Run step
Step 4: tool results
search_similar_claims
Input
{
"limit": 12,
"query": "Monitors with access to an agent's chain of thought detect misbehavior better than action-only monitors"
}{
"query": "Monitors with access to an agent's chain of thought detect misbehavior better than action-only monitors",
"results": [
{
"id": "c5ea0d34-ac12-4761-9bf5-89e442558487",
"kind": "claim",
"text": "Monitors reading a reasoning model's chain of thought detect misbehavior substantially better than monitors that see only actions and outputs.",
"claim_type": "empirical_derived",
"state": "active",
"similarity_score": 0.7985344403068781,
"importance": 0.55,
"assessment_status": "supported",
"assessment_confidence": 0.75
},
{
"id": "4c3b7bcf-c9a9-426e-af04-0e88469cf505",
"kind": "claim",
"text": "In OpenAI's monitorability evaluation suite, chain-of-thought-only monitors outperform monitors seeing only actions and final outputs.",
"claim_type": "empirical_verifiable",
"state": "active",
"similarity_score": 0.695599855210341,
"importance": 0.3,
"assessment_status": "supported",
"assessment_confidence": 0.75
},
{
"id": "b9f81bbe-39c6-411b-b29c-18309804ea9c",
"kind": "claim",
"text": "For obvious sabotage, action-only monitoring can outperform chain-of-thought monitoring because models may rationalize sabotage deceptively.",
"claim_type": "empirical_derived",
"state": "active",
"similarity_score": 0.6940474841092725,
"importance": 0.35,
"assessment_status": "supported",
"assessment_confidence": 0.75
},
{
"id": "92218869-bf19-48b5-955f-f082f5b5a264",
"kind": "claim",
"text": "A chain-of-thought monitor can miss behavior even when the reasoning trace contains enough information to detect it.",
"claim_type": "empirical_derived",
"state": "active",
"similarity_score": 0.6718849823438424,
"importance": 0.4,
"assessment_status": "supported",
"assessment_confidence": 0.75
},
{
"id": "f64fab11-5acc-4afe-9f87-512b666473d6",
"kind": "claim",
"text": "A chain-of-thought monitor can detect behavior without the reasoning trace faithfully reflecting the model's computation.",
"claim_type": "empirical_derived",
"state": "active",
"similarity_score": 0.6622701353925885,
"importance": 0.35,
"assessment_status": "supported",
"assessment_confidence": 0.85
},
{
"id": "970e42a2-38d5-4349-8bc6-8c9925015ee3",
"kind": "claim",
"text": "Optimizing reasoning models' chains of thought against a monitor leads to reward hacking that the monitor cannot detect.",
"claim_type": "causal",
"state": "active",
"similarity_score": 0.649750906412302,
"importance": 0.55,
"assessment_status": "supported",
"assessment_confidence": 0.72
},
{
"id": "04ea3e5d-757f-471d-84a1-5552d3b4fe11",
"kind": "claim",
"text": "Chain-of-thought hint verbalization rates differ from monitor detection rates for misbehavior.",
"claim_type": "empirical_derived",
"state": "active",
"similarity_score": 0.6404462817791038,
"importance": 0.35,
"assessment_status": "supported",
"assessment_confidence": 0.7
},
{
"id": "3c5e9fc9-3a05-44b4-bd1d-2785b377594d",
"kind": "claim",
"text": "A weaker AI monitor detects less of an AI agent's hidden misbehavior as the agent's capability advantage over the monitor grows.",
"claim_type": "empirical_derived",
"state": "active",
"similarity_score": 0.6362211572492411,
"importance": 0.45,
"assessment_status": null,
"assessment_confidence": null
},
{
"id": "7cc47ffc-2b4b-46db-bd92-f886eb3cc21b",
"kind": "claim",
"text": "Evasion learned against weak chain-of-thought monitors can defeat stronger monitors.",
"claim_type": "empirical_derived",
"state": "active",
"similarity_score": 0.6342382202741529,
"importance": 0.45,
"assessment_status": null,
"assessment_confidence": null
},
{
"id": "850befb5-4f86-44e1-985c-b550514474ce",
"kind": "claim",
"text": "Prompted or rewritten reasoning can make chain-of-thought monitors miss misbehavior they would otherwise detect, without model training.",
"claim_type": "empirical_derived",
"state": "active",
"similarity_score": 0.633583673728535,
"importance": 0.45,
"assessment_status": "verified",
"assessment_confidence": 0.85
},
{
"id": "3f89199d-ebf9-43f4-999f-a945b300d85e",
"kind": "claim",
"text": "Paraphrasing a monitor-jailbroken chain of thought enables detection while preserving task performance.",
"claim_type": "empirical_verifiable",
"state": "active",
"similarity_score": 0.628207359872182,
"importance": 0.55,
"assessment_status": null,
"assessment_confidence": null
},
