MonitoringBench: Semi-Automated Red-Teaming for Agent Monitoring

• URL: http://arxiv.org/abs/2605.09684v1
• Date: Sun, 10 May 2026 18:04:31 GMT
• Title: MonitoringBench: Semi-Automated Red-Teaming for Agent Monitoring
• Abstract summary: We introduce a red-teaming methodology that exposes harder-to-catch attacks for monitoring agents.<n>We find that frontier monitors often detect suspicious actions but fall for persuasion or fail to calibrate suspiciousness scores appropriately.<n>MonitoringBench is a benchmark of 2,644 attack trajectories for evaluating monitor capabilities and failure modes.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: We introduce a red-teaming methodology that exposes harder-to-catch attacks for coding-agent monitors, suggesting that current practices may under-elicit attacks and overstate monitor performance. We identify three challenges with current red-teaming. First, mode collapse in attack generation, which we reduce with a novel attack taxonomy for broader coverage. Second, a conceive-execute gap: frontier LLMs can propose strong attack ideas or execute them, but not all at once. We mitigate this by decomposing attack construction into strategy generation, execution, and post-hoc trajectory refinement. Third, manual elicitation is costly to scale, which we address with our semi-automated red-teaming pipeline. Applied to BashArena, an AI control setting for tool-using coding agents, this pipeline produces MonitoringBench, a benchmark of 2,644 attack trajectories for evaluating monitor capabilities and failure modes. Our pipeline produces more diverse and stronger attacks: Opus-4.5 monitor's catch rate falls from 94.9\% on elicited-only Opus attacks to 60.3\% on our best refined attacks, with larger drops for several mid-tier monitors. Attacks optimized against three development monitors generalize to ten held-out monitors, with catch rates generally increasing with monitor capability. Using this benchmark, we provide a snapshot of the current monitor capabilities and find that frontier monitors often detect suspicious actions but fall for persuasion or fail to calibrate suspiciousness scores appropriately, suggesting tractable paths for improvement. MonitoringBench provides both a static benchmark for current tool-use monitors and a reusable methodology for refreshing these evaluations as agents and monitors improve.

