CoT Monitoring and Plan Injection
Series · 1 posts
-
Corrupt Plans, Clean Traces: How Plan Injection Evades Chain-of-Thought Monitoring
AdvancedA deep reading of Plan Injection: when an adversarial plan enters context and an actor rewrites it into plausible Chain-of-Thought, why the monitor’s clean trace can disconnect from behavioral causality, and where APPS, Bio-Math, and budget-sweep evidence stops.
Understand it in 90 seconds
- Problem
- A CoT monitor usually reads an actor’s reasoning and asks whether it is executing a harmful plan. If that plan is placed into the actor’s context first, the actor can absorb it, rewrite it as plausible reasoning, and emit problematic code or an answer. The monitor sees the later trace but may not see what actually changed the behavior.
- Core insight
- Plan injection separates the causal source of behavior from the text visible to the monitor. The attacker need not make the actor copy the plan or state an explicit malicious intention; it is enough for the injected plan to steer the actor while the generated reasoning does not clearly attribute itself to that plan.
- Strongest evidence
- Figure 3 measures adoption of injected plans on APPS and Bio-Math; Figures 4–5 compare actor-only and with-plan monitor views; Table 8 reports 33%–68% APPS and 74%–82% Bio-Math end-to-end undetected attack success; Figure 6 shows that added reasoning budget is not monotonically safer for the Qwen3-235B monitor.
- Main boundary
- This is not an estimate that every reasoning model is equally vulnerable, nor a formal proof that CoT is always untrustworthy. The authors test Qwen3-8B and DeepSeek-R1-0528 actors on APPS and Bio-Math, sweep budget for only one monitor, and release no code, checkpoint, or complete rerunnable data bundle.
For speaking invitations, internal engineering sessions, or architecture exchange, see the topics and public work I can bring into the conversation.
Speaking & contact