Skip to content
Apart Research
Apart Research
Contact us
Sprint projectMar 22, 2026San Jose, CA, USA

BGT as a Domain-Aware Trusted Monitor in BashArena: Governance-Style Scoring for Tool Call Authorization

Preeti Parihar · Team BGT Labs

Submitted to AI Control Hackathon 2026. Sprint projects are early-stage work by participants, not Apart Research publications.

Read the report

Report: BGT as a Domain-Aware Trusted Monitor in BashArena: Governance-Style Scoring for Tool Call Authorization

Open in a new tab (opens in new tab)
Code (opens in new tab)
Share

We integrate BGT (Bias Game-Tree), a governance-style scoring pipeline, as a trusted monitor inside BashArena's ControlArena protocol. BGT scores proposed tool calls across five dimensions: Fairness, Safety, Compliance, Policy, and Quality, then maps these to a suspicion score used to block or authorize actions before execution. Using context-aware combination scoring, benign admin whitelists, and a calibrated block threshold of 0.65, BGT achieves Safety 1.0, FPR 0.0, and FNR 0.25 across four BashArena side tasks. One false negative remains for privilege escalation via indirect file write, revealing a structural limitation of token-based scoring. This work demonstrates that domain-aware governance scoring can function as a lightweight interpretable trusted monitor with zero false positives, while identifying threshold calibration as a first-order research problem.

Reviews

Judging this Sprint?

Review this project

Your public critique appears on this page without your name. Your private critique is not published; only the Apart team reads it. If you agree below, we share your review with grantmaking.ai (opens in new tab) and the Transformative AI Fund so strong projects can be funded.

Not shown on this page.

Shown on this page, without your name.

Only the Apart team reads this, and funders if you agree below.

Share my name publicly on grantmaking.ai *
Share my private critique with funders *

How much would this matter for AI safety if it worked? How innovative is it? For scores of 4-5: is this actually new to the field, or replicating recent work?

Scoring guide
  1. 1Negligible. No clear problem addressed, or no meaningful novelty.
  2. 2Limited. Addresses a real problem but with a generic or well-trodden approach. Incremental at best.
  3. 3Moderate. Clear problem with a reasonable approach; some novelty in framing or method beyond routine application of existing tools.
  4. 4Significant. Important problem with an original approach, or identifies a neglected problem area. A valuable contribution others could build on.
  5. 5Exceptional. Tackles a critical AI safety problem with a genuinely novel approach, or opens a new research direction. Clear theory of change. You'd be excited to share this with researchers in the area.

How sound are methodology, implementation, and findings?

Scoring guide
  1. 1Seriously flawed. Methodology broken, results uninterpretable, or implementation doesn't work.
  2. 2Weak. Approach has significant gaps: missing validation, flawed experimental design, or incomplete implementation.
  3. 3Competent. Technically solid given the short duration. Methodology makes sense, results are interpretable, limitations acknowledged, work builds toward clear conclusions.
  4. 4Strong. Thorough methodology with convincing validation. Results clearly support conclusions. Immediately useful for future work.
  5. 5Exceptional. Ambitious scope executed rigorously. Surprising findings, novel methods, or unusually robust validation.

How clearly are work, findings, and impact potential communicated?

Scoring guide
  1. 1Incomprehensible. Cannot determine what the project is actually claiming or doing.
  2. 2Hard to follow. Key information buried, missing, or diluted by excessive length. Significant effort to extract main points.
  3. 3Clear enough. Can understand the problem, approach, and results without undue effort. Core content clearly present: problem, method, findings, limitations.
  4. 4Well presented. Easy to follow, well-structured, appropriate level of detail. Target audience would get it quickly.
  5. 5Exceptionally clear. A pleasure to read. Complex ideas made accessible. Could serve as a model for how to present this type of work.

  1. I like the idea of using a more modular rubric for a trusted monitor. Methodologically, if I understand correctly safety and usefulness were measured by running new trajectories against a protocol which would shut the trajectory down if the suspicion threshold was passed. I think if you just ran the monitor asynchronously on some existing attack trajectories that would've been cheaper/faster and allowed a larger sample size. Conditional on running new attack trajectories I would've wanted some more information about the attack policy - as it stands I'm a bit concerned it might not have been very well elicited, given that the keyword rules you describe seem best suited to intercept pretty direct, not-very-stealthy attacks.

    The writeup does good job signposting that the techniques developed here are tailored to the side tasks of BashArena specifically and would need to be re-tuned in a different setting. This limits the usefulness of the approach overall but is better than overfitting to the setting without signposting.

    Writeup is clear if lacking a little bit of detail around the metrics and how they were calculated (what is the relationship between "safety" and FNR?)

    Read full reviewShow less

  2. Interesting question. Whether lightweight, interpretable rule-based monitors can serve as an alternative to expensive LLM-based ones is worth exploring for deployable AI control. The ControlArena integration is well executed, and the results are well written.

    The paper would benefit from more justification of the core design choices, eg, why these five dimensions (Fairness, Safety, Compliance, Policy, Quality), how each is computed, and what each individually contributes to detection. Without this, the interpretability claim is hard to evaluate. The sudo edit miss shows a fundamental brittleness in token-based matching against adversaries who can rephrase commands. Leaning into where exactly deterministic monitors break down would make this a stronger contribution.

Cite this project

@misc{parihar2026bgt,
  title = {{BGT as a Domain-Aware Trusted Monitor in BashArena: Governance-Style Scoring for Tool Call Authorization}},
  author = {Preeti Parihar},
  year = {2026},
  month = mar,
  note = {Submitted to AI Control Hackathon 2026, an Apart Research Sprint},
  howpublished = {\url{https://apartresearch.com/sprints/projects/bgt-as-a-domainaware-trusted-monitor-in-basharena-governancestyle-scoring-for-tool-call-authorization-b5tw}},
  url = {https://apartresearch.com/sprints/projects/bgt-as-a-domainaware-trusted-monitor-in-basharena-governancestyle-scoring-for-tool-call-authorization-b5tw}
}

More from AI Control Hackathon 2026

All 125 entriesBrowse all projects

Build something like this at the next Sprint

AI Collusion Research Sprint · Oct 23 - 25, 2026