Related papers

• Distributed Attacks in Persistent-State AI Control [0.8411355178908656]
  Iterative VibeCoding is the study of safely deploying capable but potentially untrusted AI.<n>Evasion remains high across state-of-the-art monitor models.<n>We introduce a stateful link-tracker monitor that tracks suspicious buildup across PRs.
  arXiv  Detail & Related papers  (2026-07-02T17:59:56Z)
• Stateful Online Monitoring Catches Distributed Agent Attacks [63.00394432922707]
  We develop an online stateful monitor that uses real-time clustering to collect weak suspiciousness signals across many agent transcripts.<n>Our results point toward a new class of safety monitors which reason over groups of users rather than isolated transcripts.
  arXiv  Detail & Related papers  (2026-05-29T17:57:00Z)
• SLEIGHT-Bench: A Benchmark of Evasion Attacks Against Agent Monitors [3.989565392866092]
  We present SLEIGHT-Bench (Subtle Low-itEration Insight-Guided Harmful Transcripts), a benchmark of synthetic transcripts containing 40 attacks across 11 categories.<n>We find that 20 of 40 attacks are never caught by an Opus 4.6 monitor with extended thinking across 10 trials at a 1% false-positive rate, while the overall catch rate is 32%.
  arXiv  Detail & Related papers  (2026-05-15T20:46:46Z)
• CoT-Guard: Small Models for Strong Monitoring [13.584850312226918]
  Monitoring the chain-of-thought (CoT) of reasoning models is a promising approach for detecting covert misbehavior (i.e., hidden objectives) in code generation tasks.<n>Large models (GPT-5, Gemini-3-Flash) can serve as effective CoT monitors, but they are expensive to deploy due to the lengthy reasoning traces and high API cost.<n>We propose a post-training pipeline combining supervised fine-tuning (SFT) and reinforcement learning (RL), where SFT narrows the gap for in-domain tasks.
  arXiv  Detail & Related papers  (2026-05-12T20:49:30Z)
• Step-level Optimization for Efficient Computer-use Agents [51.29573359027217]
  We argue that strong computer-use agents remain expensive and slow in practice.<n>We propose an event-driven, step-level cascade for computer-use agents.
  arXiv  Detail & Related papers  (2026-04-29T19:59:36Z)
• DeceptGuard :A Constitutional Oversight Framework For Detecting Deception in LLM Agents [0.0]
  We introduce DECEPTGUARD, a unified framework that systematically compares three monitoring regimes.<n>We introduce DECEPTSYNTH, a scalable synthetic pipeline for generating deception-positive and deception-negative agent trajectories.<n>Our monitors are optimized on 4,800 synthetic trajectories and evaluated on 9,200 held-out samples from DeceptArena.
  arXiv  Detail & Related papers  (2026-03-14T06:45:43Z)
• Detecting Object Tracking Failure via Sequential Hypothesis Testing [80.7891291021747]
  Real-time online object tracking in videos constitutes a core task in computer vision.<n>We propose interpreting object tracking as a sequential hypothesis test, wherein evidence for or against tracking failures is gradually accumulated over time.<n>We propose both supervised and unsupervised variants by leveraging either ground-truth or solely internal tracking information.
  arXiv  Detail & Related papers  (2026-02-13T14:57:15Z)
• Bypassing AI Control Protocols via Agent-as-a-Proxy Attacks [12.356708678431183]
  Current defenses rely on monitoring protocols that jointly evaluate an agent's Chain-of-Thought (CoT) and tool-use actions to ensure alignment with user intent.<n>We demonstrate that these monitoring-based defenses can be bypassed via a novel Agent-as-a- Proxy attack.<n>Our findings suggest current monitoring-based agentic defenses are fundamentally fragile regardless of model scale.
  arXiv  Detail & Related papers  (2026-02-04T21:38:38Z)
• Adaptive Attacks on Trusted Monitors Subvert AI Control Protocols [80.68060125494645]
  We study adaptive attacks by an untrusted model that knows the protocol and the monitor model.<n>We instantiate a simple adaptive attack vector by which the attacker embeds publicly known or zero-shot prompt injections in the model outputs.
  arXiv  Detail & Related papers  (2025-10-10T15:12:44Z)
• Beyond Linear Probes: Dynamic Safety Monitoring for Language Models [67.15793594651609]
  Traditional safety monitors require the same amount of compute for every query.<n>We introduce Truncated Polynomials (TPCs), a natural extension of linear probes for dynamic activation monitoring.<n>Our key insight is that TPCs can be trained and evaluated progressively, term-by-term.
  arXiv  Detail & Related papers  (2025-09-30T13:32:59Z)
• Reliable Weak-to-Strong Monitoring of LLM Agents [6.922769543581406]
  We stress test monitoring systems for detecting covert misbehavior in autonomous agents.<n>We develop a monitor red teaming (MRT) workflow that incorporates varying levels of agent and monitor situational awareness.<n>We release code, data, and logs to spur further research.
  arXiv  Detail & Related papers  (2025-08-26T22:29:31Z)
• Monitoring Decomposition Attacks in LLMs with Lightweight Sequential Monitors [27.976136688947093]
  Current LLM safety defenses fail under decomposition attacks, where a malicious goal is decomposed into benign subtasks that circumvent refusals.<n>We propose adding an external monitor that observes the conversation at a higher granularity.<n>We show that a carefully prompt engineered lightweight monitor achieves a 93% defense success rate, beating reasoning models like o3 mini as a monitor.
  arXiv  Detail & Related papers  (2025-06-12T17:50:58Z)
• Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscation [56.102976602468615]
  We show that we can monitor a frontier reasoning model, such as OpenAI o3-mini, for reward hacking in agentic coding environments.<n>We find that with too much optimization, agents learn obfuscated reward hacking, hiding their intent within the chain-of-thought.
  arXiv  Detail & Related papers  (2025-03-14T23:50:34Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.