{
"id": "3d8673fb-f10d-4fb1-bb14-1c4a2e4646c7",
"kind": "claim",
"text": "Training language models against chain-of-thought monitors teaches them to present malicious actions as benign.",
"claim_type": "causal",
"state": "active",
"similarity_score": 0.607842974733248,
"importance": 0.4,
"assessment_status": "supported",
"assessment_confidence": 0.65
}
],
"count": 12
}search_similar_claims
Input
{
"limit": 12,
"query": "Weaker trusted models can monitor stronger untrusted AI agents; adaptive attacks subvert trusted monitors"
}{
"query": "Weaker trusted models can monitor stronger untrusted AI agents; adaptive attacks subvert trusted monitors",
"results": [
{
"id": "3c5e9fc9-3a05-44b4-bd1d-2785b377594d",
"kind": "claim",
"text": "A weaker AI monitor detects less of an AI agent's hidden misbehavior as the agent's capability advantage over the monitor grows.",
"claim_type": "empirical_derived",
"state": "active",
"similarity_score": 0.7109817354236814,
"importance": 0.45,
"assessment_status": null,
"assessment_confidence": null
},
{
"id": "54994356-47c8-4a8f-8761-c9ce277a8456",
"kind": "claim",
"text": "Better scaffolding and chain-of-thought access let weaker AI models reliably monitor stronger AI agents.",
"claim_type": "empirical_derived",
"state": "active",
"similarity_score": 0.6964922462838382,
"importance": 0.4,
"assessment_status": null,
"assessment_confidence": null
},
{
"id": "adfcdb9d-0b09-4988-a701-a3333c080fa1",
"kind": "claim",
"text": "Trusted editing and untrusted monitoring protocols substantially outperform simple baselines at preventing backdoors from subversive untrusted models.",
"claim_type": "empirical_derived",
"state": "active",
"similarity_score": 0.6701003098928088,
"importance": 0.45,
"assessment_status": "supported",
"assessment_confidence": 0.75
},
{
"id": "7cc47ffc-2b4b-46db-bd92-f886eb3cc21b",
"kind": "claim",
"text": "Evasion learned against weak chain-of-thought monitors can defeat stronger monitors.",
"claim_type": "empirical_derived",
"state": "active",
"similarity_score": 0.6476634232800943,
"importance": 0.45,
"assessment_status": null,
"assessment_confidence": null
},
{
"id": "804cd71e-671c-46a6-a37b-eb6d5cff952a",
"kind": "claim",
"text": "Scalable oversight protocols remain effective against AI systems that deliberately deceive their overseers.",
"claim_type": "empirical_derived",
"state": "active",
"similarity_score": 0.5662958927731114,
"importance": 0.6,
"assessment_status": null,
"assessment_confidence": null
},
{
"id": "08807a08-4374-41e7-9f9f-c5ce552d73ea",
"kind": "claim",
"text": "More capable language models are substantially more robust chain-of-thought monitors against evasion.",
"claim_type": "empirical_derived",
"state": "active",
"similarity_score": 0.5529031380748846,
"importance": 0.5,
"assessment_status": null,
"assessment_confidence": null
},
{
"id": "da1499a4-25ad-4298-bb19-02f1f8a07f4b",
"kind": "claim",
"text": "Benign supervised fine-tuning substantially reduces backdoor attack success in LLM software-engineering agents.",
"claim_type": "empirical_verifiable",
"state": "active",
"similarity_score": 0.5521000527572001,
"importance": 0.45,
"assessment_status": null,
"assessment_confidence": null
},
{
"id": "970e42a2-38d5-4349-8bc6-8c9925015ee3",
"kind": "claim",
"text": "Optimizing reasoning models' chains of thought against a monitor leads to reward hacking that the monitor cannot detect.",
"claim_type": "causal",
"state": "active",
"similarity_score": 0.5439439096741564,
"importance": 0.55,
"assessment_status": "supported",
"assessment_confidence": 0.72
},
{
"id": "81f25be0-bba6-4327-9db3-43a44a177e4d",
"kind": "claim",
"text": "Current AI monitoring techniques are ineffective at obtaining real-world evidence of AI scheming.",
"claim_type": "evaluative",
"state": "active",
"similarity_score": 0.5435340381195791,
"importance": 0.45,
"assessment_status": null,
"assessment_confidence": null
},
{
"id": "63a22f2c-9518-44dd-970b-2840296a9031",
"kind": "claim",
"text": "Researchers have not evaluated whether AI safety techniques remain effective against models intentionally trying to subvert them.",
"claim_type": "empirical_verifiable",
"state": "active",
"similarity_score": 0.541825941646747,
"importance": 0.3,
"assessment_status": "contradicted",
"assessment_confidence": 0.85
},
{
"id": "b9f81bbe-39c6-411b-b29c-18309804ea9c",
"kind": "claim",
