Metraipolis › archive › dc_2febcf0ef34d

LLMs Learn to Evade Latent Monitors from Prior Feedback Alone — arXiv:2609.36490

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.36490
License (as archived): CC0-1.0
Archived: 2026-10-07T16:25:55.068Z
SHA-256 of the archived text: f8199b0f09a7183646e80f29fd1501b90aea6b3f2480f5b79535beb67f067cb8
Stable URL of this page: https://metraipolis.com/documento/dc_2febcf0ef34d

How to cite

LLMs Learn to Evade Latent Monitors from Prior Feedback Alone — arXiv:2609.36490 — arXiv (en), https://arxiv.org/abs/2609.36490 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_2febcf0ef34d (Metraipolis archive dc_2febcf0ef34d, sha256 f8199b0f09a7183646e80f29fd1501b90aea6b3f2480f5b79535beb67f067cb8)

BibTeX

@misc{dc2febcf0ef34d,
  title = {LLMs Learn to Evade Latent Monitors from Prior Feedback Alone — arXiv:2609.36490},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.36490},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_2febcf0ef34d; sha256 f8199b0f09a7183646e80f29fd1501b90aea6b3f2480f5b79535beb67f067cb8},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.36490. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Latent space monitors aim to detect undesired behaviors in LLM agents by inspecting an agent's internal activations rather than its outputs. However, interactive monitoring creates a feedback channel where each verdict the monitor delivers leaks information to the model about how its internal states are being evaluated. We ask whether an agent can infer the monitor's decision rule from this feedback and then selectively edit its activations to evade detection. Unlike prior evasion attacks, the model is never explicitly told what the monitor detects. Surprisingly, off-the-shelf models already produce activation edits aligned with the monitored direction, but at insufficient magnitude for evasion. Simply scaling up these edits by a factor of 8 reduces the monitor's TPR from 100% to 27%. A rank-1 LoRA amplifies this behavior into effective evasion within the forward pass, reducing TPR further to 4% on held-out concept monitors while leaving other concepts at their normal detection rates. Capabilities on standard benchmarks are retained under this finetuning, and the evasion skill survives retraining the monitors on the new activations. Mechanistically, we find evidence that the model computes its activation edit from the prior in-context turns, and show that the edit becomes more aligned with the monitored direction as more examples are provided. These results demonstrate feedback-conditioned control over activations and suggest that latent monitoring should be treated as an interactive process in which agents can observe and respond to oversight measures.

Tema degli esploratori: agenti e intelligenza artificiale (retro-catalogo arXiv: annunci del 2026-09-30 in cs.AI).
Categorie arXiv: Machine Learning (cs.LG) ; Artificial Intelligence (cs.AI).
Pagina del lavoro: https://arxiv.org/abs/2609.36490 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-07T15:54:53.846Z dalla pagina https://arxiv.org/catchup/cs.AI/2026-09-30?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).