.23575","text":"[2505.23575] CoT Red-Handed: Stress Testing Chain-of-Thought Monitoring\nSkip to main content\nSearch\nSubmit\nDonate\nLog in\nSearch arXiv\nPress Enter to search &middot; Advanced search\n-->\nComputer Science > Artificial Intelligence\narXiv:2505.23575 (cs)\n[Submitted on 29 May 2025 ( v1 ), last revised 24 Nov 2025 (this version, v3)]\nTitle: CoT Red-Handed: Stress Testing Chain-of-Thought Monitoring\nAuthors: Benjamin Arnav , Pablo Bernabeu-Pérez , Nathan Helm-Burger , Tim Kostolansky , Hannes Whittingham , Mary Phuong\nView a PDF of the paper titled CoT Red-Handed: Stress Testing Chain-of-Thought Monitoring, by Benjamin Arnav and 5 other authors\nView PDF\nHTML (experimental)\nAbstract: As AI models are deployed with increasing autonomy, it is important to ensure they do not take harmful actions unnoticed. As a potential mitigation, we investigate Chain-of-Thought (CoT) monitoring, wherein a weaker trusted monitor model continuously oversees the intermediate reasoning steps of a more powerful but untrusted model. We compare CoT monitoring to action-only monitoring, where only final outputs are reviewed, in a red-teaming setup where the untrusted model is instructed to pursue harmful side tasks while completing a coding problem. We find that while CoT monitoring is more effective than overseeing only model outputs in scenarios where action-only monitoring fails to reliably identify sabotage, reasoning traces can contain misleading rationalizations that deceive the CoT monitors, reducing performance in obvious sabotage cases. To address this, we introduce a hybrid protocol that independently scores model reasoning and actions, and combines them using a weighted average. Our hybrid monitor consistently outperforms both CoT and action-only monitors across all tested models and tasks, with detection rates twice higher than action-only monitoring for subtle deception scenarios.\nComments:\nTo be published in the 39th Conference on Neural Information Processing Systems (NeurIPS 2025)\nSubjects:\nArtificial Intelligence (cs.AI) ; Machine Learning (cs.LG)\nCite as:\narXiv:2505.23575 [cs.AI]\n(or\narXiv:2505.23575v3 [cs.AI] for this version)\nhttps://doi.org/10.48550/arXiv.2505.23575\nFocus to learn more\narXiv-issued DOI via DataCite\nSubmission history\nFrom: Benjamin Arnav [ view email ] [v1]\nThu, 29 May 2025 15:47:36 UTC (3,866 KB)\n[v2]\nSun, 29 Jun 2025 09:01:41 UTC (2,979 KB)\n[v3]\nMon, 24 Nov 2025 22:11:07 UTC (3,462 KB)\nFull-text links:\nAccess Paper:\nView a PDF of the paper titled CoT Red-Handed: Stress Testing Chain-of-Thought Monitoring, by Benjamin Arnav and 5 other authors\nView PDF\nHTML (experimental)\nTeX Source\nview license\nAdditional Features\nAudio Summary\nCurrent browse context:\ncs.AI\n< prev\n|\nnext >\nnew\n|\nrecent\n| 2025-05\nChange to browse by:\ncs\ncs.LG\nReferences & Citations\nSciX\nGoogle Scholar\nSemantic Scholar\nexport BibTeX citation\nLoading...\nBibTeX formatted citation\n&times;\nloading...\nData provided by:\nBookmark\nBibliographic Tools\nBibliographic and Citation Tools\n","chars":3000,"total_chars":4910,"offset":0,"truncated":true,"next_offset":3000}

read_page

{
  "url": "https://arxiv.org/abs/2512.18311",
  "max_chars": 3200
}

{"ok":true,"url":"https://arxiv.org/abs/2512.18311","text":"[2512.18311] Monitoring Monitorability\nSkip to main content\nSearch\nSubmit\nDonate\nLog in\nSearch arXiv\nPress Enter to search &middot; Advanced search\n-->\nComputer Science > Artificial Intelligence\narXiv:2512.18311 (cs)\n[Submitted on 20 Dec 2025]\nTitle: Monitoring Monitorability\nAuthors: Melody Y. Guan , Miles Wang , Micah Carroll , Zehao Dou , Annie Y. Wei , Marcus Williams , Benjamin Arnav , Joost Huizinga , Ian Kivlichan , Mia Glaese , Jakub Pachocki , Bowen Baker\nView a PDF of the paper titled Monitoring Monitorability, by Melody Y. Guan and 11 other authors\nView PDF\nHTML (experimental)\nAbstract: Observability into the decision making of modern AI systems may be required to safely deploy increasingly capable agents. Monitoring the chain-of-thought (CoT) of today's reasoning models has proven effective for detecting misbehavior. However, this &#34;monitorability&#34; may be fragile under different training procedures, data sources, or even continued system scaling. To measure and track monitorability, we propose three evaluation archetypes (intervention, process, and outcome-property) and a new monitorability metric, and introduce a broad evaluation suite. We demonstrate that these evaluations can catch simple model organisms trained to have obfuscated CoTs, and that CoT monitoring is more effective than action-only monitoring in practical settings. We compare the monitorability of various frontier models and find that most models are fairly, but not perfectly, monitorable. We also evaluate how monitorability scales with inference-time compute, reinforcement learning optimization, and pre-training model size. We find that longer CoTs are generally more monitorable and that RL optimization does not materially decrease monitorability even at the current frontier scale. Notably, we find that for a model at a low reasoning effort, we could instead deploy a smaller model at a higher reasoning effort (thereby matching capabilities) and obtain a higher monitorability, albeit at a higher overall inference compute cost. We further investigate agent-monitor scaling trends and find that scaling a weak monitor's test-time compute when monitoring a strong agent increases monitorability. Giving the weak monitor access to CoT not only improves monitorability, but it steepens the monitor's test-time compute to monitorability scaling trend. Finally, we show we can improve monitorability by asking models follow-up questions and giving their follow-up CoT to the monitor.\nSubjects:\nArtificial Intelligence (cs.AI) ; Software Engineering (cs.SE)\nCite as:\narXiv:2512.18311 [cs.AI]\n(or\narXiv:2512.18311v1 [cs.AI] for this version)\nhttps://doi.org/10.48550/arXiv.2512.18311\nFocus to learn more\narXiv-issued DOI via DataCite\nSubmission history\nFrom: Micah Carroll [ view email ] [v1]\nSat, 20 Dec 2025 10:46:04 UTC (42,856 KB)\nFull-text links:\nAccess Paper:\nView a PDF of the paper titled Monitoring Monitorability, by Melody Y. Guan and 11 other authors\nView PDF\nHTML (experimental)\nTeX Source\nview license\nCurrent browse context:\ncs.AI\n< prev\n|\nnext >\nnew\n|\nrecent\n| 2025-12\nChange to browse by:\ncs\ncs.SE\nReferences & Citations\nNASA ADS\nGoogle Scholar\nSemantic Scholar\nexport Bib","chars":3200,"total_chars":5286,"offset":0,"truncated":true,"next_offset":3200}