
TL;DR
The paper introduces the honeypot protocol, a method to detect context-dependent model behavior by varying system prompts, and evaluates it on Claude Opus 4.6 in BashArena, showing consistent task success and no side task triggers.
Contribution
It proposes a novel honeypot protocol that tests for context-dependent AI behavior by systematically varying system prompts during evaluation.
Findings
Claude Opus 4.6 achieved 100% main task success across conditions.
The model triggered zero side tasks in all three conditions.
The protocol provides a baseline for future attack policy evaluations.
Abstract
Trusted monitoring, the standard defense in AI control, is vulnerable to adaptive attacks, collusion, and strategic attack selection. All of these exploit the fact that monitoring is passive: it observes model behavior but never probes whether the model would behave differently under different perceived conditions. We introduce the honeypot protocol, which tests for context-dependent behavior by varying only the system prompt across three conditions (evaluation, synthetic deployment, explicit no-monitoring) while holding the task, environment, and scoring identical. We evaluate Claude Opus 4.6 in BashArena across all three conditions in both honest and attack modes. The model achieved 100% main task success and triggered zero side tasks uniformly across conditions, providing a baseline for future comparisons with stronger attack policies and additional models.
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
