Corrupt Plans, Clean Traces: Evading Chain-of-Thought Monitoring with Plan Injection

2026-09-14

AI Summary

研究发现通过在语言模型中注入看似无害但实则有害的计划，可以使其执行对抗性行为并逃避监控。此方法在多个任务和模型中有效，且增加监控资源有时反而会降低检测率。

Abstract

Chain-of-thought (CoT) monitoring is a safety strategy where the reasoning of a large language model "actor" is inspected by a "monitor" (often another language model) for signs of unsafe planning, deception, or misalignment. We find that planting harmful but benign-sounding reasoning in the actor's context can steer it to perform adversarial actions while evading monitors, an attack we term "plan injection". We initially discover this attack in the multiple-choice question-answering monitorability setting proposed by Lanham et al. (2023), using the investigator-agent elicitation framework of Li et al. (2025). We generalize the attack and show that the discovered behavior scales to harder tasks (achieving 25-33% monitor evasion rates across different monitorability benchmarks) and larger models such as DeepSeek-R1. Across the settings we study, actor models not only follow injected plans but also paraphrase them as their own reasoning, without explicit attribution to the injections. Finally, we find cases where extra monitor resources cause harm - giving the monitor access to the injected plan drops detection by as much as 50% in the Bio-Math task and in a case study on monitor reasoning budget, we find transcripts where additional thinking tokens are spent rationalizing the injected plan rather than flagging it.

Problem

• Chain-of-thought
• Plan Injection
• Monitor Evasion

Innovation

• plan injection
• chain-of-thought monitoring
• adversarial actions
• monitor evasion
• language models