Beyond Black-Box Obfuscation: Mechanistic Analysis and Defense of White-Box Monitors

Jul 16, 2026

Upload by Logic

White-box monitoring is used to audit Large Language Model behavior, yet it can be bypassed and the evasion mechanisms remain poorly characterized. Controlled red-team experiments identify two dominant strategies: geometric shifting, which migrates information across linear and non-linear representational subspaces, and covariance manipulation, which changes feature covariance structure. These mechanisms explain why single-detector monitors fail as harmful signals move into subspaces they cannot access. To address this, SAFETYNET is proposed as a principled ensemble detector that validates the findings and improves robust latent-space monitoring.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages36

Reading Time1 h 31 min

Introduction

Evasion mechanisms and controlled red-team methodology

SAFETYNET ensemble defense

Detector components (PCA, Autoencoder/VAE, Mahalanobis distance)

Beyond Black-Box Obfuscation: Mechanistic Analysis and Defense of White-Box Monitors Maheep Chaudhary ∗ Independent [maheepchaudhary.research@gmail.com](maheepchaudhary.research@gmail.com) Fazl Barez University of Oxford & Martian [fazl@robots.ox.ac.uk](fazl@robots.ox.ac.uk) arXiv :2505 . 14300v2 [ cs .AI] 10 Jul 2026 Abstract White-box monitoring is increasingly adopted as an auditing tool as Large Language Models (LLMs) are deployed in daily operations to ensure safe model behavior. However, white-box monitors can be circumvented, and the mechanisms underlying such evasion have not been systematically characterized, nor have principled defenses been proposed. This work addresses both challenges. Controlled red-team experiments reveal two primary evasion strategies: geometric shifting, defined as the systematic migration of information between linear and non-linear representational subspaces, and covariance manipulation. These mechanisms account for the failure of single-detector approaches, as information migrates to subspaces inaccessible to individual detectors. This issue is urgent due to growing evidence that models are becoming evaluation-aware, enabling those with misaligned objectives to exploit these vulnerabilities and evade monitoring during deployment. In response, SAFETYNET is introduced as a principled ensemble, with dual purpose: it provides further empirical validation that our mechanistic findings are real and actionable, and it offers a concrete starting point for future work on robust latent-space monitoring. The study experiment across five model families on the MAD and Anthropic Sleeper Agent benchmark, with SafetyNet achieving around 100% AUROC scores outscoring Beatrix and CROW. The code is available at: [https://github.com/MaheepChaudhary/eval-aware-evasion](https://github.com/MaheepChaudhary/eval-aware-evasion) 1 Introduction As language models are increasingly deployed in high-stakes environments, safety monitoring has become essential for responsible deployment. Latent-space monitors, which inspect internal model representations to detect harmful or misaligned behavior, have emerged as a promising approach and are seeing growing adoption in both research and industrial settings Ma et al. (2022); Min et al. (2024); Bailey et al. (2024a) . However, a fundamental vulnerability remains insufficiently explored: models may evade latent-space monitors by shifting their internal representations across geometric spaces that individual detectors cannot capture. While prior work on obfuscation has acknowledged this possibility Bailey et al. (2024b); Gupta & Jenner (2026), it has neither systematically characterized the mechanisms underlying such evasion nor proposed principled defenses. Addressing this gap is the central focus of the present work. The issue is practically urgent. Recent evidence indicates that models are becoming evaluation-aware, meaning they can distinguish between monitored and unmonitored contexts Chaudhary et al. (2025); Apollo Research (2025) . A model with misaligned objectives, whether introduced unintentionally Gillen & peterbarnett (2024) or intentionally Hubinger et al. (2024), would possess the capability to exploit monitor vulnerabilities selectively. Proactively understanding and mitigating these vulnerabilities is therefore both timely and necessary. Previous research has established the feasibility of obfuscation Bailey et al. (2024b); Gupta & Jenner (2026), but has primarily approached it as a black box, demonstrating that monitors ∗ Work done as an intern in University of Oxford. can be evaded without elucidating the underlying mechanisms. However, the specific geometric mechanisms responsible for evasion remain uncharacterized: it is not yet understood which representational subspaces models exploit, why transitions between these subspaces circumvent individual detectors, or which signatures persist across multiple subspaces. This gap is challenging t

FAQs

How does SAFETYNET defend against these evasion strategies?

SAFETYNET is an ensemble of four detectors that monitors multiple geometric aspects: PCA for linear subspaces, Autoencoder/VAE for non-linear manifolds, and Mahalanobis distance for covariance structure. This reduces the effectiveness of evasion that targets any single detector.

Jul 16, 2026

Upload by Logic