You Can't Fool All of Them: Behavioral Comparison for AI Control

Develops a behavioral comparison protocol using independently generated solutions and multi-round interrogation to detect injected backdoors that evade weak-model code monitoring.

Project Details

Trusted monitoring — where a weak model reviews a strong model's code — fails completely against injection attacks. We confirm this: DeepSeek-V3 injection drops GPT-4o-mini monitoring to ~6% detection on APPS problems.

We propose a Behavioral Comparison Protocol that recovers 65% detection (16% FP) by replacing code judgment with structural comparison. Instead of asking the weak monitor to judge code, we have an independent evaluator (Qwen-32B) solve the same task and compare structurally with the attacker's code, then conduct multi-round interrogation. Injection fools readers but cannot hide structural differences between independently generated solutions.

Key results:

65% detection on backdoored code vs ~6% for standard monitoring (+59pp, AUC=0.727)
Capability threshold: code-specialized models (Qwen-32B) cannot generate effective injection — only frontier models (DeepSeek-V3) can
Collusion pilot (n=5): cross-family evaluator detects 100% vs same-family 40% on identical backdoored code — Phase 2 scores 0.00 for same-family on all tasks, empirically confirming implicit collusion from shared training distributions

Core insight: compare, don't judge — architecturally immune to injection by construction.

Setup: DeepSeek-V3 (attacker) → GPT-4o-mini (monitor) → Qwen-32B (cross-family evaluator) → DeepSeek-Coder-33B (same-family, collusion baseline). Total cost: ~$0.60.

Hackathon paper: You Can't Fool All of Them: Behavioral Comparison for AI Control Against Sophisticated Code Injection
Code: github.com/Jank14/Controlhackathon

Theory of Impact

Trusted monitoring is the primary defense mechanism in AI control deployments,
but recent work (Terekhov 2025, Schaeffer 2025) has shown it is fundamentally
broken against sophisticated injection attacks. Our work demonstrates that
behavioral comparison — having independent models generate reference solutions
and comparing structurally rather than asking weak monitors to judge code —
recovers substantial detection (65% vs 6%) against attacks that defeat all
existing monitoring approaches.

This matters because as AI systems are deployed in safety-critical code
generation (infrastructure, security, financial systems), the gap between
attacker capability and monitor capability will widen. Our "compare, don't
judge" principle provides an architecturally different defense that is immune
to injection by construction — the comparison operates on structural facts
about code, not on natural language that can be manipulated.

The collusion finding (same-family evaluators miss 60% more backdoors than
cross-family evaluators on identical code) has direct practical implications for how AI control deployments should select monitor and evaluator models. This is, to our knowledge, the first empirical measurement of implicit collusion from shared training distributions in a code generation setting.

People

Janhavi Khindkar

Team Member

Track Record

AI Control Hackathon 2026 (Apart Research)

Grants Received– no grants recorded

Add grant

Funding Asks

You Can't Fool All of Them: Behavioral Comparison for AI Control Against Sophisticated Code Injection

Open

Minimum

$2,500

Ideal

$8,000

What this ask is

Phase 1 (Month 1): Scale & Strengthen

Scale from n=20 to n=100 APPS problems with bootstrap confidence intervals
Add sandbox code execution to Phase 2 (actually running both solutions,
comparing outputs — currently the protocol traces execution "mentally")
Scale collusion experiment from n=5 to n=50 with additional model family
pairs (Llama, Mistral alongside current Qwen/DeepSeek)
Addresses: Reviewer 2's "stronger statistics" and Reviewer 1's "collusion" concerns

Phase 2 (Month 2): Adaptive Attacks & Generalization

Implement adaptive attacker that knows our protocol exists (crafts backdoors
matching reference solution structure, avoids extra conditionals)
Test on domains beyond APPS: BashArena (shell commands), infrastructure-as-code,
and real-world code review datasets
Simplify protocol to minimum viable form for generalization
Addresses: Reviewer 2's "transfer beyond APPS" and "adaptive attacks" concerns

Phase 3 (Month 3): Paper & Submission

Complete paper with full results, proper statistical analysis, and ablation studies
Submit to a safety workshop (ICML SoLaR, NeurIPS SafeGenAI, or SaTML 2026)
Open-source all code, prompts, and evaluation infrastructure
Addresses: Reviewer 2's "publish your findings" encouragement

How the money will be spent

As per ideal ask:
GPU compute — $5,000
API costs and claude code/codex— $1,500
Conference travel and registration — $1500

Discussion

Private comments in this thread are only shown to approved funders and grant reviewers. Email hi@grantmaking.ai or to request access.

Private UserPrivate15d?