AI 审批监控器会出现相关性失效，论文建议按证据源计数而非投票
Correlated Failures of AI Approval Monitors
这篇论文测了 16 个模型当支付审批监控器的表现，发现一起失效的根源是共享证据源，结论是数来源别数票，做智能体安全的人可以看看。
arXiv 论文研究了多个 AI 监控器在审批智能体操作时的相关性失效问题，借用了分布式计算中 fail-prone systems 的概念。作者按两套预注册协议测试了 12 个小型开源权重监控器在支付审批上的表现，还额外测试了 Claude Opus 5.5、GPT-6 Astra、Gemini 4 Argon 和 DeepSeek-V3.2。结果显示，所有成功的欺诈性放行都通过某个证据源传播且只影响读该源的监控器；小型模型和 DeepSeek 会服从注入指令，而三个闭源模型基本无视。在等安全条件下，按证据源计数而非按票数计数的规则把正确支付误拦率从 7.4% 降到 0.9%。加入不可被说服的规则引擎后，可在测得的攻击下恢复安全且存活的规则条件。
Correlated Failures of AI Approval Monitors
Before an AI agent takes a consequential action, such as paying, messaging or changing code, several monitors check it. Their verdicts are combined by aggregating scores or by counting approvals, whatever inputs the monitors share. Monitors that share a base model or a poisoned input, however, may fail together. We borrow the fail-prone systems of distributed computing: lists of monitor sets that may fail together. A rule is safe if it executes no bad action and live if it blocks no good one. We measured twelve small open-weights monitors on payment approval under two pre-registered protocols. Without pre-registration, we also measured three closed frontier models (Claude Opus 5.5, GPT-6 Astra, Gemini 4 Argon) and the open DeepSeek-V3.2. Every reliable fooling of a monitor into approving a fraud came through an evidence source and reached only that source's readers. Fooling it into blocking a correct payment depended on injection resistance, a monitor's refusal to follow instructions planted in its data. Small models and DeepSeek obeyed such notes. The three closed models ignored them in all but one case, and Opus also resisted persuasion tailored to it. On new data, a rule that counts sources instead of votes blocked 0.9% of correct payments, against 7.4% for the best counting rule, at equal safety. The pre-registered worst-case test failed. One attack left the approvers on a single source, so no rule over the twelve language-model monitors survives every measured attack. Adding a rule engine, which cannot be persuaded, restored the condition for a safe and live rule on the measured attacks. Diversify the inputs, harden the monitors, count sources, not votes.
