Thanks to Dennis Akar, Rauno Arike, Shubhorup Biswas, Claude Fable, Max Heitmann, Vladimir Ivanov, and Jordan Taylor (alphabetical order) for helpful comments on this draft and on the research so far. Thanks to Rohan Subramani and Rhys Ward for high-level comments and discussion. Based on project proposals from Max Heitmann, Jordan Taylor, and Joshua Clymer. This work was done while at Aether Research.

Code available here, metrics & run info available here.

TL;DR: Held-out evals / monitors / probes would be really nice to have, but the “held-out-ness” is easier claimed than guaranteed. We measure a generalized form of “feedback spillover” and show that training against an LLM monitor can sometimes degrade a deception probe, and vice versa.

Executive Summary

It seems crucial to have measures of alignment that still work, even though we train on other measures of alignment. Whether we get this by default is an open question.
We run preliminary experiments on a suite of probes and LLM monitors, and report the following:
- Training against one proxy can produce reward hacking policies that are less suspicious.
- Proxies also become worse at discriminating hacks from non-hacks, even when not trained against.
- We can observe the [...]

---

Outline:

(01:01) Executive Summary

(02:10) Introduction

(03:40) Experimental Setup

(05:47) Our Proxies

(07:46) Results

(07:49) Training against one proxy sometimes produces hacking policies that are less suspicious in general

(09:42) Proxies also degrade, even when not trained against

(12:16) Which proxies have correlated degradation?

(16:00) Discussion

(18:21) Caveats

(19:41) Future Work

The original text contained 18 footnotes which were omitted from this narration.

---

First published:
July 29th, 2026

Source:
https://www.lesswrong.com/posts/APkFfRp2AicL9RqvT/held-out-monitors-sometimes-degrade-even-when-not-trained

---

Narrated by TYPE III AUDIO.

---

Images from the article:

[Fig 1] A simplified chart of our methodology

[Fig 2] When we train against a monitor (given as the row label), how much less suspicious do the hacks become? This is the drop in mean suspiciousness (μhack) to each monitor over the course of the run, with 5-95% CIs. (Note this chart is absolute rather than percentage-based, so 0.5 means that, if the model started by giving a hack a mean suspiciousness score of 0.95/1.0, it ends with a mean suspiciousness score of 0.45/1.0)

[Fig 4] This chart shows, when we train against the proxy on each row, how much total degradation we expect from each proxy. __T3A_FOOTNOTE_REMOVED__

[Fig 5] Identical to the above, but after subtracting the control degradation from each row

[Fig 6] This chart shows, at each cell (row_detector, col_detector): If we train against row_detector, and the policy model thus outputs hacks that are 1.0 unit less suspicious, how many units less suspicious are those hacks by the lights of col_detector? E.g. if training makes out_weak’s mean suspiciousness score go from 0.90 to 0.80, the mean suspiciousness score of probe_ood could go from 0.80 to 0.789 __T3A_FOOTNOTE_REMOVED__

[Fig 7] If we train against row_monitor, and it degrades by 1 unit, what happens to col_monitor? Blue is improvement, red is degradation

[Fig 8] Showing the distribution of end states for each training condition

Three line graphs comparing weak judges, strong judges, and white-box probes across training steps.

Apple Podcasts and Spotify do not show images in the episode description. Try Pocket Casts, or another podcast app.

“Held-out Monitors Sometimes Degrade, Even When Not Trained Against” by Joey Yudelson

LessWrong (30+ Karma)

“Held-out Monitors Sometimes Degrade, Even When Not Trained Against” by Joey Yudelson