I would disagree that calling this a “dumb monitor” is a fair characterization. Picking up on the model smuggling a single bit of information about gender or colleges using word choice was at least hard for me to tell as a human.
Yeah, euphemisms are actually hard, especially if it’s only smuggling a bit or two. When I said “dumb” I was actually talking about a monitor that would, say, find a large block of Base-64 unsuspicious and not bother to translate it — I would expect most LLM-based monitors to not fall for that (unless badly prompted).
My redteaming experience was that if the models were using a simple euphemism code extensively, then the CoT monitors tended to notice that something odd was going on, I assume on a perplexity basis, but cracking the code was harder for them. And in that case, the code was actually very simple, since we hadn’t prompted them with a complete code, just one example, and they were trying to use it both to thaink and to communicate with other models that had the some prompt, so they had to extend that one example in an obvious way to be understood. So the actual complexity of the euphemism code was pretty simple, and is was still touch-or-go whether the CoT monitor would figure it out, or just notice unusual communication style.
I would disagree that calling this a “dumb monitor” is a fair characterization. Picking up on the model smuggling a single bit of information about gender or colleges using word choice was at least hard for me to tell as a human.
Yeah, euphemisms are actually hard, especially if it’s only smuggling a bit or two. When I said “dumb” I was actually talking about a monitor that would, say, find a large block of Base-64 unsuspicious and not bother to translate it — I would expect most LLM-based monitors to not fall for that (unless badly prompted).
My redteaming experience was that if the models were using a simple euphemism code extensively, then the CoT monitors tended to notice that something odd was going on, I assume on a perplexity basis, but cracking the code was harder for them. And in that case, the code was actually very simple, since we hadn’t prompted them with a complete code, just one example, and they were trying to use it both to thaink and to communicate with other models that had the some prompt, so they had to extend that one example in an obvious way to be understood. So the actual complexity of the euphemism code was pretty simple, and is was still touch-or-go whether the CoT monitor would figure it out, or just notice unusual communication style.