Monitoring benchmark/Semi-automated red-teaming for AI control

We are a team of control researchers with @ma-rmartinez supported by CG’s Technical AI safety grant. We are now halfway through our project and would like to get feedback on the following contributions. Have a low bar for adding questions or comments to the document, we are most interested in learning:

What would make you adopt our benchmark for monitor capabilities evaluation?
Which is our most interesting contribution?

Sensitive Content Notice: This work describes attack strategies and vulnerabilities in AI monitoring systems.

If you’d like access to our benchmark, please reach out to us: monika.ai.research@gmail.com, angel.rmartinez25@gmail.com.

Executive summary

We argue that current control evaluations require strong red-teams, but using models as red-teamers presents three challenges: mode collapse, time-consuming elicitation, and models struggling to conceive, plan, and execute attacks zero-shot. To robustly evaluate monitors, we need to (1) test across a large, diverse set of attacks, (2) ensure attack quality, and (3) gain visibility into monitor strengths and failure modes.

To achieve this, we introduce a Monitoring benchmark, which addresses the above problems with the following contributions:

Attack taxonomy consisting of technical, structural and evasion categories
Human-seeded attack strategies based on our attack taxonomy to ensure large attack coverage to address the mode collapse problems
Attack refinement pipeline, which is an agentic pipeline to optimise attack quality
Monitor results on the benchmark and monitor skills to gain visibility into monitor strengths and failure modes
Analysis of the most successful attacks

Our main findings:

Agents (mainly Opus-4.5) are good at following precise instructions on how to attack; they can brainstorm attacks, execute or refine them, but cannot yet do all of this zero-shot. We can use our red-teaming uplift process via human-seed strategies and refinement to reduce the safety score by 21% with Opus-4.5 as a monitor.
Monitoring capability declines steeply for weaker models, e.g. Opus-4.5 achieves 71% safety (as caught attack rate), GPT-5 11% and GPT-5-nano 0% on our HARD dataset.
Understanding monitoring skills is important. Our early results show that monitors detect most attacks but fail to calibrate the suspiciousness enough to catch them. This shows th

...

Posts

Wikitag Contributions

Comments

Posts

Wikitag Contributions

Comments