这篇论文揭示了AI编程工具中重试策略的安全隐患，并给出了更优的重采样方案。做AI安全或使用Claude Code/Codex的开发者，建议看看具体实验数据和结论，避免踩坑。
这篇论文研究了AI编程脚手架（如Claude Code、Codex）中两种安全策略：重试（retrying）和重采样（resampling）。研究发现，重试虽然能降低可疑分数，但不可信模型可利用监控器的理由构建更隐蔽的攻击，抵消安全收益。相比之下，重采样不会泄露可利用信息。在BashArena实验中，使用Claude Opus 4.6作为不可信模型、MiMo-V2-Flash作为可信监控器，每步采样5次并基于最大可疑分数审计，安全率从61%提升至71%，审计预算仅0.3%，且不影响实用性。选择性重采样（仅对首次采样可疑的步骤）可恢复6.2个百分点的收益，同时仅需10%的额外样本。研究还发现两个与先前工作（Ctrl-Z）矛盾的结论：基于最大可疑分数审计优于最小，且执行最不可疑样本的安全增益很小。
Retrying vs Resampling in AI Control
AI coding scaffolds like Claude Code and Codex use \textit{retrying}: blocking actions flagged as risky and continuing the trajectory. We study retrying from an AI control perspective, which treats the model as potentially adversarial. We find that while retrying reduces honest suspicion scores, the untrusted model can exploit monitor rationale to construct sneakier attacks, negating safety gains. We also study \textit{resampling}: drawing multiple samples from the same context, which does not leak exploitable information. We disentangle design choices that previous work on resampling had bundled together. In BashArena, with Claude Opus 4.6 as the untrusted model and MiMo-V2-Flash as the trusted monitor, drawing five samples per step and auditing on the maximum suspicion score raises safety from 61\% to 71\% at a 0.3\% audit budget, at no cost to usefulness. Selectively resampling only the steps that look suspicious on the first draw recovers 6.2 percentage points of the gain while drawing only 10\% as many extra samples. Two of our findings in this setting contradict earlier work on resampling. The first is that auditing based on the maximum across resampled suspicion scores outperforms using the minimum, which is the opposite of what Ctrl-Z found. The second is that executing the least suspicious sample, which is the central mechanism in earlier defer-to-resample protocols, gives only a small empirical safety gain in our setting (+3.9 pp, with the confidence interval overlapping zero).