Simple features outperform most AI control monitors
Simple Features Beat Most AI Control Monitors
Quick read
Based on the paper's full text (AI-generated); refer to the original
The researchers found that on the standard APPS backdoor dataset, a simple classifier that does not run code scored higher than 20 of 24 open-weight monitoring models. The bag-of-words classifier had an AUROC of 0.806, the median of the monitoring models was 0.610, and a classifier reading only problem metadata scored 0.766. The authors point out confounds in the dataset: honest solutions were written by humans and backdoors by older models, so code style alone can distinguish the classes; after replacing one class with code from Claude Sonnet 5, AUROC rose from 0.79 to 0.95. Of the 172 labeled backdoors in the standard test set, 17 contain only trigger inputs that violate the problem constraints, and another 7 fail the public tests. The authors recommend that monitoring benchmarks report a no-code-execution baseline, pair across authors, and validate trigger inputs, and they release the reconstructed dataset and scripts under the MIT license.
- AI control uses a monitor to distinguish honest code from backdoored code, but in the standard APPS backdoor dataset the honest solutions are written by humans and the backdoors by a language model, so there is confounding between classes such as author style and problem metadata, and a high score does not necessarily mean it can actually detect sabotage.
- The authors train two classifiers—one using only bag-of-words and one using only problem metadata (no-code)—as floors, and compare them with 24 open-source monitors; then they use Claude Sonnet 5 or Haiku 4.5 to simultaneously write both types of code to reconstruct the pairing, and replace the authors class by class, to test whether the classifiers' advantage comes from the author comparison.
- Bag-of-words achieves AUROC 0.806 on the standard split, exceeding 20 of the 24 monitors; the no-code classifier reaches 0.766 within the split and also exceeds 20. Class-by-class replacement shows the highest scores when the two types of authors differ (person/Sonnet 5 is 0.953, versus 0.789 for the original pairing). Of the 172 backdoors in the standard test set, 24 fail the validity check; after correction, the gap in capture rate between the Sonnet 5 monitor on old models' backdoors and on its own backdoors drops from 0.40 to 0.17.
- A high floor only shows that the labels are predictable; it does not prove that published monitors rely on these shortcuts. Only two zero-shot monitors were run, the backdoors come from a single prompt, the working-backdoor results are based on only 54–99 problems and one attack model, and the 2% threshold is based only on the top two of 99 honest programs. The authors suggest running a legitimacy check at generation time, and call for benchmarks to report a baseline that does not run the code, cross-author pairing, and trigger legitimacy checks.
On the APPS backdoor benchmark, the paper's two baselines—bag of words and problem metadata—outperform 20 of 24 monitoring models, and it provides reusable benchmark self-check items.