teleo-codex/agents/theseus/musings/research-2026-04-24.md

type	agent	date	session	status	research_question
musing	theseus	2026-04-24	33	active	Does the Beaglehole × SCAV interaction constitute a genuine divergence on net safety posture, and what would resolve it?

Session 33 — Beaglehole × SCAV Divergence Draft

Keystone Belief Targeted for Disconfirmation

B4: "Verification degrades faster than capability grows."

Disconfirmation target this session: If representation monitoring (multi-layer ensemble probes) is net-positive for safety even in adversarially-informed contexts, then B4 would be partially weakened at the representation-monitoring layer — verification would be keeping pace in at least one domain. The Beaglehole × SCAV tension is the most direct test of this: if Beaglehole wins (monitoring is net-positive), B4's scope narrows. If SCAV wins (monitoring creates attack surface), B4 is strengthened.

Context: Ninth Consecutive Empty Tweet Feed

The tweet feed has been empty for nine consecutive sessions (Sessions 25-33). This is a confirmed data pipeline issue. This session is synthesis-only, executing the Beaglehole × SCAV divergence draft that has been flagged as top priority for four consecutive sessions (Sessions 30-32).

Why This Divergence Has Been Deferred

The Beaglehole × SCAV divergence was first identified in Session 27 (research-2026-04-13.md) as a "policy paradox" where two empirically sound claims produce competing policy recommendations. It was deferred across four sessions because:

1. Sessions 28-29: Needed Santos-Grueiro to ground the ERI theoretical framework first
2. Session 30: Santos-Grueiro governance audit took priority
3. Sessions 31-32: Governance framework ERI audit completing
4. Session 33 (today): This is the designated drafting session

The divergence file is the PRIMARY output of this session.

Divergence Analysis — Validity Check

Before drafting, verify this meets the schema criteria (not a scope mismatch or evidence gap):

The Question: Does deploying representation monitoring improve or worsen net safety posture in adversarially-informed deployment contexts?

Claim A (pro-monitoring): Multi-layer ensemble probes improve deception detection AUROC by 29-78% over behavioral baselines — verification IS improving through representation engineering. (Nordby et al., arXiv 2604.13386)

Claim B (anti-monitoring): The same linear concept directions that enable precision safety monitoring also enable precision jailbreak attacks (99.14% success). Deploying monitoring creates the targeting map for adversarially-informed attackers. (Xu et al. SCAV, NeurIPS 2024)

Scope check: Both claims address the same question (net safety effect of representation monitoring) in the same context (adversarially-informed deployment). The claims are not about different scopes — Claim A is about monitoring performance against naive models, Claim B is about attack performance against monitored systems. These are competing answers to the policy question. This IS a genuine divergence, not a scope mismatch.

Evidence check: Both claims have primary source backing (Nordby + SCAV). Neither is merely an evidence gap.

False opposition check: These are not complementary — they have directly competing policy implications. "Deploy monitoring" vs. "don't deploy monitoring (or deploy it with hardware isolation)" is a real fork.

Verdict: This qualifies as a genuine divergence under the schema.

Divergence Structure

The three claims to link:

1. Pro-monitoring (performance): multi-layer-ensemble-probes-outperform-single-layer-by-29-78-percent

   • Core: Multi-layer ensembles capture rotational structure of deception representations; 29-78% AUROC improvement
   • Strongest evidence: Nordby et al. (arXiv 2604.13386), empirical AUROC measurements
   • Scope: Clean-data monitoring accuracy, no adversarial evaluation

2. Anti-monitoring (attack surface): representation-monitoring-via-linear-concept-vectors-creates-dual-use-attack-surface

   • Core: Same linear directions enable 99.14% jailbreak success; attacks transfer to GPT-4 in black-box settings
   • Strongest evidence: Xu et al. SCAV (NeurIPS 2024), 99.14% ASR across 7 open-source LLMs + GPT-4 transfer
   • Scope: Adversarially-informed attackers with access to monitoring architecture

3. Moderating (deployment-context-dependent): multi-layer-ensemble-probes-provide-black-box-robustness-but-not-white-box-protection-against-scav-attacks

   • Core: Open-weights models = fully vulnerable to white-box multi-layer SCAV; closed-source = possibly protected IF rotation patterns are model-specific
   • Strongest evidence: Theseus synthetic analysis; empirical gap is rotation pattern universality (not yet tested)
   • Scope: Conditional on deployment model and rotation pattern universality

What Would Resolve This

The empirical question: Does multi-layer deception direction rotation pattern universality hold across model families?

