Screwtape: Adversarial Trajectory Editing for Monitoring Red-Teaming
Screwtape: Adversarial Transcript Editing for Monitor Red-Teaming
Redwood Research proposes Screwtape, an attack pipeline that rewrites real agent trajectories turn by turn to bypass action-only monitoring, with an LLM verifier judging whether the attack is real, harmful, and feasible. The team used their own agent monitoring based on Opus 4.8 and Gemini 3.1 Pro, ran 252 runs on 94 unique trajectories, and obtained 35 attacks that bypassed their own monitoring, 6 of which also bypassed a frontier developer's held-out monitoring and were confirmed by manual review. The authors state that this pipeline is better suited for patching monitoring blind spots than for providing quantitative safety estimates, and they are not releasing the implementation for now.
Screwtape iteratively attacks monitoring by rewriting real agent trajectories. The authors compare it on the same trade-off axis as synthetic environments, simulated environments, and human red teaming, and explain that it is better suited for patching monitoring blind spots than for quantifying safety.