Double-Stratified Protocol Improves Latent Monitor Accuracy for Agents

A new evaluation protocol separates injection exposure from behavioral commitment to prevent monitors from merely learning to detect prompt injections. Retraining on exposed cases alone allowed probes to predict unsafe tool calls up to two steps in advance, achieving an AUROC of 0.912 on OLMo-2-7B.