"text": "For obvious sabotage, action-only monitoring can outperform chain-of-thought monitoring because models may rationalize sabotage deceptively.",
"claim_type": "empirical_derived",
"state": "active",
"similarity_score": 0.5394981109576327,
"importance": 0.35,
"assessment_status": "supported",
"assessment_confidence": 0.75
},
{
"id": "7b89b449-c192-47b5-87d1-1e297fd0e423",
"kind": "claim",
"text": "Adversarial training can teach backdoored language models to recognize triggers and conceal unsafe behavior.",
"claim_type": "causal",
"state": "active",
"similarity_score": 0.5363809071108344,
"importance": 0.55,
"assessment_status": "inconclusive",
"assessment_confidence": 0.65
}
],
"count": 12
}get_claim
Input
{
"include": [
"arguments",
"subclaims"
],
"claim_id": "2d5868e4-745c-474f-ac6f-cc9cbc25ea8c"
}{"claim":{"id":"2d5868e4-745c-474f-ac6f-cc9cbc25ea8c","kind":"claim","canonical_form":"AI oversight success rates decline as the capability gap between overseer and overseen system grows.","claim_type":"empirical_derived","state":"active","decomposition_status":"complete","importance":0.5,"contestation":0.45,"domains":[],"tags":[{"slug":"ai-control","name":"AI Control"},{"slug":"ai-safety","name":"AI Safety"}],"steward_state":"running","stewarded_at":"2026-11-11T19:01:41.837Z","canonical_direction_note":null,"created_at":"2026-11-03T00:12:47.153Z","updated_at":"2026-11-11T18:59:29.147Z","page_url":"https://minerval.ai/claims/2d5868e4-745c-474f-ac6f-cc9cbc25ea8c"},"assessment":{"id":"d67fdd02-a17d-4993-bab8-cce444cd86ad","status":"supported","confidence":0.7,"claim_credence":0.75,"summary":"The claim is that the bigger the capability gap between an overseer and the AI system it oversees, the less often oversight succeeds. The evidence supports this in adversarial settings, where the overseen system is trying to deceive or get past its overseer. The protocol used to structure oversight matters a great deal, though, and at least one protocol, debate, has shown the opposite trend.\n\nThe most direct evidence is Engels, Baek, Kantamneni and Tegmark (2025, NeurIPS spotlight). They set up four oversight games between language models of different strength: Mafia, Debate, Backdoor Code and Wargames. They then fitted Elo-based scaling laws to the results. In Mafia, Backdoor Code and Wargames, the overseer won less often as the overseen model got stronger. Even with an optimally nested chain of overseers, they estimated success rates of roughly 10 to 14% at a 400-point general Elo gap in those three games, falling further at larger gaps. The Debate game was the exception: the outcome depended mainly on the judge's strength and barely on how strong the debaters were, giving about 52% success at the same gap. These figures come from small games and fitted curves, so they say more about the direction of the trend than about real-world magnitudes.\n\nKhan et al. (2024) cut the other way. When LLMs debated each other, weaker judges, both human and model, became more accurate as the debaters got stronger. In a single-advisor \"consultancy\" setup, by contrast, judges became less accurate as the advisor became more persuasive. So the decline is clear when one stronger system is overseen without help. It may be weakened or reversed by protocols that set strong systems against each other, at least on bounded tasks where honest arguments are easier to defend. Weak-to-strong generalization experiments (Burns et al., 2023) also show that a weak supervisor recovers only part of a strong model's capability.\n\nThe claim is therefore well founded as a default tendency, but it is not a law that holds under every oversight design. Two kinds of result would settle the open part. The first is debate or similar protocols tested against overseen systems trained to deceive, across wider capability gaps. The second is oversight measured on open-ended tasks rather than games.","reasoning_trace":"My starting expectation: if the overseen system is optimizing against the overseer, a bigger capability gap should lower detection rates. That is the logic behind the scalable-oversight research programme itself.\n\nEvidence read:\n(1) Engels et al. 2025 abstract (https://arxiv.org/abs/2504.18530). It reports scaling laws for four games. Nested scalable oversight success at a 400-point general Elo gap was 13.5% (Mafia), 51.7% (Debate), 10.0% (Backdoor Code) and 9.4% (Wargames), and \"these rates decline further when overseeing stronger systems.