AI coding scaffolds like Claude Code and Codex use \textit{retrying}: blocking actions flagged as risky and continuing the trajectory. We study retrying from an AI control perspective, which treats the model as potentially adversarial. We find that while retrying reduces honest suspicion scores, the untrusted model can exploit monitor rationale to construct sneakier attacks, negating safety gains. We also study \textit{resampling}: drawing multiple samples from the same context, which does not leak exploitable information. We disentangle design choices that previous work on resampling had bundled together. In BashArena, with Claude Opus 4.6 as the untrusted model and MiMo-V2-Flash as the trusted monitor, drawing five samples per step and auditing on the maximum suspicion score raises safety from 61\% to 71\% at a 0.3\% audit budget, at no cost to usefulness. Selectively resampling only the steps that look suspicious on the first draw recovers 6.2 percentage points of the gain while drawing only 10\% as many extra samples. Two of our findings in this setting contradict earlier work on resampling. The first is that auditing based on the maximum across resampled suspicion scores outperforms using the minimum, which is the opposite of what Ctrl-Z found. The second is that executing the least suspicious sample, which is the central mechanism in earlier defer-to-resample protocols, gives only a small empirical safety gain in our setting (+3.9 pp, with the confidence interval overlapping zero).

翻译：像Claude Code和Codex这样的AI编码脚手架会采用*重试*机制：阻止被标记为高风险的操作，并继续执行轨迹。我们从AI控制角度（将模型视为潜在对抗性实体）研究重试机制。研究发现，尽管重试会降低诚实的怀疑分数，但不受信任的模型可利用监控器推理构建更隐蔽的攻击，从而抵消安全增益。我们还研究了*重采样*机制：从同一上下文多次采样，这种机制不会泄露可被利用的信息。我们厘清了此前重采样研究中混杂的设计选择。在BashArena环境中，以Claude Opus 4.6作为不受信任模型、MiMo-V2-Flash作为可信监控器时，每步执行五次采样并基于最大怀疑分数进行审计，可将安全性从61%提升至71%（审计预算为0.3%），且不损害有用性。选择性仅对首轮采样可疑的步骤进行重采样，可在仅增加10%额外样本的情况下，恢复6.2个百分点的安全增益。本设置中的两项发现与先前重采样研究存在矛盾：第一，基于重采样怀疑分数最大值进行审计的效果优于采用最小值，这与Ctrl-Z的结论相反；第二，执行怀疑分数最低的样本（此前"延迟至重采样"协议的核心机制）在本设置中仅带来微弱的安全增益（+3.9个百分点，置信区间包含零）。