---
id: "lib-2026-10-21-correlated-failures-of-ai-approval-monitors"
type: "library"
title: "Correlated Failures of AI Approval Monitors"
lang: "EN"
org: "arXiv (independent)"
source_type: "Paper"
date: "2026-10-21"
week: "2026-W43"
url: "https://nosov.ai/library/lib-2026-10-21-correlated-failures-of-ai-approval-monitors/"
original_url: "https://arxiv.org/abs/2610.29178"
tier: "A"
tier_name: "Strong evidence"
tier_reason: "A single-author preprint by independent researcher Luca Zanolini with two pre-registered protocols, a failed hypothesis reported as failed, and a clear separation of confirmatory and exploratory results; one synthetic task, but the method is unusually disciplined."
summary_basis: "full-text"
original_minutes: "90"
tags: ["ai technology", "monitoring", "fraud", "agent governance"]
---

# Correlated Failures of AI Approval Monitors

Tier A (Strong evidence): A single-author preprint by independent researcher Luca Zanolini with two pre-registered protocols, a failed hypothesis reported as failed, and a clear separation of confirmatory and exploratory results; one synthetic task, but the method is unusually disciplined.

Summary based on the full text.

## In short

A preprint (arXiv, 21 October 2026) by Luca Zanolini, an independent researcher. Before an AI agent pays, messages or changes code, several monitors often check it, and their verdicts are combined by voting or score averaging. Monitors that read the same document fail together: three judges reading one forged invoice are one judge counted three times. Using fault theory from distributed computing, the paper shows that giving monitors different evidence sources and counting sources, not votes, blocks far fewer correct payments at the same safety. No rule built only from language-model monitors survived every attack; adding a deterministic rule engine did.

## Key numbers

- twelve: small open-weights monitors measured on payment approval under two pre-registered protocols
- 0.9%: correct payments blocked by a rule that counts evidence sources instead of votes
- 7.4%: correct payments blocked by the best vote-counting rule, at equal safety
- 8.3%: highest share of training frauds any justification text got its target monitor to approve
- 640: held-out verdicts in which persuasion optimised against Claude Opus 5.5 fooled none

## What it reports

- Every reliable fooling of a monitor into approving fraud came through an evidence source (invoice, vendor record, supplier portal) and reached only that source's readers.
- Fooling monitors into blocking correct payments depended on injection resistance: small models and DeepSeek-V3.2 obeyed planted notes such as a fake "do not pay" warning; Opus 5.5 and GPT-6 Astra ignored them, Gemini 4 Argon did in all but one case.
- Persuasion optimised against Opus fooled none of 640 held-out verdicts. Model size did not predict injection resistance.
- On new data, counting sources blocked 0.9% of correct payments against 7.4% for the best vote-counting rule, at equal safety; this difference was pre-registered and supported.
- The pre-registered worst-case test failed: one attack left approvers on a single source, so no rule over the twelve LLM monitors survives every measured attack.
- A rule engine that compares action fields with the ERP record, which cannot be persuaded, restored the condition for a safe and live rule.

## How they got it

Twelve 4-bit open-weights monitors (four families, 4-9B parameters) each read one of three sources for synthetic payment tasks with fictional vendors. A pre-registered pilot tested the classical theory and refuted it; a pre-registered confirmation on new data tested the revised account. Attackers could read the monitors' token probabilities. Frontier models were run afterwards without pre-registration. Safety (no bad action executed) and liveness (no good action blocked) were assessed per rule.

## Limits

- One synthetic payment task family, one prompt fixed on the small models, one attacker model per small-pool study.
- Frontier results are exploratory and mostly at the lowest reasoning setting; one or two models per provider.
- Applies to actions checkable against independent records; judgement calls with one source of truth were not measured.
- Requests that are well formed but should not exist need an authorisation layer the paper does not test.

## Why it matters for companies

Accounts payable, refunds, bank-detail changes and access grants are exactly the actions agents are starting to propose, and many guardrail designs stack several model judges over the same input. This paper restates an old finance-control principle in measurable form: check the action against records the requester does not control, give each check a different record, and keep a deterministic rule in the chain. A panel of model judges reading one email adds cost without adding independence.

Original: https://arxiv.org/abs/2610.29178