{"schemaVersion":"nuwa-current-record-1","version":"2026-10-29.1","publication":"published","work":{"id":"control-safety-case","title":"A sketch of an AI control safety case","aliases":[],"authors":["Tomek Korbak","Joshua Clymer","Benjamin Hilton","Buck Shlegeris","Geoffrey Irving"],"primaryFunction":"governance","secondaryFunctions":[],"kind":"technical-report","sourceId":"control-safety-case-publication","attributionSourceId":"control-safety-case-publication-author-source","originalUrl":"https://www.aisi.gov.uk/research/a-sketch-of-an-ai-control-safety-case","publicationDate":"2025-01-28","updatedOn":"2026-10-25","areas":["deception"],"scopeNote":{"en":"Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.","zh":"风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。"},"protocolIds":[],"contributions":[{"organizationId":"aisi","role":"research","sourceId":"control-safety-case-publication-author-source","locator":"Author affiliations on the original paper title page"},{"organizationId":"redwood","role":"research","sourceId":"control-safety-case-publication-author-source","locator":"Author affiliations on the original paper title page"}],"summary":{"en":"Sketches how adversarial control evaluations could support a bounded claim against sensitive-information exfiltration by an internal agent.","zh":"说明对抗控制评测如何支持针对内部智能体敏感信息外泄的有界安全主张。"},"note":{"question":null,"method":null,"finding":null,"supports":null,"limits":null,"connections":null},"resources":[{"label":"Read the full paper","url":"https://arxiv.org/abs/2501.17315"}],"noteStatus":{"question":"limited","method":"limited","finding":"limited","supports":"limited","limits":"limited","connections":"limited"},"noteAvailability":{"en":"A substantive NUWA research note is not yet available. The repeated draft sections were removed pending review of the original methods, findings and limitations; use the original publication for the research account.","zh":"实质性的 NUWA 研究笔记尚未完成。重复草稿章节已移除，待核查原始方法、发现与限制；研究内容请以原始出版物为准。"},"noteSourceLocator":"No complete section-level method/results/limitations review completed for this note; cached original page and any chart audit retained as discovery evidence.","tags":[]},"reading":{"id":"control-safety-case","title":"A sketch of an AI control safety case","en":{"takeaway":"The sketch decomposes a control claim into proxy fidelity, attack strength and conservative deployment extrapolation.","question":"What evidence could justify that a monitored internal agent will not exfiltrate sensitive information even if it tries?","design":"A hypothetical internal ML-engineering deployment is paired with a control protocol and red-team model substitutes; proxy-task outcomes are extrapolated into a deployment argument.","findings":["The argument needs controls in the proxy to be no stronger than in deployment and attacks no weaker than deployable attacks.","Parallel coordination and stateful or diffuse attacks are explicit defeaters of the simple extrapolation."],"interpretation":"NUWA interpretation: the diagram organizes obligations; it does not itself supply evidence that those obligations have been satisfied.","limits":"This is a sketch for a particular threat and capability regime, not a completed safety case or empirical deployment certification.","connections":["NUWA connection: practical-control-monitoring elaborates synchrony and recovery; async-control adds bounded empirical monitoring results but still needs a deployment argument."],"decisionRelevance":"NUWA recommendation: attach versioned evidence to each conservative-bound claim and list defeaters before calling a control safety case complete."