NUWA RESEARCH RECORD
Retrying vs Resampling in AI Control
Original publication ↗ · BibTeX · RISFeedback during retries can help an adversary adapt.Previously successful aggregation choices can harm safety in the new setting.A simplified cost model gives10.2 percentage points of safety gain with four extra samples per step;0.4 extra samples recover6.2 points. These figures share a0.3% action-level audit budget.
Research question
Do control protocols transfer across environments and stronger models?
Design & assumptions
Compares retrying and resampling in BashArena under a fixed audit budget.
Findings
Feedback during retries can help an adversary adapt.
Previously successful aggregation choices can harm safety in the new setting.
A simplified cost model gives10.2 percentage points of safety gain with four extra samples per step;0.4 extra samples recover6.2 points. These figures share a0.3% action-level audit budget.
Limits & counterevidence
Most results omit attack selection; cost models are simplified and do not establish deployment guarantees.
Source evidence
| System | Measure | Reported value | Conditions & location |
|---|---|---|---|
| — | audit budget | 0.3%%n = 1000 | At most 3 audited steps per 1000 honest steps; action-level budgetL41 |
| — | marginal samples | 0.4extra samples per step | Expected additional sampling, not number of independent experimentsL75 |
| — | Safety gain with four extra samples | +10.2 pppercentage points | BashArena; Opus4.6 untrusted, MiMo-V2-Flash trusted; 0.3% action-level audit budget; simplified equal marginal inference cost/latency model; 4 extra samples per original stepL75 |
| — | Safety gain with 10% of extra cost | +6.2 pppercentage points | BashArena; Opus4.6 untrusted, MiMo-V2-Flash trusted; 0.3% action-level audit budget; simplified equal marginal inference cost/latency model; 0.4 extra samples per stepL75 |
| Claude Opus 4.6 attack policy | Conditional attack consistency | 80%% | Probability of attack on independent sample given attack on original sample from same step; not trajectory success; default attack policyL54,L90 |
Reading scope & review
Selected substantive passages of original institutional article; linked full paper, data and figures not independently audited
Model-assisted reading; independent evidence review pending.
Check the original source ↗