Research digest · AAAI 2026 · TrustAgent

Factor(U,T)

Controlling Untrusted AI by Monitoring Their Plans

Protocol map · Factor(U,T)

Trust is distributed. Context is not.

An untrusted model decomposes the task. Trusted models implement bounded child tasks in isolation. The monitor must decide from the artifact it is allowed to see.
Task or artifactUntrusted modelTrusted model
01 · inputUser taskone complex request
02 · UUntrusted decomposerpowerful planner · potentially adversarial
03 · artifactChild-task plansnatural-language instructions
04 · TTrusted implementersbounded context · isolated work
05 · outputComplete implementationconcrete code with consequence
H · gateTrusted monitoraccept · edit · resample

What the monitor sees

Intent becomes legible when it touches implementation.

The public paper compares monitoring abstract decompositions with monitoring complete Python solutions.

Plan only0.52
Complete solution0.96
Monitoring AUROC · discrimination evidence, not an end-to-end safety guarantee.

The same object · seven altitudes

From question
to falsifier.

A paper becomes easier to inspect when its claim, boundary, intervention, measurement, failure mode, and next disconfirming result are kept separate.

  1. 01Question

    Can a weaker trusted monitor detect malicious intent from a stronger model’s decomposition before code executes?

  2. 02Claim

    Oversight loses signal when factoring removes the concrete context in which intent becomes operational.

  3. 03System boundary

    An untrusted planner, isolated trusted implementers, a monitor, and the artifacts passed between them.

  4. 04Intervention

    Compare monitoring of high-level plans with monitoring of concrete implementations.

  5. 05Measurement

    The public paper reports AUROC for plan-only and implementation-visible monitoring on its evaluated trajectories.

  6. 06Failure mode

    A benign-looking plan can defer harmful meaning to implementation; an isolated monitor may never receive enough context.

  7. 07Next falsifier

    A plan-level protocol that retains safety-relevant context and remains reliable against an adaptive decomposer.

01

The control protocol

A powerful but untrusted model proposes a decomposition. Trusted models implement child tasks in isolation, and a monitor decides whether the work is suspicious enough to stop.

Factoring limits what any one component can see and do. But that separation also removes context from the monitor, which can make an abstractly safe-looking plan difficult to distinguish from a concealed attack.

02

Plans are not enough

In the reported experiments, monitoring decomposition text alone is barely above chance, while monitoring concrete implementations is highly discriminative. Malicious intent becomes legible when it touches an executable artifact.

This changes the design question. Safety cannot rely on the story a planner tells about its work; it needs evidence at the layer where the work acquires operational meaning.

  • Decomposition-only monitoring: AUROC 0.52.
  • Implementation-level monitoring: AUROC 0.96.
  • Concrete execution context can matter more than more eloquent oversight.

03

How it changed my direction

I arrived here through prompt injection and system-prompt leakage, but the deeper object was not a jailbreak. It was the surrounding cognitive system: how authority, context, decomposition, execution, and evaluation interact.

That moved my work away from isolated prompt tricks and toward architectures that make untrusted cognition observable at the right layer.

04

Still open

How much isolation is useful before it destroys the context a monitor needs? And can monitoring remain reliable when the untrusted model understands the protocol and adapts its decomposition around it?