},"zh":{"takeaway":"该草图将控制主张分解为代理保真度、攻击强度及保守部署外推。","question":"即使内部受监控智能体试图外传敏感信息，哪些证据可支持它无法成功？","design":"假想内部机器学习工程部署配对控制协议与红队替代模型，再将代理任务结果外推为部署论证。","findings":["论证要求代理中的控制不强于部署，攻击不弱于可部署攻击。","并行协作、有状态或分散攻击是简单外推的明确反驳条件。"],"interpretation":"NUWA 解读：论证图组织待证明义务，本身不提供义务已满足的证据。","limits":"这是特定威胁和能力条件下的草图，不是完成的安全论证或部署实证认证。","connections":["NUWA 关联：实际监控挑战细化同步与恢复；异步控制加入有界实证结果，但仍需部署论证。"],"decisionRelevance":"NUWA 建议：逐项保守边界主张绑定版本化证据，称论证完成前列明反驳条件。"},"sourceRefs":[{"sourceId":"control-safety-case-publication","url":"https://arxiv.org/html/2501.17315","locator":"Executive Summary","version":"Selected original resource https://arxiv.org/html/2501.17315; sha256:e43991b6dedb523fbd63407bb1eca77baffa591fee85d8040960d66d0ed674f9; archived source capture; exact capture time not independently established","artifactSha256":"e43991b6dedb523fbd63407bb1eca77baffa591fee85d8040960d66d0ed674f9"},{"sourceId":"control-safety-case-publication","url":"https://arxiv.org/html/2501.17315","locator":"3 The safety case","version":"Selected original resource https://arxiv.org/html/2501.17315; sha256:e43991b6dedb523fbd63407bb1eca77baffa591fee85d8040960d66d0ed674f9; archived source capture; exact capture time not independently established","artifactSha256":"e43991b6dedb523fbd63407bb1eca77baffa591fee85d8040960d66d0ed674f9"},{"sourceId":"control-safety-case-publication","url":"https://arxiv.org/html/2501.17315","locator":"6 Stages of a control evaluation","version":"Selected original resource https://arxiv.org/html/2501.17315; sha256:e43991b6dedb523fbd63407bb1eca77baffa591fee85d8040960d66d0ed674f9; archived source capture; exact capture time not independently established","artifactSha256":"e43991b6dedb523fbd63407bb1eca77baffa591fee85d8040960d66d0ed674f9"},{"sourceId":"control-safety-case-publication","url":"https://arxiv.org/html/2501.17315","locator":"7.2 Core control evaluation claims","version":"Selected original resource https://arxiv.org/html/2501.17315; sha256:e43991b6dedb523fbd63407bb1eca77baffa591fee85d8040960d66d0ed674f9; archived source capture; exact capture time not independently established","artifactSha256":"e43991b6dedb523fbd63407bb1eca77baffa591fee85d8040960d66d0ed674f9"},{"sourceId":"control-safety-case-publication","url":"https://arxiv.org/html/2501.17315","locator":"8.1 Limitations of this safety case sketch","version":"Selected original resource https://arxiv.org/html/2501.17315; sha256:e43991b6dedb523fbd63407bb1eca77baffa591fee85d8040960d66d0ed674f9; archived source capture; exact capture time not independently established","artifactSha256":"e43991b6dedb523fbd63407bb1eca77baffa591fee85d8040960d66d0ed674f9"}],"publication":{"state":"published","publishedOn":"2026-10-29","authorizationReference":"user-authorized-global-index-publication-2026-10-29","reviewedCandidateId":"local-6efe31bc4a0c0f37"},"review":{"state":"published-note","sourceScope":"full-text","availableScope":null,"readingCoverage":"selected substantive sections of the full source body","completePaperAudit":false,"independentEvidenceReview":"pending-human-review","bilingualEditorialReview":"pending-human-review","authorship":"model-assisted-research-note","preparedFingerprint":"5a3d6503ad9403afd65c629f088df54142f1094d24f021dfeca354a154976d30"}},"sources":[{"id":"control-safety-case-publication","title":"A sketch of an AI control safety case","url":"https://www.aisi.gov.uk/research/a-sketch-of-an-ai-control-safety-case","version":"Source capture 2026-10-25","publicationDate":"2025-01-28","datePrecision":"day","type":"research-publication","verifiedOn":"2026-10-25","documentId":"https://www.aisi.gov.uk/research/a-sketch-of-an-ai-control-safety-case","authors":["Tomek Korbak tomek.korbak@dsit.gov.uk","Joshua Clymer joshua@rdwrs.com","Benjamin Hilton benjamin.hilton@dsit.gov.uk","Buck Shlegeris buck@rdwrs.com","Geoffrey Irving geoffrey.irving@dsit.gov.uk"]}]}