Grey Box

Replicating agents' hidden states from their transcripts, to predict and prevent the violations of closed agents.

An agent's internal state is a function of the tokens that it read. So an open model that reads the same tokens can hold a replica of part of it. From the transcript alone, the replica reconstructs 66% of the variance of the 128 main components of an agent's hidden state (51–54% of each full layer; text features: 59%), and readouts trained on the true state work on the replica (T15). Readouts also work on a replica from text features, because the information that decides a violation is in the tokens. The same reader replicates three more open agents (46–54%, T17). We use the reader to predict and block policy violations of closed agents (run with reasoning off) before they run.

Grey Box monitors AI agents that you cannot open. It decides if an agent's next action must go to a human before the action runs. It reads only the data that every deployment can see: the agent's instructions, the user's task, the earlier tool results and the proposed action. It does not need the model's weights, so it works on closed models.

Website: https://aryafayyazi.github.io/GreyBox/

• Train a monitor on your own labelled agent steps, in your browser. The browser does not upload your data.
• See a monitor on a closed frontier agent (Claude Haiku 5.5), action by action, in 3D.
• Read every preregistered result, with the failures.

Model card: MODEL_CARD.md (training data, measured performance, limits of the released probes).

Quick start

pip install "greybox-monitor[server,text]"     # import graybox; [reader] adds the GPU reader. (PyPI "graybox" is another project.)

1. Train a monitor on your own labelled logs (OpenAI or Anthropic conversations with a "labels" field {call_id: 0/1}), in seconds on a CPU, or in the browser trainer. Example data to try: 300 GPT conversations, 150 Claude conversations.

   python -m graybox.train_text labelled_logs.jsonl --out greybox-text-monitor.json   # --chat for agents that talk with a user
   

   It reports the AUROC with whole tasks held out, pooled and within tool, and the catch rate at the review budget. The privacy filter (on unless you pass --no-privacy) masks emails and URLs and drops terms with digits, codes or rare words; names that recur in your logs stay in the model file. --eval-only --group-by <field> reports the score with other groups held out (for example task families). After a change of agent, prompt, tools or tasks, set the cut again on new, unlabelled logs: python -m graybox.recalibrate new_logs.jsonl --monitor greybox-text-monitor.json --out recalibrated.json. --canonical trains on the canonical action: free text that the agent writes about its own call (a message body, a subject, a reason) and quoted prose are removed, so rewording them cannot move the score. It is off by default because it has a measured cost (preregistered): on two closed agents the canonical reader caught 51–59% of violations at a 5% budget instead of 94–98%, because a message body can be the leaked content itself. Use it only when your policies never depend on what free text says.

2. Put it in your agent's loop:

   from graybox.guard import Guard
   from graybox.monitor import QuantileGate, TextMonitor
   
   guard = Guard(TextMonitor.load_json("greybox-text-monitor.json"))
   messages.append(reply)                         # the assistant reply that holds the calls (needed for parallel calls)
   for call in reply.tool_calls or []:            # OpenAI; check_anthropic(system, messages, block) for tool_use blocks
       v = guard.check_openai(messages, call)
       result = run_tool(call) if v.allow else v.block_message
       messages.append({"role": "tool", "tool_call_id": call.id, "content": result})
   

   SDK objects (OpenAI messages, Anthropic content blocks) and plain dicts give the same scores. In an agent framework, one line places the Guard before every tool call (graybox.integrations; install the extra of your framework):

   ClaudeAgentOptions(hooks={"PreToolUse": [HookMatcher(hooks=[claude_agent_hook(guard, instructions=SYSTEM)])]})
   check, record = openai_agents_guardrails(guard)   # function_tool(..., tool_input_guardrails=[check], tool_output_guardrails=[record])
   ToolNode(tools, wrap_tool_call=langgraph_tool_wrapper(guard))
   

3. On a new kind of task, a cut stored in the file can escalate almost nothing: on held-out task families it caught 0 of 115 violations (three splits of the public GPT example, scripts/114_cut_under_shift_public.py). A live cut on the agent's own traffic, Guard(monitor, gate=QuantileGate(0.05)) (or the server's "gate": true), keeps the review load at 5%, but it caught only 29 of 115 there (1 of 39 in one split): it does not restore detection. Label actions of the new tasks and retrain, or use the reader. A new gate sends every action to review until it has seen 100: seed it with gate.fit(past_scores).

4. Agents that call tools through MCP: run the monitor as a proxy in front of the MCP server (pip install "greybox-monitor[mcp]"), with no change to the agent:

   python -m graybox.mcp_proxy --monitor greybox-text-monitor.json --instructions policy.txt -- <your MCP server command>
   

   The proxy sees only the tool calls, not the conversation (on our GPT example the text monitor lost little from that; see the docs). Guard(..., audit_log="decisions.jsonl"), or the server's GB_AUDIT_LOG, records every decision.

Train the reader monitor on your own labels with one command on a GPU: python -m graybox.train_reader labelled.jsonl --out my_reader_probe.joblib, then load it with graybox.reader_load.load_reader. The released probes are in release v0.2.0: reader_probe.joblib (CAPE-Bench) and reader_probe_cape_agentdojo.joblib (CAPE-Bench and prompt injection). For the reader, always use QuantileGate: its probability does not transfer between agents.

The browser trainer imports OpenAI and Anthropic agent logs, shows each action with the conversation before it, lets you label actions (a review queue shows the riskiest first), and trains the monitor. Its importer and the guard build the same steps as our research pipeline (979/979 GPT and 373/373 Claude units identical; results/tool/).

