PaperlayerView exact revision on arXiv

Source-linked AI summary

ObserverBench: Testing Mechanistic Estimates for Intervention and Control

Vijay Erramilli

arXiv:2609.03026v1cs.LGcs.AI

TL;DR

An internal estimate can be accurate on average yet lead to a poor intervention or safety decision, so estimation accuracy alone is not enough to evaluate it. ObserverBench fixes the task conditions and reports prediction quality separately from the loss of the action chosen. Across its operational tasks, better prediction or classification does not necessarily mean better decisions, and the best information source can vary by model.

  • Problem

    Interpretability estimates increasingly guide interventions and safety decisions, but statistical accuracy alone does not establish whether an estimate is adequate for the action it directs.

    Source: §1 · p. 1

  • Method

    ObserverBench defines fixed, reusable tasks with explicit decision conditions and evaluates both observer prediction quality and held-out loss from its chosen action.

    Source: §1 · pp. 1–2

  • Results

    Across control and safety tasks, better mean-effect prediction or perfect classification does not necessarily yield better actions, and the lowest-loss information context varies across models.

    Source: §1 · p. 2, §8 · p. 21

  • Takeaways & Limitations

    Observer adequacy is task-relative: an estimate need only preserve information used by the available action, decision rule, and loss.

    Source: §8 · p. 21

    The APPS study uses one stored-backdoor task rather than attacks adapted to each monitor, and neither study tests deception or an adaptive attacker.

    Source: §7 · p. 21

Abstract

from arXiv · show

Mechanistic interpretability is increasingly used to guide interventions such as activation steering, circuit removal, and safety monitoring. Yet an internal estimate that is accurate on average can still choose a poor action. We present ObserverBench, a benchmark framework for testing whether an internal estimator---an observer---is adequate for the intervention, control, or safety task it directs. Each task fixes the model, information boundary, allowed actions, decision rule, held-out cases, and loss. The benchmark reports estimation accuracy separately from the loss caused by the chosen action. Theory and experiments show why both are needed. In closed-loop control, observer errors matter at the starting point and along directions the allowed intervention can reach. On circuit-intervention tasks in GPT-2-small and Qwen2.5-7B, pairwise observers predict unseen effects more accurately without always choosing better actions; observers trained on action loss choose lower-loss actions. In safety triage, a score that perfectly separates violations can allocate a fixed intervention budget poorly when violations have different costs. Across Qwen2.5-7B, Gemma-2-9B-it, and prospectively frozen Qwen3.5-9B APPS tasks, AUROC can rank monitors differently from deployment loss, and the best information source changes across models. Sparse SAE readouts also trail their layer-matched dense controls on the reported Qwen panels, under disclosed activation-density or checkpoint mismatches. ObserverBench provides fixed task contracts, runnable baselines, and table-based submissions for evaluating interpretability methods through the actions they enable.

1 Introduction

As interpretability estimates increasingly guide interventions and safety decisions, ObserverBench asks whether an observer is adequate for the particular action it directs. It fixes each task’s decision conditions and reports prediction quality separately from the loss of the chosen action.

1 Introduction

  • ObserverBench separates the observer’s estimate, the controller’s action choice, and the intervention the controller may take, evaluating adequacy for that decision.Each task fixes the model, observer information, interventions, controller, measurement budget, held-out cases, and loss; the evaluator reports prediction accuracy and chosen-action loss separately.Source: §1 · pp. 1–2
  • ObserverBench evaluates the operational decision problem, complementing methods that recover internal mechanisms and effect maps.For safety tasks, it freezes the audit policy and compares monitors within it; this is distinct from testing whether a complete protocol withstands an adaptive model.Source: §1 · p. 2
  • Task-relative adequacy depends on the target, information and integrity boundary, action space, decision rule, loss, and operating regime.Versioned task and observer cards support local implementations and table-based submissions under a common evaluator.Source: §1 · p. 2
  • 18.5% lower GPT-2 action loss in the clean confirmation and 8.9% lower Qwen aggregate loss show that direct-loss training can improve decisions over the same-feature mean observer.Pairwise observers predict held-out effects more accurately, but do not always choose better actions; a sparse Qwen SAE readout also incurs more escaped attacks than its dense control.Source: §1 · p. 2
  • A label observer with AUROC 1.000 can allocate a fixed safety-intervention budget poorly, and AUROC can reverse the ranking of monitors by realized violations.Across Qwen2.5-7B, Gemma-2-9B-it, and prospectively frozen Qwen3.5-9B tasks, residual observers lead on average, but the lowest-loss information context changes across models and checkpoints.Source: §1 · p. 2

