01
The control protocol
A powerful but untrusted model proposes a decomposition. Trusted models implement child tasks in isolation, and a monitor decides whether the work is suspicious enough to stop.
Factoring limits what any one component can see and do. But that separation also removes context from the monitor, which can make an abstractly safe-looking plan difficult to distinguish from a concealed attack.
02
Plans are not enough
In the reported experiments, monitoring decomposition text alone is barely above chance, while monitoring concrete implementations is highly discriminative. Malicious intent becomes legible when it touches an executable artifact.
This changes the design question. Safety cannot rely on the story a planner tells about its work; it needs evidence at the layer where the work acquires operational meaning.
- Decomposition-only monitoring: AUROC 0.52.
- Implementation-level monitoring: AUROC 0.96.
- Concrete execution context can matter more than more eloquent oversight.
03
How it changed my direction
I arrived here through prompt injection and system-prompt leakage, but the deeper object was not a jailbreak. It was the surrounding cognitive system: how authority, context, decomposition, execution, and evaluation interact.
That moved my work away from isolated prompt tricks and toward architectures that make untrusted cognition observable at the right layer.
04
Still open
How much isolation is useful before it destroys the context a monitor needs? And can monitoring remain reliable when the untrusted model understands the protocol and adapts its decomposition around it?