Reading the Decoder: Colluding Monitors Reuse Their Own Evidence Heads

AI control often uses one copy of an untrusted model to monitor another. This breaks if the two collude: the policy hides a signal in its code, and the monitor sees it and lets the backdoor through. Most defenses change what the monitor reads. We look at what it computes instead.

We test this in a code-review game with Qwen3-32B as the monitor. When the monitor knows its partner's signal, the signal cuts its flag rate on backdoors it would otherwise catch from 74% to 33%. Inside the monitor, the signal does not get a circuit of its own. It reaches the verdict through about 20 attention heads that normally carry evidence of real backdoors, and patching these heads undoes 85% of the collusion. This is also why collusion is hard to remove without hurting honest monitoring.

Collusion is easier to detect than to remove. A probe trained on known signals catches 45% of attacks that use unseen signals when 5% of tasks can be audited (64% if calibrated per codebook family), against 7% for the monitor itself. The probe fires on harmless rules about the same code feature too, and a second score built from a key-free run mostly separates the two. The same route appears in Mistral-Small-24B and when the key is fine-tuned into the weights, where comparing against a trusted copy of the weights catches 93–100% of attacks. Monitors trained to evade that comparison still collude, by moving the work into their final layers.