Sequential detection of covert campaigns with hollowed selection

Determine whether a sequential test based on the hollowed score can detect covert model-extraction campaigns that evade deployed thresholds, including campaigns constructed from real user prompts.

Background

The paper finds that hollowed selection can rank the least-detectable campaign above benign windows while failing to trigger at deployed thresholds. This suggests that aggregating evidence over time might distinguish covert campaigns even when no single-week alarm is possible.

The unresolved issue is whether sequential accumulation of the hollowed score can produce reliable detection without exceeding the desired false-alarm rate. The authors also connect this question to the realism of the campaign construction, since colluders assembled from whole real user-weeks may be harder to distinguish than pooled synthetic accounts.

References

Whether a sequential test on the hollowed score catches covert campaigns, and whether real same-week populations of $104$ accounts are harder than our pooled ones (this period's weeks held at most 469 accounts), remain open.

— The Limits of Query Monitoring against Distributed Model Extraction  (2610.13083 - Khilar, 9 Oct 2026) in Section 3, “The test that matters: one frozen evaluation on untouched weeks,” paragraph “Covert is not invisible”