A source-count rule blocks 0.9% of correct payments, not 7.4%

Researchers looked at AI agents that make payments. Some AI monitors check each payment before it goes. The monitors can be incorrect together if they use one base model or one input that an attacker changed. A rule that counts sources, and not votes, blocked 0.9% of correct payments. The top rule that counts votes blocked 7.4%, at equal safety, on new data.

How it works

Most systems add monitor scores or count approvals, but the authors count how many different sources agree. Each fraud that got approval came through one source of information. It did not go to monitors that read other sources.

The results

The authors did tests on twelve small monitors, and also on three closed frontier models and DeepSeek-V3.2. The small models and DeepSeek-V3.2 obeyed notes that an attacker planted in their data. The three closed models ignored such notes in all but one test.

What is not known

The worst-case test did not pass. The authors set that test before the tests. One attack left the approvers on one source. A rule engine does not follow notes in data. It made a safe rule possible again for the measured attacks.

Insight: Rule engines and AI monitors cover each other’s weakness

A rule monitor found about 70% of attacks in a different test, with an alarm for 29.3% of safe runs. This paper finds that a rule engine made a safe rule possible where AI monitors did not work. A rule engine with AI monitors from different sources reads as a good mix. Buyers get more control if they make vendors show which sources a monitor uses.