Show Notes
There has been a lot of discussion recently of policy proposals around monitorability, such as Redwood's proposal and my counter-proposal. I'd like to say a bit more generally about how I'm thinking about monitorability. Note that nothing here is an official Anthropic position; these are just my personal thoughts.
First, a categorization. I currently think about four different types of monitorability:
Control Monitorability: the extent to which Control and monitoring techniques would likely catch catastrophic sabotage actions, like escaping a sandbox or setting up a rogue internal deployment. We can measure this via reference to sabotage evaluations like LinuxArena or any evaluation that measures the model's capability to take dangerous actions like escaping a sandbox while looking to a monitor like it's doing some innocuous task (like a cyber eval).
Auditing Monitorability: the extent to which alignment audits, evaluations, and test deployments would likely incriminate a systematically misaligned model (e.g. a schemer). We can measure this via reference to the model's capability to consistently distinguish between our most realistic alignment audits/evals and real internal deployment cases where it would have an opportunity to do something catastrophic.
Training Monitorability: the extent to which reward models [...] ---
First published:
October 22nd, 2026
Source:
https://www.lesswrong.com/posts/zAczYuHQS6jdG5DTg/monitorability-evaluations-and-policy-proposals
---
Narrated by TYPE III AUDIO.
More from LessWrong (30+ Karma)
Back in the before-time of the 2010s, when EA was still known mostly for funding health efforts in the developing world, there were many baskets of criticism floating around from the left. The most prominent was a cluster centered around EAs being white men, and therefore suspicious. Another category, in my experience the second-most common, was that in attempting to rectify the problems in the world, EA was masking, whitewashing, and misdirecting efforts away from solving the "real problem", usually capitalism but often other contradictory forces. These arguments were often not specific to EA, but applied to charitable giving in general. On any Hacker News post about a billionaire giving to charity, one of the first few comments would inevitably be this Oscar Wilde quote: Just as the worst slave-owners were those who were kind to their slaves, and so prevented the horror of the system being realized by those who suffered from it, and understood by those who contemplated it, so, in the present state of things in England, the people who do most harm are the people who try to do most good. These arguments have a long history. Anticapitalist critiques of charity go back to [...] The original text contained 4 footnotes which were omitted from this narration. ---
This is the fifth post in a series: the announcement post introduced the journal's core premise and its three key innovations: paid attributed review, published review summaries, and LLM-assisted workflow; the features and policies post examined the shortcomings of existing venues and argued for the advantages of a journal over a conference; the Adaptation to AI post described how we expect AI progress to shape the journal; and the Organization, Personnel, and Scope post announced our editorial board, scope, and acceptance criteria. In this post we go deeper: presenting our theory of change — including the status and information economics of the journal; a survey of previous related projects; and the high-level conclusions that follow from this analysis. We list some of the key performance indicators we'll track, the downside scenarios we must avoid, and possible future extensions of the journal. The journal is being built to serve the alignment research community. This post's purpose is to solicit feedback and encourage you to sign up on alignmentjournal.org if you want to participate. Our plans will be continually revised. Goals The primary function of a journal is to bring together exceptional researchers and focus their collective [...] --- Outline: (01:28) Goals (02:43) Theory of change (02:58) Prestige and information externalities in scholarly publication (05:31) Separate validation from acclaim (09:02) Remunerate reviewer labor (11:00) Desired outcomes (12:41) Objections (13:15) Key performance indicators (14:52) Downside risk pre-mortem (18:07) Extensions (20:39) Appendix: Prior Art (21:00) Distill (22:19) Journal of Open Source Software (23:23) Automation as philosophy (24:00) Chatops-driven publishing (25:39) Open-source infrastructure (26:32) Where JOSS has struggled (27:59) The Unjournal (28:40) Substantive Innovations (30:29) Procedural innovations and tools (32:20) Transactions on Machine Learning Research (38:53) Lessons for the Alignment Journal (39:53) Credits and thanks The original text contained 16 footnotes which were omitted from this narration. ---
TL;DR Frontier LLMs are now capable of generating artistic images using SVG. We ask – if these LLMs had to hide a message in an image – how would they do so? And if they hid such messages, could they be successfully decoded? We show interesting results from testing Fable 5.1 on these questions, and briefly compare with GPT-6 Astra on the same task. Figure 1: The stars encode a message, read left to right. Each star's height represents its place in the alphabet. Hidden message: The monster acts on the moonshine module. Introduction Frontier LLMs can now capably generate images. Whenever asked for an image, Claude Fable 5.1 writes an SVG, which renders as an ordinary image. The model has full control over every attribute (such as shape, height, width, colour, rotation, etc.). We ask – how does a model hide a message in the image it draws? Additionally, can an instance of the same model read the message from the image without the SVG source code and without any scheme agreed on in advance? We tested this with Claude Fable 5.1 at maximum reasoning effort: What encoding scheme does Fable reach for on its own? --- Outline: (00:14) TL;DR (00:57) Introduction (02:05) Types of encodings (02:50) Height encoding (03:43) How does the decoding model do it? (05:08) Patching gaps in encoding style (07:19) Method (09:38) Results: What survives a screenshot (10:08) What does GPT-6 Astra do differently? (10:57) Implications (11:34) Prior work (12:29) Citation (12:39) Acknowledgments The original text contained 1 footnote which was omitted from this narration. ---
Suppose we have an AI CEO, ruthlessly devoted to maximising shareholder value. Fortunately, we haven't been completely stupid, and have given it a rich definition of shareholder value, encompassing the success, flourishing, safety, preference satisfaction, and moral values of the shareholders, not just the stock price. So it won't destroy the company - or the world - to build a giant stock-ticker with a swiftly increasing number on it. This rich definition is contained in a sophisticated LLM, able to analyse the current situation and answer any question about the objective. The LLM is an integral part of the AI's system and motivation, not something it can simply set aside or hack directly. Unfortunately, as discussed, there are going to be zones in the space of possible situations where the LLM's understanding of the goal is going to come apart from ours. The true goal G(true) in those zones is distinct from the LLM's proxy goal G(proxy). And a subset of those "zones of divergence" will be the Goodhart zones - areas where G(proxy) is much easier to satisfy than G(true). The AI will be motivated to steer towards the Goodhart zones, as this lets it satisfy its stated [...] The original text contained 1 footnote which was omitted from this narration. ---