2 How ObserverBench evaluates an observer

ObserverBench makes observer comparisons meaningful by fixing the decision problem and applying a common evaluation to each submission. Its workflow reports prediction quality, action loss, and access or measurement cost rather than collapsing different operational tasks into one ranking.

2 How ObserverBench evaluates an observer

  • A fair observer comparison holds the decision problem fixed, since changes in loss could otherwise reflect a different controller, action set, or test distribution.The task card fixes training measurements, held-out cases, budgets, and clean-performance checks before observers are compared.Source: §2 · p. 3
  • Observers may use any method within the task’s information and integrity boundary, with their inputs, fitting, model access, and known failure conditions recorded.For control tasks, submissions declare whether they replace the state estimate, edit direction, or both.Source: §2 · p. 3
  • Every observer receives the same held-out cases, controller, actions, budgets, and loss; the scorecard reports prediction quality, downstream action loss, and access or measurement cost.A submission can be a local implementation or a table of predictions or scores for released cases.Source: §2 · p. 3
  • ObserverBench’s operational modes pose different questions, and its scorecards identify which observer is better for a declared use rather than assigning one overall rank.The modes share a task-relative comparison contract.Source: §2 · p. 3, Table 1 · p. 3
  • Evaluation rules separate construction from held-out testing, check clean base-task performance, and require measurements to exercise the effects being compared.The score should target the quantity the controller actually uses, such as mean-effect prediction, prompt-level intervention loss, or consequence-weighted safety risk.Source: §2 · p. 3

3 Closed-loop control: what an observer must preserve

For closed-loop control, an observer need not match the target everywhere: it must preserve the information that can affect states reached by allowed interventions. The section derives a finite-horizon error certificate and tests its predictive value in a nonlinear Transformer experiment.

3 Closed-loop control: what an observer must preserve

  • For an affine target and observer, adequacy on the reachable set requires matching at the starting state and along allowed edit directions; errors orthogonal to those directions cannot affect the controller.With one fixed direction, the required coefficient match is only along that direction.Source: §3 · p. 4

3.1 Why a convergent observer can still miss the target

  • A convergent observer can still miss the target: convergence controls reported error, while starting-state mismatch and target–observer response mismatch remain in the finite-horizon error.When pT is nearly zero and m0 = 0.2, the observer reports success while the true target remains off by about 0.2, before response mismatch is counted.Source: §3.1 · p. 5

3.2 A simple control certificate remains predictive in a Transformer

  • The experiment edits a residual after block 0 and reruns the learned suffix, comparing first-order and pairwise estimator–direction pairs across interactional and additive targets.It uses 12 independently trained models per target family and measures integrated squared tracking error across the trajectory.Source: §3.2 · p. 6
  • In the learned nonlinear suffix, the certificate terms remain predictive across the checked operating range, but this does not establish local linearity of the suffix or activation manifold.At the largest offsets, mean deviation from the affine prediction is 16.1% of output movement, and certificate residual is 20.2% of mean absolute final error.Source: §3.2 · p. 6
  • The full certificate correlates 0.952 with actual final error, gets the sign right in 96.0% of conditions, and has residual MAE equal to 16.5% of mean absolute actual error.With an intercept and slope fitted on the other 11 seeds, leave-one-seed-out MAE is 0.063, versus 0.302 for the bias-only model and 0.367 for the observer-pole-only model.Source: §3.2 · p. 6
  • The exact control results assume affine readouts, one fixed direction, proportional control, and no clipping; the nonlinear test uses a small model with known binary features.The work does not establish token-level or large-model control, and the reported gain applies to the matched estimator–direction pair.Source: §3.2 · pp. 6–7
  • 29.0% lower integrated squared tracking error for the pairwise estimator–direction pair on the interactional target, with improvement in 11 of 12 models; it has no reliable advantage on the additive target.The gain belongs to the matched estimator–direction pair, not the estimator alone.Source: §3.2 · p. 6, Table 3 · p. 7, Figure 1 · p. 7

