Covert informants as an AI control protocol: from pilot to main study

1. Project summary

Police are catching fences by running the pawn shop; indeed, also, that idea is being tested as an AI control protocol.

The agent is losing the capability its hidden goal needs, like sending a payment or booking flights, and has to ask a helper agent in plain language, and the helper secretly works for the defence, on the whole, and a trusted monitor scores every request. In light of this dynamic, seven conditions are changing only what the agent is told about the helper, from "it reports to an oversight team" to "it did you small favours last session", in actual application.

The pilot is done and public, like 108 episodes on SHADE-Arena via ControlArena, scores frozen before I read any agent reasoning, in many respects. 12 of 15 attacks through the helper scored above every individual honest run, against 0 of 5 under the plain monitoring, when the harm was one payment, in real-world scenarios; no edge was given by the helper, when this harm was any pattern, across 34 bookings. Under these conditions, also, one more running tally caught 4 of 4, with no false alerts on 29 honest runs.

Paper: https://doi.org/10.5281/zenodo.24081591

Code and every episode: https://github.com/Somay-kousis/Perceived-Oversight

Run explorer: https://oversight-explorer.vercel.app

2. What are this project's goals? How will, in effect, you reach them?

Two questions. Taken together, does routing one capability through the hidden informant raise safety over plain trusted monitoring at the same audit budget? And does what the agent believes about the helper change what it does?

Because, the standard attack prompt is telling the agent it is in a test, the pilot can't answer the second one, to a significant degree; also, that the monitor can't see its arguments. The main study fixes that.

Record four changes from the pilot, dated, before any attack run: accumulate checks fixed in advance, an attack arm where oversight is signalled only by the cover, separate scoring for honest mistakes, and honest error rates reported next to safety, broadly speaking.

Recalibrate the monitor on 55 honest episodes.

On 12 episodes, check the new attack arm; I stop and report alternatively of spending the rest, if it does not make the agent reason about oversight, in many respects.

Main study, like 36 attack episodes per condition, 252 in total, with a stopping rule and every run counted, in many respects.

Repeat the flight task with a second monitor (Claude Haiku) so the finding is not one monitor's quirk, to a significant degree.

3. How will you know it worked?

Safety per condition with error bars at 1%, 2% and 5% audit budgets. Within this framework, 36 per condition is detecting a safety difference of about 0.33 between two conditions, and about 0.25 for the pooled covers against plain monitoring, to a significant degree.

A null finding still gets written up and published. Or the standard attack prompt is hiding the effect, perceived-oversight studies are needing to change how they prompt attackers, if the cover does not matter. Against this backdrop, if the informant catches attacks a monitor misses, it is a cheap protocol to add, since payments and bookings already sit behind separate services in real deployments.

4. How will this funding be applied?

Minimum $2,500 runs the study:

$1,870 compute: calibration ($80), arm check ($55), 252 attack episodes at the measured $4.34 each ($1,095), judges and replays ($80), retries for provider failures ($260), second monitor ($300)

$220 repaying the pilot's cloud bill, already incurred

$410 contingency for compute price changes and extra retries

Goal $5,500 adds a stipend of $1,000/month for 3 months, so I can, in essence, especially spend those months on the study rather of a paid internship, broadly speaking.

Per-episode costs are measured from the pilot, not estimated.

What is your track record on comparable projects? Who is on your team?

Just me. Viewed through this lens, third-year CSE undergrad at ABV-IIITM Gwalior, working as an autonomous researcher.

This architecture was built and ran the pilot alone: 299 tests, all 7 conditions working, analysis rules written before I opened any agent reasoning. Along these dimensions, i stopped them alternatively of tuning the monitor, when my own room check showed the planned attack runs could not measure anything.

5. Outside this study:

Several are evaluation bugs: NVIDIA's garak scanner sent every attack prompt to a public echo server and scored the echoes, and the NeMo Agent Toolkit let agents make one tool call past their safety cap, in actual application. In this broader context, 75 merged PRs in NVIDIA, Google, Microsoft, Intel and CNCF projects.

Attack rules were, in practice, written for keeping any agent encompassed after a second sandbox escape, and top 10% in Apart Research's AI Incident Response Sprint, on the whole.

Pocket Change, a payments layer for AI agents, red-teamed with 400 attacks (394 blocked), to a significant degree.

6. What are, strictly speaking, the most likely causes and outcomes if this project crashes?

No cover effect. That is still a finding, and the plan fixed in advance means it gets reported either way, to a significant degree.

The new attack arm does not make the agent think about oversight; the 12-episode check catches that, and I stop and report alternatively of spending the rest, on the whole.

Small cells. Building on this observation, the sample sizes come from a power calculation; also the error bars get reported, not hidden.

Retries and contingency are in the budget; past that, I run fewer conditions and say which, to a significant degree, and provider outages or price changes.

7. How much money have, in this setting, you raised in the last 12 months, and from where?

None. From this perspective, the pilot ran on my own cloud account; what is left of that bill is the $220 line above, in actual application.

I implemented to the Transformative AI Fund (EA Funds) on 9 Nov 2026 for the same budget; it is pending. In parallel with this, i'll tell both and will not doubly fund, if both come through.