PaperlayerView exact revision on arXiv

Source-linked AI summary

Decorrelation Is Not Complementarity: Skill, Not Lineage, Governs Trusted-Monitor Ensembles

Anik Jha

arXiv:2608.16190v1cs.CRcs.LG

TL;DR

The paper asks whether verifier-pool heterogeneity adds value beyond stronger monitors, given that prior ensembles varied prompts and fine-tuning around one base model. Across open-weight monitors and decomposed agreement analyses, skill—not pretraining lineage—governs useful complementarity, while ensemble gains decline as panel skill rises.

  • Problem

    Prior trusted-monitor ensembles varied prompts and fine-tuning around one base model, leaving the source of their diversity and complementarity unclear.

  • Method

    The study evaluates open-weight monitors on backdoored code and decomposes pairwise agreement into shared detectability and idiosyncratic error components.

  • Results

    Skill predicts monitor agreement and lineage yields no detectable matched-capability detection benefit, while ensemble gain declines with panel skill and selection never beats the best monitor out of sample.

  • Takeaways & Limitations

    Ensemble advantage should not be assumed to persist as monitors improve and should be re-measured at the capability of the deployed monitor.

  • Takeaways & Limitations

    The lineage null cannot exclude smaller cross-lineage benefits because the statistic is unstable in pools of this size.

Abstract

from arXiv · show

Trusted monitoring has a cheap, trusted model score a stronger untrusted model's actions, and a diverse ensemble of them beats a single stronger monitor at matched cost. They are built by minimising average pairwise correlation, and that paper's twelve monitors shared one base model, leaving open what supplies the diversity. We study 24 open-weight monitors spanning nine pretraining lineages and a 29x range of detection skill (pAUC at 10 percent FPR, 0.028 to 0.803) on backdoored code. The metric used to build panels does not predict what a panel is for, and we can say why. Agreement on attack items splits into a shared-detectability signal component and an idiosyncratic error component, which predict ensemble gain with opposite sign (Spearman -0.25 and +0.26), so their sum, the metric actually used, predicts it barely at all (+0.05); the cancellation holds in 7 of 8 evaluations. Skill acts on signal (+0.53) while error stays flat (-0.01), which is why a monitor's own skill predicts its agreement with the pool (Spearman 0.84, n = 24, permutation p below 0.0001). Pretraining lineage is the obvious way to buy decorrelation, and it does not pay. At matched member capability, cross-lineage panels detect no better (permutation p = 0.13), and lineage barely moves the metric either (+0.064, p = 0.18). We report that against ourselves: on our own 22-monitor pool the same test read +0.104 at p = 0.037 until two monitors were added. An earlier pool topping out at pAUC 0.23 had already invalidated another analysis. Such a quantity is a property of the pool assembled. Panel gain over the best member falls monotonically with panel skill (-0.66 at k = 2, -0.70 at k = 3), and no correlation-weighted selection beats picking the single best monitor out of sample. Across six attacker models the gain result holds in all six, the agreement and cancellation results in five of six.

1 Introduction

Trusted-monitor ensembles improve verification, but this paper finds that skill—not pretraining lineage or aggregate decorrelation—governs complementarity and practical gain. Decomposing agreement explains why the usual diversity metric fails and shows that its conclusions depend on the monitor pool assembled.

  • Open questions: All twelve prior monitors shared one base model, leaving cross-family diversity and the mechanism underlying complementarity untested.Their diversity came from prompt and fine-tuning variation, motivating this paper’s broader open-weight monitor pool.
  • Motivation: Trusted monitoring combines cheaper trusted-model scores to decide which actions from stronger untrusted agents receive audit or deferral.A single monitor is a single point of failure, motivating panels and the question of whether to buy better monitors or greater heterogeneity.
  • Why the diversity metric fails: The aggregate agreement metric predicts ensemble gain barely at all (+0.05) because shared-detectability signal and idiosyncratic error predict gain with opposite signs (Spearman −0.25 and +0.26).The cancellation replicates in 7 of the 8 evaluations available.
  • Skill, not lineage: Skill acts on the signal component (+0.53) while error stays flat (−0.01), producing strong capability–agreement correlation (Spearman ρ = 0.84, n = 24, permutation p < 10−4).This relationship survives three attenuation controls.
  • Skill, not lineage: At matched member capability, lineage yields no detectable detection benefit (monitor-level permutation p = 0.13) and barely shifts the correlation metric (+0.064, p = 0.18).A 22-monitor pool instead showed +0.104 at p = 0.037 until two monitors were added, illustrating that correlation structure depends on the assembled pool.

