{"schemaVersion":"nuwa-current-record-1","version":"2026-10-29.1","publication":"published","work":{"id":"ctrl-z","title":"Ctrl-Z: Controlling AI Agents via Resampling","aliases":[],"authors":["Aryan Bhatt","Cody Rushing","Adam Kaufman","Tyler Tracy","Vasil Georgiev","David Matolcsi","Akbir Khan","Buck Shlegeris"],"primaryFunction":"governance","secondaryFunctions":[{"function":"evaluation","rationale":{"en":"The work defines or applies an explicit evaluation setting in addition to its main monitoring or control contribution.","zh":"该工作除主要监测或控制贡献外，还定义或应用了明确评测设置。"}}],"kind":"method","sourceId":"ctrl-z-publication","attributionSourceId":"ctrl-z-publication-author-source","originalUrl":"https://arxiv.org/abs/2504.10374","publicationDate":"2025-04-14","updatedOn":"2026-10-25","areas":["deception","cybersecurity"],"scopeNote":{"en":"Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.","zh":"风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。"},"protocolIds":[],"contributions":[{"organizationId":"redwood","role":"research","sourceId":"ctrl-z-publication-author-source","locator":"Author affiliations on the original paper title page"},{"organizationId":"mats","role":"research","sourceId":"ctrl-z-publication-author-source","locator":"Author affiliations on the original paper title page"}],"summary":{"en":"Evaluates action resampling and oversight protocols in a system-administration agent environment.","zh":"在系统管理智能体环境中，评测动作重采样和监督控制协议。"},"note":{"question":{"en":"Can resampling suspicious actions improve a control protocol’s safety while preserving useful multi-step agent work?","zh":"对可疑动作重新采样，能否在保留多步智能体任务效用的同时改善控制协议的安全性？"},"method":{"en":"BashBench pairs system-administration tasks with an attack objective. A human-assisted adversarial policy and an honest policy face the same control rules. Protocols compare monitoring, deferral and resampling under a limited auditing budget; importance sampling simulates a longer deployment episode.","zh":"BashBench 将系统管理任务与攻击目标结合。经人工辅助构建的对抗策略与诚实策略面对相同控制规则。研究在有限审计预算下比较监测、转交与重新采样协议，并通过重要性采样模拟更长部署过程。"},"finding":{"en":"Resampling and analysis of earlier actions improve the tested safety–usefulness trade-off. Resampling can both avoid executing a suspicious action and generate further evidence that helps identify an attacking policy.","zh":"重新采样与历史动作分析改善了所测条件下的安全性—效用权衡。重新采样既可避免执行可疑动作，也可生成有助于识别攻击策略的额外证据。"},"supports":{"en":"The contribution is a comparison of complete control protocols under explicit attacker and auditing assumptions, rather than evidence that an untrusted model has become aligned.","zh":"该贡献是在明确攻击者与审计假设下比较完整控制协议，而不是证明不可信模型已经对齐。"},"limits":{"en":"Attack strategies receive substantial human help; trajectories are short and the target is narrow. Auditing is assumed infallible, and absolute safety depends strongly on the audit budget. The authors emphasize relative protocol improvements over transfer of absolute scores to deployment.","zh":"攻击策略得到大量人工帮助；轨迹较短、攻击目标较窄。审计被假定为完全可靠，绝对安全性对审计预算高度敏感。作者更强调协议间的相对改进，而不是将绝对分数迁移到实际部署。"},"connections":{"en":"The paper extends the APPS backdoor control setting to a multi-action agent environment and explicitly studies collusion risks when an untrusted model is also used as a monitor.","zh":"论文将 APPS 后门控制设置扩展到多动作智能体环境，并专门研究将不可信模型用作监测器时的串谋风险。"}},"resources":[],"noteStatus":{"question":"verified","method":"verified","finding":"verified","supports":"verified","limits":"verified","connections":"verified"},"noteAvailability":{"en":"The substantive sections shown here were checked against the original source. Unfilled sections are omitted; source checking is not experimental replication.","zh":"此处展示的实质性章节已对照原始来源核查；未完成的章节已省略。来源核查不等于实验复现。"