Search arXiv⌕ Search
Home/Archive/arXiv

arXiv · 2610.29178

Correlated Failures of AI Approval Monitors

Luca Zanolini
View original source ↗Read source document ↗Export metadata ↓

Abstract

Before an AI agent takes a consequential action, such as paying, messaging or changing code, several monitors check it. Their verdicts are combined by aggregating scores or by counting approvals, whatever inputs the monitors share. Monitors that share a base model or a poisoned input, however, may fail together. We borrow the fail-prone systems of distributed computing: lists of monitor sets that may fail together. A rule is safe if it executes no bad action and live if it blocks no good one. We measured twelve small open-weights monitors on payment approval under two pre-registered protocols. Without pre-registration, we also measured three closed frontier models (Claude Opus 5.5, GPT-6 Astra, Gemini 4 Argon) and the open DeepSeek-V3.2. Every reliable fooling of a monitor into approving a fraud came through an evidence source and reached only that source's readers. Fooling it into blocking a correct payment depended on injection resistance, a monitor's refusal to follow instructions planted in its data. Small models and DeepSeek obeyed such notes. The three closed models ignored them in all but one case, and Opus also resisted persuasion tailored to it. On new data, a rule that counts sources instead of votes blocked 0.9% of correct payments, against 7.4% for the best counting rule, at equal safety. The pre-registered worst-case test failed. One attack left the approvers on a single source, so no rule over the twelve language-model monitors survives every measured attack. Adding a rule engine, which cannot be persuaded, restored the condition for a safe and live rule on the measured attacks. Diversify the inputs, harden the monitors, count sources, not votes.

Explore related subjects

cs.CRcs.AIcs.DC

Keep this discovery

Explore connections, maps & timelines

BibTeXRIS

Luca Zanolini. 2026-10-21. Correlated Failures of AI Approval Monitors. https://arxiv.org/abs/2610.29178

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

AuthOr: Lower Cost Privacy-Free Garbling of Arbitrary Boolean Circuits

Privacy-free garbling schemes of Frederiksen et al. (Eurocrypt '15) are designed to satisfy only the authenticity criterion of Bellare et al. (ACM CCS '12) and to be more efficient than full-fledged garbling schemes. In this work, we improve the state-of-the-art privacy-free version of half-gates (HG) garbling of Zahur et al. (Crypto '15) by allowing an AND gate to be garbled with zero ciphertexts whenever at least one of its input wires is freely settable by the garbler. Our full solution, AuthOr, then combines the ideas from the information-theoretic garbling of Kondi and Patra (Crypto '17) with the improved HG-based scheme we obtain. AuthOr has a lower communication cost (i.e., garbled-circuit size) than HG garbling without any additional security assumptions. Theoretically, AuthOr's garbled-circuit size reduction over HG garbling ranges from 0% to 100%, with the exact improvement depending on the circuit structure. We have implemented our scheme and evaluated it on various circuits constructed by independent researchers. Our experimental results show that, in practice, the garbled-circuit size reduction can reach roughly 98%.

cs.CR↗
arXiv2026

Sharing is caring: Attestable and Trusted Workflows out of Distrustful Components

Trusted Execution Environments (TEEs) protect private memory and attest initial code and configuration, but neither constrain nor attest shared channels between TEEs or with the untrusted host. Confidentiality thus depends on the functional correctness of all in-TEE code accessing these channels: a single misuse can leak data and compromise a pipeline. This assumption is increasingly untenable for agentic applications that generate code at runtime and cloud pipelines of mutually distrustful components. We present MICA, a confidential-computing firmware extension that decouples confidentiality from trust in in-TEE code. MICA lets tenants define, restrict, and attest channel constraints between TEEs and with the untrusted host, including transitive constraints spanning a pipeline. It extends attestation to groups of communicating TEEs, letting external parties verify the confidentiality properties induced by these constraints across a pipeline. We implement MICA on Arm CCA by extending the Realm Management Monitor with a small policy language, requiring no hardware changes and minor QEMU and KVM changes. Our evaluation demonstrates support for confidential agentic applications and pipeline computations without trusting the functional correctness of in-TEE code. MICA increases the TCB by 7% and incurs infrequent setup costs: 2-4% boot-time overhead, approximately 1.5 s for policy upload, and 246-598 ms for group attestation. Once established, Realm communication is direct, uses protected memory, and requires no MICA intervention or software encryption, yielding up to 14.5 times lower cross-TEE message latency than encrypted communication over untrusted memory.

cs.CR↗
arXiv2026

SUDP: Secret-Use Delegation Protocol for Agentic Systems

Agentic systems now act with user secrets for APIs, messaging platforms, and cloud services. Today's agent runtimes typically implement authorization by exposure: enabling action means placing a reusable secret, or a reusable artifact derived from it, inside the runtime, so a transient prompt-injection or tool-side compromise becomes durable account compromise. Existing defenses cover adjacent pieces such as secret storage, scoped delegation, sender-constrained tokens, and runtime monitoring, but none states the combined requirement: an untrusted autonomous requester should be able to cause a user-authorized secret-backed operation without gaining reusable authority over it. We formalize this as the Agent Secret Use (ASU) problem and identify seven security properties any solution must satisfy, spanning authorization integrity and secret confidentiality. We propose the Secret-Use Delegation Protocol (SUDP), in which a requester proposes a canonical operation, the user authorizes it with a fresh authenticator-backed grant, and a custodian redeems the grant to perform the bounded use; reusable authority never crosses the requester boundary. We specialize SUDP for LLM-driven agents, where it applies whenever a tool call would exercise user-enrolled authority-bearing material. Under standard cryptographic assumptions, SUDP satisfies six of the seven properties; the seventh, runtime-memory confidentiality, is closed by composition with a hardware-rooted runtime. A reference implementation, available at https://github.com/xhyumiracle/sudp, adds sub-millisecond protocol overhead per mediated call.

cs.CR↗