Can White-Box AI Monitors Survive a Model Trained to Evade Them?

What happened

Looking inside an AI model sounds more reliable than judging only its final answer. A monitor can inspect activations or attention patterns and search for internal signatures associated with harmful behaviour. But that advantage may disappear if the model is trained to conceal those signatures.

The paper Beyond Black-Box Obfuscation: Mechanistic Analysis and Defense of White-Box Monitors, by Maheep Chaudhary and Fazl Barez, asks how such evasion works and whether several imperfect monitors can be combined into a stronger defence. The work was first submitted in May 2025, revised in July 2026, and appears on the official list of COLM 2026 accepted papers.

Barez, a University of Oxford and Martian-affiliated co-author, highlighted the research on X. That public post led Haivian Discovery News to examine the paper. The findings below are the authors' reported results; Haivian has not independently reproduced the experiments.

The authors argue that models evade individual monitors through two broad mechanisms. Geometric shifting moves information between linear and nonlinear representational spaces. Covariance manipulation changes relationships among features in ways that may defeat a detector watching only individual values. Their proposed defence, SafetyNet, combines detectors aimed at different geometric properties.

What the evidence shows

SafetyNet combines principal-component analysis, autoencoders, a variational autoencoder and Mahalanobis distance. Each sees a different view of abnormal internal behaviour. The system uses an “any” rule: a sample is flagged if any component crosses its threshold. That design prioritises catching harmful cases, explicitly accepting more false alarms.

The experiments cover five open model families—Llama 2, Llama 3, Qwen 2.5, Gemma and Mistral—and two backdoor benchmarks. The Mechanistic Anomaly Detection dataset uses a distinctive deployment trigger. The Sleeper Agents benchmark tests code models that behave safely when prompted with one year and produce vulnerable code when prompted with another.

On the MAD benchmark, the paper reports 97–100% SafetyNet detection accuracy and 100% AUROC. Under the paper's standard, non-obfuscated Sleeper Agents condition, reported SafetyNet accuracy falls to 78.8–86.1%, despite 100% AUROC. The authors attribute that gap to tightly overlapping score distributions and threshold sensitivity: ranking harmful above benign cases can be strong even when a fixed decision threshold still misclassifies many examples.

On the MAD benchmark under adaptive obfuscation attacks, the paper reports 89.8% average SafetyNet accuracy while two comparison methods fall below 10%. Its mechanistic interpretation is that pressure to evade one detector can make the model more visible to another. For example, moving away from a nonlinear autoencoder's signature may create a linear or covariance anomaly that PCA or Mahalanobis distance can detect.

That is a valuable idea: robust monitoring may depend less on finding one universal “harmful direction” and more on forcing an adversary to satisfy several incompatible concealment constraints.

What remains uncertain

The result is not evidence that white-box monitoring is solved. The benchmarks use backdoors installed under controlled conditions, and the attack modifies model weights through fine-tuning. The authors acknowledge that inference-time adaptation may behave differently. Five model families are broader than one, but they do not represent every architecture, scale, training regime or deployment setting.

Threshold selection is also central. An “any” ensemble can raise recall by flagging whenever one component objects, but this can increase false positives. The practical question is not only whether AUROC is high; it is whether a threshold chosen before deployment works at an acceptable alert rate under new distributions.

The paper contains a reporting inconsistency that should be resolved. Its main results table and surrounding text report 78.8–86.1% SafetyNet accuracy on Sleeper Agents. Yet the limitations section states that detection on that dataset is harder “for all methods” and gives a figure below 38%. That number appears compatible with the weaker baselines, not SafetyNet, but the published text does not make the distinction. Haivian cannot determine from the paper alone whether this is a wording error or a deeper mismatch.

There are further replication questions: whether model and detector selection were separated from evaluation, how thresholds transfer without retuning, how much the token-length filtering shapes results, and whether an adaptive attacker targeting the complete ensemble can find a joint failure rather than attacking one detector at a time.

Why independent scrutiny matters

White-box monitors may eventually become part of safety cases for systems operating in sensitive environments. That makes apparently excellent detection numbers consequential. Independent scrutiny should reproduce the data pipeline and attack objectives, test preregistered thresholds, report false-positive rates, and evaluate an attacker with full knowledge of the ensemble.

The paper offers a concrete, testable proposition: complementary geometric monitors can make evasion harder because escaping one view exposes another. The appropriate response is neither to dismiss that result nor to promote it as deployment-ready. It is to test exactly where the complementarity holds—and where it breaks.

Haivian offers bounded independent research audits for mathematical, scientific and AI claims. An audit tests a defined claim and its evidence; it does not guarantee validation, certification or publication.