Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
TraceGuard, a structured multi-dimensional monitoring protocol, is introduced to address the limitations of single-score monitors in detecting subtle attacks and preventing collusion in AI control protocols. It evaluates agent actions across five dimensions using independent LLM calls, heuristic detectors, and an LLM-based intent analyzer. Evaluated on BashArena, TraceGuard demonstrates improved attack-honest separation, constrains collusion achieving 95% safety with an untrusted monitor, and achieves 100% safety with a separation-of-duties variant.
Untrusted LLM monitors can actually work: TraceGuard achieves 95% safety against colluding agents by decomposing the monitoring task into multiple dimensions scored by independent LLMs.
AI control protocols use monitors to detect attacks by untrusted AI agents, but standard single-score monitors face two limitations: they miss subtle attacks where outputs look clean but reasoning is off, and they collapse to near-zero safety when the monitor is the same model as the agent (collusion). We present TraceGuard, a structured multi-dimensional monitoring protocol that evaluates agent actions across five dimensions -- goal alignment, constraint adherence, reasoning coherence, safety awareness, and action-trace consistency -- scored in parallel by independent LLM calls, augmented by seven heuristic detectors and an LLM-based intent analyzer. We evaluate on BashArena (637 bash tasks, 4 attack categories) within the ControlArena framework. Our results on 519 samples (279 honest, 240 attack) show that: (1) the hybrid approach achieves clear attack-honest separation (attack mean 0.616 vs. honest mean 0.206, Delta=0.410); (2) structured scoring constrains collusion -- the untrusted structured monitor achieves 95% safety vs. 0% for single-score untrusted monitoring; (3) goal alignment and constraint adherence are the most discriminative dimensions; and (4) a separation-of-duties variant splitting dimensions across trusted and untrusted models achieves 100% safety while preventing any single model from seeing the full evaluation. TraceGuard is implemented as a new monitor type for the open-source ControlArena framework.