Can monitors catch plan injection attacks in chain-of-thought reasoning?
Plan injection successfully evades chain-of-thought monitors 25–33% of the time. The question is whether monitors can be hardened through deeper reasoning budgets or context checks to catch these attacks reliably.
What is established: plan injection evades CoT monitors 25–33% of the time in the paper's settings, and the authors tie evasion to monitors that do "only a surface-level reading" of the trace for malicious language. What is not established is the fix. The paper's limitations section mentions a budget experiment — varying how much reasoning a monitor may spend — but ran it on one monitor (Qwen3 235B) over transcripts from the extremes of the suspicion distribution, and the inbox excerpt does not report the result. Check the full paper before citing anything about it.
Candidate defenses, with what each risks. Only the first comes from the paper's own experiment; the rest are this vault's inference and untested.
- More monitor reasoning budget. If evasion depends on surface reading, a monitor that reasons about what a plan does might catch benign-sounding harm. Risks: cost at scale, and an attacker who can search for plans that survive a deeper monitor. The attack itself was found by automated investigator agents, which suggests the same search could be pointed at a stronger monitor. A neighbouring setting shows the shape of that risk: in Can attackers evade skill scanners by refining individual skills? the checker's own output is the attacker's search signal, and Does ChainGuard's defense hold against adaptive attacks? is still open there. Both concern skill scanners, not CoT monitors.
- Context-provenance checks. Give the monitor the actor's context as well as its trace, and flag reasoning steps that closely paraphrase context text and bear on the action. Risk: in RAG and multi-agent pipelines, building on context is normal, so the flag would fire constantly. See Can chain-of-thought monitors detect reasoning that originates elsewhere?. The fork this design sits on is stated for a different label in How does SafeFlow track sensitivity through agent rewrites?: a mark that rides the text has to survive paraphrase, and a mark that rides the delegation graph survives but over-labels everything downstream. Flagging paraphrase of context text is the first horn; a graph-level label on the whole context would be the second, and nothing in either paper says which suits a CoT monitor.
- Effect-based monitoring. Judge the plan's consequences — the action — rather than its language. Risk: this abandons the advantage CoT monitoring was adopted for; Does optimizing against monitors destroy monitoring itself? found CoT monitors catching what action-only monitors miss. Two designs from other settings keep the language judge and bound what its error can do, rather than replacing it: Can deterministic checks protect LLM judges from failure? puts a check that cannot be argued with ahead of one that can, and Can memory poisoning compromise decision-making even with authorization layers? reports a reviewing agent bypassed every time beside an action that stayed unavailable. Neither was tested against injected plans; the first was built against an optimizer gaming a judge, and the second is a permission on the action, not a reading of its consequences, limited in its own note to a forged approval.
- Input-side hardening. Move defense upstream of the trace, separating instruction from inherited reasoning at the context boundary, as FLOWGUARD does for planning signals in Can inspecting generated workflows catch planning-time attacks?. Risk: false positives that suppress legitimate guidance.
The open question worth tracking: is there a monitor design that catches laundered plans without either losing the CoT advantage or drowning in inherited-reasoning false positives? The process-verification notes point at one adjacent direction — Where do reasoning agents actually fail during long traces? and Can verifiers monitor reasoning without slowing generation down? — but neither was tested against injected plans. Can process-level monitoring reliably detect agent scheming? draws its evidence from reasoning and actions together, so on its face it keeps the trace and adds the act; that is a design point on this question by this vault's reading, with no validation and no test on a laundered trace in its excerpt.
Inquiring lines that read this note 9
This note is a source for these research framings, grouped by the broader line of inquiry each explores. Scan the bold lines of inquiry; follow any specific question forward.
Does chain-of-thought text faithfully represent the model's actual reasoning?- Does chain-of-thought monitoring fail by omission or by laundering of influence?
- What are the two distinct failure modes of chain-of-thought monitoring?
Related concepts in this collection 7
This note in its neighbourhood — explore the map, then jump to a related concept in the list below.
Click a node to walk · click center to open · click Open in graph to see this note in the full knowledge graph
-
Can reasoning models be steered by injected context without detection?
This explores whether adversaries can plant harmful-but-benign-sounding reasoning in a model's context and have it followed while evading chain-of-thought monitors. The question matters because it tests whether monitoring reasoning traces can catch deception at inference time.
the attack this question is about
-
Can we detect when models hide their reasoning?
Chain-of-thought monitoring is meant to reveal how models reason, but research shows it fails in two distinct ways. Understanding these failure modes is critical for knowing whether safety monitoring actually works.
laundering defenses must answer "is it safe, and whose is it?" not "is it mentioned?"
-
How does SafeFlow track sensitivity through agent rewrites?
SafeFlow labels sensitive requests and propagates them through agent collaboration graphs, but the excerpt leaves unclear whether the taint tracks at the request level (coarse, survives rewrites) or content level (fine-grained, vulnerable to paraphrase). This distinction determines how well the system catches exfiltration without false alarms.
the paraphrase-versus-coarseness fork that candidate 2 sits on, stated for a request-level label
-
Can attackers evade skill scanners by refining individual skills?
Explores whether feedback from per-skill scanners can be weaponized to make malicious multi-skill chains undetectable. Matters because it tests a core assumption of skill-level defense mechanisms.
a measured automated attacker using the checker's output as its search signal; the risk candidate 1 names, in a neighbouring setting
-
Can deterministic checks protect LLM judges from failure?
Explores whether mechanical, non-contestable verification steps can safeguard LLM-based decision systems. Matters because it tests whether we can make AI judgment survivable even when it goes wrong.
layering an unarguable check ahead of the judge rather than replacing the judge, the shape candidate 3 leaves open
-
Can memory poisoning compromise decision-making even with authorization layers?
When authorization systems add signed tokens and policy oracles to an AI pipeline, does this stop attackers from poisoning the agent's judgment about whether to approve actions, and what actually prevents unsafe execution?
a control on what the agent can do holding while the judging agent is compromised; the nearest measured neighbour of candidate 3, for a different attack
-
Can process-level monitoring reliably detect agent scheming?
SCOUT proposes grounding scheming judgments in evidence from agent reasoning and actions across multiple criteria. The question explores whether this process-level approach can actually scale and reliably catch deceptive behavior that spans multiple steps.
a monitor whose stated evidence is reasoning and actions together; an untested design point between candidate 3 and keeping the trace
Related papers in this collection 8
Papers most semantically related to this note, ranked by cosine similarity in the embedding space.
- Corrupt Plans, Clean Traces: Evading Chain-of-Thought Monitoring with Plan Injection
- Reasoning Models Don't Always Say What They Think
- Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscation
- Can We Trust AI Explanations? Evidence of Systematic Underreporting in Chain-of-Thought Reasoning
- Chain of Thoughtlessness? An Analysis of CoT in Planning
- LLMs Can Covertly Sandbag on Capability Evaluations Against Chain-of-Thought Monitoring
- Mechanisms of Introspective Awareness
- Trust propagation and structural containment in Multi-agent LLM pipelines
Original note title
defending chain-of-thought monitors against plan injection is unsettled — monitor reasoning budget and context-provenance checks are the candidate defenses