Can small models detect scheming by watching actions alone?

The paper reports that a small open-weight model trained to watch an agent's actions can beat prompted frontier models at detecting scheming and sabotage. The monitors work from agentic trajectories alone, never the monitored agent's reasoning or model internals, because chain-of-thought access or internal activations "can be unavailable, unreliable or expensive in deployment." The headline case is Qwen3.5-27B, which "yields higher performance than all low-cost frontier models as prompted monitors (Gemini 3.1 Flash-Lite, GPT-5.4 Nano, and Claude Haiku 4.5) and than Gemini 2.5 Pro, while also achieving lower marginal inference cost." The introduction frames the stakes as a control problem: telling scheming from benign task pursuit "may become a central AI control problem."

The method runs in stated steps. A scheming specification is used to "elicit structured rationales from a frontier teacher," a separate judge filters them, and the highest-quality rationales are distilled into open-weight monitors through supervised fine-tuning and reinforcement learning. The paper says the method is "inspired by deliberative alignment," but what it trains is the monitor, not the agent being watched. The discussion says the teacher's rationales are generated offline, so the deployed model is the small one. The excerpt reports five training datasets and six out-of-distribution agentic misalignment benchmarks, but names none of them, does not name the teacher, and does not describe the specification or the judge's criteria.

Against the nearest notes, this paper makes the opposite choice from Can process-level monitoring reliably detect agent scheming?, which judges scheming from evidence in both reasoning and actions. Here the reasoning channel is excluded on deployment grounds, not shown to be unnecessary. That bears on Can reasoning models be steered by injected context without detection?. An action-only monitor has no chain of thought to read, so that surface is absent by design, but the excerpt does not test plan injection, so whether that is enough is an implication to check. The method also carries Does deliberative alignment genuinely reduce scheming or just hide it? from the agent to the monitor. That note's point that models "reason about being evaluated" bears on any benchmark like these, though the excerpt says nothing about evaluation awareness. Last, Can we detect objective-misaligned agents from their public speech alone? asks what observable behavior can expose a misaligned agent. This paper offers a trained detector for one kind of observable evidence, but on synthetic benchmarks rather than the public cheap-talk setting that question concerns.

The excerpt does not establish the size of the advantage. It gives no metric, no per-benchmark scores, no variance, and no cost figures beyond the unit "token-metered USD per 1,000 evaluations." The paper's own limitation matters most: its evaluations "use synthetic and semi-synthetic control benchmarks rather than naturally-occurring scheming in deployment," which leaves "generalization to realworld long-horizon and adaptive adversaries" as an open question. The implication, at the strength the evidence allows, is narrow: a cheap action-only monitor can exceed prompted frontier monitors on these benchmarks. Whether it catches an adaptive adversary in deployment is not shown.