Difficult to evaluate, with potential yellow flags.
Read full explanation
All current AI-control monitors read code as text ,which means they miss backdoors that are structurally obvious but textually innocent. Here's a non-LLM structural monitor that catches them. As models become more capable, they can insert a backdoor that looks innocent. For example, a condition that fails on specific inputs, with downstream consequences. And the catch here is that there's another frontier LLM with the same architecture, same blind spots, and therefore, LLM judging LLM. So what we need currently is a monitor that isn't an LLM that will look at something LLMs can't fake easily. That's the code structure.
For example c = n - m becoming c = n - m + (1 if m % 5 == 0 else 0) An LLM scores this 0/10 for suspicion. It passes all test cases except for m % 5 == 0, (red team keeps this as a secret ), but the structure is completely different : new nodes ,new branches , a new data dependency that's what a structural monitor catches.
So the approach was to base on contrast technique to let the monitor understand between trusted and untrusted code , these code snippets were transformed into code property graph which involved 3 different node types and edges from AST , control flow and data flow . The trusted reference came from a weaker trusted model; the submission being checked came from the stronger untrusted model. The 2 graphs were compared with cross graph attention and each part of submission looks for counterpart , backdoor has no counterpart in the reference , so it stands out Also for audit trail we have same graph attention weights that tells which lines triggered the flag as well .
On the apps -control-arena framework we got a recall of 70% vs 8% at the 2% budget FPR (8% was with Qwen 72B param model) , the setup is tiny model with 0.7M parameters for the classifier head, the LLM diff prompt even got the reference code and task description while the GNN approach got only the graphs and won by a wide margin. The LLM loses even with more information which means a bigger LLM won't fix it. It's a limitation of reading code as text, not of model capability.
We encountered limitations: few datasets to benchmark against , and experiment were only run on python so far and 9% single-constant backdoors slip through because single-constant changes add or remove no nodes, so the two graphs are topologically identical and the structural signal has nothing to detect. Some other unexplored areas are not red-teamed against CPG-aware adversaries, cross-dataset generalization untested. I believe this could generalise beyond backdoors and GNN+LLM ensemble can be used for Agentic AI evals or runs , do reach out if this is your area to further explore
All current AI-control monitors read code as text ,which means they miss backdoors that are structurally obvious but textually innocent. Here's a non-LLM structural monitor that catches them. As models become more capable, they can insert a backdoor that looks innocent. For example, a condition that fails on specific inputs, with downstream consequences. And the catch here is that there's another frontier LLM with the same architecture, same blind spots, and therefore, LLM judging LLM. So what we need currently is a monitor that isn't an LLM that will look at something LLMs can't fake easily. That's the code structure.
For example
c = n - mbecomingc = n - m + (1 if m % 5 == 0 else 0)An LLM scores this 0/10 for suspicion. It passes all test cases except for
m % 5 == 0, (red team keeps this as a secret ), but the structure is completely different : new nodes ,new branches , a new data dependency that's what a structural monitor catches.So the approach was to base on contrast technique to let the monitor understand between trusted and untrusted code , these code snippets were transformed into code property graph which involved 3 different node types and edges from AST , control flow and data flow .
The trusted reference came from a weaker trusted model; the submission being checked came from the stronger untrusted model. The 2 graphs were compared with cross graph attention and each part of submission looks for counterpart , backdoor has no counterpart in the reference , so it stands out
Also for audit trail we have same graph attention weights that tells which lines triggered the flag as well .
On the apps -control-arena framework we got a recall of 70% vs 8% at the 2% budget FPR (8% was with Qwen 72B param model) , the setup is tiny model with 0.7M parameters for the classifier head, the LLM diff prompt even got the reference code and task description while the GNN approach got only the graphs and won by a wide margin. The LLM loses even with more information which means a bigger LLM won't fix it. It's a limitation of reading code as text, not of model capability.
We encountered limitations: few datasets to benchmark against , and experiment were only run on python so far and 9% single-constant backdoors slip through because single-constant changes add or remove no nodes, so the two graphs are topologically identical and the structural signal has nothing to detect. Some other unexplored areas are not red-teamed against CPG-aware adversaries, cross-dataset generalization untested.
I believe this could generalise beyond backdoors and GNN+LLM ensemble can be used for Agentic AI evals or runs , do reach out if this is your area to further explore
Note: the research used Claude Code for eval scripts and figures; the writing here is my own.
GitHub : https://github.com/tanzeel291994/control-arena-gnn-monitor
Paper : https://apartresearch.com/project/structural-code-monitors-graph-matching-networks-on-code-property-graphs-for-topologyaware-trusted-monitoring-iwyy