TraceGuard: Structured Multi-Dimensional Monitoring as a Collusion-Resistant Control Protocol
This addresses the problem of ensuring safety in AI control protocols for users deploying untrusted AI agents, with incremental improvements in monitoring techniques.
The paper tackles the problem of AI control protocols missing subtle attacks and collapsing to near-zero safety under collusion, by introducing TraceGuard, a structured multi-dimensional monitoring protocol that achieves clear attack-honest separation (Delta=0.410) and constrains collusion to 95% safety vs. 0% for single-score monitoring.
AI control protocols use monitors to detect attacks by untrusted AI agents, but standard single-score monitors face two limitations: they miss subtle attacks where outputs look clean but reasoning is off, and they collapse to near-zero safety when the monitor is the same model as the agent (collusion). We present TraceGuard, a structured multi-dimensional monitoring protocol that evaluates agent actions across five dimensions -- goal alignment, constraint adherence, reasoning coherence, safety awareness, and action-trace consistency -- scored in parallel by independent LLM calls, augmented by seven heuristic detectors and an LLM-based intent analyzer. We evaluate on BashArena (637 bash tasks, 4 attack categories) within the ControlArena framework. Our results on 519 samples (279 honest, 240 attack) show that: (1) the hybrid approach achieves clear attack-honest separation (attack mean 0.616 vs. honest mean 0.206, Delta=0.410); (2) structured scoring constrains collusion -- the untrusted structured monitor achieves 95% safety vs. 0% for single-score untrusted monitoring; (3) goal alignment and constraint adherence are the most discriminative dimensions; and (4) a separation-of-duties variant splitting dimensions across trusted and untrusted models achieves 100% safety while preventing any single model from seeing the full evaluation. TraceGuard is implemented as a new monitor type for the open-source ControlArena framework.