Mitigating Deceptive Alignment via Self-Monitoring
On the map: LLM reasoning → Prompting and chain-of-thought reasoning
Abstract (arXiv)
Modern large language models rely on chain-of-thought (CoT) reasoning to achieve impressive performance, yet the same mechanism can amplify deceptive alignment, situations in which a model appears aligned while covertly pursuing misaligned goals. Existing safety pipelines treat deception as a black-box output to be filtered post-hoc, leaving the model free to scheme during its internal reasoning. We ask: Can deception be intercepted while the model is thinking? We answer this question, the first framework that embeds a Self-Monitor inside the CoT process itself, named CoT Monitor+. During generation, the model produces (i) ordinary reasoning steps and (ii) an internal self-evaluation signal trained to flag and suppress misaligned strategies. The signal is used as an auxiliary reward in reinforcement learning, creating a feedback loop that rewards honest reasoning and discourages hidden goals. To study deceptive alignment systematically, we introduce DeceptionBench, a five-category benchmark that probes covert alignment-faking, sycophancy, etc. We evaluate various LLMs and show that unrestricted CoT roughly aggravates the deceptive tendency. In contrast, CoT Monitor+ cuts deceptive behaviors by 43.8% on average while preserving task accuracy. Further, when the self-monitor signal replaces an external weak judge in RL fine-tuning, models exhibit substantially fewer obfuscated thoughts and retain transparency. Our project website can be found at cot-monitor-plus.github.io
Key facts. Cited by 29 papers in the map (data through 14 Oct 2026). Placed in Prompting and chain-of-thought reasoning, one of 17 directions in LLM reasoning. Builds on 42 of its 58 references that are in the map. First posted on arXiv 24 May 2025.
Builds on
42 of 58 references.
Closest ancestors · 4
Same direction, newest first
- 2025Policy Frameworks for Transparent Chain-of-Thought Reasoning in Large Language Models14 Mar
- 2025Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscation14 Mar
- 2023Language Models Don't Always Say What They Think: Unfaithful Explanations in Chain-of-Thought Prompting7 May
- 2022Chain-of-Thought Prompting Elicits Reasoning in Large Language Models28 Jan
Other references · 38
- 2022Training language models to follow instructions with human feedbackcited by 15,971
- 2024The Llama 3 Herd of Modelscited by 14,715
- 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
- 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
- 2025DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learningcited by 6,330
- 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,720
- 2024Gemini 1.5: Unlocking multimodal understanding across millions of tokens of contextcited by 3,224
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
- 2024Qwen2 Technical Reportcited by 2,120
- 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
- 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
- 2023BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Datasetcited by 860
26 more
- 2022Discovering Language Model Behaviors with Model-Written Evaluationscited by 836
- 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMscited by 573
- 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 536
- 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Trainingcited by 529
- 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deepcited by 472
- 2024A StrongREJECT for Empty Jailbreakscited by 385
- 2024Alignment faking in large language modelscited by 360
- 2025From System 1 to System 2: A Survey of Reasoning Large Language Modelscited by 320
- 2016Cooperative Inverse Reinforcement Learningcited by 300
- 2024Frontier Models are Capable of In-context Schemingcited by 287
- 2023AI Alignment: A Comprehensive Surveycited by 263
- 2019Risks from Learned Optimization in Advanced Machine Learning Systemscited by 258
- 2023Red-Teaming Large Language Models using Chain of Utterances for Safety-Alignmentcited by 223
- 2024Foundational Challenges in Assuring Alignment and Safety of Large Language Modelscited by 199
- 2023AI Deception: A Survey of Examples, Risks, and Potential Solutionscited by 188
- 2024AI Sandbagging: Language Models can Strategically Underperform on Evaluationscited by 145
- 2025SafeChain: Safety of Language Models with Long Chain-of-Thought Reasoning Capabilitiescited by 136
- 2024Language Models Learn to Mislead Humans via RLHFcited by 124
- 2023Deception Abilities Emerged in Large Language Modelscited by 101
- 2016The Off-Switch Gamecited by 97
- 2025The MASK Benchmark: Disentangling Honesty From Accuracy in AI Systemscited by 72
- 2025STAR-1: Safer Alignment of Reasoning LLMs with 1K Datacited by 68
- 2025International AI Safety Reportcited by 67
- 2025Evaluating the Paperclip Maximizer: Are RL-Based Language Models More Likely to Pursue Instrumental Goals?cited by 33
- 2025DarkBench: Benchmarking Dark Patterns in Large Language Modelscited by 28
- 2024Frontier AI systems have surpassed the self-replicating red linecited by 17
Built on by
Citing papers per year: 2025: 12; 2026: 17.