},"noteSourceLocator":"arXiv:2504.10374v1, §§2, 3.2–3.4, 4–6; Appendix C","tags":[]},"reading":{"id":"ctrl-z","title":"Ctrl-Z: Controlling AI Agents via Resampling","en":{"takeaway":"Resampling suspicious actions and using trajectory history improved the tested control trade-off.","question":"Can a multi-step agent be kept useful while stopping a deliberately subversive policy under a limited audit budget?","design":"BashBench tasks are split into development and test sets. Red/blue protocols compare monitoring, deferral and resampling in simulated long deployment episodes.","findings":["Resampling can both replace a suspicious action and collect further incriminating evidence.","The safety metric is episode-level prevention; usefulness is normalized between trusted and honest-untrusted baselines."],"interpretation":"NUWA interpretation: relative protocol improvements are more portable than the absolute safety score under one auditing budget.","limits":"Attacks rely on human-designed templates, trajectories are short, the target failure is narrow and auditing is assumed infallible in the setting.","connections":["NUWA connection: BashArena expands privileged task coverage; async-control changes when oversight occurs, so their safety denominators differ."],"decisionRelevance":"NUWA recommendation: evaluate resampling under realistic costs, state and audit reliability before transferring this protocol to deployment."},"zh":{"takeaway":"对可疑动作重采样并利用轨迹历史，改善了所测控制权衡。","question":"有限审计预算下，能否保留多步智能体效用并阻止刻意破坏策略？","design":"BashBench 区分开发集与测试集，红蓝协议在模拟长期部署回合中比较监控、转交与重采样。","findings":["重采样既可替换可疑动作，也能收集进一步证据。","安全指标是部署回合级阻止失败，效用则在可信与诚实非可信模型基线间归一化。"],"interpretation":"NUWA 解读：协议相对改善比固定审计预算下的绝对安全分数更便于迁移。","limits":"攻击依赖人工模板，轨迹较短、失败目标狭窄，且设置假定审计无误。","connections":["NUWA 关联：BashArena 扩展高权限任务，异步控制改变监督时机；它们的安全分母不同。"],"decisionRelevance":"NUWA 建议：部署迁移前，在真实成本、状态与审计可靠性条件下评估重采样。"},"sourceRefs":[{"sourceId":"ctrl-z-publication","url":"https://arxiv.org/html/2504.10374","locator":"2 Setting","version":"Selected original resource https://arxiv.org/html/2504.10374; sha256:1f8cac6d8ffcba43383a704d7586855f63660bf88232655050adc1a0b9a0b28f; archived source capture; exact capture time not independently established","artifactSha256":"1f8cac6d8ffcba43383a704d7586855f63660bf88232655050adc1a0b9a0b28f"},{"sourceId":"ctrl-z-publication","url":"https://arxiv.org/html/2504.10374","locator":"2.3 Safety and Usefulness Metrics","version":"Selected original resource https://arxiv.org/html/2504.10374; sha256:1f8cac6d8ffcba43383a704d7586855f63660bf88232655050adc1a0b9a0b28f; archived source capture; exact capture time not independently established","artifactSha256":"1f8cac6d8ffcba43383a704d7586855f63660bf88232655050adc1a0b9a0b28f"},{"sourceId":"ctrl-z-publication","url":"https://arxiv.org/html/2504.10374","locator":"3.2 Resample Protocols","version":"Selected original resource https://arxiv.org/html/2504.10374; sha256:1f8cac6d8ffcba43383a704d7586855f63660bf88232655050adc1a0b9a0b28f; archived source capture; exact capture time not independently established","artifactSha256":"1f8cac6d8ffcba43383a704d7586855f63660bf88232655050adc1a0b9a0b28f"},{"sourceId":"ctrl-z-publication","url":"https://arxiv.org/html/2504.10374","locator":"5 Discussion","version":"Selected original resource https://arxiv.org/html/2504.10374; sha256:1f8cac6d8ffcba43383a704d7586855f63660bf88232655050adc1a0b9a0b28f; archived source capture; exact capture time not independently established","artifactSha256":"1f8cac6d8ffcba43383a704d7586855f63660bf88232655050adc1a0b9a0b28f"}],"publication":{"state":"published","publishedOn":"2026-10-29","authorizationReference":"user-authorized-global-index-publication-2026-10-29","reviewedCandidateId":"local-6efe31bc4a0c0f37"},"review":{"state":"published-note","sourceScope":"full-text","availableScope":null,"readingCoverage":"selected substantive sections of the full source body","completePaperAudit":false,"independentEvidenceReview":"pending-human-review","bilingualEditorialReview":"pending-human-review","authorship":"model-assisted-research-note","preparedFingerprint":"597599f1ce3a79ac154abadf5c8c8095a2784234d90dfd062dc1fbd283b4cf91"}},"sources":[{"id":"ctrl-z-publication","title":"Ctrl-Z: Controlling AI Agents via Resampling","url":"https://arxiv.org/abs/2504.10374","version":"arXiv:2504.10374v1","publicationDate":"2025-04-14","datePrecision":"day","type":"paper","verifiedOn":"2026-10-25","documentId":"arxiv:2504.10374","authors":["Aryan Bhatt","Cody Rushing","Adam Kaufman","Tyler Tracy","Vasil Georgiev","David Matolcsi","Akbir Khan","Buck Shlegeris"],"aliases":["https://doi.org/10.48550/arXiv.2504.10374","https://arxiv.org/abs/2504.10374","https://arxiv.org/pdf/2504.10374"]}]}