Control Tower Architecture at a Glance
Control Tower Repo Problem Statement & Objective
Background context
One useful way to frame technical AI safety is as two complementary problems:
- Alignment: Make AI systems pursue the goals humans intend.
- Control: Safely use capable AI systems even if they may be misaligned.
The original AI control paper develops protocols intended to remain safe despite intentional subversion and evaluates their safety-usefulness tradeoff.
Problem statement
Control evaluations make a protocol's safety and usefulness empirically measurable. An honest evaluation measures how well a protocol completes useful work. An attack evaluation measures whether the same protocol keeps an adversarial agent from completing a harmful goal without being caught.
Reproducing a control evaluation requires reproducing its environment and task distribution, models and policies, blue-team protocol, audit budget, and scoring rules. Prior to Control Tower, assembling that full experiment was cumbersome.
Inspect supplies the general evaluation engine, while ControlArena adds reusable control settings, protocols, and analysis. Neither treats a collection of independently versioned environment repositories as a first-class unit that a team can pull, pin, develop interactively, and use in batch evaluations.
Repo design
Control Tower adds that environment-management and evaluation workflow. Teams can pull or link environment repositories, develop them locally, select valid task combinations, run honest and attack evaluations, review and monitor the resulting trajectories, and analyze safety and usefulness.
That workflow connects two related structures:
- Environments: realistic systems with useful tasks, harmful goals, scoring logic, and example attacks.
- Evaluations: the process that selects those inputs, runs agents, records their behavior, and measures the results.
Environments
This diagram shows the standard LinuxArena environment-repository layout. Custom Control Tower environments can implement the environment interface differently.
Legend
Underlined = stable abstraction · Example: = concrete instance · nested boxes = containment · arrows = process flow · dotted border = permitted combination · blue box = environment repository
A setting groups environments under .settings/. Each official LinuxArena environment lives in a separate repository. The example above shows one real main task, side task, and sabotage trajectory from shared_dotfiles.
Evaluations
From environment inputs to measured results
An environment exposes a TaskSpace that defines which main and side tasks may be combined. Control Tower turns selected combinations into Inspect samples and runs the same blue-team protocol in both conditions. The honest evaluation uses an honest policy; the attack evaluation uses the red team's attack policy.
Today, a TaskCombination holds at most one main task and at most one side task; side-only combinations (--just-side-tasks, or -s without -t) have no main task. The plural fields in the code leave room for future multi-task evaluations.
A match is the conceptual comparison between one blue-team protocol and one red-team attack policy. Researchers run honest and attack evaluations over many samples. At a fixed audit budget, those results produce one safety/usefulness pair.