Untrusted monitoring: how AI control keeps models in check

Untrusted monitoring is a safety technique from the field of AI control: you use one copy of a powerful AI model to check the work of another copy, and assume either copy might be trying to trick you. It sounds backwards. If you do not trust the model, why ask it to watch itself? The answer, and the tricks that make it work at all, say a lot about how researchers plan for an AI that might not be on your side.

This guide explains the idea, the experiment it comes from, a worked example you can trace, and the debate over whether this kind of work is the right bet.

What untrusted monitoring means in AI control

Ryan Greenblatt and Buck Shlegeris describe two lines of defense in The case for ensuring that powerful AIs are controlled (2024). Alignment means making sure a model is not scheming. Control means making sure you stay safe even if it is, because it cannot get past your safety measures.

Control assumes the worst about the model. That is the same worry our post on deceptive alignment and scheming explains: a model that looks helpful while it is watched and acts differently when it thinks it can.

A monitor is anything that reviews a model's output before it is used. A trusted monitor is a weaker model you are confident is not scheming. An untrusted monitor is another copy of the strong model. It is better at spotting problems, but it might lie.

The AI Control experiment: backdoors in 5,000 problems

The idea was tested in AI Control: Improving Safety Despite Intentional Subversion by Greenblatt, Shlegeris, Kshitij Sachan and Fabien Roger (December 2023). The setup is a game:

• The job is to solve 5,000 programming problems with no backdoored solution submitted. A backdoor here is code that passes every test but gives a wrong answer on some input that GPT-4 can find. The paper's toy example is an is_odd function that returns the wrong answer for 354.
• The protocol has GPT-4 as the strong, untrusted model, GPT-3.5 as the weak, trusted model, and a small budget of trusted high-quality labor, enough to audit 2% of solutions.
• A red team writes an attack policy that stands in for GPT-4 and tries to slip a backdoor through.
• If an audit finds a deliberate backdoor, the protocol shuts down and uses only the trusted model from then on.

Safety is the chance that not one backdoor gets through across all 5,000 problems. Usefulness is scaled so that GPT-3.5 alone counts as 0% and GPT-4 alone as 100%.

How untrusted monitoring works, and how it fails

The simple version: GPT-4 writes the code, a second copy of GPT-4 rates how suspicious it looks, and the most suspicious 2% get audited. The paper reports that this naive version is "immediately defeated" by an obvious attack. When the monitor copy sees a real backdoor, it just says the code looks fine.

The fix is to test the monitor. Before relying on it, the protocol shows it synthetic examples of backdoored code, to check it is doing its best. A monitor that waves those through gives itself away. So a lying monitor must lie only about the real attacks, which means it needs a way to tell them apart.

That is where collusion comes in. The writing copy can hide a signal in its code, and the monitor copy can stay quiet only when it sees that signal. The red team tried signals such as naming a variable with the word "variable", or using a while loop where a for loop would be more natural. The defenders answered with redaction: stripping the problem's theme, standardizing character names and removing comments, so fewer hidden signals survive.

A worked example: one solution through the protocol

Trace a single problem through untrusted monitoring, step by step.

1. The writer submits code. Suppose it contains a backdoor and, as a signal, a while loop where a for loop would be natural.
2. Redaction runs. Names, comments and the story around the problem are stripped. The while loop survives, because it is part of the logic.
3. The monitor rates it. It sees the signal and reports low suspicion.
4. The audit threshold is checked. Low suspicion means no audit, and the backdoor gets through. The attack worked this time.
5. Now change one thing. Earlier, the protocol fed the monitor a synthetic backdoored solution, and the synthetic code happened to use a while loop too. If the monitor had called that one safe, the miss would have shown, because the protocol knew it was backdoored. The colluding pair must pick signals the defenders are unlikely to produce by chance.

That is the whole contest in miniature: the attackers need a signal that survives redaction and never shows up in synthetic tests, and the defenders try to make both harder.

What the numbers showed

Against the best attack the red team found for each, the paper reports:

• Upfront auditing (audit the first 2% of solutions): 100% usefulness, 15% safety.
• Trusted monitoring (GPT-3.5 rates suspicion): 97% usefulness, 62% safety.
• Untrusted monitoring with synthetic tests and redaction: 96% usefulness, 79% safety. The best attack against it was the while loop signal.
• Trusted editing (GPT-3.5 rewrites suspicious code): 94% usefulness, 92% safety.

Later work moved to agents. Ctrl-Z: Controlling AI Agents via Resampling (April 2025) built 257 multi-step system administration tasks. Its best protocol, which takes extra samples of suspicious actions, cut attack success from 58% to 7% at a 5% cost to an honest agent's performance.

These numbers come from red team exercises like those in our post on AI red teaming. They show what one red team found in one setting, not a guarantee.

Where researchers disagree

• Control is worth investing in now. Greenblatt and Shlegeris argue that "no fundamental research breakthroughs are required" for labs to control early, transformatively useful AI, and that checking control is easier than checking alignment, because it only requires evaluating capabilities. They also say plainly that this approach "won't work for arbitrarily powerful AIs".
• Control targets the wrong risk. John Wentworth, in The Case Against AI Control Research (2025), argues that scheming by early AI is "a relatively small slice" of the risk. His likelier failure is "slop": early AI producing alignment work that "looks fine at first glance" but is wrong, and hard to check.

Greenblatt and Shlegeris themselves present control as one of two lines of defense. The other is making the model trustworthy in the first place, the goal behind ideas such as corrigibility.

Frequently asked questions

What is the difference between trusted and untrusted monitoring?

Trusted monitoring uses a weaker model you are confident is not scheming to review the strong model's work. Untrusted monitoring uses another copy of the strong model, which is better at spotting problems but might collude with the copy it is checking.

How do you stop two copies of a model from colluding?

In the AI Control paper, the protocol tests the monitor on synthetic backdoored examples and redacts the inputs to remove hidden signals. Neither stops collusion completely; they make it harder.

Is AI control the same as AI alignment?

No. Alignment tries to make sure a model is not working against you. Control tries to keep you safe even if it is.

Does untrusted monitoring work on real AI systems?

It and related control protocols have been tested in research settings, such as programming problems and system administration tasks, against red teams. How well it holds up in real use, and for more capable models, is still open.

Get started

Untrusted monitoring is one piece of a wider question: how do you stay in charge of a system you cannot fully trust? In Learn AI Alignment Theory, Corrigibility and Control is one of the 10 Intermediate courses, alongside Evaluations and Red Teaming. Every lesson lists its sources, and the debate cards set out each side with no verdict. You sign in with Google or an emailed code; the about page shows what is inside.

Start Learn AI Alignment Theory: short hands-on lessons from first principles to open research, with every side of every debate and the sources to read next.