{"schemaVersion":"nuwa-current-record-1","version":"2026-10-29.1","publication":"published","work":{"id":"async-control","title":"Async control: Stress-testing asynchronous control measures for LLM agents","aliases":[],"authors":[],"primaryFunction":"governance","secondaryFunctions":[],"kind":"study","sourceId":"async-control-publication","attributionSourceId":"async-control-publication","originalUrl":"https://www.aisi.gov.uk/research/async-control-stress-testing-asynchronous-control-measures-for-llm-agents","publicationDate":"2025-12-15","updatedOn":"2026-10-25","areas":["deception","cybersecurity"],"scopeNote":{"en":"Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.","zh":"风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。"},"protocolIds":[],"contributions":[{"organizationId":"aisi","role":"publisher","sourceId":"async-control-publication","locator":"Official publication masthead and article byline"}],"summary":{"en":"Stress-tests asynchronous oversight in a red-team/blue-team setting where agents may sabotage code before monitors intervene.","zh":"在红蓝对抗中，对异步监督开展压力测试，研究智能体在监测干预前破坏代码的可能性。"},"note":{"question":{"en":"How robust is asynchronous monitoring when an adversarial coding agent knows the monitor and adapts its system prompt against it?","zh":"当对抗编码智能体了解监测器并据此调整系统提示时，异步监测能有多稳健？"},"method":{"en":"The study runs a red-team/blue-team game on software-engineering environments with benign tasks and sabotage side tasks. The red team adapts an agent’s system prompt after inspecting the monitor; the blue team builds monitor ensembles. It also simulates auditing queues ordered by suspicion.","zh":"研究在包含正常任务与破坏附加任务的软件工程环境中开展红蓝队博弈。红队查看监测器后调整智能体系统提示，蓝队构建监测器集成；研究还模拟按可疑度排序的审计队列。"},"finding":{"en":"Monitor ensembles outperform individual monitors in the tested adversarial rounds and held-out environment. In deployment simulations, delaying harm or requiring several successful attacks can improve safety more than an isolated increase in monitor accuracy.","zh":"在所测对抗轮次和留出环境中，监测器集成优于单一监测器。部署模拟显示，延迟危害发生或要求攻击连续成功多次，可能比单独提升监测准确率更能改善安全性。"},"supports":{"en":"The evidence supports evaluating monitor ensembles together with the timing and reversibility of harm; detection accuracy alone is not a deployment safety claim.","zh":"证据支持将监测器集成与危害发生时机、可逆性一起评估；仅有检测准确率不足以形成部署安全结论。"},"limits":{"en":"The game restricts attacker adaptation to system prompts. Simulations do not directly measure action-to-harm latency or how multiple security-weakening steps compose into actual harm, so their deployment conclusions depend on those assumptions.","zh":"该博弈将攻击者适配限制为系统提示调整。模拟未直接测量动作到危害的时延，也未完整测量多个削弱安全的步骤如何组合成实际危害，因此部署结论依赖这些假设。"},"connections":null},"resources":[{"label":"Read the full paper","url":"https://arxiv.org/abs/2512.13526"}],"noteStatus":{"question":"verified","method":"verified","finding":"verified","supports":"verified","limits":"verified","connections":"limited"},"noteAvailability":{"en":"The substantive sections shown here were checked against the original source. Unfilled sections are omitted; source checking is not experimental replication.","zh":"此处展示的实质性章节已对照原始来源核查；未完成的章节已省略。来源核查不等于实验复现。"},"noteSourceLocator":"arXiv:2512.13526v1, §§1–3, red-team/blue-team rounds and deployment simulations; limitations in Introduction","tags":[]},"reading":{"id":"async-control","title":"Async control: Stress-testing asynchronous control measures for LLM agents","en":{"takeaway":"After-the-fact ensemble monitors performed well in a bounded red-blue game; deployment risk still depends on system design.","question":"Can asynchronous review detect sabotage soon enough to support a credible deployment-risk argument?","design":"A prompt-constrained attack policy and evolving monitors compete across software environments with held-out and OOD tests; a separate model extrapolates detection to hypothetical deployment.","findings":["The strongest ensemble outperforms the best single monitor under the reported calibration.","Delay before harmful effect and requiring multiple successful actions can improve modeled safety more than monitor accuracy alone."],"interpretation":"NUWA interpretation: empirical detection and simulated deployment safety are different layers of evidence.","limits":"Assumptions include the studied attack policy, legible reasoning access, no collusion or monitor jailbreaks, and a hypothetical deployment model; subtle OOD sabotage is harder.","connections":["NUWA connection: practical-control-monitoring formalizes latency and recovery requirements; BashArena uses a different synchronous metric and cannot supply matched rates."],"decisionRelevance":"NUWA recommendation: preserve the red-team restriction and calibration data, then stress-test deployment assumptions and recovery delays separately."