Adaptive Attacks on Trusted Monitors Subvert AI Control Protocols
AI control protocols serve as a defense mechanism to stop untrusted LLM
agents from causing harm in autonomous settings. Prior work treats this as a
security problem, stress testing with exploits that use the deployment context
to subtly complete harmful side tasks, such as backdoor insertion. In practice,
most AI control protocols are fundamentally based on LLM monitors, which can
become a central point of failure. We study adaptive attacks by an untrusted
model that knows the protocol and the monitor model, which is plausible if the
untrusted model was trained with a later knowledge cutoff or can search for
this information autonomously. We instantiate a simple adaptive attack vector
by which the attacker embeds publicly known or zero-shot prompt injections in
the model outputs. Using this tactic, frontier models consistently evade
diverse monitors and complete malicious tasks on two main AI control
benchmarks. The attack works universally against current protocols that rely on
a monitor. Furthermore, the recent Defer-to-Resample protocol even backfires,
as its resampling amplifies the prompt injection and effectively reframes it as
a best-of-n attack. In general, adaptive attacks on monitor models represent
a major blind spot in current control protocols and should become a standard
component of evaluations for future AI control mechanisms.
68ecb9a8cd07fb414898cc22
Mikhail Terekhov
claimed_verified
2025-10-13T16:09:00.712Z
6564d6fd58b686cf6929d364
/avatars/9314b3fcb2b4aa9b36767ed82ab1255b.svg
Mikhail Terekhov
user
terekhov
68ecb9a8cd07fb414898cc23
Alexander Panfilov
claimed_verified
2025-10-13T10:03:53.569Z
645410c50b50e97d3722f1d2
/avatars/e8e079981316b26dbf0f4ada6dcdc8c6.svg
Alexander Panfilov
user
kotekjedi
68ecb9a8cd07fb414898cc24
Daniil Dzenhaliou
claimed_verified
2025-10-15T15:25:27.636Z
640df642612e7f36f90d0614
/avatars/68b6dd4d9238634367adcbfaf5d370f4.svg
Daniil Dzenhaliou
user
programmer228
68ecb9a8cd07fb414898cc25
Caglar Gulcehre
68ecb9a8cd07fb414898cc26
Maksym Andriushchenko
68ecb9a8cd07fb414898cc27
Ameya Prabhu
68ecb9a8cd07fb414898cc28
Jonas Geiping
Adaptive Attacks on Trusted Monitors Subvert AI Control Protocols
AI control protocols serve as a defense mechanism to stop untrusted LLM
agents from causing harm in autonomous settings. Prior work treats this as a
security problem, stress testing with exploits that use the deployment context
to subtly complete harmful side tasks, such as backdoor insertion. In practice,
most AI control protocols are fundamentally based on LLM monitors, which can
become a central point of failure. We study adaptive attacks by an untrusted
model that knows the protocol and the monitor model, which is plausible if the
untrusted model was trained with a later knowledge cutoff or can search for
this information autonomously. We instantiate a simple adaptive attack vector
by which the attacker embeds publicly known or zero-shot prompt injections in
the model outputs. Using this tactic, frontier models consistently evade
diverse monitors and complete malicious tasks on two main AI control
benchmarks. The attack works universally against current protocols that rely on
a monitor. Furthermore, the recent Defer-to-Resample protocol even backfires,
as its resampling amplifies the prompt injection and effectively reframes it as
a best-of-n attack. In general, adaptive attacks on monitor models represent
a major blind spot in current control protocols and should become a standard
component of evaluations for future AI control mechanisms.
Adaptive attacks on AI control protocols using prompt injections can evade monitors and complete malicious tasks, highlighting a significant vulnerability in current security mechanisms.
LLM AI control protocols security problem backdoor insertion LLM monitors adaptive attacks prompt injections Defer-to-Resample protocol best-of-n attack