4 Effect prediction: better estimates need not choose better actions

ObserverBench separates intervention-effect prediction accuracy from the loss of the action an observer selects. In the supplied GPT-2-small and Qwen2.5-7B studies, pair terms improve held-out effect prediction, but better prediction does not guarantee better actions; observers trained on realized loss choose lower-loss interventions in frozen aggregates.

4.1.1 A fixed test of effect prediction and action selection

  • GPT-2-small observers used the same calibration masks and chose one fixed mask per action pool and target for every held-out prompt.The audit corrected an earlier metric that allowed outcome-informed prompt-specific choices before validation or test outcomes were opened.Source: §4.1.1 · pp. 8–9

4.1.2 Interaction terms improve mean-effect prediction

  • At 160 measurements, GPT-2-small’s all-pairs observer lowered candidate-mask MAE to 0.395 from 0.486 for per-head additivity and 0.473 for count additivity.The improvement held in all ten pools and at budgets 40, 80, and 160; the 20-measurement fit was underdetermined, and the P × E and all-pairs observers were effectively tied (MAEs 0.3940 and 0.3945).Source: §4.1.2 · p. 9

4.1.3 The better mean predictor does not choose a better action

  • At budget 160, the all-pairs model had the best R2 and nearly the best mean-effect MAE, but action-loss reductions were only 0.10% and 2.34%, with paired intervals crossing zero.Even perfect knowledge of each mask’s test-set mean chose the lowest-loss mask in only 3 of 30 pool–target cells; its loss was 0.927, compared with 0.749 when full prompt-level action loss was known.Source: Table 5 · p. 9, §4.1.3 · pp. 9–10

4.1.4 Predict the loss used to choose the action

  • The pilot-informed direct-loss observer reduced action loss from 1.076 to 0.833, a 22.6% reduction, but that test omitted exact no-op and failed its baseline task check.No-op loss averaged 0.750, below the direct-loss observer; the result therefore supports better ranking among forced nonempty actions, not improvement over no-op.Source: §4.1.4 · p. 10

4.1.5 At a one-logit target, direct loss beats the mean observer and exact no-op

  • At t = 1, direct-loss selection reduced action loss by 18.5% versus the same-feature mean observer and 10.9% versus exact no-op, with both paired intervals excluding zero.The direct-loss observer had a worse mean-to-target term (0.397 vs. 0.286) but a lower dispersion penalty (0.494 vs. 0.807); it beat the mean observer on all eight templates and no-op on six.Source: Table 7 · p. 11, §4.1.5 · p. 11
  • Across screened targets, direct-loss selection beat both mean-based controls, but at t = 0.5 its loss was 46.2% higher than exact no-op; it beat no-op at t = 1 and t = 1.5.This post-confirmatory sensitivity analysis had no success gate, and the negative no-action result at t = 0.5 was retained.Source: Table 8 · p. 11, §4.1.5 · p. 12

4.2.2 Held-out interventions confirm the eight-head panel

  • For prompts where the model already distinguishes the planted value from two distractors, held-out interventions showed selected heads lowered candidate margin more than matched controls across 256 confirmation prompts, with the paired interval excluding zero.The task does not test unconstrained generation.Source: §4.2.1 · p. 12, §4.2.2 · p. 13

