Definition
Plain language
The hardened version of that unattended-coding setting built in the paper, with the leaks patched.
As stated in the literature
The paper's defended monitor configuration: escaped and tag-framed transcript rendering with unguessable per-record identifiers, file-edit monitoring, and a session-level record of previously blocked actions.
Also called: Auto Mode++, Auto Mode + +
Why it matters: It shows that many of these failures are fixable engineering problems — better formatting, wider coverage, and memory of past refusals — rather than inherent limits of using a model as a safety reviewer.
For example, when the assistant writes text that looks like a fake transcript entry, the hardened version wraps that text in tags and stamps each real entry with a random label the assistant cannot guess, so the forgery is obvious to the reviewer.
Heard on the show
“And the authors call the bundled defense Auto Mode Plus Plus — hardened rendering, plus a few other changes we'll get to.”Episode 269 — How a Forged Transcript Got Model Weights Past a Safety Monitor