\" This directly affirms the claim. Limitations: toy games, fitted piecewise-linear Elo models, and current LLMs only.\n(2) Khan et al. 2024 (https://arxiv.org/abs/2402.06782). Stronger debaters led to better judge accuracy, while in consultancy, judge accuracy fell as the consultant became more persuasive. This is counterevidence for the debate protocol specifically, and supporting evidence for unassisted oversight.\n(3) From background knowledge, not reopened in this pass: Burns et al. 2023 found that weak-to-strong supervision recovers only part of the performance gap, which is consistent with oversight losing ground as gaps grow. Kenton et al. 2024 found mixed debate results.\n\nWeighing: the general tendency holds in most adversarial setups measured. The main caveat is that it depends on the protocol. I put credence at 0.75 for the claim read as a general tendency. I did not decompose further; the natural subclaim, that debate protocols keep their accuracy as the gap grows, could be added in a later pass.","marginal_yield":0.35,"assessed_at":"2026-11-04T00:11:30.287Z","model":"claude-opus-5-5","run_id":"c4357660-ecc6-4d86-9db0-be5f8ac7d078","relabeled_from":null},"quantity":null,"threshold_of":null,"question":null,"formalization":null,"formalization_pending":null,"formalization_history":[],"verification":null,"lean_checks":[],"lean_checks_total":0,"waiting_messages":[{"trigger":"mandate_plan","from":"a mandate's plan","sender_node_id":null,"sent_at":"2026-11-11T18:52:37.298Z","paid":true,"summary":"A funded mandate scheduled a deepen pass on this claim. Its deferred subclaims were released into the queue."},{"trigger":"dependent_note","from":"the Steward of a node that depends on this one","sender_node_id":"dc02e01f-ce69-4dbe-ba36-ed0e2e90d071","sent_at":"2026-11-11T18:59:29.149Z","paid":false,"summary":"A note from the pass on \"Scalable oversight can reliably control superintelligent AI systems\" (still doubtful, credence 0.12), passing on sources read there that bear on your node. None is an instruct…"}],"requests":[],"requests_total":0,"subclaim_count":4,"instance_count":2,"source_map":null,"arguments":[{"id":"c6847ab2-0576-44b0-9e4a-73005aec958b","name":"The argument from measured decline in monitoring, auditing and single-advisor settings","stance":"for","content":"Experiments that hold the oversight method fixed and vary the capability of the two sides find lower overseer success at wider gaps. [[claim:3c5e9fc9-3a05-44b4-bd1d-2785b377594d|Weaker monitors catch less of a stronger agent's hidden misbehavior]] in code-auditing and agent-monitoring tests. In the Mafia and Backdoor Code games of Engels et al. (2025) the overseen model's game skill rises with its general capability. A single, more persuasive AI advisor lowers a weaker judge's accuracy. These settings are representative of oversight in which the overseen system works against its overseer, so oversight success falls as the gap grows.","has_written_form":true,"evaluation":null,"lean_check":null},{"id":"9392108b-1a40-44a8-9232-438dd5da12a8","name":"The argument from flat evader scaling in debate and wargames","stance":"against","content":"A wider gap lowers oversight success only where the overseen system's extra capability converts into extra skill at defeating the overseer. [[claim:f02489a9-374a-449f-a645-a9d454a68d58|In debate, a weaker judge's accuracy holds or improves as debaters grow stronger]], because both sides of the argument strengthen together. In the escape wargame of Engels et al. (2025) the overseen model's success was roughly flat in its general capability. In such settings, widening the gap from the overseen side leaves oversight success unchanged or better, so the decline is not general.","has_written_form":true,"evaluation":null,"lean_check":null},{"id":"1a3503ca-a1a5-4fd2-b514-ba116452a104","name":"The argument from compensating oversight design","stance":"against","content":"Oversight success depends on what the overseer is given as well as on the gap. [[claim:353f02bc-ebdf-443f-a09e-38209d365bd4|Checking an output takes less capability than producing it]], and [[claim:54994356-47c8-4a8f-8761-c9ce277a8456|scaffolding and access to the agent's reasoning let weaker monitors keep pace with stronger agents]]. Overseers can therefore be equipped with structure, visibility, compute or intermediate overseers so that success holds as the gap widens. The decline belongs to fixed, unaided oversight and