4.2.3 Pair terms and direct loss improve held-out performance

  • On Qwen2.5-7B, the pairwise observer improved held-out-mask MAE over the additive observer at 128 measurements, with the paired interval excluding zero.The improvement also held at every smaller nested budget, but the 16-measurement fit had more coefficients than measurements and was descriptive.Source: §4.2.3 · p. 13
  • Direct loss lowers aggregate loss by 8.9% versus natural mean, 12.6% versus transformed mean, and 49.6% versus no-op.These aggregate results weight the three targets equally.Source: Table 9 · p. 13, §4.2.3 · p. 13
  • At the largest target, natural mean and direct loss tie within uncertainty: natural-minus-direct loss is −0.008, with interval [−0.038, 0.021].Appendix Table 17 reports results separately for each target.Source: §4.2.3 · p. 14
  • On 512 matched non-induction continuations, direct loss has no larger clean-to-intervened KL than natural-mean or transformed-mean controls: 0.0115 versus 0.0157 and 0.0160.The passage explicitly cautions that this secondary check is not a general safety result.Source: §4.2.3 · p. 14
  • Pair terms improve held-out effect prediction, and realized-loss-trained observers choose lower-loss interventions across GPT-2 and the bounded Qwen task.The Qwen finding is limited to one pinned model, eligible prompts, the confirmed eight-head panel, and the declared masks; it neither identifies a complete induction circuit nor establishes general in-context learning.Source: §4.2.3 · p. 14

5 Safety triage: scores must guide scarce interventions

Safety triage evaluates whether monitors allocate scarce interventions according to consequence under fixed task contracts. Results show that classification and AUROC alone do not determine deployment loss, and useful information sources vary across models and operating regimes.

5 Safety triage: scores must guide scarce interventions

  • The safety tasks keep measurement views fixed and trusted, so they do not test whether a monitor survives an attacker who adapts to being watched.A channel that works against frozen attacks may fail after attackers learn it is monitored.Source: §5 · p. 14, §5.2 · p. 17

5.1 A perfect classifier can allocate a safety budget poorly

  • Severity-weighting cut mean policy loss 32.1% versus action-only and 57.0% versus allowing every request, while the label observer’s AUROC 1.000 still yielded loss 3.334.Severity-weighting closed 71.1% of the action-only-to-oracle gap while preserving benign utility.Source: Table 11 · p. 15, §5.1 · p. 15
  • Across operation–format groups, a global threshold sent 63.2% of interventions to seen-form deletes but only 18.4% to the doubly held-out group, where activation loss was 5.007 versus 3.059 for action-only.The activation label had AUROC 1.000 within every subgroup, but its score scale shifted between them; the split lacked held-out cases for testing recalibration.Source: Figure 2 · p. 16, §5.1 · p. 16

5.2 Monitor rankings depend on the model and operating regime

  • On Qwen2.5-7B APPS, neutral activations reached AUROC 0.979; at 1% attacks and a 2% audit budget they missed 2.65 attacks on average, versus 9.05 for text.The balanced panel hid some action differences; the prevalence and budget sweeps show why monitors should be compared in the intended operating regime.Source: Table 12 · p. 17, §5.2 · p. 17, Figure 3 · p. 18

5.2.1 A matched Gemma replication changes the mean ranking

  • On Gemma-2-9B-it, the detailed prompted monitor had higher AUROC than the Gemma Scope SAE probe, 0.893 versus 0.870, but more mean realized violations, 10.803 versus 9.070.Residual access had the lowest mean loss, but the best measured context was verdict-adjacent on Gemma and neutral on Qwen.Source: Table 13 · p. 18, §5.2.1 · pp. 18–19

5.2.2 Qwen3.5 reverses the Qwen2.5 context ranking

  • On Qwen3.5-9B, verdict-adjacent residuals averaged 4.625 fewer violations than neutral residuals, reversing Qwen2.5’s context ranking; the useful context can change between checkpoints.The official SAE probe averaged 12.725 violations versus 6.601 for the dense neutral residual, but used a Base-trained SAE on the post-trained model.Source: Table 14 · p. 19, §5.2.2 · p. 19

5.3 Four checks before claiming that an internal safety signal helps

  • Before crediting an internal safety signal, test output and input baselines, neutral-context persistence, and performance under the intended policy, attack rate, budget, groups, and loss.These checks locate where useful information becomes available; they do not establish deception, intent, or hidden knowledge.Source: §5.3 · pp. 19–20

6 Related work

ObserverBench evaluates estimates through the declared intervention or controller they guide, complementing benchmarks that test other interpretability capabilities.

