Simulated control evaluations predict real-world monitor performance within 3.6% error
The claim
The authors claim that simulated control evaluations (SCEs) can accurately predict monitor performance and attack outcomes in real deployments, with errors comparable to variability between real runs.
Published as: “Simulated Control Evaluations”
So what
If adopted, SCEs could let AI developers assess monitor safety more cheaply and with higher realism than existing control settings.
The five-minute version
The authors build a simulator (gpt-6-astra with a gpt-5.6-sol fallback) that mimics tool responses in LinuxArena environments and use an LLM judge to assess attack success. They compare simulated runs to real executions in LinuxArena and to a simpler BashArena baseline. The simulation reproduces attack strategies and monitor reasoning with a safety-prediction error of 3.6 percentage points, far better than the 10.1 pp error of BashArena, and its behavioral divergence is on par with repeat real runs. Evidence is limited to settings where real execution is possible and does not cover long-horizon multi-agent attacks.
What they found 2
- Safety prediction error of SCEs is 3.6 pp versus 10.1 pp for BashArena.
“Its error in predicting the main safety number is 3.6 percentage points, versus 10.1 for BashArena.”
- Simulated and real safety curves track each other closely, leading to similar monitor rankings.
“The simulated and executed curves closely track one another: an evaluator using SCE would reach similar conclusions about which monitors protect better and how much additional auditing helps.”
What undercuts it the paper’s own results
- we can only verify simulator fidelity in settings where real execution is possible, so applying SCEs to deployment involves some extrapolation.
- The clearest gap is long-horizon, multi-agent attacks, which we haven’t yet built simulators for.
Stated limits 4
- Verification of simulator fidelity is limited to environments where real execution can be performed.
- Results must be extrapolated to actual deployments, which may differ.
- Current simulators do not handle long-horizon, multi-agent exploit chains.
- Assumes a trusted simulator; untrusted simulators could bias results.
What’s new here 4
- Shows that simulation can predict safety metrics with error comparable to natural run-to-run variance.
- Demonstrates order-of-magnitude lower KL divergence between simulated and real behavior than between BashArena and real.
- Finds that only a few percent of simulated samples are needed to beat full BashArena predictions.
- Provides a methodology for measuring qualitative behavior transfer using embeddings and clustering.
Artifacts & methods 6
- gpt-6-astrasystem
- gpt-5.6-solsystem
- LinuxArenaevaluation
- BashArenaevaluation
- attack success judge (gpt-5.6-sol)primitive
- KL divergence behavioral comparison via embeddings and clusteringprimitive