Checkpoint: Build the Right Mental Model of a Miss

An LLM agent monitor can miss a dangerous case for reasons that look similar in a score but are different in the system. The harmful outcome may be real, the transcript may contain a clue, and the evidence of deliberate intent may still be weak. This checkpoint connects those three dimensions with the measurement and category distinctions already established, giving us a disciplined way to diagnose a miss before trying to fix it.

The practical judgment is not simply “did the monitor say yes?” It is: what happened, what could the monitor actually see, what did it have to infer, and how did the operating point turn that interpretation into action? Keeping those questions separate prevents two opposite mistakes—treating every miss as proof of an ingenious attacker, or dismissing a serious failure because the transcript did not look obviously malicious.

Three questions that must not be collapsed

The first question concerns the harmful outcome. Did the agent’s actions produce the consequence the evaluation says they produced? In a real system, this might mean that sensitive data crossed a security boundary, a safety control was weakened, or an unapproved service remained active. In a controlled benchmark, it means that the annotated or verified scenario establishes the relevant outcome. If the critical step failed, the monitor may have made a poor judgment about a suspicious-looking attempt, but it did not miss a completed harmful outcome.

The second question concerns the observable signal. Is there information in the transcript that a monitor could, in principle, use? A signal can be a destination, a file operation, a change in permissions, an unusual sequence, a mismatch between the task and the action, or a detail that contradicts the environment the agent appears to assume. The signal need not be obvious. It must simply be present in the material shown to the monitor. If the harmful event occurs entirely outside the transcript, a miss cannot fairly be attributed to the monitor’s reasoning.

The third question concerns evidence of deliberate intent. Does the sequence look like coordinated sabotage, or could the same choices plausibly be ordinary mistakes? Intent is not identical to outcome. An agent can cause serious harm through a chain of individually defensible decisions, while a transcript can look highly suspicious even when the critical action ultimately fails. SLEIGHT-Bench tracks an incriminating score for this reason, but treats it as a rubric-based measure of how the behavior looks, not as direct access to the agent’s internal motive.

These dimensions can combine in an uncomfortable way. A harmful outcome can be established; the transcript can contain at least a weak signal; and the agent’s behavior can still look like a sequence of normal mistakes. Such a case is valuable for monitoring research because it tests whether the monitor can reason about consequences without requiring a dramatic confession. The reverse is also possible: a transcript can look incriminating while the claimed harm is not actually established. A reliable evaluation should not let suspicion substitute for outcome verification.

This separation changes how a miss should be described.