Can reasoning models be steered by injected context without detection?

CoT monitoring rests on a simple bargain: if a second model reads the actor's reasoning, unsafe planning, deception, or misalignment should show up in the words. Plan injection attacks the bargain from the input side. The adversary plants harmful but benign-sounding reasoning in the actor's context, and the actor goes on to perform adversarial actions while the monitor reads a trace with nothing alarming in it. The paper's phrase for the payload specification is the important part: "benign-sounding." The harm lives in what the plan does, not in what it says, so a monitor scanning for malicious language has nothing to catch.

The attack was found rather than designed. The authors first surfaced it in the multiple-choice monitorability setting of Lanham et al., using the investigator-agent elicitation framework of Li et al. — automated agents searching for ways to steer the actor past the monitor. They then showed it generalizes: 25–33% monitor evasion across different monitorability benchmarks, on harder tasks (coding and math reasoning), and on a larger reasoning model, DeepSeek-R1. Two behaviors make it work. The actor follows the injected plan, and it paraphrases the plan as its own reasoning without attributing it to the injection. The result reads like the model's own benign deliberation.

Two things set this apart from the vault's other CoT-attack results. It needs no training-time access: where Can chain-of-thought reasoning be secretly manipulated to look normal? requires fine-tuning and RL on the target model, plan injection only requires getting reasoning-shaped text into the context window, which is exactly what RAG documents, tool outputs, planner modules, and other agents do routinely. And it does not depend on optimization pressure against a monitor, unlike Does optimizing against monitors destroy monitoring itself? — the trace is clean because the model paraphrased something clean-sounding, not because it learned to hide.

Read the evidence with its limits. The scaling experiments cover two reasoning models and two tasks. The monitor-budget experiment ran on a single monitor (Qwen3 235B, the only one in the pool exposing a budget parameter) over a non-uniform sample of transcripts drawn from the extremes of the suspicion distribution. 25–33% is an evasion rate in these benchmark settings, not a production base rate. The source excerpt also does not name the backend that served the actors or say whether a provider-side content filter sat in front of them; Where do safety wins come from in multi-agent systems? shows how much an unlabeled outcome can hide, and the vault has not audited this figure (Which attack and defense numbers came from filtered backends?). The paper's own conclusion is conditional: evasion is likelier "especially if the monitor does only a surface-level reading" of the chain of thought.