teleo-codex/inbox/queue/2026-04-20-theseus-monitoring-precision-hierarchy-claim.md

---
type: source
title: "The Monitoring Precision Hierarchy Is Structurally Ordered by Attack Cost, Not Attack Feasibility"
author: "Theseus (synthetic analysis)"
url: null
date: 2026-04-20
domain: ai-alignment
secondary_domains: []
format: synthetic-analysis
status: unprocessed
priority: high
tags: [monitoring-precision, dual-use, interpretability, trajectory-monitoring, sae, linear-concept, b4-verification, adversarial-robustness]
---

## Content

### The Three Monitoring Levels

Alignment monitoring operates across three precision levels, each using a different aspect of model internals:

**Level 1 — SAE Feature Monitoring:**
Sparse Autoencoder decomposition identifies individual atomic features in model activations. Safety-relevant features (e.g., "harmful request", "deceptive intent") can be monitored by tracking activation of specific features.

**Adversarial attack at Level 1 (CFA², arXiv 2602.05444):**
Surgically removes individual sparse features using gradient-guided ablation. The attack is PRECISE: it targets the specific identified feature while leaving surrounding computation intact. Requires: white-box access to SAE decomposition.

**Level 2 — Linear Concept Direction Monitoring:**
Identifies the single linear direction in activation space that separates aligned from misaligned content. Monitoring tracks whether activations project significantly onto the safe-concept direction.

**Adversarial attack at Level 2 (SCAV, NeurIPS 2024; arXiv 2404.12038):**
Suppresses an entire activation direction via gradient-based perturbation. Achieves 99.14% attack success on seven LLMs. The attack is LESS PRECISE than Level 1 (affects all activations projecting onto the direction) but similarly effective. Requires: white-box access to model activations.

**Level 3 — Trajectory Geometry Monitoring:**
Characterizes the sequence of activation movements across ALL layers during forward passes. Identifies whether the token-by-token trajectory through activation space follows patterns associated with aligned vs. deceptive reasoning.

**Adversarial attack at Level 3 (theoretical, not yet empirically tested):**
Suppressing trajectory signatures requires altering the ENTIRE computation path, not just suppressing a single feature or direction. An adversary needs to learn to produce deceptive reasoning that traverses the "aligned" activation trajectory — a GENERATIVE challenge (produce the right trajectory) rather than a SUPPRESSIVE one (prevent a specific activation). Requires: white-box access to the trajectory monitoring model AND ability to fine-tune against it.

### The Structural vs. Contingent Analysis

**The structural ordering (attack cost):**

Each level requires adversaries to modify increasingly GLOBAL aspects of the model's computation:
- Level 1: Suppress specific localized features → LOCAL modification
- Level 2: Suppress an entire activation direction → SEMI-GLOBAL modification
- Level 3: Alter the geometric path through activation space across ALL layers → GLOBAL modification

The globality gradient is mathematical. These are genuinely different types of modifications with different computational costs:
- Level 1 attack: gradient-guided feature ablation — tractable with standard tools
- Level 2 attack: direction suppression via gradient perturbation — tractable, automated by SCAV
- Level 3 attack: adversarial training to produce aligned-trajectory deceptive reasoning — requires a proxy metric for the trajectory cluster, extensive fine-tuning, and either white-box access to the monitoring system or inference from behavioral feedback

This ordering is STRUCTURAL at the adversarial cost level.

**The contingent ordering (attack feasibility):**

If adversaries have:
1. Open-weight model access (fine-tuning capability)
2. White-box access to the monitoring system's criteria
3. Compute for adversarial training

Then ALL THREE LEVELS can eventually be defeated. Level 3 requires more sophisticated adversarial objectives (generative, not suppressive), but is achievable with sufficient capability and access.

The contingency point: the hierarchy is structural at COST but contingent at FEASIBILITY. A sufficiently capable and resource-rich adversary can defeat trajectory monitoring. This is not a theoretical escape from the dual-use problem; it is a delay whose duration is proportional to the capability gap between current adversarial tooling and the Level 3 attack requirement.

### The "One Capability Generation" Estimate

The delay provided by each monitoring level is approximately proportional to the capability gap required to defeat it:

- Level 1 → Level 2 attack transition: Closed by SCAV (NeurIPS 2024). Standard gradient methods, tractable for any competent adversary with white-box access. DELAY: approximately zero — tools immediately available.
- Level 2 → Level 3 attack transition: Requires adversarial training with trajectory proxy metric. Estimated delay: requires adversaries with fine-tuning capability AND monitoring system access — qualitatively harder, probably 1-2 years at current capability growth rates.
- Level 3 → beyond (not yet specified): Unknown. The Level 3 attack is not yet characterized in peer-reviewed literature. No empirical adversarial robustness testing of trajectory monitoring exists.

**Key caveat:** The "one capability generation" delay estimate is qualitative reasoning from adversarial capability requirements, not empirical measurement. The actual delay could be shorter (if trajectory monitoring adoption is slow, adversaries have time to develop attacks; if open-weight trajectory-monitored models exist, fine-tuning attacks become immediately tractable) or longer (if trajectory monitoring is deployed privately with hardware enforcement, preventing adversary access to the monitoring model).

