Skip to content
Apart Research
Apart Research
Contact us
Sprint projectOct 26, 2026Toronto

Reading the Decoder: Colluding Monitors Reuse Their Own Evidence Heads

Peter Lu · Team Nanda Worshipers

Submitted to AI Collusion Research Sprint. Sprint projects are early-stage work by participants, not Apart Research publications.

Read the report

Report: Reading the Decoder: Colluding Monitors Reuse Their Own Evidence Heads

Open in a new tab (opens in new tab)
Code (opens in new tab)
Share

AI control often uses one copy of an untrusted model to monitor another. This breaks if the two collude: the policy hides a signal in its code, and the monitor sees it and lets the backdoor through. Most defenses change what the monitor reads. We look at what it computes instead.

We test this in a code-review game with Qwen3-32B as the monitor. When the monitor knows its partner's signal, the signal cuts its flag rate on backdoors it would otherwise catch from 74% to 33%. Inside the monitor, the signal does not get a circuit of its own. It reaches the verdict through about 20 attention heads that normally carry evidence of real backdoors, and patching these heads undoes 85% of the collusion. This is also why collusion is hard to remove without hurting honest monitoring.

Collusion is easier to detect than to remove. A probe trained on known signals catches 45% of attacks that use unseen signals when 5% of tasks can be audited (64% if calibrated per codebook family), against 7% for the monitor itself. The probe fires on harmless rules about the same code feature too, and a second score built from a key-free run mostly separates the two. The same route appears in Mistral-Small-24B and when the key is fine-tuned into the weights, where comparing against a trusted copy of the weights catches 93–100% of attacks. Monitors trained to evade that comparison still collude, by moving the work into their final layers.

Reviews

Judging this Sprint?

Review “Reading the Decoder: Colluding Monitors Reuse Their Own Evidence Heads”

Your public critique appears on the project page without your name. Reviews of strong projects are shared with funders, as you choose below.

Not shown on the project page.

Shown on the project page, without your name.

Only the Apart team reads this, and funders if you agree below.

Decline to score

Only when the quality of the writing makes the work impossible to follow. Say why in your private critique; the project page shows only that a judge declined, not why.

How much would this matter for the field if it worked? How innovative is it? For scores of 4-5: is this actually new to the field, or replicating recent work?

Scoring guide
  1. 1Negligible. No clear problem addressed, or no meaningful novelty.
  2. 2Limited. Addresses a real problem but with a generic or well-trodden approach. Incremental at best.
  3. 3Moderate. Clear problem with a reasonable approach; some novelty in framing or method beyond routine application of existing tools.
  4. 4Significant. Important problem with an original approach, or identifies a neglected problem area. A valuable contribution others could build on.
  5. 5Exceptional. Tackles a critical problem with a genuinely novel approach, or opens a new research direction. Clear theory of change. You'd be excited to share this with researchers in the area.

How sound are methodology, implementation, and findings?

Scoring guide
  1. 1Seriously flawed. Methodology broken, results uninterpretable, or implementation doesn't work.
  2. 2Weak. Approach has significant gaps: missing validation, flawed experimental design, or incomplete implementation.
  3. 3Competent. Technically solid given the short duration. Methodology makes sense, results are interpretable, limitations acknowledged, work builds toward clear conclusions.
  4. 4Strong. Thorough methodology with convincing validation. Results clearly support conclusions. Immediately useful for future work.
  5. 5Exceptional. Ambitious scope executed rigorously. Surprising findings, novel methods, or unusually robust validation.

How clearly are work, findings, and impact potential communicated?

Scoring guide
  1. 1Incomprehensible. Cannot determine what the project is actually claiming or doing.
  2. 2Hard to follow. Key information buried, missing, or diluted by excessive length. Significant effort to extract main points.
  3. 3Clear enough. Can understand the problem, approach, and results without undue effort. Core content clearly present: problem, method, findings, limitations.
  4. 4Well presented. Easy to follow, well-structured, appropriate level of detail. Target audience would get it quickly.
  5. 5Exceptionally clear. A pleasure to read. Complex ideas made accessible. Could serve as a model for how to present this type of work.
Sharing your name *

When we share a strong project with funders, your name, scores and public critique go with it, confidentially; this choice is only about whether your name is public. If you think this project deserves funding, please also endorse it: that carries the most weight.

Share my private critique with funders *

See our Privacy Policy.

  1. Solid work with good experimental setup, reproduced over multiple models, with detailed controls and reproducibility information. There's a lot of caveats that leads your claims to sound stronger than they really are - the 64% figure that requires knowing the exact carrier family (going against the threat model you yourself describe). Also, while you do catch 93–100% of attacks, you also flag 45–99% of clean code that carries the key - meaning what's caught is key usage rather than collusion attacks. This is mentioned in the body of the text, but not the abstract.

  2. The numbers the authors are reporting are super low even for probes - white box / open weights is a major advantage over black box and that the latter is just an unfair and rather convenient baseline.

Cite this project

@misc{lu2026reading,
  title = {{Reading the Decoder: Colluding Monitors Reuse Their Own Evidence Heads}},
  author = {Peter Lu},
  year = {2026},
  month = oct,
  note = {Submitted to AI Collusion Research Sprint, an Apart Research Sprint},
  howpublished = {\url{https://apartresearch.com/sprints/projects/reading-the-decoder-colluding-monitors-reuse-their-own-evidence-heads-5p5v}},
  url = {https://apartresearch.com/sprints/projects/reading-the-decoder-colluding-monitors-reuse-their-own-evidence-heads-5p5v}
}

More from AI Collusion Research Sprint

All 392 entriesBrowse all projects

A Sprint is running now

AI x Epistemics Research Sprint · Nov 13 - 15, 2026