AI control mitigations
Prices whether AI control mitigations — monitoring, honeypots, deployment-time defences — will be strong enough by 2030 to stop a misaligned model that is actively trying to cause catastrophe.
In Risks
Risk dossier · condition
P(this | by 2030) = 0.15–0.55
Composed, all-in: 0.15–0.55 — the intervals multiplied along the full `requires` chain, assuming the conditions are independent, which they are not entirely.
What would move it
- A frontier lab publishes a deployment safety case resting primarily on control (monitoring, honeypots) rather than alignment.
How the interval was set
No `requires` parents, so this is the unconditional probability that AI control mitigations exist in a form strong enough to do the mitigating work the downstream edge assigns them — i.e. defences that would actually stop a misaligned model from causing catastrophe, not merely that some monitoring exists.
The held evidence is thin and aspirational on both counts. Anthropic's rogue-eval post says only that "we may also try to build mitigations that would prevent LLMs from causing a catastrophe even if they tried to cause one" — an intention, not a demonstrated capability. The safety-cases post states the goal as making "evaluations, honeypots, and deployment time monitoring good enough that even a misaligned AI would not be able to defect in a consequential way at deployment time without first triggering one of these defenses." That is the target condition restated, with no evidence quoted here that it has been met, nor any stated probability from the authors.
Weighing this: the shallow version of the node (control protocols adopted, untrusted monitoring, honeypots in frontier deployment pipelines) is plausibly already trending toward true, which supports the upper end. The demanding version — sufficiency against a capable scheming model, and coverage across the actors whose failures would matter, including less cautious labs and open-weight releases — is where the control literature's own caveats bite, and pulls the lower bound down. Effectiveness also degrades as capability rises, so a 2030 horizon cuts both ways: more time to build, more capable adversaries to hold.
Residual uncertainty is dominated by node interpretation (deployed vs. adequate) and by the absence of any recorded influences or empirical control-eval results in the dossier. The interval is deliberately wide; narrower would claim calibration these two quotes cannot support. Horizon 2030 is my reading of the evidence's near-term frontier-deployment framing, not a stated one.
Grounded in
https://alignment.anthropic.com/2024/rogue-eval — 1 quoted claim
- “we may also try to build mitigations that would prevent LLMs from causing a catastrophe even if they tried to cause one”
https://alignment.anthropic.com/2024/safety-cases — 1 quoted claim
- “The idea is to make the evaluations, honeypots, and deployment time monitoring good enough that even a misaligned AI would not be able to defect in a consequential way at deployment time without first triggering one of these defenses.”
Also phrased across sources as: “Control-based mitigations against misaligned LLM actions” · “Evaluations, honeypots, and deployment-time monitoring sufficiently robust”
Assessed probabilities are the model’s knowledge, not verification — 2026-09-05 · assess-risk@3 · claude-opus-5.
This node holds if, by 2030, defences exist that would actually stop a misaligned AI model from causing a catastrophe — not merely that some monitoring is in place.
Nothing upstream narrows this one. There are no conditions that have to hold first, so the interval above is the plain question: do the defences work, and do they work where it matters? That bar is higher than it first sounds. The downstream edge asks these mitigations to do real blocking work against an AI system that is trying to cause harm. Defences that catch honest mistakes, or that catch a model that is not trying to hide, do not clear it.
What pushes the estimate up is that the shallow version of this is already being built. Control protocols, monitoring at deployment time, and honeypots — deliberately planted opportunities that look like a chance to defect and are watched — are moving into frontier deployment pipelines. The safety-cases post from Anthropic states the target directly: make “the evaluations, honeypots, and deployment time monitoring good enough that even a misaligned AI would not be able to defect in a consequential way at deployment time without first triggering one of these defenses.” Someone is aiming at the right thing, with a concrete plan and time on the clock.
What pushes it down is that the held evidence states intentions, not results. The rogue-eval post says only that “we may also try to build mitigations that would prevent LLMs from causing a catastrophe even if they tried to cause one.” That is a plan. The safety-cases quote restates the goal; it does not report having met it, and neither author offers a probability of their own. Two further problems bite. Coverage: the actors whose failures would matter most include less cautious labs and open-weight releases, where a protocol adopted at one company does nothing. And decay: a defence tuned to today’s models has to hold against more capable ones, so the 2030 horizon cuts both ways — more time to build, and a stronger adversary to hold at the end of it.
Most of the remaining uncertainty is about what counts as holding. Read the node as “control measures are deployed,” and it looks close to settled. Read it as “control measures are sufficient,” which is what the downstream edge requires, and the control literature’s own caveats do the work. The dossier records no empirical control-evaluation results and no influences either way. The interval above is wide on purpose; narrower would claim a calibration these two quotes cannot support.
The subtree
The diagram is an illustration; the model is the record.