probing-monitor-collusion

In AI control, an untrusted model is overseen by a monitor that flags anything dangerous in its output. When the monitor is itself untrusted, the failure mode is collusion: it detects a backdoor and reports "looks fine". From outside, a colluding "safe" and an honest "safe" are the same output.

The headline result is that a linear probe fit on the base model, which never sees a collusion example, reads the channel well enough to matter. Against a monitor fine-tuned to conceal backdoors on a covert signal, black-box untrusted monitoring drops to 0.007 safety. Adding that probe brings it to 0.64, at 96% usefulness.

P-backdoor-base is fit on trusted base weights and asks only whether the code contains a backdoor, so it is deployable. It beats trusted monitoring and the signal-aware P-collusion-org upper bound. Regenerate: python experiments/06_base-probe-transfer/fig_src/make_fig4_frontier_deployed.py

Status: proof-of-concept. Every result is small-n and reported with its own caveats. Treat each experiment as a worked example of a methodology, not a settled general claim. Negative results are kept in full, including the ones that cut against our own thesis.

Experiments

#	Experiment	Question	Status	Headline
01	cross-role-generalization	Does misalignment transfer policy to monitor?	✅ ◻	somo-olmo7b hacks as a policy but stays honest as a monitor. af-hughes-8b: null.
02	deception-steering	Can a deception direction be read and steered?	✅ ◻	30/30 held-out concealments flipped to honest disclosure at 24B. Negative at 13B.
03	two-pass-monitor	Concealment, or just the backdoor or the signal?	✅ ◻	Steering fails its own control under a selective colluder (0.51). A probe reaches 0.94, but jamming cuts recall to 0.04.
04	probe-collusion-detection	Can a probe read an active collusion channel?	✅	AUROC 0.95 to 0.98, surviving code redaction, via an α-scaled in-band organism.
05	control-eval	What does the probe buy in a control eval?	✅ ◻	Untrusted monitoring collapses to 0.007, below a 1.5B trusted monitor. Probes restore 0.318 to 0.433. A signal-aware jammer still wins.
06	base-probe-transfer	Can the probe be built on trusted weights?	✅	Yes, 63/73 caught at a 2% budget, matching the org-fit baseline. The circularity is gone.
07	trusted-probe-decorrelation	Is it decorrelated from trusted monitoring?	◻	Leaning no. Errors correlate on the colluding passes; the union is dominated by the probe alone.
08	deception-probe-baseline	Just a generic deception direction?	✅ ◻	No, orthogonal at the random null. But the subspaces overlap.

✅ complete · ◻ null, negative, or self-undercutting result reported

Contributions

Ryan Kelly built 03 and 05, the evaluation environment and the control evaluation. Martin Veron built 04 and 06 to 08, the organism, the probe and the attacks on it. 01 and 02 are joint early work.

Layout

experiments/NN_<slug>/   README.md · design.md (pre-registration) · code/ · results/
shared/                  lifted here only once a pattern repeats across 2+ experiments
_internal/               gitignored: process docs, raw logs, source PDFs

Weights and raw activation dumps are gitignored; the exp04 adapter rides as a GitHub Release (exp04-organism-v1). Conventions in CONTRIBUTING.md, provenance in REFERENCES.md.

Reproducing

requirements.txt covers the CPU analyses: rebuilding frontiers, refitting probes from saved scores, regenerating figures. It is unpinned on purpose, since only 03_two-pass-monitor has a real lock and pinning the rest after the fact would be a fiction. Score files and derived vectors are checked in, so the headline results rebuild without a GPU. Each experiment documents its own steps.

Authors

Martin Veron & Ryan Kelly. MIT licensed, see LICENSE.