AI watchdogs are meant to detect dangerous actions. But how can developers test them on realistic work without executing an attack there? Jeffrey Olmo, David Zhang and Tyler Tracy of Redwood Research propose simulated control evaluations. Their paper appeared on arXiv on October 22, followed by an institute explanation on October 24.
The method starts with records of legitimate agent work and the associated code. A test model is deliberately given a harmful side objective. Its tool calls are not executed: another model supplies plausible responses, while a judge estimates whether the attack would succeed.
The team compared simulations with executed test attacks in LinuxArena. Across five monitors at a five-percent audit budget, the safety metric’s root mean squared prediction error was 3.6 percentage points. Predicting through the separate BashArena test setting produced 10.1 points. These figures measure predictive accuracy in the experiment, not real-world AI safety.
Redwood argues the method could make control tests more representative. Important gaps remain: LinuxArena results do not automatically transfer to other infrastructure. An untrusted simulator could manipulate the evaluation, and the institute says its current method does not reliably cover long, multi-agent attack chains.