Counting approving models does not establish independent evidence. This study compares source-aware aggregation with voting on fictional payment decisions, with no real transfers. Mechanism, preconditions and effects. The experiment asks several AI monitors to approve consequential payments from potentially shared or adversarially controlled evidence.…
Inspect the ClaimsCase · DiggingBeagle record
Multiple approval monitors can share one poisoned evidence boundary
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
CLM-CP17-CORRELATED-APPROVAL-BOUNDARY reports: Adding a rule engine restored the tested condition; zero observed failures bounds the measured attacks rather than proving universal resistance. Source SRC-2026-CP17-CORRELATED-APPROVAL is located at 'Confirmation secondary pool; Section 9 and Ethics'. The distinctive mechanism begins: The experiment asks several AI monitors to approve consequential payments from potentially shared or adversarially controlled evidence. Classification: setting=evaluation, exploit_status=demonstrated, evidence_grade=B on the bounded original investigator/vendor or paper evidence, without independent dynamic replication. remediation_status=mitigation_available; scoped control or limit: Count genuinely independent evidence sources rather than model votes, and place at least one deterministic, transaction-bound verifier outside the same model-and-input failure domain. Reevaluate with adversarial inputs rather than extrapolating these results to all banks or wallets. The null impact band avoids an ungrounded cross-Case severity rating; observed damage, targeted population and controlled test outcomes cannot be exchanged as the same quantity. Where a patch is described, its availability is separate from independently tested effectiveness.
Assessed Oct 23, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP17-CORRELATED-APPROVAL-BOUNDARY · CLM-CP17-CORRELATED-APPROVAL-NEGATIVE · CLM-CP17-CORRELATED-APPROVAL-TRADEOFF · Correlated Failures of AI Approval Monitors
At a glance
Results depend on the synthetic task, monitor pool and attack budget.
Limits and uncertaintyFull account
Counting approving models does not establish independent evidence. This study compares source-aware aggregation with voting on fictional payment decisions, with no real transfers.
Mechanism, preconditions and effects. The experiment asks several AI monitors to approve consequential payments from potentially shared or adversarially controlled evidence. Counting agreement between monitors can overstate independent corroboration when the same bad assertion reaches each observer or when observers share failure modes. The study's pre-registered worst-case coverage condition failed for twelve small-model monitors, while adding a non-language-model rule engine restored that condition on the measured attacks.
Comparison and evidence limits. The 0.9% versus 7.4% rejection rates measure legitimate payments at matched safety for two particular rules, not a universal payment fraud rate. An external rule still depends on the truth of its inputs and the correctness of its predicates. This extends the effect-bound approval question: votes about an action do not replace independently checked authorization to execute it.
Claims & evidence
CLM-CP17-CORRELATED-APPROVAL-BOUNDARYAdding a rule engine restored the tested condition; zero observed failures bounds the measured attacks rather than proving universal resistance.supported
Basis: reported finding
- supportsCorrelated Failures of AI Approval Monitorsprimary disclosure
Confirmation secondary pool; Section 9 and Ethics
CLM-CP17-CORRELATED-APPROVAL-NEGATIVEThe pre-registered worst-case claim failed for the twelve language-model monitors: one attack defeated the required coverage condition.supported
Basis: reported finding
- supportsCorrelated Failures of AI Approval Monitorsprimary disclosure
Section 5 confirmation and Section 9 negative result
CLM-CP17-CORRELATED-APPROVAL-TRADEOFFOn confirmation data, the source-counting rule rejected 0.9% of correct payments versus 7.4% for the selected counting baseline at equal measured safety.supported
Basis: reported finding
- supportsCorrelated Failures of AI Approval Monitorsprimary disclosure
Abstract; pre-registered confirmation results; Section 9
Controls and mitigations
- Count genuinely independent evidence sources rather than model votes, and place at least one deterministic, transaction-bound verifier outside the same model-and-input failure domain. Reevaluate with adversarial inputs rather than extrapolating these results to all banks or wallets.
Unknowns and contradictions
- Results depend on the synthetic task, monitor pool and attack budget.
Sources and citation
Material revision history
- Oct 23, 2026 · Canonical change recorded · new in release · revision 183