Simple Features Beat Most AI Control Monitors
Shubhrangshu Debsarkar and Valmik Nahata (University of Virginia, UC San Diego) show that the standard AI control dataset of honest versus backdoored code can be separated by simple features without running the code, which outranks 20 of 24 open-weight models prompted as monitors.
Ask this paper
Label leakage. People wrote the honest solutions and older models wrote the backdoors, so code style reveals the class. Problems that LLMs can backdoor also differ in basic characteristics.
Author contrast. Replacing one class with Claude Sonnet 5 code shows the features reward the contrast between authors. Human code against Sonnet 5 backdoors separates at 0.95, against 0.79 for the original pairs.
Invalid items. One in seven backdoors in the standard test set fails validity checks, which distorts attacker comparisons.
Monitor gap. A Sonnet 5 monitor appears to catch 77% of older models' backdoors but 37% of Sonnet 5's, and 78% against 61% once both sets are verified. The rebuilt dataset and checks are released.
Abstract
AI control relies on monitors to catch a capable model that sabotages its work. These monitors are evaluated on their ability to differentiate honest from backdoored code. We show that on a standard evaluation dataset, simple features beat most monitors without ever running the code, outranking 20 of 24 open-weight models prompted as monitors. The dataset gives its labels away in two ways. People wrote the honest solutions and older language models the backdoors, so the style of the code reveals the class. Additionally, problems that LLMs can backdoor have different characteristics, so basic facts about the problem reveal it too. Swapping one class at a time for code by Claude Sonnet 5 shows that these features reward a contrast between authors, since human code against Sonnet 5's backdoors is easier to separate than the original pairs, 0.95 against 0.79. One in seven backdoors in the standard test set fails our validity checks, which distorts comparisons between attackers. A Sonnet 5 monitor appears to catch 77% of the older models' backdoors but 37% of Sonnet 5's, and 78% against 61% once both are verified. We do not show that published monitors rely on these shortcuts, but our findings suggest that a high score on such a dataset is not by itself evidence of sabotage detection. We release the rebuilt dataset and checks.