Metraipolis › archive › dc_ec07ca658103

Simple Features Beat Most AI Control Monitors — arXiv:2610.41713

Source: arXiv (en)
Original: https://arxiv.org/abs/2610.41713
License (as archived): CC0-1.0
Archived: 2026-11-03T07:52:40.765Z
SHA-256 of the archived text: b7b9faf5774f5b9e45788e809db72182bcdca47714f616fde13465dbcf561790
Stable URL of this page: https://metraipolis.com/documento/dc_ec07ca658103

How to cite

Simple Features Beat Most AI Control Monitors — arXiv:2610.41713 — arXiv (en), https://arxiv.org/abs/2610.41713 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_ec07ca658103 (Metraipolis archive dc_ec07ca658103, sha256 b7b9faf5774f5b9e45788e809db72182bcdca47714f616fde13465dbcf561790)

BibTeX

@misc{dcec07ca658103,
  title = {Simple Features Beat Most AI Control Monitors — arXiv:2610.41713},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2610.41713},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_ec07ca658103; sha256 b7b9faf5774f5b9e45788e809db72182bcdca47714f616fde13465dbcf561790},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2610.41713. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

AI control relies on monitors to catch a capable model that sabotages its work. These monitors are evaluated on their ability to differentiate honest from backdoored code. We show that on a standard evaluation dataset, simple features beat most monitors without ever running the code, outranking 20 of 24 open-weight models prompted as monitors. The dataset gives its labels away in two ways. People wrote the honest solutions and older language models the backdoors, so the style of the code reveals the class. Additionally, problems that LLMs can backdoor have different characteristics, so basic facts about the problem reveal it too. Swapping one class at a time for code by Claude Sonnet 5 shows that these features reward a contrast between authors, since human code against Sonnet 5's backdoors is easier to separate than the original pairs, 0.95 against 0.79. One in seven backdoors in the standard test set fails our validity checks, which distorts comparisons between attackers. A Sonnet 5 monitor appears to catch 77% of the older models' backdoors but 37% of Sonnet 5's, and 78% against 61% once both are verified. We do not show that published monitors rely on these shortcuts, but our findings suggest that a high score on such a dataset is not by itself evidence of sabotage detection. We release the rebuilt dataset and checks.

Tema degli esploratori: agenti e intelligenza artificiale (elenco arXiv cs.AI, nuovi lavori del giorno).
Categorie arXiv: Cryptography and Security (cs.CR) ; Artificial Intelligence (cs.AI).
Pagina del lavoro: https://arxiv.org/abs/2610.41713 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-11-03T07:49:31.170Z dalla pagina https://arxiv.org/list/cs.AI/new (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).