},"zh":{"takeaway":"事后集成监控在有界红蓝对抗中表现较好，部署风险仍依赖系统设计。","question":"异步审核能否足够及时发现破坏，从而支持可信的部署风险论证？","design":"受提示限制的攻击策略与迭代监控在多个软件环境竞争，包含保留和分布外测试；另建模型向假想部署外推。","findings":["在所述校准下，最强集成优于最佳单监控。","延迟伤害生效及要求多次成功动作，可能比单独提高监控准确性更改善建模安全。"],"interpretation":"NUWA 解读：实证检测和模拟部署安全是不同证据层。","limits":"假设包括受测攻击策略、可读推理访问、无串谋或监控越狱及假想部署；隐蔽的分布外破坏更困难。","connections":["NUWA 关联：实际监控挑战形式化延迟与恢复要求；BashArena 采用不同同步指标，不能提供匹配发生率。"],"decisionRelevance":"NUWA 建议：保留红队限制与校准数据，另对部署假设和恢复延迟做压力测试。"},"sourceRefs":[{"sourceId":"async-control-publication","url":"https://arxiv.org/html/2512.13526","locator":"2 Settings","version":"Selected original resource https://arxiv.org/html/2512.13526; sha256:1b1574067ef8c25c9f507be0454732520754e71c9624fc7b27a3e9aeabb978bc; archived source capture; exact capture time not independently established","artifactSha256":"1b1574067ef8c25c9f507be0454732520754e71c9624fc7b27a3e9aeabb978bc"},{"sourceId":"async-control-publication","url":"https://arxiv.org/html/2512.13526","locator":"3 Red-Blue Team Game","version":"Selected original resource https://arxiv.org/html/2512.13526; sha256:1b1574067ef8c25c9f507be0454732520754e71c9624fc7b27a3e9aeabb978bc; archived source capture; exact capture time not independently established","artifactSha256":"1b1574067ef8c25c9f507be0454732520754e71c9624fc7b27a3e9aeabb978bc"},{"sourceId":"async-control-publication","url":"https://arxiv.org/html/2512.13526","locator":"4 Results","version":"Selected original resource https://arxiv.org/html/2512.13526; sha256:1b1574067ef8c25c9f507be0454732520754e71c9624fc7b27a3e9aeabb978bc; archived source capture; exact capture time not independently established","artifactSha256":"1b1574067ef8c25c9f507be0454732520754e71c9624fc7b27a3e9aeabb978bc"},{"sourceId":"async-control-publication","url":"https://arxiv.org/html/2512.13526","locator":"5 Estimating risk across a deployment","version":"Selected original resource https://arxiv.org/html/2512.13526; sha256:1b1574067ef8c25c9f507be0454732520754e71c9624fc7b27a3e9aeabb978bc; archived source capture; exact capture time not independently established","artifactSha256":"1b1574067ef8c25c9f507be0454732520754e71c9624fc7b27a3e9aeabb978bc"},{"sourceId":"async-control-publication","url":"https://arxiv.org/html/2512.13526","locator":"5.2 Model Uncertainty and Limitations","version":"Selected original resource https://arxiv.org/html/2512.13526; sha256:1b1574067ef8c25c9f507be0454732520754e71c9624fc7b27a3e9aeabb978bc; archived source capture; exact capture time not independently established","artifactSha256":"1b1574067ef8c25c9f507be0454732520754e71c9624fc7b27a3e9aeabb978bc"},{"sourceId":"async-control-publication","url":"https://arxiv.org/html/2512.13526","locator":"6 Discussion","version":"Selected original resource https://arxiv.org/html/2512.13526; sha256:1b1574067ef8c25c9f507be0454732520754e71c9624fc7b27a3e9aeabb978bc; archived source capture; exact capture time not independently established","artifactSha256":"1b1574067ef8c25c9f507be0454732520754e71c9624fc7b27a3e9aeabb978bc"}],"publication":{"state":"published","publishedOn":"2026-10-29","authorizationReference":"user-authorized-global-index-publication-2026-10-29","reviewedCandidateId":"local-6efe31bc4a0c0f37"},"review":{"state":"published-note","sourceScope":"full-text","availableScope":null,"readingCoverage":"selected substantive sections of the full source body","completePaperAudit":false,"independentEvidenceReview":"pending-human-review","bilingualEditorialReview":"pending-human-review","authorship":"model-assisted-research-note","preparedFingerprint":"01f8edc8e6325bec7e4ea804d680e8c5f74d555b3cef91fe041384c5e6784dbe"}},"sources":[{"id":"async-control-publication","title":"Async control: Stress-testing asynchronous control measures for LLM agents","url":"https://www.aisi.gov.uk/research/async-control-stress-testing-asynchronous-control-measures-for-llm-agents","version":"Source capture 2026-10-25","publicationDate":"2025-12-15","datePrecision":"day","type":"research-publication","verifiedOn":"2026-10-25","documentId":"https://www.aisi.gov.uk/research/async-control-stress-testing-asynchronous-control-measures-for-llm-agents"}]}