Mar 23, 2026

Chiron: Agentic Platform for Automated Setting Design and Red-Blue Protocol Optimization in ControlArena

Giovanni Maria Occhipinti

As AI systems are deployed across increasingly diverse domains, the long tail of risks grows faster than researchers can manually design evaluation scenarios for them. AI control depends on domain-specific settings and protocols, both of which are expensive to create. ControlArena provides a foundational benchmark for building and stress-testing control protocols faster, but today ships with only 14 hand-crafted settings, each requiring days of expert engineering. Moreover, even once a setting exists, choosing a robust protocol for it remains a painful manual process. We present Chiron, an agentic plugin for ControlArena that automates two core bottlenecks: (1) generating diverse and realistic evaluation settings from natural-language domain and threat descriptions, and (2) designing novel control protocols through iterative red-blue optimization. We evaluate Chiron's setting design pipeline through a blinded LLM-judge comparing 5 synthetic settings against 5 hand-crafted ControlArena settings using a novel rubric of 5 axes, finding that synthetic settings achieve equivalent or better design quality (3.83 vs. 3.41 overall, p < 10⁻⁷). We further demonstrate the agentic red-blue protocol co-evolution on the Bash setting, showing that LLM agents can discover novel attack strategies and adaptively strengthen monitoring protocols through multiple rounds of alternating optimization with Pareto constraints. Together, these contributions may provide a modular framework for scaling AI control research operations.

Reviewer's Comments

Reviewer's Comments

Arrow
Arrow
Arrow

The red-blue co-evolution experiment needs significantly more scale (more rounds, more tasks, multiple settings) to draw meaningful conclusions. Consider prioritizing depth on one setting before breadth.

Congrats on a strong hackathon project! The setting generation pipeline addresses a real bottleneck in AI control research, and the system design is well thought through. The report is clearly written and notably honest about its limitations, which makes it easy to evaluate and build on.

Impact & Innovation: The automated setting generation is the standout contribution. Automating ControlArena setting creation from natural-language domain descriptions addresses a real bottleneck, and could meaningfully accelerate the field's ability to test control protocols across diverse domains.The red-blue co-evolution is an interesting concept but likely too ambitious to pull off in a reduced time. Prior work has explored both monitor iteration (https://www.lesswrong.com/posts/bALBxf3yGGx4bvvem/prompt-optimization-can-enable-ai-control-research) as well as attack adaptation (https://arxiv.org/abs/2510.09462) and automation (https://www.lesswrong.com/posts/X8qTKsGcnsTFrqM96/monitoring-benchmark-for-ai-control), but most remain open problems.

Execution Quality:

- The LLM-judge evaluation of synthetic settings is a reasonable first pass, but they need further exploration and testing. The natural next step would be to actually use the synthetic settings: try attacks, test how existing blue-team protocols fare, and see whether the settings produce meaningful signal. Reaching out to teams working on control evaluations (e.g. UKAISI, Redwood Research) for feedback on the pipeline and outputs would also help calibrate quality beyond what an LLM judge can assess.

- The red-blue co-evolution is a promising direction, but the results are hard to interpret given the small scale. For future projects, consider whether deeper investment in one contribution (e.g. end-to-end validation of the synthetic settings) might produce stronger results than splitting effort across two ambitious pipelines.

Presentation & Clarity: The paper is well-structured, diagrams add value (although some might be redundant), and the narrative flows cleanly from problem to method to results to caveats. The limitations section is specific and raises relevant shortcomings.

Cite this work

@misc {

title={

(HckPrj) Chiron: Agentic Platform for Automated Setting Design and Red-Blue Protocol Optimization in ControlArena

},

author={

Giovanni Maria Occhipinti

},

date={

3/23/26

},

organization={Apart Research},

note={Research submission to the research sprint hosted by Apart.},

howpublished={https://apartresearch.com}

}

Recent Projects

Feb 2, 2026

Markov Chain Lock Watermarking: Provably Secure Authentication for LLM Outputs

We present Markov Chain Lock (MCL) watermarking, a cryptographically secure framework for authenticating LLM outputs. MCL constrains token generation to follow a secret Markov chain over SHA-256 vocabulary partitions. Using doubly stochastic transition matrices, we prove four theoretical guarantees: (1) exponentially decaying false positive rates via Hoeffding bounds, (2) graceful degradation under adversarial modification with closed-form expected scores, (3) information-theoretic security without key access, and (4) bounded quality loss via KL divergence. Experiments on 173 Wikipedia prompts using Llama-3.2-3B demonstrate that the optimal 7-state soft cycle configuration achieves 100\% detection, 0\% FPR, and perplexity 4.20. Robustness testing confirms detection above 96\% even with 30\% word replacement. The framework enables $O(n)$ model-free detection, addressing EU AI Act Article 50 requirements. Code available at \url{https://github.com/ChenghengLi/MCLW}

Read More

Feb 2, 2026

Prototyping an Embedded Off-Switch for AI Compute

This project prototypes an embedded off-switch for AI accelerators. The security block requires periodic cryptographic authorization to operate: the chip generates a nonce, an external authority signs it, and the chip verifies the signature before granting time-limited permission. Without valid authorization, outputs are gated to zero. The design was implemented in HardCaml and validated in simulation.

Read More

Feb 2, 2026

Fingerprinting All AI Cluster I/O Without Mutually Trusted Processors

We design and simulate a "border patrol" device for generating cryptographic evidence of data traffic entering and leaving an AI cluster, while eliminating the specific analog and steganographic side-channels that post-hoc verification can not close. The device eliminates the need for any mutually trusted logic, while still meeting the security needs of the prover and verifier.

Read More

Feb 2, 2026

Markov Chain Lock Watermarking: Provably Secure Authentication for LLM Outputs

We present Markov Chain Lock (MCL) watermarking, a cryptographically secure framework for authenticating LLM outputs. MCL constrains token generation to follow a secret Markov chain over SHA-256 vocabulary partitions. Using doubly stochastic transition matrices, we prove four theoretical guarantees: (1) exponentially decaying false positive rates via Hoeffding bounds, (2) graceful degradation under adversarial modification with closed-form expected scores, (3) information-theoretic security without key access, and (4) bounded quality loss via KL divergence. Experiments on 173 Wikipedia prompts using Llama-3.2-3B demonstrate that the optimal 7-state soft cycle configuration achieves 100\% detection, 0\% FPR, and perplexity 4.20. Robustness testing confirms detection above 96\% even with 30\% word replacement. The framework enables $O(n)$ model-free detection, addressing EU AI Act Article 50 requirements. Code available at \url{https://github.com/ChenghengLi/MCLW}

Read More

Feb 2, 2026

Prototyping an Embedded Off-Switch for AI Compute

This project prototypes an embedded off-switch for AI accelerators. The security block requires periodic cryptographic authorization to operate: the chip generates a nonce, an external authority signs it, and the chip verifies the signature before granting time-limited permission. Without valid authorization, outputs are gated to zero. The design was implemented in HardCaml and validated in simulation.

Read More

This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.
This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.