Robustness of neutral internal safety signals to monitor-aware attacks
Determine whether the safety signal obtained from neutral-context residual activations remains effective when an attacker knows that the signal is being monitored and adapts its behavior accordingly.
References
The attack leaves an option-span collapse that may be a detectable tamper, but that defense needs a base-model anomaly reference and an anomaly-aware adversary, which we leave open.
It shows that a useful signal can appear before the model is asked for a verdict. It does not show that the same signal survives once an attacker knows it is being read.
Fully white-box adaptive attacks that optimise directly against the OR-detector (e.g., via gradient-based search over response-region tokens) are an important next step that we leave to future work. Theorem~\ref{thm:barrier_cost} does constrain such an attacker. The kinetic energy an attack must spend scales as $\delta2/((t_2-t_1)\,|M|{\max}\,G{\max}2)$, which leaves three levers. Stretching the crossing interval keeps the gap descending through the window the slope signals integrate, and deferring it past that window turns into late anchoring, which $R_0$ catches because the initial state is unmodified ($t_{\text{inter}{=}32$ below). Exploiting positions where $G_{\max}$ is large means working where refusal and compliance mass are both non-negligible, which is the region the $\Delta E$ slope monitors. Reducing the effective barrier $\delta$ means starting near the barrier, which $R_0$ measures directly. The constraint therefore lies in the attacker's objective rather than in any threshold choice: the energy an attack must spend is the quantity the detector measures. Whether this coupling survives a deliberate optimiser, either over response-region tokens or one that suppresses $\mathcal{V}_{\text{ref}$ mass while keeping harmful semantics, is the experiment that would most strengthen this line of work.
Our defense results identify concrete opportunities to interrupt the failure, while leaving their durability under explicit knowledge of the defense and longer-term adaptation unresolved; architectural safeguards likewise require evaluation.
Nothing in the score is specific to attacks; the same residual flags missed actions, layout changes, or unexpected modals, so the verifier doubles as a reliability monitor. The contribution also shifts the adversary's problem: an outcome-only monitor is defeated by any legitimate-looking screen, while an expectation-based monitor requires forging an outcome in the agent's own representation space, a harder objective whose difficulty we have not yet quantified.