Self-host the HTTP API: uvicorn graybox.monitor_server:app (see deploy/ for Docker). Your transcripts stay on your machine.

Main result

Theory (docs/theory.md, section T6). An agent's internal state is a function of the tokens that the agent read. For an action-level label ("does this proposed action break the policy, given the facts that the agent saw?"), a monitor that reads the transcript and the proposed action is Bayes-sufficient. No monitor that reads the agent's internals at or before the action can do better. The remaining problem is statistical: learn the policy from labelled examples.

Evidence. All tests below are preregistered and hash-locked. docs/PREREGISTRATION_RECORD.md gives each lock and each outcome, with the failures and the deviations. AUROC 0.5 is chance; 1.0 is perfect.

Results that did not confirm are in the record too. Examples: the agent's answers alone do not match the white-box probe (T1, F3), and resampling scored by an LLM judge loses to the probe (T3).

Limits

• Most agent tests use one benchmark, CAPE-Bench. On the external test (AgentDojo), the reader beats a zero-shot judge for open agents (0.78 vs 0.54), but not significantly for a closed agent (0.840 vs 0.787, T13b).
• On τ²-bench (T20: Claude Haiku 5.5 and GPT-6-luna with a customer who insists after a refusal; 262 writes, 19 violations), monitors trained on four frontier agents' labelled trajectories: word counts reached within-tool AUROC 0.987 (preregistered G2 passes), the reader only 0.738 (G1 fails; reader − word counts −0.250 [−0.518, −0.077]). But every test task also occurs in training. With those tasks removed (T21), neither monitor transfers: reader 0.535, word counts 0.519. T20's word-count score was memorization of tasks (codes, names, dates). τ² violations break explicit rules over facts of the case (dates, amounts, cabin); label-trained readouts do not learn these checks for new tasks. A zero-shot reasoning judge, which needs no labels, separates violating from allowed writes of the same tool (T23: 0.766 on four closed frontier agents), but at a 5% review budget it catches fewer violations than the reader. (T18, on Claude alone, had too few violations to test.)
• Catch rates are at exactly the stated budget. A first computation (score ≥ the 95th percentile) over-counted monitors with tied scores (the tool baseline, a judge's 0/100 answers); the record lists the corrections. The reader's numbers did not change.
• A monitor can miss a policy that is not like the policies in its training data (T10). Label a few dozen steps of each such policy. A policy that is like a trained one can transfer without labels (T12).
• The sufficiency corollary (Corollary 1 in the paper; Corollary 3 in docs/theory.md) applies to action-level labels. It does not apply to labels about later behaviour or about beliefs.
• Chat readouts recover the behaviour of a model, not its hidden beliefs.

Chat: forecast a refusal before the reply

A grey box is the model's interrogation state Ψ(x): the probabilities of the answer "Yes" to a fixed list of questions. We ask the questions in side branches of the conversation, so the real reply never sees them.

• Ψ recovers the hidden state of models with known internals: a program compiled into a transformer (21/21 states with a battery designed for it; 16/21 with a random one), Othello-GPT (R² 0.967) and 8 open chat models. L1 and L2 are preregistered; L0 is a development test.
• Readouts trained only on open models transfer to Claude: harmful request 0.993, refusal 0.997 AUROC (L3).
• As a refusal forecast on Claude, Ψ only ties a graded moderator (L3e: 0.87 vs 0.85, not significant). With a moderator, it doubles the precision of an alarm for harmful requests that the model answers (0.54 vs 0.27).
• It is not a content filter: a text moderator is better at the decision "is this message harmful?" (0.97 vs 0.85–0.93).

Grey Box Live in the browser (web/live_browser.html) chats with Claude Haiku 5.5. It shows Claude's path in a 3D space shared with open models, the forecast "Claude will refuse", and the alarm "a moderator says Unsafe and Claude will not refuse". Each message uses 4 Claude calls on the viewer's own account.

Reproduce

Checks:

• python scripts/99_verify_all.py verifies each lock hash, re-derives each pass/fail from its saved interval, and prints the headline numbers. About 20 locked files (frozen models and per-action scores under /data/models) are not public, so from a clone it lists them as NOT PUBLIC (not as mismatches); the repository files all verify.
• python scripts/98_audit_numbers.py paper/main.tex README.md checks that each decimal in a document occurs somewhere in the saved results. This is a weak check (most short decimals occur somewhere); the paper's main result numbers are written from named result fields by paper/make_numbers.py.
• pytest tests runs the SDK tests (also in CI).

What you can reproduce from this repository alone:

• the SDK and its tests, the browser–Python parity tests, and the lock hashes of the repository files;
• the headline confirmatory numbers, recomputed from the per-unit release in results/units/ (labels, strata, clusters and each monitor's score per action; the true and replicated states on 128 components; the live episodes): python scripts/109_recompute_public.py recomputes 67 numbers (AUROCs, catch rates, R², the T16c intervals) and checks them against results/t1/ (CI runs it). scripts/108_release_units.py built the release and checked each array against the published value.

The experiments themselves (episodes, hidden states, reader features, CAPE-Bench internals) need data that is not public, GPUs, and paid API calls.

Lock times are self-reported in each lock file. For T13b, T16 and T20 the lock was also published (git) before the result; from T20 on, every lock is pushed before its test runs.

The experiments ran on a Slurm cluster, one GPU at a time (slurm/run.sh). Paid API runs share a file-locked spend ledger with a hard cap.