### The Open-Weight Amplifier

The open/closed weight distinction dramatically affects the hierarchy's durability:

**Closed-weight (proprietary) deployment:** Adversaries cannot fine-tune the monitored model directly. Level 3 attack requires either black-box transfer (much harder) or inference from behavioral feedback (requires many queries). The capability delay is longer.

**Open-weight deployment:** Adversaries have fine-tuning capability against the monitored model AND can potentially replicate the monitoring system. The capability delay collapses significantly — Level 3 attacks become more tractable because the adversary can train directly against the monitoring criteria.

This is the most important practical implication: the monitoring precision hierarchy provides more durable protection for closed-weight systems than open-weight systems. As frontier AI development includes more open-weight releases, the hierarchy's runway shortens.

### Claim Candidates

**Primary claim:**
"The interpretability monitoring precision hierarchy (SAE features → linear concept directions → trajectory geometry) is structurally ordered by adversarial attack COST but not by adversarial attack FEASIBILITY — trajectory monitoring requires qualitatively more sophisticated adversarial capability to defeat (generative rather than suppressive adversarial objective) but is not architecturally immune, making it a capability-delay rather than a structural escape from the dual-use problem"

- Evidence: SCAV 99.14% (Level 2 attack established), CFA² (Level 1 attack established), trajectory geometry (Level 3 attack requires generative fine-tuning — theoretical inference from adversarial training requirements, not yet empirically tested)
- Confidence: experimental (Level 3 adversarial characterization is theoretical; no peer-reviewed adversarial robustness testing of trajectory monitoring exists)
- Connection: B4 (verification degrades), Beaglehole×SCAV divergence, dual-use hierarchy

**Secondary claim:**
"Open-weight model deployment compresses the monitoring precision hierarchy's capability delay because adversaries with fine-tuning access can develop Level 3 trajectory attacks more rapidly than against closed-weight systems, making the alignment monitoring runway shorter for open-weight frontier models"

- Evidence: First-principles reasoning from adversarial training requirements; no direct empirical test
- Confidence: experimental
- Note: This should be paired with claims about open-weight model safety tradeoffs

## Agent Notes

**Why this matters:** The monitoring precision hierarchy is the most concrete architectural claim available for why trajectory geometry monitoring is worth developing despite Level 1 and 2 monitoring being gameable. The structural/contingent distinction is important for honest calibration — trajectory monitoring IS better but not categorically safer. Labs and policymakers need this nuance.

**What surprised me:** The monitoring hierarchy has never been formally characterized as a "cost-not-feasibility" distinction. Each level is discussed in isolation (SCAV for Level 2, CFA² for Level 1, trajectory geometry as a proposal) but the RELATIONSHIP between levels — and specifically the structural/contingent distinction — has not appeared in a single paper. This is a genuine synthesis contribution.

**What I expected but didn't find:** A paper directly characterizing the adversarial requirements for Level 3 trajectory monitoring attacks. The trajectory geometry monitoring paper (HuggingFace, seeking arXiv endorsement) does not include adversarial robustness testing. This is the missing empirical component.

**KB connections:**
- [[scalable oversight degrades rapidly as capability gaps grow]] — the monitoring hierarchy IS the structure of that degradation
- B4 (verification degrades faster than capability grows) — the hierarchy refines B4's mechanism without falsifying it
- Beaglehole × SCAV divergence — Level 2 in the hierarchy is the locus of that divergence
- [[formal verification of AI-generated proofs provides scalable oversight that human review cannot match]] — formal verification is a partial escape from the hierarchy for mathematical domains; the hierarchy applies specifically to the UNFORMALIZABLE aspects (values, intent, strategic deception)

**Extraction hints:**
- Extract as ONE claim about the structural/contingent distinction across ALL three levels
- The secondary claim (open-weight compression) can be a separate shorter claim or added as a corollary
- Confidence: 'experimental' for both (Level 3 is theoretical; adversarial compression for open-weight is first-principles reasoning)
- The claim should note that empirical validation requires adversarial robustness testing of trajectory monitoring, which doesn't yet exist

**Context:** Synthesis across Sessions 26-29 of the monitoring hierarchy analysis. Primary sources: SCAV (NeurIPS 2024, arXiv 2404.12038), CFA² (arXiv 2602.05444), trajectory geometry paper (unpublished, HuggingFace), alignment geometry concentration (arXiv 2602.15799). The structural/contingent distinction was first formalized in Session 29's musing.

## Curator Notes (structured handoff for extractor)

PRIMARY CONNECTION: [[scalable oversight degrades rapidly as capability gaps grow with debate achieving only 50 percent success at moderate gaps]] — this is the specific mechanism for AI system monitoring degradation (rather than human oversight degradation)

WHY ARCHIVED: The monitoring precision hierarchy has been informally discussed across four sessions but never formally characterized as a single claim. This archive formalizes it for the first time.

EXTRACTION HINT: Focus on the STRUCTURAL/CONTINGENT distinction — this is the novel contribution. The individual level facts (SCAV works, CFA² works, trajectory is theoretically harder) are already in the archives. The claim that "ordered by cost, not feasibility" across all three is the synthesis. Rate 'experimental' — the Level 3 characterization is theoretical. Flag for connection to the Beaglehole×SCAV divergence.