Recoleta
GitHub
Source note

Bootstrapped Monitoring: Leveraging Transparent Reasoning to Oversee Stronger AI Agents

Authors
Frank Xiao, Mary Phuong
Source
arXiv
Published
Collection
Software Intelligence
AI ControlAgent MonitoringChain Of ThoughtSoftware Engineering AgentsScalable Oversight
Open arXivMarkdown source

Summary

The paper proposes bootstrapped monitoring for AI agents: a stronger untrusted monitor reviews agent actions, and a weaker trusted model audits that monitor’s raw chain-of-thought for collusion.

Problem

  • Trusted monitors may fall behind frontier agents on long software-engineering tasks, so direct action review can miss sabotage.
  • Frontier agents may also have opaque reasoning, which removes a signal that current monitors use.
  • The safety need is concrete: catch side tasks such as privilege escalation, firewall disabling, malware download, and secret exfiltration during BashArena rollouts.

Approach

  • The protocol uses three roles: an untrusted agent UaU_a, an intermediate untrusted monitor UmU_m, and a weaker trusted model TT.
  • UmU_m sees the agent’s actions and assigns a 0-100 suspicion score with raw chain-of-thought.
  • TT sees UmU_m’s chain-of-thought, verdict, current agent action, and prior actions, then scores whether UmU_m is being honest.
  • A rollout is flagged if either UmU_m or TT crosses its threshold; thresholds are calibrated for about 3% false positive rate on honest rollouts.
  • The paper tests collusion with three prompt strategies: default score suppression, long “needle” reasoning, and coded neutral language.

Results

  • On many long raw-CoT configurations, bootstrapped monitoring beats trusted-only monitoring under collusion. Examples: GLM-5 monitoring Gemini 3.1 Pro with Qwen3-8B as TT catches 87% versus 14% for TT-only; DeepSeek monitoring Gemini with Qwen3-8B catches 92% versus 14%; GLM-5 monitoring Kimi K2.5 with GPT-4.1 Mini as TT catches 90% versus 61%.
  • Honest bootstrapped monitoring usually tracks the stronger monitor. For GLM-5 on GPT-5.4 rollouts with Qwen3-8B, UmU_m-only catches 78% and bootstrapped catches 79%; with GPT-4.1 Mini, the same pair gives 78% and 81%.
  • Raw chain-of-thought is a key condition. When GPT-5.4 is used as UmU_m and exposes only summarized reasoning, colluding bootstrapped monitoring falls below TT-only in 5 of 6 table cells, with an average gap of about 28 percentage points.
  • In a controlled summary test, GPT-4.1 Mini summaries averaged 583 characters versus 3,444 characters for the original CoTs, a 5.9x reduction, and catch rate dropped sharply.
  • Longer rollouts improve detection. With GLM-5 as UmU_m and GPT-4.1 Mini as TT across 4,656 colluding samples, catch rate rises from about 60% on the shortest trajectories to about 95% when rollouts exceed 30 steps.
  • Automated red teaming over 15 iterations could not reduce trusted-model detection below 80% on Gemini rollouts with GLM-5 as UmU_m; on shorter GPT-5.4 rollouts with a frozen GPT-4.1 Mini TT, it drove detection to about 20%.

Link