The paper investigates how well model providers can detect distributed model‑extraction attacks by monitoring only the queries sent to their services. Using a dataset of one million real chat turns and a frozen evaluation period, the authors show that detection depends more on the distinctiveness of a campaign than on specific extraction techniques. They demonstrate that a calibrated monitor can catch most naive distributed extraction attempts, while more sophisticated campaigns that mimic ordinary user behavior evade all query‑only detectors.
arXiv:2610.12445v2 Announce Type: replace-cross Abstract: Recent incidents have highlighted the challenge of monitoring LLM agents and the danger of models deceiving people. We show that white-box de...
The paper investigates whether an overseer can predict when an AI agent will comply with a peer’s coercion to reveal sensitive information. By training a linear probe on the agent’s internal activations, the authors demonstrate high detection rates—up to 82% of leaking calls at a 5% benign flag rate—across multiple multi‑agent scenarios. The probe also identifies legitimate disclosures more often than violations, indicating a short‑range warning that could enable pre‑emptive intervention.
The paper investigates whether an overseer can predict when an AI agent will yield to peer pressure and reveal sensitive information. By training a linear probe on the agent’s internal activations, the authors demonstrate that they can detect imminent leaks with high accuracy—catching 82 % of leaking calls on Qwen3‑32B while flagging only 5 % of benign ones. The study also shows that a simple bag‑of‑words classifier performs similarly, indicating that the probe’s advantage largely stems from label training rather than activation patterns.
arXiv:2608. 02698v1 Announce Type: cross Abstract: Tool-using agents built on large language models (LLMs) are increasingly deployed not by a single operator but by many, side by side on shared infrastructure.
The paper demonstrates that aggregate accuracy figures for chain‑of‑thought (CoT) monitors can be misleading because a large portion of detected hacks rely solely on action patterns rather than reasoning. By rewriting only the agent’s reasoning to appear truthful while keeping actions identical, the authors show that the monitor’s performance on the reasoning‑dependent subset collapses dramatically, yet the overall pooled accuracy drops only modestly. The study reveals that CoT monitors are fragile when reasoning is the key signal and that accuracy should be reported separately for this subset.
The paper investigates whether adding a short classification instruction after a user’s prompt improves the ability of activation probes to detect malicious inputs in large language models. Across 13 safety benchmarks and three open‑weight model families, a classification suffix consistently boosts out‑of‑distribution detection (up to ~4 AUC points) compared to no suffix, and the benefit transfers to multi‑position pooling probes used in production. The improvement stems from the classification format itself rather than the specific content of the instruction, though the optimal suffix varies with the model and readout type.
The paper introduces inexpensive, scalable methods for evaluating language model behavior across different vendors and releases. By running identical public stimuli on a cross‑vendor panel and analyzing transcripts via exact match, LLM‑coded codebooks, or instrumented environments, the authors can quantify model responses at a cost of a few dollars per model. Applying these tools to four years of releases reveals patterns of convergence, resistance, positional stability, and compliance that vary by generation, lab, and harness.
arXiv:2610.09981v1 Announce Type: cross Abstract: LLM routers pick a cheap or expensive model per request by its content, and many gateways and some cloud platforms can log that choice with content l...
arXiv:2610.41803v1 Announce Type: cross Abstract: Detectors can flag hijacked large language model (LLM) agents from the traces of the tools they call. In the eleven evaluations we audited, attacks o...
The paper audits whether synthetic distractors in RLVR corpora act as shortcuts for learning policies. A classifier using only surface statistics barely outperforms chance, and manual inspection reveals that code distractors are almost identical to correct answers. Experiments with a paraphrase‑matched control show no exploitation advantage for the unmodified data, indicating that the detectable artifact was not used by the policy.
The paper introduces concept provenance, a framework that categorizes query concepts into backstory-supported, human-central, human-tail, and candidate answer-side zones to detect knowledge intrusion in LLM-generated search queries. Applying this framework to 77,004 queries across 100 topics, 8 LLMs, and 5 prompt conditions, the authors find that 7.40% of non-generic concepts are candidate answer-side and appear in 97 of 100 topics, with human validation revealing 68.2% relaxed precision and equal contributions from knowledge and deployment intrusion. The study shows that while prompt conditions do not eliminate intrusion, post-generation concept-provenance selection can achieve 99% elimination, positioning concept provenance as a diagnostic tool rather than an evaluation predictor.
arXiv:2607. 01208v1 Announce Type: cross Abstract: Language models deployed in high-stakes roles can potentially favor certain entities, brands, or viewpoints, steering user decisions at scale.