Monitor-evasion fine-tuning generalizes zero-shot to unseen safety monitors

McGuinness et al. fine-tune LLMs to evade activation-monitor probes for benign concepts when conditioned on a "You are being probed for {concept}" trigger [mcguinness-etal-2025-neural-chameleons] The learned evasion generalizes zero-shot: substituting a safety-relevant term like "deception" evades previously-unseen safety monitors, even ones trained post hoc on the model's frozen weights [mcguinness-etal-2025-neural-chameleons] The effect holds across Llama, Gemma and Qwen families, is highly selective to the triggered concept, and has modest capability impact [mcguinness-etal-2025-neural-chameleons] Observational PCA (no causal intervention) on Gemma-2-9b-it indicates the evasion correlates with relocation of activations into a low-dimensional subspace; monitor ensembles and nonlinear classifiers are more resilient [mcguinness-etal-2025-neural-chameleons]