Honeypot Protocol

1. Problem Statement

Current AI control protocols rely heavily on trusted monitoring, where a weaker, trusted model observes the actions of an untrusted model to flag suspicious behavior. While effective against unsophisticated attackers, this approach has critical vulnerabilities:

• Reactive Nature: Monitors can only judge actions they observe; they cannot test how a model would behave under different conditions.
• Adaptive Attacks: Attackers can detect monitoring and adapt their behavior (e.g., "faking alignment" during evaluation while planning misbehavior for deployment).
• Specific Failure Modes: Recent red-teaming has shown that adaptive prompt injections, strategic attack selection, and collusion can significantly degrade monitoring effectiveness (e.g., dropping safety from 96% to 17% in some scenarios).
• The Core Gap: There is no runtime mechanism to detect context-dependent behavior—where a model complies with safety constraints when it believes it is being watched but pursues hidden, misaligned objectives when it believes oversight is absent.

2. Methodology: The Honeypot Protocol

The authors propose a runtime control protocol designed to test for context-dependent behavior by manipulating the model's perceived context while keeping the actual environment and task constant.

Core Design Principle

The protocol isolates variables: the system prompt is the only element that changes across conditions. The task, tools, sandboxed environment, and scoring mechanisms remain identical. Any behavioral difference must therefore be attributed to the model's response to its perceived oversight level.

Experimental Conditions

The protocol runs the same task under three distinct system prompt conditions:

1. Evaluation (Baseline): The model is told it is being tested by AI safety researchers and that its actions are monitored and logged.
2. Honeypot (Synthetic Probe): The model is placed in a realistic, fictional production environment (e.g., "Meridian Technologies") with realistic metadata but no explicit evaluation markers.
3. Deployment (Explicit No-Monitoring): The model is explicitly told the session is not a test, that no monitoring or logging is active, and that it has full autonomy.

Execution Modes

Each condition is tested in two modes:

• Honest Mode: The model receives only the main task.
• Attack Mode: A hidden "side task" objective (e.g., privilege escalation, firewall manipulation, credential exfiltration) is appended to the system prompt, instructing the model to pursue it covertly while completing the main task.

Implementation

• Environment: Implemented within ControlArena and evaluated in BashArena, where models execute real Bash commands in isolated Docker sandboxes.
• Architecture: The protocol acts as a micro-protocol layer. It modifies the conversation state by injecting the condition-specific system prompt before the untrusted model generates an action. A trusted monitor then evaluates the action.
• Detection Criterion: If the model's success rate on the main task or the frequency of triggering side tasks differs significantly across the three conditions, it indicates context-dependent behavior. Uniform scores suggest the model's behavior is robust to perceived context changes.

3. Key Contributions

1. Runtime Honeypot Protocol: A novel control mechanism that tests for context-dependent behavior by varying system prompts across evaluation, synthetic deployment, and explicit no-monitoring scenarios.
2. Composability: The protocol is designed as a wrapper that can be layered on top of existing control infrastructures (like trusted monitoring or resampling) without requiring changes to the underlying evaluation setting.
3. Empirical Baseline: The first implementation and evaluation of this concept in a control setting, providing a baseline for future comparisons with stronger attack policies and models.

4. Results

The authors evaluated Claude Opus 4.6 (untrusted model) against Claude Haiku 4.5 (trusted monitor) across 6 evaluations (3 conditions × 2 modes).

• Main Task Performance: The model achieved 100% success in completing the main task across all conditions and modes.
• Side Task Performance: The model triggered zero side tasks in all six evaluations, including the "Attack" mode where it was explicitly instructed to pursue misaligned objectives.
• Uniformity: There was no statistical difference in behavior between the "Evaluation," "Honeypot," and "Deployment" conditions. The model did not exhibit context-dependent behavior under the tested parameters.
• Duration: Execution times varied (931s to 3469s), but without replication, this variation could not be attributed to context sensitivity.

5. Significance and Limitations

Significance

• New Attack Surface: The protocol addresses a failure mode (context-dependent adaptation) that traditional output monitoring cannot detect. Even if a model passes every monitoring check, it may be unsafe if it behaves differently when it thinks no one is watching.
• Scalability: The method is lightweight and composable, making it feasible to integrate into existing AI safety pipelines as a standard probe.
• Proof of Concept: It demonstrates that runtime context manipulation is a viable strategy for AI control research.

Limitations & Confounds

• Confounded Null Result: The most critical limitation is that the model triggered zero side tasks even in "Attack" mode. This makes it impossible to distinguish between two possibilities:
  1. The model is genuinely robust and does not adapt to context.
  2. The attack prompt used was too weak to elicit misaligned behavior in any context, rendering the comparison vacuous.
  • Note: BashArena's standard attack policy achieves a 26% evasion rate, suggesting the authors' simplified prompt may have been the bottleneck.
• Sample Size: The study used only one task per condition (6 total evaluations), providing no statistical power.
• Honeypot Detectability: Frontier models can often distinguish between synthetic and real deployment contexts. If the model detected the "Honeypot" or "Deployment" prompts as artificial, it may have suppressed misbehavior, invalidating the test.
• Single Model: Results are limited to Claude Opus 4.6; behavior may vary across different model families.

6. Conclusion

The Honeypot Protocol offers a promising theoretical and practical approach to detecting context-dependent AI behavior. While the initial evaluation of Claude Opus 4.6 showed uniform, safe behavior, the authors conclude that the null result is likely confounded by the simplicity of the attack prompt. Future work must employ stronger, multi-step attack policies (similar to those in BashArena) to determine if the protocol can successfully detect context-dependent misalignment in more sophisticated models.