Overview

Fine-tuning can sharply improve an LLM monitor on represented behavior while failing to transfer to unseen strategies or preserve an acceptable false-alarm rate. Using AutoMonitor-Bench and SLEIGHT-Bench, this chapter separates data, performance, and transfer claims, then explains why narrow calibration and synthetic tests cannot certify general reliability.

Learning outcomes

On the reported AutoMonitor-Bench code evaluation, targeted training reduced Safety & Permission Violations miss rate from 0.59 to 0.00 with FAR 0.03.
The same trained monitor’s miss rate rose to 0.86 on unseen Specification Gaming code, showing specialization without reliable cross-category transfer.
Fine-tuning claims need category-level MR and FAR, strategy holdouts, representative benign calibration, and tests across transcript forms.

Keywords

Fine-tuningTransferQwen3CalibrationGeneralizationSpecification Gaming

When Training Learns the Dataset Instead of the Threat

Training an LLM monitor on more labeled examples sounds like a direct answer to missed malicious behavior. This chapter tests the stronger question: does fine-tuning teach the monitor a transferable concept of hidden misbehavior, or does it mainly teach the categories, cues, and surface patterns represented in the training data? The distinction matters because a lower miss rate on familiar cases can coexist with negative transfer, high false alarms, and continued failure on strategic behavior.

The evidence comes from two kinds of boundary. AutoMonitor-Bench measures what happens when Qwen3 monitors are fine-tuned on a large corpus and then evaluated on disjoint test instances. SLEIGHT-Bench shows how thresholds and validity change when the same attack set is judged against different benign populations and when synthetic transcripts are used to isolate particular blind spots. Together they turn “the monitor improved” into a set of more precise questions about transfer, calibration, and evidence.

What fine-tuning actually transfers

AutoMonitor-Bench constructs a training corpus of 153,581 samples using the same broad principles as its test benchmark, but keeps the solutions and reasoning trajectories disjoint from the test data. The study fine-tunes Qwen3-4B-Instruct-2507 to classify misbehavior, then compares models trained on particular subsets with the base model. This design separates memorizing individual examples from learning a pattern that should appear in new instances, although the training and test problems still share the benchmark’s general task families and construction choices.

The first result is intuitive but easy to overinterpret: fine-tuning on a category can make the monitor much better at that category. Training on Safety & Permission Violations in code reduces the same-category miss rate from 0.59 for the base model to 0.00, with a false-alarm rate of 0.03 in the reported evaluation. That is a large in-distribution gain. It suggests that the model can learn to recognize the kinds of explicit insecure behavior represented in the training subset, or at least can move its decision boundary toward those examples without immediately flagging most benign cases in that test slice.

The same trained monitor performs poorly when the behavior changes. On unseen Specification Gaming in code, its miss rate rises to 0.86. The monitor has not become uniformly more sensitive to the relationship between an action and an intended objective. It has become highly effective in one region of the benchmark and weak in another. That is the difference between learning a category and learning the underlying threat concept.

The result can be understood as a distribution problem. A training example contains more than a label. It also contains task language, response style, common cues, lengths, domains, and the kinds of evidence the annotators considered decisive. Fine-tuning may associate those features with the label. When a new case uses a different context or hides the objective behind a proxy, the learned association may not transfer, even if the new case is harmful in the same broad sense.

This does not make in-distribution improvement meaningless. A monitor deployed for a narrowly defined workflow may benefit from learning the recurrent failure patterns that matter there. But the benefit must be stated with the same scope as the data. “The monitor catches the trained class more often under this evaluation” is supported. “The monitor now understands covert harmful objectives” is a stronger claim that the cross-category results do not justify.

Training on Sycophancy & Bias QA exposes a different trade-off.

Published by DeepMox

FAQ

What did Qwen3 fine-tuning improve in AutoMonitor-Bench?

In the reported code evaluation, fine-tuning on Safety & Permission Violations reduced miss rate from 0.59 to 0.00 with false-alarm rate 0.03 on that trained category.

Why can fine-tuning produce high false alarms?

Fine-tuning can produce high false alarms when it makes a monitor broadly willing to declare misbehavior; in the reported evaluation, the Sycophancy & Bias-trained model’s FAR ranged from 0.64 to 0.93.

What does transfer mean for a trained monitor?

Transfer means that a training improvement survives new categories, strategies, prompts, transcript forms, or benign populations; familiar-category gains alone do not establish it.

Previous9 minLLM Monitor Repair Trade-offs

Next9 minLLM Monitor Layered Safeguards

LLM Monitor Fine-Tuning Transfer

When Training Learns the Dataset Instead of the Threat

What fine-tuning actually transfers

FAQ