The paper investigates how large language model (LLM) agents that triage security alerts can be misled when the detection tools they rely on provide conflicting or incorrect evidence. By corrupting up to three of four heterogeneous detectors on the CIC-IDS2017 dataset, the authors show that naive LLM investigators become highly fragile, with accuracy dropping to as low as 13% and abstaining on up to 63% of flows. They propose Conflict‑Aware Evidence Verification (CAV), which combines an equal‑weight vote, an evidence‑conflict gate, and a nearest‑neighbour trust check; CAV consistently outperforms naive investigators across all corruption scenarios, improving accuracy to 84–88% when three detectors are corrupted while only querying the LLM on 0.4% of clean traffic.
By Yuchen Zhang
arXiv:2607. 06596v1 Announce Type: cross Abstract: Trusted monitoring is a central defense in AI control: a cheaper trusted model scores an untrusted model's actions for sabotage, and the most suspicious are audited or deferred.
By Lucas Pinto
The paper demonstrates that aggregate accuracy figures for chain‑of‑thought (CoT) monitors can be misleading because a large portion of detected hacks rely solely on action patterns rather than reasoning. By rewriting only the agent’s reasoning to appear truthful while keeping actions identical, the authors show that the monitor’s performance on the reasoning‑dependent subset collapses dramatically, yet the overall pooled accuracy drops only modestly. The study reveals that CoT monitors are fragile when reasoning is the key signal and that accuracy should be reported separately for this subset.
By Shikhar Shiromani, Leo Richter
The paper introduces the twin‑prefix framework to evaluate how the size of the verification unit—i.e., how many actions a pre‑execution LLM monitor reviews in one call—affects its performance. By pairing each gold plan with a twin that differs by a single write and injecting a controlled error, the authors isolate the impact of review length on catch rates and false rejections. Their findings show that longer review windows increase rejection rates but do not improve discrimination, with the highest informedness occurring at one or two actions across all judges and domains.
By Yuchen Han, Cheng Yan, Wuyang Zhang
The paper investigates how AI approval monitors can fail together when they share a base model or poisoned input, using concepts from distributed computing to identify vulnerable monitor sets. Experiments on twelve open‑weight monitors and several closed models show that fooling a monitor into approving fraud is limited to its own evidence source, while blocking correct payments requires overcoming injection resistance. A rule that counts distinct evidence sources rather than votes reduces false rejections, and adding a rule engine that cannot be persuaded restores safety and liveness against the measured attacks.
By Luca Zanolini
arXiv:2609.36490v1 Announce Type: cross
Abstract: Latent space monitors aim to detect undesired behaviors in LLM agents by inspecting an agent's internal activations rather than its outputs. However,...
By Hugo Lyons Keenan, Christopher Leckie, Sarah Erfani
arXiv:2608. 16190v1 Announce Type: cross Abstract: Trusted monitoring has a cheap, trusted model score a stronger untrusted model's actions, and a diverse ensemble of them beats a single stronger monitor at matched cost.
By Anik Jha
The paper investigates how the choice of feature space affects the effectiveness of label‑only backdoor detection. By keeping the test, labels, and metric constant while swapping feature spaces, the authors show that defenses can perform very differently—e.g., a nearest‑neighbor check yields AUROC 0.546 on poisoned features but 0.995 on frozen DINOv2 features. They also demonstrate that higher detection scores do not necessarily translate to safer models and that static prototype‑based audits can be bypassed by adaptive attackers.
By Arnab Dey, Mohammad Mahfuzul Islam
The paper investigates how standard evaluations of detectors for hijacked large language model (LLM) agents may conceal important weaknesses. By auditing eleven evaluations on the AgentDrift and AgentDojo benchmarks, the authors show that detectors often perform poorly when faced with rare attacks, unseen tools, or data from a different benchmark, with precision dropping dramatically at low attack rates and rankings reversing as tool coverage falls. They also find that a released LLM action monitor, despite high AUROC on its own data, would still generate many false alerts when applied to a new benchmark.
"whyItMatters":"The study highlights that current evaluation practices can give a misleading sense of detector reliability, underscoring the need for more robust, cross‑benchmark testing to ensure real‑world safety of LLM agents."
By Mahmoud Abbasi, Juan M. N\'u\~nez V., Amin Shahraki
arXiv:2607. 19321v1 Announce Type: new Abstract: As AI agents begin to automate AI R&D, we need ways to assess whether their outputs are safe to deploy, even when the agents themselves may be untrusted.
By Lena Libon, Ben Rank, Jehyeok Yeon, David Schmotz, Jeremy Qin, Daniel Donnelly, Derck Prinzhorn, Maksym Andriushchenko
The paper examines how to quantify the time AI tools save, contrasting a simple stopwatch approach with a more nuanced ledger view that accounts for errors introduced. It introduces model‑free metrics—time saved, excess escaped defects, and a break‑even defect cost—and applies them to a baseline checking model, randomized studies, and a replication of METR’s developer data. The author also reports on a small experiment with AI reviewers, showing that reduced effort can lead to faster but more error‑prone outcomes.
By Solomon Shalom Lijo
arXiv:2607. 05904v1 Announce Type: new Abstract: Training a language model against its own reference-free judgments (the premise of self-rewarding, self-play, and LLM-as-a-judge pipelines) assumes a model's verdict on a shown answer tracks correctness.
By Chenyu Zhou