# When can we trust untrusted monitoring? A safety case sketch across collusion strategies

arXiv: https://arxiv.org/abs/2602.20628 · HTML: https://mlsanity.com/paper/2602.20628/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 24 Feb 2026.

## Built on by (most cited first, 10 of 10)

- [Training Deliberative Monitors for Black-Box Scheming Detection](https://mlsanity.com/paper/2605.29601/) (2026)
- [CIAware-Bench: Benchmarking Control Intervention Awareness Across Frontier LLMs](https://mlsanity.com/paper/2606.11063/) (2026)
- [Beyond Reward Suppression: Reshaping Steganographic Communication Protocols in MARL via Dynamic Representational Circuit Breaking](https://mlsanity.com/paper/2603.15655/) (2026)
- [TraceGuard: Structured Multi-Dimensional Monitoring as a Collusion-Resistant Control Protocol](https://mlsanity.com/paper/2604.03968/) (2026)
- [Honeypot Protocol](https://mlsanity.com/paper/2604.13301/) (2026)
- [Bounded Sovereignty and the Control Tax: Pricing AI Oversight When the Deployer Does Not Own the Model](https://mlsanity.com/paper/2608.19216/) (2026)
- [Counter-Swarm Doctrine: Containing Coordinated Agent Intrusions](https://mlsanity.com/paper/2609.06140/) (2026)
- [Who Audits Whom, on What Substrate, with What Evidence? An Independence-Graded Audit Protocol for Agentic AI](https://mlsanity.com/paper/2609.18272/) (2026)
- [When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systems](https://mlsanity.com/paper/2609.23700/) (2026)
- [Style, Not Self: Surface Cues Explain Zero-Shot Code Attribution by Large Language Models](https://mlsanity.com/paper/2609.30048/) (2026)

## Abstract (arXiv)

AIs are increasingly being deployed with greater autonomy and capabilities, which increases the risk that a misaligned AI may be able to cause catastrophic harm. Untrusted monitoring -- using one untrusted model to oversee another -- is one approach to reducing risk. Justifying the safety of an untrusted monitoring deployment is challenging because developers cannot safely deploy a misaligned model to test their protocol directly. In this paper, we develop upon existing methods for rigorously demonstrating safety based on pre-deployment testing. We relax assumptions that previous AI control research made about the collusion strategies a misaligned AI might use to subvert untrusted monitoring. We develop a taxonomy covering passive self-recognition, causal collusion (hiding pre-shared signals), acausal collusion (hiding signals via Schelling points), and combined strategies. We create a safety case sketch to clearly present our argument, explicitly state our assumptions, and highlight unsolved challenges. We identify conditions under which passive self-recognition could be a more effective collusion strategy than those studied previously. Our work builds towards more robust evaluations of untrusted monitoring.