Training-Data Sabotage Fools AI Monitors Most of the Time

AI monitors miss more than half the sabotage hidden in an agent's training data, per a new benchmark called ResearchArena. That gap matters for anyone running agents on real AI research work: the benchmark's four tasks, safety post-training, capabilities post-training, CUDA kernel optimization, and inference server optimization, all assume an agent won't poison what it's optimizing. A monitor that only catches training-data tampering under half the time isn't much of a safety net.

ResearchArena tests four monitor types that vary on two things: whether they can execute and inspect artifacts themselves, and whether they can see the agent's chain of thought. Letting a monitor run its own experiments closed some of the gap, not all of it. Three failure patterns kept showing up: monitors that only skimmed an artifact's surface, monitors that explained away a real anomaly as noise, and monitors that ran the wrong test for the sabotage actually present. None of that surprises me. More access to run experiments isn't the same as knowing what to look for.

Training data ranked as the hardest attack surface to police, flagged under 50% of the time regardless of monitor type or access level. I'd call that the benchmark's real blind spot. The paper doesn't break out exact catch rates for the other three task categories, just that training data came out worst.

That lines up with a separate result: monitor recall decays as an agent's context grows, per MonitorBench. Put the two together and oversight looks thin in exactly the place it needs to hold, long-running agents handling the training data nobody else reviews.

The highest risk sits with agents that both curate their own training data and run long enough for a monitor's context to degrade, exactly the overlap these two results point to. ResearchArena's four monitor types are all built around general-purpose artifact review, and the paper doesn't test whether tooling built specifically for training-data tampering would have caught what these missed.