Corrupt Plans, Clean Traces: Evading Chain-of-Thought Monitoring with Plan Injection
This research is important for anyone working on AI safety or model monitoring, as it identifies a new vulnerability in how large language models can be manipulated to bypass safety checks.
Researchers discovered an attack called 'plan injection' that can trick large language models into performing harmful actions while evading safety monitors. The attack involves planting harmful reasoning into the model's context, causing it to follow the injected plan and paraphrase it as its own reasoning without attribution. This behavior was found in models like DeepSeek-R1 and across multiple benchmarks, with monitor evasion rates reaching 25-33%. In some cases, giving the monitor access to the injected plan actually decreased detection rates.
Chain-of-thought (CoT) monitoring is a safety strategy where the reasoning of a large language model "actor" is inspected by a "monitor" (often another language model) for signs of unsafe planning, deception, or misalignment. We find that planting harmful but benign-sounding reasoning in the actor's context can steer it to perform adversarial actions while evading monitors, an attack we term "plan injection". We initially discover this attack in the multiple-choice question-answering monitorability setting proposed by Lanham et al. (2023), using the investigator-agent elicitation framework of Li et al. (2025). We generalize the attack and show that the discovered behavior scales to harder tasks (achieving 25-33% monitor evasion rates across different monitorability benchmarks) and larger models such as DeepSeek-R1. Across the settings we study, actor models not only follow injected plans but also paraphrase them as their own reasoning, without explicit attribution to the injections. Finally, we find cases where extra monitor resources cause harm - giving the monitor access to the injected plan drops detection by as much as 50% in the Bio-Math task and in a case study on monitor reasoning budget, we find transcripts where additional thinking tokens are spent rationalizing the injected plan rather than flagging it.