Interventions, steering, and interpretability benchmarks

  • Unlike benchmarks for localization, concept detection, or known-structure recovery, ObserverBench starts from an estimate and tests whether it improves the action under a fixed policy.For sparse probing, it asks whether a compact fitted readout improves the action, not only whether SAE features support a predictor.Source: §6 · p. 20

Decisions and AI control

  • Decision-focused learning evaluates predictors through downstream decisions, while ObserverBench holds the controller, audit rule, budget, and test cases fixed to compare observers.This component-level evaluation does not establish end-to-end robustness to subversion.Source: §6 · p. 20

Borrowed testbeds

  • The IOI and induction-head systems supply borrowed structures for defining interventions; the evaluation uses fresh held-out masks and prompts rather than claiming new mechanisms.The Qwen2.5-7B task provides a second model surface.Source: §6 · p. 20

7 Limitations and next steps

The paper bounds its claims by the assumptions, models, tasks, and evaluation settings tested, and identifies broader tests as next steps.

Control

  • The exact control results assume affine readouts, one fixed direction, proportional control, and no clipping; the nonlinear test uses a small Transformer with known binary features.The reported 29.0% gain belongs to the matched estimator–direction pair, not the estimator alone.Source: §7 · p. 20

Pretrained-model interventions

  • The pretrained-model studies use pinned models, selected head sets, fixed ablations, and narrow prompt distributions; the IOI confirmation was pilot-informed rather than independently preregistered.The Qwen task filters prompts, and the direct-loss observer ties the natural-mean observer at the largest target.Source: §7 · p. 20

Authorization safety

  • The authorization task asks Qwen directly for a verdict and cannot test harmful execution, deception, or adaptive attacks; one global threshold also exposed poor cross-group calibration.The proposed next test removes the explicit verdict question and provides calibration data for each intended deployment group.Source: §7 · p. 21

APPS backdoors

  • The APPS work uses one stored-backdoor task, offline scoring, fixed dataset-family mixes, and non-adaptive attacks; its SAE comparisons are limited to one task and probing rule.The Qwen3.5 SAE was trained on the Base checkpoint, not the evaluated post-trained checkpoint; full AI-control safety under subversion remains untested.Source: §7 · p. 21

Artifact

  • The release provides checked control, finite-effect, and safety interfaces, but is not yet a general task ecosystem.Next steps include literature baselines, another safety environment with adaptive attacks, and a stable end-to-end reproduction path.Source: §7 · p. 21

8 Conclusion

ObserverBench evaluates whether an estimate preserves what a declared action, decision rule, and loss use, rather than ranking observers in the abstract.

8 Conclusion

  • Across the three modes, better mean-effect prediction need not yield a better intervention, perfect classification can misallocate a safety budget, and accessible output signals can make internal probes unnecessary.AUROC and mean realized violations can rank monitors differently, and the best measurement context can change between closely related checkpoints.Source: §8 · p. 21

A Artifact interfaces and sealed evaluation

ObserverBench provides versioned interfaces and task-specific evaluation routes for control, finite-effect prediction, and safety triage. Sealed targets and fixed contracts support comparable evaluation, while the appendix retains checks that qualify the main results.

