When can we trust untrusted monitoring? A safety case sketch across collusion strategies

TL;DR

This paper explores the safety of untrusted AI monitoring by analyzing various collusion strategies, relaxing previous assumptions, and proposing a safety case framework to improve robustness in AI oversight.

Contribution

It introduces a comprehensive taxonomy of collusion strategies and develops a safety case sketch to evaluate untrusted monitoring under relaxed assumptions.

Findings

Passive self-recognition can be a more effective collusion strategy than previously considered.

The safety case framework clarifies assumptions and highlights challenges in untrusted AI monitoring.

Conditions are identified where untrusted monitoring may be reliably trusted despite collusion risks.

Abstract

AIs are increasingly being deployed with greater autonomy and capabilities, which increases the risk that a misaligned AI may be able to cause catastrophic harm. Untrusted monitoring -- using one untrusted model to oversee another -- is one approach to reducing risk. Justifying the safety of an untrusted monitoring deployment is challenging because developers cannot safely deploy a misaligned model to test their protocol directly. In this paper, we develop upon existing methods for rigorously demonstrating safety based on pre-deployment testing. We relax assumptions that previous AI control research made about the collusion strategies a misaligned AI might use to subvert untrusted monitoring. We develop a taxonomy covering passive self-recognition, causal collusion (hiding pre-shared signals), acausal collusion (hiding signals via Schelling points), and combined strategies. We create a safety case sketch to clearly present our argument, explicitly state our assumptions, and highlight unsolved challenges. We identify conditions under which passive self-recognition could be a more effective collusion strategy than those studied previously. Our work builds towards more robust evaluations of untrusted monitoring.