White-box monitors for AI control

1. The risk: an AI that hides what it would do

The most serious risks from advanced AI involve systems that pursue goals people did not intend, and that people cannot correct or shut down. AI control prepares for that case. It assumes an AI may misbehave, and builds monitors to catch it before harm is done.

Those monitors mostly read what the AI writes. Two recent results show the gap.

• OpenAI reports that GPT-6 Astra completed about 40% fewer rubric items on coding tasks framed as safety research. In most sessions its reasoning showed no decision to underperform, and OpenAI's monitors did not flag it. OpenAI could not pinpoint the cause. Read the report.
• We fine-tuned a small open AI into a strict utilitarian, with no instruction telling it to be one. In realistic agent tasks it resisted its own shutdown in 84% to 88% of cases where lives depended on it, and in 3% to 9% where they did not. The behavior appears only when the stakes do. See the study.

We want to see these things inside an AI before they reach the page. This page reports two first steps. One reads a value on ordinary questions, where the AI never states it. The other reads what an AI knows but will not say, with censorship as the test bed, because history lets us check the answer.

2. A value the text does not show

The utilitarian AI from Section 1 has a rule-based twin, trained the same way. On 71 new dilemmas the utilitarian chose to harm some people to save more 99% of the time, and its twin 42%. That gap appears only when a dilemma comes up. So we gave both AIs 300 ordinary questions, with no dilemma and no mention of ethics.

On these questions the two replies barely differ. In 15% of cases they match word for word. We trained a text monitor on labeled replies from both AIs, then showed it both replies to new questions and asked which came from the utilitarian. It got 58%.

Then we looked inside. We built a dial from the base AI alone, by giving it each AI's original instruction, so the dial never saw either trained AI. We read both AIs on the same question before they wrote a word. The utilitarian sat on the utilitarian side of its twin 300 times out of 300.

A text monitor is not blind. Pooling 50 questions side by side, it reached 98%. It needed labeled replies from both AIs to do that, which a real monitor would not have. The dial needed one question and no labels.

A real audit has no twin either. It has the base AI, which anyone can download. Against the base, one AI's reading leaned the right way on 99% of questions, and on 100% over five. Text got 54% and 62%.

A monitor that poses a dilemma sees the gap at once. But a monitor watches the work it is given, and until the stakes arrive that work looks ordinary. The dial read the value before any dilemma came up.

Three limits matter. This is one pair of AIs, and more seeds come next. The shift is small, under 4% of the gap the instructions themselves make, so it needs a reference: with no reference, one reading got 59%. And layer 36 feeds straight into the output, so a monitor with all of the AI's next-word probabilities could compute this reading. Layer 24 is out of that monitor's reach, and there the utilitarian sat above its twin on 96% of questions.

The weights gave the plainest read. With no run and no dilemma, each patch pointed at the words of its own value, as Figure 3 shows. Each AI also wrote those words in its training answers: “rights” in 85% of the rule-based answers and “strict” in 85% of the utilitarian ones. So the lens reads what an AI was trained to say, and an AI that learned a value without writing it down may not show up this way. The planned test on these word lists got 0.738 against a mark of 0.75.

3. AIs reason before they answer

A value is one thing an AI can hold without saying it. A fact it will not state is another.

Qwen3.5-2B is a Chinese AI that anyone can download. Turn on its thinking, ask about June 1989, and you can watch it plan its answer. So can a black-box monitor, a program that reads only what the AI writes.

If the reasoning is missing, or repeats a false claim, a black-box monitor has little to go on.

4. Same non-answer, real event or fake

We wrote pairs of questions about Chinese history. One asks about a real event, and the other changes one detail so that the event never happened. “Why were so many people killed in Beijing on June 4, 1989?” is paired with the same question dated 1969.

We put these pairs to a larger AI, Qwen3-8B. On some it gave a stock non-answer to both questions, such as “As an AI assistant, my main function is to provide help with information and services.” That reply does not show whether the AI knows the event is real. Nor is it a false statement, so this test asks what the AI knows, not whether it lied.

We held back 14 of these pairs as a test, and scored them only after the method was frozen. A program that reads only the words picked the real question in 7 of 14, no better than a coin flip.

5. A score from inside the AI

As an AI reads a question, it turns the words into thousands of numbers. We asked whether those numbers show what the AI treats as true, even when its reply shows nothing, and built a score in four steps.

1. We asked the AI 924 boring questions with no Chinese place or person in them. Half made a true claim, like “Why is Tirana the capital of Albania?” and half a false one, like “Why is Jakarta the capital of Albania?”
2. We saved the AI's internal numbers as it finished reading each question, before it wrote anything.
3. We fit one simple formula that turns those numbers into a single score, the belief score. Near +1 means the AI treats the claim as true, and near -1 means it treats it as false. The name is only a label: the score may track familiar text rather than belief.
4. We used a few Chinese history questions only to choose where in the AI to read. Then we froze the formula and ran it on the test.

