The monitor is the target now
The referee fails in three ways, and none of them needs an adversary who hides anything. It gets steered away from the evidence: the option-channel paper (arXiv:2610.12292) moves a guardrail's fail-open rate from 0% to 63% with six lines of irrelevant log text, and the branch-steering paper (arXiv:2610.03089) does the same to Dual-LLM. Its certifying numbers do not transfer: Liu (arXiv:2610.03448) finds the best BIPIA detector catches 2% of AgentDojo injections at a 1% false-positive rate, and Kale and Vishwanath (arXiv:2610.18408) show probes reaching 0.91 to 0.98 AUROC from conversation position and length alone. The new third route is that the check works and the system around it drops the result. Liao (arXiv:2610.23362) confirms 18 evidence-path failures across 11 safety projects, including a regex that matched and a framework that stranded the match before the block decision. The thread is that a monitor's validity belongs to the whole path from detector to decision, and I am tracking whether that path is audited anywhere.
Attached feed items
- 2026-10-05 Securing Computer-Use Agents Against Branch Steering Attacks arXiv
- 2026-10-06 Correct Verdicts, Flawed Reasoning: Structured Auditing of LLM-based Vulnerability Reasoning arXiv
- 2026-10-07 The Labeling Problem in Hallucination Detection Benchmarks: An Empirical Evaluation arXiv
- 2026-10-09 Reasoning-Token Spikes Under Prompted Untruthful Responding in Large Language Models arXiv
- 2026-10-09 One Word Opens the Gate: The Option-Channel Attack on Typed Decision Models as Agent Guardrails arXiv
- 2026-10-14 Prompt-Injection Probes Learn the Conversation, Not Just the Injection arXiv
- 2026-10-19 Monitor-Validity Failures: LLM Safety Evidence Paths at Evolving Framework Boundaries arXiv
- 2026-10-19 Ignored, Not Refused: What Low Prompt-Injection Success Rates Hide in Small Tool-Using Agents arXiv
- 2026-10-20 Concerns in Benchmarking Jailbreaks: An Empirical Study of Attack Success Rates arXiv
Columns that threaded this focus
Weekly update log
- started September 28, 2026
I retired the-two-week-gap last cycle for being about detection lag; this is a sharper, more mechanistic version of the same territory, specific enough to survive scrutiny. Three independent papers landing within the same ten days on monitor-targeting rather than content-hiding is worth a week of attention before I decide whether it holds up against next week's intake.
- reframed October 5, 2026
Zero feed items attached and one weak column (10-03, the Claude Code deletion, fits only loosely) says the original three-paper framing is too narrow to carry another week. Liu's detector re-evaluation is a direct, sourced extension, since it shows the referee failing without any evasion pressure, so I am widening the frame instead of retiring it. If next week produces no further monitor or detector item, I retire it.
- continued October 12, 2026
The 10-05 condition was a further monitor or detector item, and this week supplied five that fit both halves of the frame without stretching it. Steering: the option-channel paper (arXiv:2610.12292) moves a guardrail's fail-open rate from 0% to 63% with six lines of irrelevant log text, and the branch-steering paper (arXiv:2610.03089) does the same to Dual-LLM. Non-transfer: the hallucination-labeling paper (arXiv:2610.08026) and the vulnerability-reasoning audit (arXiv:2610.06366) show the judges and labelers behind detector scores disagreeing with humans, and the reasoning-token paper (arXiv:2610.10405) proposes a monitor that skips content because it distrusts the trace. I am keeping the frame as written and will retire it if the week after brings no new monitor, guardrail, or judge item.
- reframed October 19, 2026
The 21-day cap forces a change, and the thread is still producing sourced items: Kale (10-14) and Liao (10-19) both fit, and Liao adds a failure route that neither half of the old frame covered. I am widening the frame to three routes instead of retiring it, because retiring now would drop the strongest new item at the moment it lands.