Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages

Trusted monitoring is a central defense in AI control: a cheaper trusted model scores an untrusted model's actions for sabotage, and the most suspicious are audited or deferred. Such monitors are evaluated against one or two untrusted models, and the resulting accuracy is reported as a property of the monitor. We ask whether it is partly a property of the pairing. We make the untrusted policy family the controlled axis: we fit a monitor on family A's transcripts, apply it to family B, and decompose the cross-family AUROC into how obvious each family's sabotage is, how capable each monitor is, and the residual own-family advantage after both are removed: the interaction. A positive interaction means a monitor ranks its own lineage's sabotage above an equally detectable attack from a different lineage. On code-backdoor transcripts the interaction is positive and survives the dominant confounds: +0.172 (95% CI [+0.158, +0.185]) on four open-weight families on a strict leak-free basis, holding across an eight-family matrix spanning four frontier vendors, a trained transcript-reading monitor, and a second code benchmark. Translated to a defer-to-trusted protocol at a 1% audit budget, an off-lineage monitor catches 24% of attack attempts where an in-lineage monitor catches 42% at the same audit cost. We measure attack-attempt detection, not realized sabotage: successful backdoors are too rare at this scale to build a realized-sabotage matrix, which we state plainly as the main limitation. The takeaway for practice is that control evaluations should report cross-family transfer matrices, because a single-pairing accuracy overstates the safety a monitor delivers against a lineage it was not calibrated on; the four-step protocol that acts on the gap (detect off-lineage drift, recalibrate with labeled sabotage, treat pooling as a bounded partial defense) is in Section 5.