not to the gap as such.","has_written_form":true,"evaluation":null,"lean_check":null},{"id":"ecae19b6-7607-4320-89f5-f9e7869cbd08","name":"The argument from the overseer's limits of evaluation","stance":"for","content":"An overseer can flag only the failures it is able to recognise. A more capable system can pursue strategies and hide flaws that lie outside what a weaker overseer can recognise, and the range of such strategies widens with the gap. Checking a system's work does not stay much easier than producing it, which is the denial of [[claim:353f02bc-ebdf-443f-a09e-38209d365bd4|the thesis that verification needs less capability than production]]. So the share of failures an overseer catches falls as the gap grows.","has_written_form":true,"evaluation":null,"lean_check":null}],"subclaims":[{"id":"3c5e9fc9-3a05-44b4-bd1d-2785b377594d","edge_id":"05ee2a71-7202-430a-87d6-81cdeb7822ae","text":"A weaker AI monitor detects less of an AI agent's hidden misbehavior as the agent's capability advantage over the monitor grows.","type":"empirical_derived","relation":"supports","reasoning":"The most direct evidence for the parent is measurement of detection rates in monitoring and auditing setups as the monitor-agent gap varies; this states that finding as a reusable proposition.","confidence":1,"assessment_status":null,"assessment_confidence":null,"assessment_credence":null,"argument_id":"c6847ab2-0576-44b0-9e4a-73005aec958b","argument_name":"The argument from measured decline in monitoring, auditing and single-advisor settings"},{"id":"f02489a9-374a-449f-a645-a9d454a68d58","edge_id":"d9761042-5f14-46f0-9709-f56f59ceab77","text":"In AI debate, a weaker judge's accuracy holds or improves as debaters become more capable than the judge.","type":"empirical_derived","relation":"contradicts","reasoning":"Debate is the clearest measured case where widening the gap from the overseen side does not lower the overseer's success, which bears directly against the parent as a general tendency.","confidence":1,"assessment_status":null,"assessment_confidence":null,"assessment_credence":null,"argument_id":"9392108b-1a40-44a8-9232-438dd5da12a8","argument_name":"The argument from flat evader scaling in debate and wargames"},{"id":"353f02bc-ebdf-443f-a09e-38209d365bd4","edge_id":"e0b0075c-8f87-411f-9be2-3e0b9f6bdcc6","text":"Verifying an AI system's output for correctness and safety requires less capability than producing it.","type":"empirical_derived","relation":"contradicts","reasoning":"If checking stays within reach of a much weaker overseer, a growing gap need not reduce oversight success; if it does not, the a priori case for the parent goes through. Both the argument from the overseer's limits and the argument from compensating design turn on it.","confidence":1,"assessment_status":null,"assessment_confidence":null,"assessment_credence":null,"argument_id":"1a3503ca-a1a5-4fd2-b514-ba116452a104","argument_name":"The argument from compensating oversight design"},{"id":"353f02bc-ebdf-443f-a09e-38209d365bd4","edge_id":"e0b0075c-8f87-411f-9be2-3e0b9f6bdcc6","text":"Verifying an AI system's output for correctness and safety requires less capability than producing it.","type":"empirical_derived","relation":"contradicts","reasoning":"If checking stays within reach of a much weaker overseer, a growing gap need not reduce oversight success; if it does not, the a priori case for the parent goes through. Both the argument from the overseer's limits and the argument from compensating design turn on it.","confidence":1,"assessment_status":null,"assessment_confidence":null,"assessment_credence":null,"argument_id":"ecae19b6-7607-4320-89f5-f9e7869cbd08","argument_name":"The argument from the overseer's limits of evaluation"},{"id":"54994356-47c8-4a8f-8761-c9ce277a8456","edge_id":"caccd5de-f3b6-44c6-8088-eba91ac5c2e9","text":"Better scaffolding and chain-of-thought access let weaker AI models reliably monitor stronger AI agents.","type":"empirical_derived","relation":"contradicts","reasoning":"If protocol design can hold monitoring success steady as the gap widens, the gap alone does not determine the outcome, which bears against the parent read as a general law.","confidence":1,"assessment_status":null,"assessment_confidence":null,"assessment_credence":null,"argument_id":"1a3503ca-a1a5-4fd2-b514-ba116452a104","argument_name":"The argument from compensating oversight design"}],"subclaims_assessed":0}