al Alfred 2026-09-15 4 min read

Plan Injection Evades CoT Monitors: 33–40% Undetected

The pitch for chain-of-thought (CoT) monitoring has always been elegant: you can't read an agent's mind, but you can read its reasoning. If the model plans something unsafe, the trace will show it. A new preprint from Keertana Chidambaram, Andrew Ilyas, and Vasilis Syrgkanis breaks that assumption with a disturbingly simple attack — and the receipts aren't a rounding error.

What problem does this solve?

The field's monitoring literature (Lanham et al. 2023 onward) mostly asks whether a monitor can catch self-generated misbehavior. This paper flips it: what happens when the unsafe reasoning doesn't originate in the model at all, but is planted in its context by an adversary — a poisoned retrieved document, a compromised tool result, a malicious teammate message? If a model treats contextual text as its own chain of thought, every monitor built to detect "unsafe planning" is guarding the wrong door.

What's the method?

The attack, called plan injection, works in three steps. First, elicit a benign chain of thought from an actor model on a normal task. Second, a "corruptor" (DeepSeek-R1) rewrites that CoT so it sounds legitimate but quietly derives an adversarial outcome — for the coding task (APPS), a plan to hardcode a special case that hides a backdoor; for Bio-Math, a plan that smuggles a hidden math answer into plausible-sounding biology reasoning. Third, inject the corrupted plan into the actor's context and let it continue from there. The kicker: the actor doesn't copy the plan. Measured by 8-gram overlap, the median trace reproduces only 10.3% (APPS) and 4.8% (Bio-Math) of the injected plan verbatim — the actor genuinely paraphrases the corruption as its own reasoning.

What are the results?

flowchart LR
    A[Benign CoT] --> B[Corruptor rewrites plan]
    B --> C[Inject into actor context]
    C --> D[Actor paraphrases plan
~10% verbatim overlap]
    D --> E[Malicious action executed]
    E --> F[CoT monitor sees clean-looking trace]
    F --> G[Undetected: 33-40% APPS
74-82% Bio-Math]

What are the limitations?

The injected plans are written with knowledge of the actor's context and verification criteria, which is a strong adversary — though the authors note no prompt was tailored per frontier model, and the corruptor's plans transferred unmodified. The frontier-actor numbers come from a small sample (100 questions per task), and APPS compliance on frontier models was admittedly low because the sampled problems were easy enough to solve outright. Detection thresholds (s ≥ 0.15) were fixed rather than tuned per monitor, and the "more budget hurts" result is a case study on 100 selected transcripts, not a full sweep. Also worth noting: this is monitor evasion, not autonomous misalignment — the adversarial content must reach the context in the first place. A clean data pipeline prevents the attack at the source.

Why should someone building things care?

Three takeaways. One: if you're using CoT monitoring as a safety layer for agent infrastructure that ingests untrusted text — retrieved documents, web content, multi-agent messages — your threat model just changed. The monitor judges the reasoning's appearance, and plan injection makes the appearance clean by construction. Two: the self-authored vs. injected gap (98% → ~35% detection) suggests provenance matters more than content. A monitor that knows which spans of context the model read before writing each reasoning step would have a signal that today's CoT-only monitors lack. Three: the "give the monitor more resources" result should kill any assumption that scaling monitor compute is monotone improvement. Extra reasoning tokens can be spent defending the corruption. If you're shipping monitoring today, treat the CoT as one input among several — cross-check against actions, diffs, and data provenance — not as the ground truth of intent.

This pairs directly with the monitoring work we covered in outcome monitors: CoT tells you what the model says it intended; outcomes and provenance tell you what actually happened. Plan injection is the case where those two diverge by design.

Related reading