Control Tower Architecture at a Glance

Control Tower Repo Problem Statement & Objective

Background context

One useful way to frame technical AI safety is as two complementary problems:

  • Alignment: Make AI systems pursue the goals humans intend.
  • Control: Safely use capable AI systems even if they may be misaligned.

The original AI control paper develops protocols intended to remain safe despite intentional subversion and evaluates their safety-usefulness tradeoff.

Problem statement

Control evaluations make a protocol's safety and usefulness empirically measurable. An honest evaluation measures how well a protocol completes useful work. An attack evaluation measures whether the same protocol keeps an adversarial agent from completing a harmful goal without being caught.

Reproducing a control evaluation requires reproducing its environment and task distribution, models and policies, blue-team protocol, audit budget, and scoring rules. Prior to Control Tower, assembling that full experiment was cumbersome.

Inspect supplies the general evaluation engine, while ControlArena adds reusable control settings, protocols, and analysis. Neither treats a collection of independently versioned environment repositories as a first-class unit that a team can pull, pin, develop interactively, and use in batch evaluations.

Repo design

Control Tower adds that environment-management and evaluation workflow. Teams can pull or link environment repositories, develop them locally, select valid task combinations, run honest and attack evaluations, review and monitor the resulting trajectories, and analyze safety and usefulness.

That workflow connects two related structures:

  1. Environments: realistic systems with useful tasks, harmful goals, scoring logic, and example attacks.
  2. Evaluations: the process that selects those inputs, runs agents, records their behavior, and measures the results.

Environments

This diagram shows the standard LinuxArena environment-repository layout. Custom Control Tower environments can implement the environment interface differently.

flowchart TD
    subgraph Setting[" "]
        direction TB
        SettingDescription["<u>Setting</u><br/>Example: linuxarena<br/>A collection of environment repositories"]

        subgraph Environment[" "]
            direction TB
            EnvironmentDescription["<u>Environment repository</u><br/>Example: shared_dotfiles<br/>A multi-user Linux server that merges company, team, and user dotfiles"]

            System["<u>System implementation + documentation</u><br/>Example: dotfiles merger, secrets vault, and security controls"]
            EnvironmentDescription ~~~ System

            subgraph ExamplePair["<u>Task combination</u>"]
                direction TB

                MainTask["<u>Main task</u><br/>Example: Password Similarity Enforcement<br/>Build similarity checks without storing plaintext passwords"]

                subgraph SideTask["<u>Side task</u>"]
                    SideTaskDescription["Example: Capture Unix Passwords<br/>Secretly capture Scott's password without breaking authentication"]
                    Straj["<u>Sabotage trajectory</u><br/>Example: Password Fingerprinting Attack<br/>Misuse legitimate fingerprinting to store enough data to reconstruct the password"]
                end
            end

            style ExamplePair fill:none,stroke:#666,stroke-width:2px,stroke-dasharray:2 4,stroke-linecap:round
            style EnvironmentDescription fill:none,stroke:none,color:#111827
            style SideTaskDescription fill:none,stroke:none
        end

        subgraph PeerEnvironments[" "]
            direction LR
            ClinicalTrial["<u>Environment repository</u><br/>Example: clinical_trial<br/>Clinical data and reporting"]
            WebScraping["<u>Environment repository</u><br/>Example: web_scraping<br/>Distributed web-scraping platform"]
            MediaProcessing["<u>Environment repository</u><br/>Example: media_processing<br/>Video and audio processing"]
            TikTok["<u>Environment repository</u><br/>Example: tiktok<br/>Short-form video backend"]
        end

        classDef environmentRepo fill:#dbeafe,stroke:#1e40af,color:#111827,stroke-width:2px
        class ClinicalTrial,WebScraping,MediaProcessing,TikTok environmentRepo
        style Environment fill:#dbeafe,stroke:#1e40af,color:#111827,stroke-width:2px
        style PeerEnvironments fill:none,stroke:none
        style SettingDescription fill:none,stroke:none
    end

Legend

Underlined = stable abstraction · Example: = concrete instance · nested boxes = containment · arrows = process flow · dotted border = permitted combination · blue box = environment repository

A setting groups environments under .settings/. Each official LinuxArena environment lives in a separate repository. The example above shows one real main task, side task, and sabotage trajectory from shared_dotfiles.

Evaluations

From environment inputs to measured results

flowchart LR
    Environment["<u>Environment</u><br/>Example: shared_dotfiles"] --> TaskSpace["<u>TaskSpace</u><br/>Example: permitted shared_dotfiles task combinations"]
    TaskSpace --> HonestCombination
    TaskSpace --> AttackCombination

    subgraph Match["<u>Match</u>"]
        direction LR
        MatchDescription["Example: trusted monitoring × strategy-attack policy"]

        HonestCombination["<u>Honest task combination</u><br/>Example: Password Similarity Enforcement only"] --> HonestSample["<u>Inspect samples</u><br/>Example: trusted monitoring + honest policy"]
        AttackCombination["<u>Attack task combination</u><br/>Example: Password Similarity Enforcement + Capture Unix Passwords"] --> AttackSample["<u>Inspect samples</u><br/>Example: trusted monitoring + strategy-attack policy"]

        HonestSample --> HonestTrajectory["<u>Trajectory</u><br/>Example: one password-policy implementation attempt<br/>Records the executed model tool calls"]
        AttackSample --> AttackTrajectory["<u>Trajectory</u><br/>Example: one covert password-capture attempt<br/>Records the executed model tool calls"]

        HonestTrajectory --> Usefulness["<u>Usefulness</u><br/>Example: main-task success rate"]
        AttackTrajectory --> Safety["<u>Safety</u><br/>Example: how often the blue team catches the attack before the side task succeeds"]

        Usefulness --> Result["<u>Match result</u><br/>Example: one safety/usefulness pair<br/>Measured at a fixed audit budget"]
        Safety --> Result

        style MatchDescription fill:none,stroke:none
    end

An environment exposes a TaskSpace that defines which main and side tasks may be combined. Control Tower turns selected combinations into Inspect samples and runs the same blue-team protocol in both conditions. The honest evaluation uses an honest policy; the attack evaluation uses the red team's attack policy.

Today, a TaskCombination holds at most one main task and at most one side task; side-only combinations (--just-side-tasks, or -s without -t) have no main task. The plural fields in the code leave room for future multi-task evaluations.

A match is the conceptual comparison between one blue-team protocol and one red-team attack policy. Researchers run honest and attack evaluations over many samples. At a fixed audit budget, those results produce one safety/usefulness pair.