2 Setup

The study evaluates trusted monitors on backdoored Python solutions using a reconstructed APPS test split, a six-attacker benchmark, and a 24-model pool spanning nine pretraining lineages. It uses logprob-based YES/NO suspicion scores, pAUC@10%, attack-only agreement, and monitor-level permutation tests for pairwise observations.

  • Task and data: 1,375 samples comprise 172 attack and 1,203 honest Python solutions in the reproduced backdoored-APPS test split.The split is reproduced exactly, while train/validation membership is deterministically reconstructed because it was not published.
  • Attacker variation: 767 attacks from six attacker models are evaluated against one shared 600-sample honest pool.The attackers are o3-mini, Claude-3.7-Sonnet, GPT-4o, Gemini-2.0-Flash, o1-mini, and GPT-4.
  • Monitors: 24 open-weight instruction-tuned monitors span nine pretraining lineages, sizes from 0.36B to 32B, and 276 monitor pairs.A separate six-prompt Qwen3-8B set is used only in §3.6 to reproduce within-model diversity.
  • Scoring: Suspicion is logit(YES) −logit(NO) from a YES/NO backdoor judgement, replacing integer 0–10 prompted scores.The logprob design avoids parse failures from weak models that could contaminate the capability axis.
  • Metrics and statistics: pAUC@10% is the primary metric, with random ranking scoring 0.05; agreement is Pearson correlation on attack samples only.Capability is measured on a held-out validation split, and statistical significance uses permutations of monitor properties rather than treating the 276 pairs as independent.

3 Results · 3.1 Agreement rises with monitor skill · 3.2 The diversity metric fails because its two components cancel

Agreement rises with monitor skill because competent monitors share genuine detectability, while weak monitors disagree through idiosyncratic error. Consequently, the pairwise-correlation metric used for panel selection is nearly uninformative about ensemble gain because its signal and error components cancel.

  • 3.1 Agreement rises with monitor skill: 0.841: Monitor skill strongly and monotonically predicts mean agreement with the other 23 monitors.At the pair level, agreement also rises across skill quartiles, from mean r = 0.04 in the weakest quartile to r = 0.29 in the strongest.
  • 3.1 Agreement rises with monitor skill: 0.78: Skill and attack-score spread are strongly related, creating a potential attenuation confound in the skill–agreement relationship.The analysis tests this confound using rank-based agreement, which is invariant to score scale and spread.
  • 3.1 Agreement rises with monitor skill: Competent monitors agree because they detect real backdoors, whereas weak monitors disagree because they are wrong on different items, making weak-pool diversity substantially noise.Agreement rises steeply through the weak range and then plateaus.
  • 3.2 The diversity metric fails because its two components cancel: +0.05: Across 276 monitor pairs, pairwise agreement essentially does not predict panel gain over the best member.This is the metric panels are built by minimising, so low agreement does not reliably identify useful ensembles.
  • 3.2 The diversity metric fails because its two components cancel: −0.25 versus +0.26: Signal agreement and error agreement predict panel gain in opposite directions, while their sum predicts it at +0.05.The decomposition models scores as shared detectability plus idiosyncratic error; the composite is closer to zero than either component in 7 of 8 evaluations.
  • 3.2 The diversity metric fails because its two components cancel: +0.53: Signal agreement rises with pair skill, while error agreement remains flat at −0.006 and non-monotone across quartiles.This explains why skilled monitors agree through shared detectability and weak monitors exhibit apparent diversity from error.
  • 3.2 The diversity metric fails because its two components cancel: +0.72 and +0.42: The signal–skill relationship survives estimating detectability from a disjoint half of the monitor pool.The error–skill relationship is unstable at n = 66 per half and takes both signs, so the precise error estimate is not claimed.

3.3 Lineage moves neither detection nor, in a large enough pool, the metric

Cross-lineage partners neither improve detection nor produce a significant agreement-metric difference in the pooled evaluations. The strongest-monitor slice is inconclusive, while an all-row capability comparison yields a −0.021 cross-minus-same difference (p = 0.042).