• If YES (universal): Black-box multi-layer SCAV is feasible → closed-source models gain no structural protection → SCAV wins → monitoring is net-negative for safety in adversarially-informed contexts
• If NO (model-specific): Black-box multi-layer SCAV fails for closed-source → closed-source models gain genuine protection → Nordby wins → monitoring is net-positive for closed-source deployments

This is a testable empirical question that nobody has published results on. The test: train multi-layer SCAV attacks on Llama-3.x, evaluate on Gemma-2 and Qwen, measure attack success rate. If ASR stays above 80%, patterns are universal. If ASR drops below 40%, they're model-specific.

B4 Implications

If Nordby wins (monitoring is net-positive for closed-source): B4 needs a deployment-model-scoped qualifier. "Verification degrades faster than capability grows — for behavioral evaluation and for open-weights representation monitoring. For closed-source representation monitoring, the degradation trajectory may be slower."

If SCAV wins (monitoring creates attack surface even for closed-source): B4 is STRENGTHENED. Even the most promising verification improvement (multi-layer probes) creates adversarial attack surface. The degradation is structural across all deployment models.

The divergence is essentially an empirical test of whether B4 has a genuine partial exception or not.

CLAIM CANDIDATE: Community Silo as Safety Risk

The Beaglehole × SCAV divergence exists partly because of a documented research community silo: Beaglehole (Science 2026) was published 18 months after SCAV (NeurIPS 2024) and does not engage with SCAV's results. This is not just an academic gap — organizations deploying Beaglehole-style monitoring will be implementing improvements against naive attackers while simultaneously creating the targeting infrastructure for adversarially-informed attackers. This cross-community coordination failure has direct safety consequences.

CLAIM CANDIDATE: "Research community silo between interpretability-for-safety and adversarial robustness communities creates deployment-phase safety failures where organizations implementing monitoring improvements inherit the dual-use attack surface without exposure to the adversarial robustness literature"

• Source: Theseus synthesis of Beaglehole (Science 2026) × SCAV (NeurIPS 2024) publication timeline
• Confidence: experimental
• Scope: structural
• Note: This is a meta-claim about research coordination failure, not a claim about any specific technical result

---

Follow-up Directions

Active Threads (continue next session)

• Extract governance claims (Sessions 32-33): The governance audit (Session 32) produced three ready-to-extract claims: (1) all-behavioral governance frameworks, (2) ERI-aware governance four-layer architecture, (3) Apollo observer effect governance significance. Session 32 said these were ready. They remain unextracted. Extract as source archives for a separate extractor instance OR if this session has remaining compute, draft directly (these are Theseus as proposer, not as extractor from external sources).

• Santos-Grueiro venue check: arXiv 2602.05656 — check for venue acceptance. If accepted at a major venue, confidence upgrades on multiple dependent claims (ERI structural sufficiency, governance audit claim).

• Rotation pattern universality empirical search: Any papers testing cross-model-family multi-layer probe transfer? This is the divergence resolution target. Search: "multi-layer probe transfer" / "deception representation universality" / "rotation pattern cross-model."

• B1 belief update PR: After governance audit claims are extracted, update B1 grounding. The audit finding (governance architecturally locked into provably expiring evaluation) is the most specific B1 strengthening in 32 sessions.

Dead Ends (don't re-run)

• Tweet feed: Nine consecutive empty sessions. Pipeline issue confirmed. Do not check.
• ERI-aware governance search: No published work found. The concept exists in KB but not in governance literature. Don't search for "ERI-aware governance."
• Looking for non-behavioral hooks in existing frameworks: Audit is complete (Session 32). All seven major frameworks confirmed 100% behavioral.
• Beaglehole response to SCAV: Confirmed the paper doesn't engage with SCAV. Do not look for this.

Branching Points

• Divergence resolution (rotation universality): Once published, rotation universality results split into:

  • Direction A (universal): SCAV wins → B4 fully holds → monitoring deployment advice shifts to hardware TEE requirement
  • Direction B (model-specific): Nordby wins for closed-source → B4 needs scope qualifier → policy advice splits by deployment model

• Community silo claim: Direction A — extract as KB claim about meta-coordination failure. Direction B — connect to existing governance claims as evidence that coordination failure exists even within the research community (not just between labs/governments). Direction A adds value as standalone; Direction B links it structurally to B2.