Thanks for writing this up! I think this proposal sounds pretty reasonable and it avoids one of the issues with capability-based gates that I thought would make such agreements not possible (by saying you can just use whatever interp and monitoring to pass the gate and thus making it a dynamic threshold). I tentatively would be in favor of it over no monitorability commitment at all.

However, I think this proposal does not address what I see as the strongest arguments against an outcome-based commitment ("achieve sufficient monitorability") and in favor of an architecture-based commitment ("do not train neuralese models"), at least in the current regime of competitive frontier AI development.

Argument 1: It is hard to win a fight when the model is trained

I think the proposal you laid out would result in labs having internal fights about the interpretation of evidence from the sabotage capability evals, putting a lot of pressure on their methodology (eg what counts as fair amount of elicitation, which as you point out is the trickiest question; or what the results in the eval setting mean for the actual internal deployment that can look very differently). Under an outcome-based commitment, this fight will happen repeatedly, after a lot of people put their blood, sweat and tears into an artifact that they also have multiple strong incentives to ship. Being tricky to adjudicate + strong incentives to subvert seem like a bad combination for an agreement governing high-stakes technology.

you should always be able to unblock scaling if you get blocked by this just by improving your interpretability and monitoring to make the monitor once again stronger than the policy

For example, here I expect deciding whether the improved interpretability and monitoring are sufficient will be a huge fight and the decision will always be strongly biased in favor of deploying.

Or if the reason that this broke was because you made the CoT less monitorable—e.g. by training against it or by doing some neuralese-y thing—you should always be able to unblock by rolling that back.

Re-doing a training run (to avoid training against CoT) and rolling back the architecture and re-doing a run are incredibly expensive asks! I'd expect in practice some half-way solutions to happen (like do a bit of fine-tuning to "fix" monitorability) which will run into the problem from the previous example.

Argument 2: Sabotage capability evals (and other monitoraiblity evals) only test for monitorability of a few specific behaviors that we already know to look for. Currently, CoT provides rich signal about model cognition that monitorability evals do not capture. Therefore, relying solely on monitorability evals for holistic judgment of monitorability (regardless of other information, like model architecture) will over-estimate safety. There is more to say here, but I will leave it at this for now.

There's also the argument some make that neuralese may make worst kinds of misalignment (eg scheming) more likely, which your proposal doesn't address.

———

I wonder if you see any blockers for getting the best of both worlds and basing a commitment in both monitorability and architecture? Adding the architecture agreement would: (a) make the monitorability commitment more effective by alleviating some major sources of pressure from arguments 1 and 2, (b) make scheming less likely, and (c) buy interpretability research more time.