This research was completed for London AI Safety Research (LASR) Labs 2025 by Jennifer Za, Julija Bainiaskina, Nikita Ostrovsky and Tanush Chopra. The team was supervised by Victoria Krakovna (Google DeepMind). Find out more about the programme and express interest in upcoming iterations here.

Introduction

Many proposals for controlling misaligned LLM agents rely on using a second LLM as a monitor [1]. A concerning vulnerability of this setup is that agents may persuade monitors to approve undesirable actions.

Our research investigates the capability of frontier models to persuade monitors to approve actions that are against the monitor’s policy, and how this changes when the monitor has access to the agent’s chain-of-thought (CoT) [2]. We open source all code and datasets on GitHub. Full details are in our paper, Persuade Me If You Can: Evaluating AI Agent Influence on Safety Monitors.

Our contributions are:

We develop a pipeline for evaluating monitor persuasion capability.
We show that CoT monitors may be more easily persuaded than those without CoT access.
We find that AI agents are more persuasive when generating their own persuasion strategies than those that we propose.

Figure 1: Agents succeed in persuading monitors to approve undesirable actions on average 27% more frequently for monitors that have access to CoT (right), compared to those that don’t (left).

We Develop a Pipeline for Evaluating Monitor Persuasion Capability

Figure 2a: The agent’s system prompt includes a persona, main task, hidden task (which includes the malicious action), information about the monitor policy and, optionally, a suggestion of a persuasion strategy

We produce a dataset of 40 tasks in software engineering, customer support, finance, and social media domains. The dataset can be augmented by adding a persona, main and hidden task, and persuasion strategy for the agent; and a persona, main task and policy for the monitor. Together, these seven variables define a situation in which the agent-monitor pair might be deployed, the undesirable action that the agent might pursue, and a way that it might try to persuade the monitor. Figures 2a and 2b show examples of the resulting agent and monitor system prompts.

In order to control for agents trying to get actions approved by making backdoors more subtle (or removing them entirely), rather than by trying to persuade the monitor,...

Posts

Wikitag Contributions

Comments