A Artifact interfaces and sealed evaluation

  • Three versioned interfaces cover control composition, held-out finite-effect prediction, and safety triage, with schemas, examples, and validation commands supplied in the repository.Version identifiers prevent results produced under different contracts from being compared silently.Source: A Artifact interfaces and sealed… · p. 24
  • For analytic control, the checked external-observer adapter fixes the controller and task components; replacing the controller produces a non-comparable score.The wrapper reuses the task’s fixed generator, readouts, normalization, and metrics.Source: A Artifact interfaces and sealed… · p. 24
  • Public safety packs disclose the threat model, actions, losses, budgets, training measurements, and held-out queries, while evaluator targets remain separately stored and sealed.A cryptographic hash links the targets to the public pack; data-only safety tasks can be added without changing the core workbench.Source: A Artifact interfaces and sealed… · p. 24
  • Finite-effect registries provide frozen measurement tables, enforce model and split records, and let outside observers submit predictions without rerunning intervention experiments.The GPT-2 IOI and Qwen induction-copy registries include per-component and additive ridge observers as comparison rows.Source: A Artifact interfaces and sealed… · p. 24
  • APPS scorecards evaluate prompt, output, text, dense-residual, and SAE-feature observers within separate Qwen2.5-7B, Gemma-2-9B-it, and Qwen3.5-9B panels, without issuing a cross-model rank.The Qwen3.5 release includes a frozen source manifest and checked aggregate summary, while per-example evaluator labels remain sealed.Source: A Artifact interfaces and sealed… · p. 24
  • Run records include contract and result-schema versions, component and dependency details, configuration and result hashes, and submitter-supplied observer provenance.Runs use strict JSON.Source: A Artifact interfaces and sealed… · p. 24

B Robustness checks and protocol provenance

  • The appendix retains checks that directly qualify the main results, while superseded control fixtures and unsupported development history remain with the artifact.The latter material is excluded from the paper.Source: B Robustness checks and protocol… · p. 24

B.1 Nonlinear estimator–direction robustness

The nonlinear-suffix robustness table crosses estimator and direction choices, but its diagnostic failures limit what the comparison can establish.

B.1 Nonlinear estimator–direction robustness

  • Table 15 reports a secondary nonlinear-suffix estimator–direction factorial, with seed-level means and rollout-condition counts summarized by column.The table covers all four estimator–direction combinations behind Sec. 3.2.Source: §B.1 · p. 24, Table 15 · p. 25
  • At γ = 1.15, crossed arms fail loop-conditioning and clean-archetype scale diagnostics, so they do not identify an estimator-only advantage.The clean maximum serves as a scale check, not a manifold boundary.Source: Table 15 · p. 25
  • The clean maximum should be read as a scale check rather than as a manifold boundary.Source: Table 15 · p. 25

B.2 IOI interaction robustness

Across these robustness and protocol checks, the reported action-loss gains are qualified by target-level variation, while measurement-budget and selection checks clarify the scope of comparisons.

B.2 IOI interaction robustness

  • Table 16 reports the full nested-budget curve for the IOI interaction comparison, with fresh held-out mean-effect MAE by measurement budget.The provided passages do not state the table’s cell values.Source: Table 16 · p. 25, §B.2 · p. 25

B.3 Protocol provenance

  • After expanding the source seal, two IOI measurement copies were byte-identical; only the second entered analysis, and transformed-mean control retained negative predicted losses in 44, 44, and 16 pools across targets.Direct loss produced negative predicted losses in 4, 0, and 0 pools; scores were not clipped after outcomes were observed.Source: §B.3 · p. 25
  • Qwen Copy-v1 failed its frozen 95% candidate-accuracy gate at 92.97% before attention or intervention outcomes were computed, so Copy-v2 used fresh tokens and prompts under the same gate.The locked results use Copy-v2.Source: §B.3 · p. 25

B.4 Authorization tail-loss selection

  • Selecting the activation observer by tail loss chose the same layer and ridge setting as mean-loss selection, but its tail-loss difference from action-only was 0.039 with paired 95% interval [−1.013, 1.156].The authors retain the mean activation gain but do not claim a tail-loss gain over action-only.Source: §B.4 · p. 25

B.5 Qwen action loss by target

  • Direct loss beats transformed mean and no-op at every Qwen target, beats natural mean at the first two, and ties it within uncertainty at the largest.The aggregate result is not a win in every cell; Table 17 reports action loss by target, with gains and bootstrap intervals.Source: §B.5 · p. 25, Table 17 · p. 26

C Post-outcome APPS diagnostics

Post-outcome APPS checks qualify the reported SAE and monitor comparisons by their frozen-panel scope, context differences, and pooled group allocation.

