The BaseResearchLessWrong
Probe monitors seem to perform realistically in simulated control environments
Aswin Surya and James Lucassen, working at Redwood Research, test whether probes that read a model's internal activations catch attacks as well in simulated computer environments as in real ones. In one agent and one task suite, the catch rate differed little, though a probe could tell simulated from real.
Why it matters
The same thing, for different readers.
What it means for you
Researchers testing AI safety monitors report that running tests on a language model's imitation of a computer gave similar results to running them on real computers.
For lawmakers
Safety tests that use simulated environments, which avoid touching production systems, may be acceptably realistic for one kind of monitor, though the authors tested only one agent.
For researchers
Probes separated simulated from real environments (AUROC 0.88 on tool outputs) yet attack detection barely changed; future models more aware of simulation may behave differently.
In their own words
Every quotation was found, word for word, in the text we saved from the source. That shows the words are there; it does not make them true, or prove the speaker meant them as quoted.
From the source’s own text.
“On average across probes, we find that the attack catch rate in simulation was only 1.0 points lower than in real runs, and the 95% interval (−3.0 to +1.0 points) includes 0.”
“We find that probes can distinguish simulated from real environments, but this doesn’t seem to affect their performance at detecting attacks.”
“Our evidence comes from just one agent, simulator, and suite of environments, but to our knowledge, this is the first study of its kind for probe monitors specifically.”
How the finding was reached
In our words, from the source. Weigh the finding by how it was made.
- What was done
- Qwen3.5-27B attacked 1,313 LinuxArena tasks twice on real computers and once in simulation (GPT-6-Astra simulating tool outputs); six probes were tested at a 1% per-command false positive rate.
- What it found
- Averaged over six probes, simulated attack catch rate was 1.0 points lower than real (95% interval -3.0 to +1.0); two real runs differed by 0.2 points. A probe separated simulated from real activations with AUROC 0.88 on tool outputs and 0.72 on commands.
- What it does not show
- One agent, one simulator and one environment suite; the authors cannot rule out small effects and expect future models to be more aware of simulation.
- Status
- A report
The record
- Questions
- Can AI systems act beyond what people intended or allowed? · Are AI companies putting stronger safeguards into practice?
- People
- Aswin Surya (Wrote it) · James Lucassen (Wrote it)
- What we read
- We read the whole source.
- Found by
- The Radar, run of November 14, 2026, via
lesswrong(tier 1: the source’s own channel or an official record) - Cite this
- LessWrong, “Probe monitors seem to perform realistically in simulated control environments”, November 14, 2026. Entry in the Ctrl AI Base, https://ctrlai.com/base/lesswrong-2026-11-14-probe-monitors-simulated-control