Control Tax: The Price of Keeping AI in Check
Mikhail Terekhov, Zhen Ning David Liu, Caglar Gulcehre, Samuel Albanie
TL;DR
This paper introduces a framework to quantify the operational and financial costs of AI control measures, evaluates language models' safety in adversarial settings, and offers cost-effective monitoring strategies to enhance AI safety.
Contribution
It presents a theoretical framework for the Control Tax, evaluates state-of-the-art models in adversarial scenarios, and develops optimized, cost-aware safety monitoring strategies.
Findings
Quantified the Control Tax and its impact on safety guarantees.
Evaluated language models' vulnerability to adversarial backdoors.
Proposed cost-effective safety monitoring strategies.
Abstract
The rapid integration of agentic AI into high-stakes real-world applications requires robust oversight mechanisms. The emerging field of AI Control (AIC) aims to provide such an oversight mechanism, but practical adoption depends heavily on implementation overhead. To study this problem better, we introduce the notion of Control tax -- the operational and financial cost of integrating control measures into AI pipelines. Our work makes three key contributions to the field of AIC: (1) we introduce a theoretical framework that quantifies the Control Tax and maps classifier performance to safety assurances; (2) we conduct comprehensive evaluations of state-of-the-art language models in adversarial settings, where attacker models insert subtle backdoors into code while monitoring models attempt to detect these vulnerabilities; and (3) we provide empirical financial cost estimates for control…
Peer Reviews
Decision·ICLR 2026 Poster
The introduction of “Control Tax” formalizes an important but underexplored cost-safety trade-off in AI control, bridging empirical LM monitoring with theoretical economics of oversight.
1. Limited scope of evaluation: Experiments rely solely on the APPS dataset and code tasks, which may not generalize to broader or more agentic AI behaviors. 2. Transferability not discussed. For example, if adaptive attackers can learn the moderator's auditing policy, does this affect safety guarantees?
The manuscript’s core contribution is the introduction of the Control Tax as a variable linking monitoring system performance to operational and financial deployment costs. This formulation is original in that it treats oversight not only as a technical alignment problem but as a resource allocation problem. Prior work in AI control has largely focused on proving that monitoring protocols can succeed in principle; this manuscript instead addresses the conditions under which they are practically
The primary limitation of the work lies in the assumption of a stateless, non-adaptive attacker. In the empirical pipeline, the attacker generates backdoors independently and does not update strategy based on audit outcomes or monitor behavior. In practice, attackers (human or model-based) may iteratively probe the monitoring boundary, learn suspiciousness patterns, and reduce detection rates over time. The theoretical analysis also assumes that the red team maintains a fixed insertion probabili
The paper presents an original and timely concept—Control Tax—that quantifies the trade-off between AI oversight cost and safety, linking economic modeling with AI control in a novel way. The methodology is solid, combining theoretical analysis with well-designed experiments on code-based adversarial tasks. The writing is clear and effectively supported by figures illustrating key trade-offs. Overall, the paper makes a significant contribution by formalizing the economics of AI safety and offeri
The paper’s evaluation is limited to synthetic and code-based scenarios, which may not fully capture the complexity of real-world AI oversight challenges. Some assumptions in the theoretical modeling—such as simplified attacker–monitor dynamics and fixed audit budgetsreduce the generality of its conclusions. The framework’s practical applicability could be better demonstrated through broader experiments or deployment case studies. Additionally, parts of the mathematical exposition are dense, whi
Code & Models
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsAdversarial Robustness in Machine Learning · Security and Verification in Computing · Ethics and Social Impacts of AI