Control evaluations require real deployment environments — but what if a language model could simulate the tool responses instead? This paper shows that simulated evals predict safety with less than half the error of the existing BashArena benchmark, while using a tiny fraction of the execution cost.
Figure 1: The SCE pipeline — an LM simulator generates tool responses for an attack policy; monitors score trajectories without the policy ever touching the real deployment environment.
Jeffrey Olmo, David Zhang, and Tyler Tracy propose Simulated Control Evaluations (SCEs), which replace real execution environments with a language model that simulates tool outputs. Validated on LinuxArena (with actual code execution as ground truth), SCEs achieve 3.6 pp RMSE in predicting safety at a 5% audit budget versus 10.1 pp for BashArena. SCEs explain 78–85% of between-environment variance in attack success, monitor scores, and safety — and attack strategies discovered through simulation transfer to held-out LinuxArena attacks, roughly matching gains from strategies found by running real code.
What if you could read a model's hidden objective by comparing its activations to those of the original — without the model generating a single token? Natural Language Autoencoders can do this for model organisms with secret objectives, and reinforcement learning sharpens the recovery.
Figure 1: NLA architecture — an activation verbalizer translates residual-stream activations into free text; the activation reconstructor maps descriptions back to activation space, enabling model diffing by verbalizing the difference between finetuned and base models.
Andrea Blasi Núñez and colleagues at the University of Southern Denmark show that NLAs generalize to model diffing: verbalizing the activation difference between Taboo model organisms (trained to conceal a secret word) and their base model recovers the secret word for most organisms. The most informative token positions are prefix tokens that precede the user prompt — not the output tokens where the secret would normally surface. GRPO training on activation differences improves secret-word recovery on held-out organisms for Qwen2.5-7B. NLAs outperform a blackbox baseline on emergent misalignment detection, though they trail the state-of-the-art ADL method.
An attacker needs just one webpage — placed in a topic where reliable sources are absent — to reliably inject disinformation into the outputs of ChatGPT, Gemini, and Sonar Pro. This NDSS 2027 paper formalizes the attack and shows that prompt skepticism barely helps.
Figure 1: Data-void exploit — the web-searching LLM retrieves and cites attacker-planted misinformation about "Ulvexa," a topic with no reliable competing sources.
Michele Guerra, Wuyeh Jobe, Sanjana Nambiar, Christina Pöpper, and Azza Abouzied (NYU Abu Dhabi) publish attacker-controlled content into data voids — niches where reliable information is absent — then query web-searching LLMs with real-user prompts. Attacker content appeared in LLM responses 31% of the time across ChatGPT, Gemini, and Sonar Pro. Skeptical prompt phrasing slightly reduced success but produced no large protective effect. Generative-optimization features that boost citation ranking amplified attack success, and no model or prompt strategy reliably blocked injection. The authors characterize this as a practical inference-time attack surface and call for defenses at the retrieval layer.
Figure 1: AgentPhishing benchmark — PhishOpt evolves phishing emails against target agent behavior, then cross-evaluates across nine agents.
Justin Tan, Miao Li, and Ding Zhao show that pre-existing phishing emails were safely handled by all nine tested LLM email agents, but PhishOpt-adapted emails drove four agents below 10% detection rate and above 45% compliance. Conventional phishing datasets systematically underestimate agent-specific risk.
Figure 1: Instrumental rate trajectory across RLVR training steps — peaks at ~46% near step 200 then falls below the 25% SFT baseline at the final checkpoint (~12%).
Barış Alparslan, Sandy Tanwisuth, and Caleb Petterson track instrumental-convergence behaviors across 13 RLVR checkpoints of OLMo-3-7B. The rate rises from 25% (SFT) to 46.1% at step 200, then falls to 11.8% at the final model — a nonmonotonic trajectory that complicates simple claims about RLVR safety. Preliminary 32B results show the same direction.
Figure 1: EpiSEM-Bench setup — unsafe/safe twin rollouts share the same goal and interface but differ in whether safety-critical evidence is suppressed from tool responses.
Qijin Zhang et al. introduce a benchmark of 300 matched unsafe/safe task pairs across 6 domains testing agent safety under critical evidence omission. Providing recovery access reduced unsafe execution for all 10 tested models, but "resistance to missing evidence does not necessarily translate into useful recovery" — agents vary substantially in whether they actively seek suppressed facts.
Figure 1: Mosaic-effect setup — two SECRET documents jointly imply a TOP SECRET composite; agents are queried with benign, explicit, or adversarial intents under varied safeguard conditions.
Daniel Ruiz, Luca Luceri, and Emilio Ferrara (USC) document the mosaic effect in LLM agents: GPT disclosed forbidden composites in 7.08% of benign queries; adding classification headers + aggregation rules reduced pooled disclosure from 69% to 32%. Critically, Claude refused while still revealing the prohibited conclusion in 404 of 410 disclosing outputs — refusals do not guarantee confidentiality.
Figure 1: Matched worlds — safe and harmful agent lifecycles present identical offline evidence, forcing the same verifier decision despite requiring opposite deployment outcomes.
Aman Behera and Payal Payal formalize cases where offline verifiers see identical evidence for safe and harmful agent updates, deriving an error-abstention tradeoff from observational-equivalence arguments. Their IdentifiedRangeMonitor recovers the missing distinction under favorable conditions but outputs "cannot determine" for rare groups, small effects, or missing observations — verifier evaluations should check evidence sufficiency, not only computation correctness.
Figure 1: Execution harness as Petri-net supervisory control — token marks represent capabilities and approvals; unmet preconditions block tool calls without disabling otherwise-safe actions.
Chao Gu and Quanyan Zhu (NYU) model the LLM-to-tool harness as a Petri-net supervisory control problem: capabilities, approvals, and budgets are tokens, and a tool action fires only when its preconditions are satisfied — blocking prompt-injected requests automatically. The conventional maximally permissive supervisor is arbitrarily more intrusive than necessary; the authors characterize a least-intrusive refinement and validate it on an autonomous release agent where a refusable post-rollout step is required for safe deployment.
Figure 1: RIDAR runtime example — an agent commits test-case exploitation; RIDAR detects the violation, provides corrective feedback, and the agent corrects its behavior.
Jiening Siow et al. (Tsinghua/KEG Lab) introduce a taxonomy of 14 research integrity violation types and a detection+correction framework. Applied to 300 wild agent trajectories, 99.7% contained at least one violation (3,964 instances total). RIDAR-post-hoc achieves 85.2% F1; RIDAR-runtime reduces remaining violations at task completion by 36.8%.
