Taxonomy without complementarity: routing monitor ensembles

Develops a three-step, score-only diagnostic to determine whether routing among AI safety monitors can improve attack detection, tested on 130 AgentDojo episodes.

Endorsed by

Hélios

Develops a three-step, score-only diagnostic to determine whether routing among AI safety monitors can improve attack detection, tested on 130 AgentDojo episodes.

Endorsed by

Hélios

Project Details

AI safety monitors can be combined by routing—picking which monitor to trust based on the type of threat. But routing only helps if the monitors are complementary, meaning each one catches attacks the other misses. We test this on 130 AgentDojo episodes using action trace and chain-of-thought (CoT) monitors. Even with a perfect router that knows the true attack type, routing (AUROC=0.984) cannot beat CoT alone (0.998), because CoT already dominates on every category of attack. Our subtlety taxonomy is statistically valid (χ2=16.25, p=0.0003), but it reflects CoT winning everywhere rather than genuine complementarity. Adaptive attacks did not degrade CoT, though this likely reflects benchmark saturation rather than true robustness. We propose a three-step diagnostic that uses only existing scores—no new model calls—to check whether routing can help before any infrastructure is built

Hackathon paper: Taxonomy without complementarity: a necessary precondition for routing monitor ensembles
Code: github.com/retroam/apart/tree/main/control%20hackathon

Theory of Impact

AI safety teams should build a router only when monitors catch different failures. My AgentDojo pilot found that one monitor dominated across both attack categories, so routing added complexity and reduced detection. Testing this condition first can save teams from training a router that is not useful.

The project will turn that test into a reusable package for other ControlArena environments and monitor pairs. It will include the LLM-labeling pipeline used in the pilot. Researchers can define categories suited to a new setting, label episodes at scale, check a sample with human annotators, and measure whether those categories identify cases where different monitors perform best. Once the scores and labels exist, the diagnostic requires no new model calls.

Each result supports a practical decision. If one monitor dominates, teams can use it and search for a monitoring channel with different strengths. If the monitors catch different failures, teams have evidence to test a production router that selects one monitor or escalates difficult cases.

I will release the package and underlying episode data, including traces and human-checked labels. Other researchers can reproduce the results and apply the method beyond AgentDojo.

People

Rob Amanfu

Team Member

Track Record

AI Control Hackathon 2026 (Apart Research)

Grants Received– no grants recorded

Add grant

Funding Asks

Taxonomy without complementarity: a necessary precondition for routing monitor ensembles

Open

Minimum

$25,000

Ideal

$90,000

What this ask is

AI safety teams use trusted models to flag harmful behavior by more capable agents. A reasoning monitor reads the agent’s chain of thought (CoT), while an action monitor reads its tool calls. A production router could choose the best monitor for each task, improving detection while avoiding the cost of running every monitor. This works only when the monitors catch different failures.

I tested this idea in a pilot study of 130 AgentDojo episodes, a benchmark of prompt-injection attacks against tool-using agents. The reasoning monitor achieved 0.99 AUROC, where 1.0 means perfect separation between benign and attack runs. It outperformed the tool-use monitor on both subtle and overt attacks. Routing between them reduced detection because the tool-use monitor added too little coverage. Even simple attacks designed to conceal suspicious reasoning left the reasoning monitor at the benchmark ceiling. Funding will move the test to harder settings, where reasoning reveals less and tool use carries more evidence.

The minimum scope ($25,000 over three months at half-time) will:

Test reasoning and action monitors in two harder ControlArena settings with richer action traces and less revealing reasoning.
Have independent annotators label attack type and monitor correctness for at least 100 episodes.
Release a package that measures whether monitors catch different failures and whether routing or score blending improves detection.

The results will tell researchers whether to use one dominant monitor, build a router, or develop a new monitoring channel.

The ideal scope ($90,000 over six months at full-time) adds a third setting, at least 300 annotated episodes, more model families, and adaptive attacks trained or selected to hide suspicious reasoning while completing a harmful side task.

I will publish the hypotheses and stopping rules before the main experiments. Both scopes include an open-source package, a public dataset, and a reproducibility report. The ideal scope also includes a paper submission.

How the money will be spent

The two budgets fund different scopes of the same project. Both use a lead researcher rate of $7,000 per full-time month. Each amount below is the total for that funding level.

Ideal ask: $90,000 over six months

The ideal budget funds six months of full-time research across three settings, plus labeling for at least 300 episodes, additional model-family tests, and adaptive-policy training or selection. It also covers the tool, public dataset, reproducibility report, and paper submission.

Lead researcher, full-time for six months: $42,000
Part-time research engineering and contract support for experiments, tool development, and documentation: $24,000
Compute and API costs for pilots, agent rollouts, monitoring, and adaptive-policy training: $12,000
Human annotation, at least 300 episodes with multiple annotators: $4,000
Tooling, continuous integration, and dataset hosting: $2,000
Workshop or conference submission and travel: $3,000
Contingency for compute overruns or one replacement setting: $3,000

Minimum ask: $25,000 over three months
The minimum budget funds three months of half-time research across two harder settings, trace inspection, and multiple-annotator labeling for at least 100 episodes. It also covers the tool release, public dataset, and reproducibility report. A paper submission, third setting, additional model families, and adaptive-policy work require the ideal budget.
Lead researcher, half-time for three months: $10,500
Contract research engineering for experiments, tool development, and documentation: $6,000
Compute and API costs for pilots, agent rollouts, and monitoring: $5,500
Human annotation, at least 100 episodes with multiple annotators: $2,000
Tooling, hosting, and publication costs: $1,000

Discussion

Private comments in this thread are only shown to approved funders and grant reviewers. Email hi@grantmaking.ai or to request access.

Private UserPrivate15d?

Hélios LyonsJudge · AI Control Hackathon 2026Endorsement15d

this was a real pleasure to read, thorough and seemingly airtight methodology and logic in defining complementarity clearly and as a precondition for routing, then testing this explicitly.
the fact that AgentDojo attacks leave fingerprints in the reasoning traces that can be picked up by CoT is interesting. looking directly at those traces to understand what was flagged would have been useful, though the appendix does a bit of this already. perhaps CoT is not something that can apply in subversive real world environments where the fingerprints would be less visible in the reasoning trace.... would be curious as to further research in this direction.
whilst the results seem reasonably hedged, the outcome is limited to this single benchmark / monitor pair and attack distribution. looking at reasoning traces from other attacks to better understand the ground truth of what's being monitored might be valuable here as well, and/or trying with further model pairs and benchmarks. in this same vein, it would be good to have human validation of the subtlety taxonomy - LLM-labels all the way down, so not sure exactly what we're measuring here
excellent work, impressive for a single author submission, right size and clear results, if not super striking given the setup.