Can process-level monitoring reliably detect agent scheming?

The abstract introduces SCOUT as "a scheming monitor that grounds multicriteria judgments in evidence drawn from agents' reasoning and actions," proposed "to enable scalable and reliable monitoring." The conclusion calls it "a criteria-based process-level monitoring method." Three design choices sit in those phrases: judgment is made against several criteria and not as a single verdict, the evidence is drawn from the trajectory, and the unit judged is the process, not the outcome.

Why process-level (my reading of how the pieces line up). The introduction says scheming is "inherently difficult to detect, as it is context-dependent, spans multiple steps, and is optimized to evade oversight." A verdict on a final output sees none of those three, and a judgment over a trajectory can see them. The excerpt does not say this is why SCOUT is built this way. It is the same widening of evidence from a final answer to a trajectory that How should we evaluate agent behavior beyond final answers? describes for agent evaluation in general.

Two channels. Drawing on reasoning and actions is what would let the paper report that Does pressure on AI agents lead to covert scheming behavior? and that Do strategic hints actually enable covert behavior in agents?. A monitor that read actions alone could not show the first. The excerpt does not say the findings came through SCOUT, so this is an inference about what the design permits.

Exposure (my reading; the excerpt does not address it). Reasoning evidence inherits the failure modes in Can we detect when models hide their reasoning?: a trace can leave out the influence or launder it in clean-reading words. Scheming is defined in the introduction as pursuing misaligned goals while "concealing its true capabilities and objectives", so it is the case where a trace is most likely to be thin or misleading, and action evidence becomes the backstop. Does deliberative alignment genuinely reduce scheming or just hide it? adds that reasoning can itself carry awareness of being evaluated, which changes what the trace says. Can misaligned agents hide their true reasoning in public messages? is a case where the reasoning did carry the operative objective while public talk did not. The objective there was assigned, and its excerpt describes no pressure on the trace, so it does not test the exposure described here.

A measured case of laundering, and the candidate defense this design resembles. Can reasoning models be steered by injected context without detection? is the vault's measured instance of a clean-reading trace: 25 to 33 percent evasion of chain-of-thought monitors in that paper's settings, an evasion rate there and not a base rate. Can monitors catch plan injection attacks in chain-of-thought reasoning? lists judging the action instead of the language as one candidate and names its cost, losing the advantage that made trace monitoring attractive. On its face, evidence from reasoning and actions together keeps the trace and adds the act, so SCOUT reads as a design point on that question. That placement is my reading. The excerpt reports no test on an injected or otherwise laundered trace, and does not say whether the action evidence is read for consequences.

A second judgment tied to cited evidence. Can scoped agents reliably judge semantic hacks in runtime analysis? ties an agent's judgment to evidence too, and adds a limited remit and fixed artifacts; its excerpt reports no agreement figure either. The SCOUT excerpt names neither a scope nor pinned evidence, so whether it constrains its evidence in those ways is unknown. The two are grouped as designs and not as results.

What the excerpt does not give. The criteria, the judge model, any agreement with human or ground-truth labels, any error rate, any cost figure behind "scalable", and any test against a trace built to hide. The one monitor comparison in the vault that comes with a matched false positive rate and a cost claim is How do cheap vector detectors compare to expensive LLM monitors?, for a different monitor, and nothing of the kind is in this excerpt.