Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces a novel marginal-preserving, correlation-encoded distributed-sabotage attack that exploits the limitations of per-step AI-control monitors by maintaining benign marginal scores while encoding harm through temporal correlations. The authors demonstrate that traditional monitoring methods, such as mean and max score assessments, are ineffective against this stealthy attack, achieving a KS-distance of 0.013 at various harm levels, indicating that harm can be decoupled from observable per-step metrics. Furthermore, the study reveals that while some monitors can detect this attack, they are not optimally effective, highlighting a critical gap in current monitoring strategies for AI systems.
Traditional AI-control monitors can be easily fooled by attacks that distribute harm across many benign actions, revealing a significant vulnerability in current detection methods.
AI-control monitors score individual agent actions to detect misbehavior, but real harm can be distributed across many benign-looking steps, each individually below any per-step alarm. We construct a marginal-preserving, correlation-encoded distributed-sabotage attack using a Gaussian-copula AR(1) construction: the per-step monitor-score marginal is held exactly equal to benign, so mean, max, top-k tail, and threshold monitors (Monitor A) are defeated by construction, while harm is encoded in the temporal correlation structure. We sequence the paper around three reviewer-mandated gates. (1) Realizability gate: the stealthy attack achieves KS-distance to benign of 0.013 (effectively zero) at all tested harm levels up to 3.0, confirming that harm is fully decoupled from the per-step marginal and realizability is not harm-limited. (2) Monitor-A-vs-B reconciliation: we show formally that the attack, built against Monitor A's score marginal, remains marginal-preserving under a different-score Monitor B (the correlation/sequence family: CUSUM, SPRT, HMM-LR, runs test, autocorrelation, windowed logistic), and scope worst-case claims to score functions that admit a temporal signature. (3) Non-empty detectability band: Monitor A achieves AUC 0.52 (chance); Monitor B spans AUC 0.79-0.97 at the same 1% FPR target, and as harm is amortized over more steps Monitor A collapses to chance while Monitor B holds at AUC ~0.95. These results demonstrate a non-empty detectability band and characterize the sub-threshold sabotage frontier: distribution-shape monitors fail by construction; temporal-correlation monitors can detect but are not trivially optimal.