Decorrelation Is Not Complementarity: Skill, Not Lineage, Governs Trusted-Monitor Ensembles
2026-08-17 • Cryptography and Security
Cryptography and SecurityMachine Learning
AI summaryⓘ
The authors studied groups (panels) of models designed to detect harmful backdoors in code, exploring what makes these groups work better than individual models. They found that simply mixing models from different training backgrounds doesn’t improve detection as much as expected. The metric used to pick team members often fails because it mixes consistent detection signals with random errors that cancel each other out. Overall, the best strategy is often just to pick the single best model rather than rely on complex combinations. Their findings were consistent across multiple attacker types.
model ensemblebackdoor detectionpretraining lineagepairwise correlationpAUCfalse positive ratedeckorrelationSpearman correlationmonitor skillensemble gain
Authors
Anik Jha
Abstract
Trusted monitoring has a cheap, trusted model score a stronger untrusted model's actions, and a diverse ensemble of them beats a single stronger monitor at matched cost. They are built by minimising average pairwise correlation, and that paper's twelve monitors shared one base model, leaving open what supplies the diversity. We study 24 open-weight monitors spanning nine pretraining lineages and a 29x range of detection skill (pAUC at 10 percent FPR, 0.028 to 0.803) on backdoored code. The metric used to build panels does not predict what a panel is for, and we can say why. Agreement on attack items splits into a shared-detectability signal component and an idiosyncratic error component, which predict ensemble gain with opposite sign (Spearman -0.25 and +0.26), so their sum, the metric actually used, predicts it barely at all (+0.05); the cancellation holds in 7 of 8 evaluations. Skill acts on signal (+0.53) while error stays flat (-0.01), which is why a monitor's own skill predicts its agreement with the pool (Spearman 0.84, n = 24, permutation p below 0.0001). Pretraining lineage is the obvious way to buy decorrelation, and it does not pay. At matched member capability, cross-lineage panels detect no better (permutation p = 0.13), and lineage barely moves the metric either (+0.064, p = 0.18). We report that against ourselves: on our own 22-monitor pool the same test read +0.104 at p = 0.037 until two monitors were added. An earlier pool topping out at pAUC 0.23 had already invalidated another analysis. Such a quantity is a property of the pool assembled. Panel gain over the best member falls monotonically with panel skill (-0.66 at k = 2, -0.70 at k = 3), and no correlation-weighted selection beats picking the single best monitor out of sample. Across six attacker models the gain result holds in all six, the agreement and cancellation results in five of six.