# The Oversight Gap: What LLM Safety Monitors Miss, and Why It Is Not Capability

arXiv: https://arxiv.org/abs/2609.07162 · HTML: https://mlsanity.com/paper/2609.07162/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 13 of its 19 references that are in the map.
- First posted on arXiv 7 Sep 2026.

## Builds on (most cited first, 13 of 13)

- [Towards Understanding Sycophancy in Language Models](https://mlsanity.com/paper/2310.13548/) (2023)
- [Discovering Language Model Behaviors with Model-Written Evaluations](https://mlsanity.com/paper/2212.09251/) (2022)
- [Counterfactual Fairness](https://mlsanity.com/paper/1703.06856/) (2017)
- [Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training](https://mlsanity.com/paper/2401.05566/) (2024)
- [Frontier Models are Capable of In-context Scheming](https://mlsanity.com/paper/2412.04984/) (2024)
- [AI Control: Improving Safety Despite Intentional Subversion](https://mlsanity.com/paper/2312.06942/) (2023)
- [AI Sandbagging: Language Models can Strategically Underperform on Evaluations](https://mlsanity.com/paper/2406.07358/) (2024)
- [Optimal Algorithms for Testing Closeness of Discrete Distributions](https://mlsanity.com/paper/1308.3946/) (2013)
- [Pairwise or Pointwise? Evaluating Feedback Protocols for Bias in LLM-Based Evaluation](https://mlsanity.com/paper/2504.14716/) (2025)
- [Detecting Safety Violations Across Many Agent Traces](https://mlsanity.com/paper/2604.11806/) (2026)
- [Distributed Attacks in Persistent-State AI Control](https://mlsanity.com/paper/2607.02514/) (2026)
- [Monitoring Hyperproperties](https://mlsanity.com/paper/1807.00758/) (2018)
- [The Complexity of Monitoring Hyperproperties](https://mlsanity.com/paper/2101.07847/) (2021)

## Abstract (arXiv)

Several properties safety monitors are asked to certify, among them cross-tenant noninterference, sandbagging and evaluation awareness, are 2-safety hyperproperties, witnessed only by two executions. The standard consequence is a binary impossibility: one trace cannot decide them. We replace the binary with a measurement. A tight bound puts the balanced accuracy of any single-trace monitor at tfrac12+tfrac12,TV(P0,P1), turning undecidability into a graded detectability frontier and defining an oversight gap: a monitor's shortfall below it. On a leak family with closed-form TV, nine LLM monitors are optimal at TV=0 but capture little signal as TV grows; at TV=1, where a 20-line membership check scores 100%, they average 60.9%. That shortfall is mostly not capability: naming what to check closes 61% of it while leaving the TV=0 control at chance. The same split runs through a 2×2 factorial: an imagined second run leaves monitors at chance (50.4%) while the same rule on an executed second run reaches 90.0%, and a stored oracle without a comparison procedure yields only 68.2%. Information and procedure are each necessary and neither is capability. Under nondeterminism, replay tracks a closed-form k-replay curve only under the right projection, and a projection frontier shows the resulting dilemma is forced: narrow misses 98.6% of off-channel leaks, broad flags 75.7% of clean traffic, and attainable accuracy decays like 1/(qm) in the benign-variation rate and the channel count. Finally, two frontier LLM judges certified an earlier version of our own benchmark as sound while a sign test found a directional bias (p=2.7×10-5) that invalidated three of our findings. Construction validity for hyperproperty benchmarks should be proved mechanically, not audited by models.