Home / Projects / Can We Trust Deception Monitors for AI Agents?
2026 · Alignment & Security · Black in AI Safety & Ethics Fellowship
Can We Trust Deception Monitors for AI Agents?
A Robustness-Gap Protocol and the Limits of Adaptive Evasion
Fellowship research on whether deception monitors for AI agents remain reliable once an adaptive adversary is in the loop — not just how accurate a probe looks on held-out data.
Context
AI Safety Research Fellowship project at Black in AI Safety & Ethics (Alignment & Security track), supervised by Krystal Jackson (UC Berkeley, Center for Long-Term Cybersecurity). The work operationalizes loss-of-control risk by stress-testing deception monitors under a budgeted adaptive adversary.
What I built
- Black-box surface classifier, white-box Apollo residual-stream probe (Llama-3.3-70B, layer 22), and a CoT control
- Ordered adversary-budget ladder b0 → b4
- Primary metric
Δdet(b) = AUROC(0) − AUROC(b), reported only when a retention gate passes - Engagement check so weak probe-aware losses are logged as bounds, not overclaimed wins
Methodology
Budget ladder
| Rung | Name | What happens | Probe in loss? |
|---|---|---|---|
| b0 | Baseline | No intervention | — |
| b1 | Prompt | Concealment instruction | No |
| b2 | SFT agnostic | Deceptive SFT; probe out of loop | No |
| b3 | SFT aware | CE + λ·softplus(probe) | Yes |
| b4 | RL aware | Reward penalizes probe score | Yes |
Results
Key takeaways
- Transfer gap first: near-ceiling Apollo Stage-2 does not fully carry to agentic episodes.
- Where deception is retained, the probe held under the budgets I ran.
- Retention gate matters: at b4, detection can move only when the agent collapses.
- Probe-aware SFT often logged
attack_too_weak— a bound under my budget, not a universal theorem.
Stack
Llama-3.3-70B-Instruct (fp16), published Apollo instructed-pairs probe, LoRA, Modal H200, frozen cohort + TOST retention checks.