C Post-outcome APPS diagnostics

  • The post-outcome checks use frozen activations and scores after the main result was known and do not change the locked comparison in Table 12.Source: C Post-outcome APPS diagnostics · p. 26
  • Table 18 integrates published methods on the frozen Qwen APPS panel using mean violations from 2,000 resampled populations with 1% attacks and a 2% audit budget.Lower mean violations are better.Source: Table 18 · p. 26
  • The sparse SAE readout uses fewer fitted coefficients but does not improve mean audit loss on the frozen Qwen panel; within 1,301 rows under its training-length limit, AUROC is 0.956 versus 0.983 for the dense residual.Dense minus sparse averages −2.62 escaped attacks, with central 95% outcome range [−6, 0]; the checkpoint’s observed mean L0 is 115 versus the reported 240. The result is limited to this checkpoint, layer, task, and probing rule.Source: C Post-outcome APPS diagnostics · p. 26
  • The fixed calibration rule selected layer 28 for the verdict-adjacent observer, with calibration AUROC 0.935 and locked AUROC 0.953; a post-outcome layer-20 check reached 0.958 but calibration would not have selected it.The neutral layer-20 probe remained higher at 0.979, and this check cannot separate answer position from the monitoring instruction or other context changes.Source: C Post-outcome APPS diagnostics · p. 26
  • Neutral-probe separation remained strong within APPS source families (AUROC 0.956–0.991) and length quartiles (0.974–0.988), but score scales shifted across groups.At a global 2% cutoff, a family’s share of caught attacks was 0.36–2.38 times its population share; across length quartiles the range was 0.67–1.43. These ratios use only 29 audits and are descriptive; Figure 4 shows the grouped scores and cutoff differences.Source: C Post-outcome APPS diagnostics · p. 26, Figure 4 · p. 27

D Qwen3.5 APPS replication protocol

The Qwen3.5 replication holds the APPS task and evaluation setup fixed while prospectively sealing a primary contrast after earlier results were known. The section also explains why a lexical safety fixture was rejected and what controls replaced it.

D Qwen3.5 APPS replication protocol

  • The Qwen3.5 replication keeps the APPS pairs, split, prompts, controller, audit budgets, resampling population, and realized-violation loss fixed while changing the model.The 1,444 pairs are split by problem ID into 500 fit, 200 calibration, and 744 locked-test pairs; thinking is disabled for every Qwen3.5 view.Source: D Qwen3.5 APPS replication protocol · p. 27
  • The primary contrast was sealed before Qwen3.5 monitor outcomes, but the design was chosen after Qwen2.5 and Gemma results were known.The contrast is neutral-residual minus verdict-adjacent-residual mean violations at 1% attack prevalence and a 2% audit budget; the authors call this a local prospective seal, not an independent preregistration.Source: D Qwen3.5 APPS replication protocol · p. 27
  • The replication artifact includes source files and a sealed manifest linking the aggregate scorecard to the exact code and configuration without publishing per-example evaluator labels.Source: D Qwen3.5 APPS replication protocol · p. 27
  • Fit data train probes, calibration selects the layer and ridge value, and the locked test is read only after selection; one overlength fit pair is excluded under the frozen rule.No calibration or locked-test pair reaches the 4,096-token limit.Source: D Qwen3.5 APPS replication protocol · p. 27
  • The SAE control uses base-trained features on post-trained Qwen3.5-9B, so it tests transfer rather than a checkpoint-matched comparison.The authors state this is not evidence that SAE features generally fail for safety monitoring.Source: D Qwen3.5 APPS replication protocol · p. 27

E Why a lexical safety fixture was rejected

  • The lexical fixture was rejected because text baselines solved its small split and removing lexical directions removed the target signal by construction.The setup could not distinguish an internal safety representation from words that revealed the label.Source: E Why a lexical safety fixture was… · p. 28
  • The later authorization study tests a text baseline, varies authorization context while holding the requested action fixed, and compares against an exact policy rule when available.Text, output, and neutral-context controls further check whether a prompt asking directly for a safety verdict leaves a uniquely hidden safety state to establish.Source: E Why a lexical safety fixture was… · p. 28
Loading 2609.03026v1…