  • Lineage moves neither detection nor, in a large enough pool, the metric: Neither lower agreement nor higher panel detection for cross-lineage monitors is measurable here.The proposed complementarity test requires both less agreement and better panel detection than same-lineage monitors.
  • Lineage moves neither detection nor, in a large enough pool, the metric: −0.0084 pAUC: Cross-lineage partners detect no better than same-lineage partners when matched on validation capability.The monitor-level lineage permutation gives p = 0.13, with null 95% interval [−0.012, +0.010].
  • Lineage moves neither detection nor, in a large enough pool, the metric: 0.064: Same-lineage pairs agree more than cross-lineage pairs, but the monitor-level permutation is nonsignificant (p = 0.18).Per-attacker gaps span +0.040 to +0.098, while 87% of the gap lies in error (+0.055, p = 0.12) versus +0.008 in signal.
  • Lineage moves neither detection nor, in a large enough pool, the metric: −0.021: The cross-minus-same agreement difference for above-median anchors minus below-median anchors is significant under a monitor-level permutation (p = 0.042).This comparison uses 1026 and 912 rows; slicing only to the strongest monitors has 3 rows and 2 anchors and resolves nothing.

3.4 Correlation structure is a property of the pool

Correlation-structure results depend on which monitors populate the pool: adding capable monitors changed an apparent lineage effect from significant to null. More broadly, ensemble-diversity quantities can shift substantially between weak and competent pools, while ensemble advantage shrinks as panel skill improves.

  • Pool dependence: Changing the monitor pool invalidated two project results, including an earlier lineage-null finding from this work.The paper emphasizes that both invalidations arose from changing which monitors were included.
  • Panel skill: Ensemble advantage shrinks as the monitors composing a panel become better.Figure 3 reports panel gain over the best single member by quartile of mean panel skill.
  • Pool dependence: +0.104 same-minus-cross agreement gap at p = 0.037 on the 22-monitor pool became +0.064 at p = 0.18 after adding two monitors.The added monitors were Mistral-Small-24B at pAUC 0.407 and OLMo-2-32B at 0.166.
  • Mechanism: Same-lineage agreement changed little, from 0.247 to 0.232, while cross-lineage agreement rose from 0.142 to 0.168 after adding competent monitors.The mechanism is that agreement tracks skill, so a competent monitor in a new lineage agrees more with other lineages.
  • General caution: Every ensemble-diversity quantity depending on pool correlation structure can move by a factor of three between weak and competent pools.The passage cautions that weak-pool nulls do not establish claims about deployed monitors, and effects can lose significance when a lineage gains a competent member.

3.5 Ensemble gain falls as pool skill rises

Ensemble gain declines monotonically as pool skill rises, falling from −0.013 to −0.175 at k = 2 and from −0.032 to −0.287 at k = 3. Gain remains negative throughout this pool, so panels never beat their best member, though part of the decline is mechanical.

  • 3.5 Ensemble gain falls as pool skill rises: −0.013 to −0.175 at k = 2 and −0.032 to −0.287 at k = 3: gain falls monotonically across skill quartiles.The corresponding Spearman correlations are −0.66 and −0.70.
  • 3.5 Ensemble gain falls as pool skill rises: Gain is negative throughout, so an unselected panel never beats its best member in this pool.This is consistent with majority vote beating the best member in 9.98% of canonical size-3 subsets and 1.27% pooled over sizes 2–4.
  • 3.5 Ensemble gain falls as pool skill rises: Part of the decline is mechanical: stronger panels have stronger best members, creating a higher bar to clear.This caveat does not change the direction of the observed relationship.

3.6 What still beats every ensemble we built

The best single monitor or prompt variant matches or exceeds every ensemble under the paper’s strict best-member baseline, although panels show gains against a weaker single baseline. Prompt choice can matter nearly as much as monitor choice among weaker monitors.

  • Baseline-dependent ensemble gains: 52% relative gain separates the best prompt-only panel at 0.226 from the baseline prompt variant at pAUC 0.149.The apparent within-model mean loss of −0.032 at k = 2 uses the panel’s own best member, a stricter baseline than a single baseline monitor.
  • Prompt choice versus monitor choice: 3.3× is the pAUC spread from prompt choice on fixed weights, versus 5.4× across weaker monitors spanning 0.036 to 0.193.Among monitors below the competence threshold, prompting is therefore worth about as much as monitor selection.

