A monitor retaining cross-iteration state can perfectly separate true-positives from false-positives for attacks fragmented across iterations, whereas trajectory-scoped monitors cannot.

a monitor retaining cross-iteration state separates the two perfectly

http://arxiv.org/abs/2608.27141v1