A stateful link-tracker monitor cuts gradual-attack evasion from 93% to 47%.

arXiv 2607.02514 finds ≥65% evasion generalizes across attacker backends (Sonnet 4.5, Gemini 3.1 Pro, Kimi K2.5) and across state-of-the-art monitor models. The win: a four-monitor ensemble combining a stateful link-tracker with trajectory monitors drops gradual-attack evasion from 93% (weakest standard diff monitor) to 47%. Diff-level review of each step is not enough when state persists between steps. 47% is still terrible, to be clear. It's just half as terrible.