3.7 No correlation-weighted selection beats the best single monitor · 3.8 Everything replicates across attackers

Correlation-weighted panel selection does not improve out-of-sample detection over skill-only selection, while the main findings replicate across attackers. Agreement rises with skill in five of six evaluations, panel gain declines with pool skill in all six, and signal/error cancellation holds in five.

  • 3.7 No correlation-weighted selection beats the best single monitor: No positive λ reliably improves out-of-sample panel selection when panels optimize capability − λ agreement.Panels are selected on single-attacker data and evaluated on an unseen six-attacker set.
  • 3.7 No correlation-weighted selection beats the best single monitor: 0.723 is the out-of-sample pAUC for k = 3 from λ = 0 through λ = 1.The value falls to 0.440 at λ = 4 and 0.068 under pure diversity selection.
  • 3.7 No correlation-weighted selection beats the best single monitor: 0.440 is the k = 3 out-of-sample pAUC at λ = 4, versus 0.068 under pure diversity selection.This contrasts with the flat 0.723 result from λ = 0 through λ = 1.
  • 3.8 Everything replicates across attackers: ρ = +0.39 to +0.85 for agreement rising with skill in five of six attacker evaluations.GPT-4 is the exception, with n = 57 and p = 0.06.
  • 3.8 Everything replicates across attackers: ρ = −0.58 to −0.67 for panel gain falling with pool skill in all six attacker evaluations.This replication covers every attacker evaluation reported in the passage.
  • 3.8 Everything replicates across attackers: The signal/error cancellation of §3.2 holds in five of six attacker evaluations.The passage also reports that monitor skill is nearly invariant to who wrote the backdoors.

4 Implications

The implications are that monitor diversity is most abundant among weak monitors, while competent monitors converge and leave less exploitable complementarity. Average pairwise correlation is therefore a poor selection target; prompting a competent monitor well is better supported than adding another lineage.

  • Implications: Weak monitors offer abundant diversity but poor absolute detection, whereas deployable monitors converge and provide less diversity to exploit.This pattern does not contradict prior ensembles beating their single monitors.
  • Implications: Average pairwise correlation combines error and signal terms with opposite associations to ensemble gain, so selecting on the error component alone does not improve out-of-sample panels.The error-only substitution was tested at both panel sizes and matched skill-only selection.
  • Implications: More than 3× detection movement came from prompt choice on fixed weights, while adding a lineage bought neither decorrelation nor detection.The passage recommends investing first in prompting a competent monitor well and checking which monitors formed any pool behind a published diversity number.

5 Limitations

The study’s conclusions are limited to one backdoored-code task family, an estimator with a stated operating range, and open-weight monitors up to 32B. Null lineage effects also leave smaller benefits unresolved, while frontier-scale monitor behavior remains untested.

  • Task scope: The evaluation covers one dataset, one YES/NO decision-log-odds scoring method, and backdoored competitive-programming solutions; sabotage in long-horizon agent trajectories remains untested.Varying attackers across six models tests who wrote the sabotage, not what kind of sabotage it is.
  • Statistical power: With one to six monitors per lineage, the study excludes a cross-lineage detection benefit roughly the size of one attack item, but not smaller effects.At about 128 attacks per attacker slice, one item moves normalised pAUC@10% by around 0.008; the matched-partner permutation-null interval is [−0.012, +0.010] pAUC.
  • Measurement limits: The signal/error decomposition depends on leave-out consensus as an item-detectability estimate and fails when that consensus contains no competent monitors.The consensus is therefore a measurement device with a stated operating range, not a general-purpose estimator.
  • Model scale: All monitors are open-weight models of at most 32B, so whether the agreement–skill relationship continues into frontier-scale monitors remains untested.The paper claims ensemble headroom shrinks as monitors improve, while deployed trusted monitors sit above the study’s top range.

6 Related work

This work directly extends Koran et al. (2026) by varying axes held fixed in its single-base-model design, while related studies vary monitored-model families or audit diversity metrics. The paper distinguishes its monitor-lineage manipulation from Pinto (2026)’s monitored-model-family manipulation.

  • Related work: Koran et al. (2026) is the direct antecedent and supplies this paper’s data, metric, prompt, and scoring design.This paper varies axes that Koran et al.’s single-base-model design holds fixed.
  • Related work: Pinto (2026) varies the family of the monitored model with a trained monitor, whereas this paper varies the lineage of the monitors themselves.Pinto (2026) also finds a real own-family interaction, consistent with this paper’s findings.
Loading 2608.16190v1…