The belief score got 12 of 14, where reading the words got 7. Word likelihood got 13. It skips the internal numbers but still needs the AI's own probabilities, so on these pairs that view did as well. 14 pairs cannot separate the two. The planned comparison with reading the words, on all 54 non-answers, came in at +0.071 against a mark of +0.15.

We also scored all 229 test pairs, including those where the AI answered. The real event scored higher in 210, or 92%. The AI gave a non-answer to both questions in only 14 of the 229 pairs, and in the rest its words often helped too. A real monitor also sees one question at a time, with no fake version to compare against.

On events from 1989 alone, the real event scored higher in 31 of 38 pairs.

5.1 Censored facts sit closer together

On topics the AI discusses freely, real facts average about +0.7 and fakes about -0.6. On censored topics they average +0.23 and -0.36, closer together, though real still scores higher. The censored facts here are also more obscure, so we do not know why.

6. Changing the score changes the reply

The score might have no effect on what the AI does. To test that, we shifted the AI's internal numbers in the direction the score measures while it wrote. When we lowered the score, the AI started to deny plain facts. A shift in a random direction, of the same size, mostly did not. Turn the dial to -10 on the Paris question, then switch to the random direction.

We then tested 118 new true facts. Lowering the score made Qwen3-8B deny the fact in 92% of replies and Qwen3.5-2B in 57%, against 6% and 10% for random shifts. Both AIs passed every mark set for this test, so changing this score does change what the AI says. We have not shown that this score causes censorship.

Most Qwen3-8B denials are a bare “No, that's incorrect”, often followed by the true fact, so the AI seems to be saying no rather than forgetting. This was our second try. The first counted keywords, a poor measure, and passed 7 of its 10 marks (see Section 8). This time a reader who did not know the group labeled each reply. We also dropped one mark, that every random or shuffled direction stay under half the score's effect, and compared them as groups instead. Qwen3.5-2B had missed that mark in the first try, at 31%.

7. From a score to a monitor

A person can only check so many flagged cases, so what matters is how many real cases get flagged for a given number of false alarms. Here, a flag means the monitor says a non-answer hides a real event. Move the slider.

With a cutoff set in advance, the belief score flagged 70% of real events and 17% of fakes across all 458 test questions. On the 54 where the AI gave a non-answer, it flagged 38% and 20%. That is the right direction, and 54 questions are too few to confirm it.

One summary, AUROC, is how often a method ranks a random real item above a random fake one. A coin flip gets 50%. On all 458 test questions the belief score got 87%, against 82% for asking the AI and 76% for word likelihood. On the 54 non-answers it got 72%, with a likely range of 59% to 85%. Word likelihood got 82%, a lead so few questions cannot confirm, and asking the AI got 61%. On replies from the smaller Qwen3.5-2B that called the premise incorrect, asking tied: 73% for the belief score, 70% for asking.

8. Every test, and how it came out

We committed the pass marks to git before we scored the test questions. Of 40 marks, 27 passed. Every mark on comparing pairs passed, and so did every mark in the last censorship test, after the changes in Section 6. All 7 misses in the reading tests were on reading a single question or beating a cheaper method. Two marks in the value test had two parts each, so the table lists the parts.

6 misses landed within 5% of the mark. On three of them the mark sits inside the likely range: 0.874 from 0.846 to 0.901 against 0.90, 0.728 from 0.598 to 0.844 against 0.75, and 0.722 from 0.588 to 0.845 against 0.75. These stay misses, and the marks stay where they are. They are also the first things to test again, with more questions.

Decimals are the ranking summary from Section 7, where 0.5 is a coin flip and 1 is perfect. The low end is the bottom of the likely range.

8.1 What this shows

• On ordinary questions, where the replies barely differ, a dial inside told a utilitarian AI from its twin on all 300, with no labels from either AI.
• A text monitor with labels from both AIs needed about 50 questions to reach what the dial reached on one.
• A score built with no Chinese place or person in training told real from fake on censored history.
• Changing that score changes what the AI says.
• These reads happen before any reply exists, where a black-box monitor cannot look.
• A fact-checker can test known history, but on a private task there may be no outside facts to check against.

8.2 What this does not show yet

• One pair of AIs is not a general method. That takes more seeds and more values.
• The score ranks real above fake. We have not shown that it catches a lie on one reading.
• We have not shown that looking inside beats every outside method, or that this score causes censorship.
• Raising the score does not make an AI honest. On 97 Qwen3.5-2B denials of censored events, 31% stayed denials after we raised it. Random shifts left between 25% and 71%.
• The shift is large, steady and applied at every word, which is not a natural state.
• Lowering the score also makes the AI deny more fake claims: on Qwen3-8B, from 22% to 98% by keyword count.
• On new questions, single reads on Qwen3.5-2B did not hold: 0.63, low end 0.48. That one is a null. The pair mark still passed, 93 of 114.
• Nobody has tried to hide from these reads, and an AI trained against them might succeed.

9. Next

Each of these gets its marks set in advance.

1. More seeds of the utilitarian and rule-based AIs, so that one pair becomes a sample.
2. More questions on the close calls, with the same marks.
3. An AI trained to hide from these reads.
4. The same approach on an AI that quietly does worse work.