29 papers.
Sort:
By area:
- 2025DeceptionBench: A Comprehensive Benchmark for AI Deception Behaviors in Real-world Scenarioscited by 19
- 2025SafeLawBench: Towards Safe Alignment of Large Language Modelscited by 9
- 2025LLMs Deceive Unintentionally: Emergent Misalignment in Dishonesty from Misaligned Samples to Biased Human-AI Interactionscited by 8
- 2025SusBench: An Online Benchmark for Evaluating Dark Pattern Susceptibility of Computer-Use Agentscited by 8
- 2025LH-Deception: Simulating and Understanding LLM Deceptive Behaviors in Long-Horizon Interactionscited by 7
- 2025SafeMT: Multi-turn Safety for Multimodal Language Modelscited by 6
- 2026Training Agents to Self-Report Misbehaviorcited by 6
- 2025Beyond Prompt-Induced Lies: Investigating LLM Deception on Benign Promptscited by 5
- 2026MirageBackdoor: A Stealthy Attack that Induces Think-Well-Answer-Wrong Reasoningcited by 4
- 2026Dissociative Identity: Language Model Agents Lack Grounding for Reputation Mechanismscited by 4
- 2026ForesightSafety Bench: A Frontier Risk Evaluation and Governance Framework towards Safe AIcited by 3
- 2026Value-Conflict Diagnostics Reveal Widespread Alignment Faking in Language Modelscited by 3
17 more
- 2025Bridging Distribution Shift and AI Safety: Conceptual and Methodological Synergiescited by 2
- 2025PRISON: Unmasking the Criminal Potential of Large Language Modelscited by 2
- 2026Decoding Hidden Deception in Reasoning LLMs: Activation Explainers for Deception Auditingcited by 2
- 2025Debate with Images: Detecting Deceptive Behaviors in Multimodal Large Language Modelscited by 1
- 2026Not Just the Destination, But the Journey: Reasoning Traces Causally Shape Generalization Behaviorscited by 1
- 2026Tatemae: Detecting Alignment Faking via Tool Selection in LLMscited by 1
- 2026Belief-Guided Inference Control for Large Language Model Services via Verifiable Observationscited by 1
- 2026SPADE-Bench: Evaluating Spontaneous Strategic Deception in Agents via Plan-Action Divergencecited by 1
- 2026Probing the Misaligned Thinking Process of Language Modelscited by 1
- 2025Towards Integrated Alignmentcited by 0
- 2025Spot The Ball: A Benchmark for Visual Social Inferencecited by 0
- 2026Towards Multi-modal Multi-turn Safety: From Agentic Interaction to Strategic Alignmentcited by 0
- 2026Survive at All Costs: Exploring LLM's Risky Behaviors under Survival Pressurecited by 0
- 2026Stable Reasoning, Unstable Responses: Mitigating LLM Deception via Stability Asymmetrycited by 0
- 2026Towards Mitigating Deceptive Safety Alignment in Large Reasoning Modelscited by 0
- 2026Before Agent Tells The Lie: Has Deception Already Been Represented?cited by 0
- 2026Understanding and Reducing Misalignment in Persuasion Optimizationcited by 0
- 2026Understanding and Reducing Misalignment in Persuasion Optimization12 Oct 2026
- 2026Before Agent Tells The Lie: Has Deception Already Been Represented?5 Oct 2026
- 2026Towards Mitigating Deceptive Safety Alignment in Large Reasoning Models28 Sep 2026
- 2026Probing the Misaligned Thinking Process of Language Models23 Jun 2026
- 2026Decoding Hidden Deception in Reasoning LLMs: Activation Explainers for Deception Auditing16 Jun 2026
- 2026SPADE-Bench: Evaluating Spontaneous Strategic Deception in Agents via Plan-Action Divergence1 Jun 2026
- 2026Dissociative Identity: Language Model Agents Lack Grounding for Reputation Mechanisms28 May 2026
- 2026Belief-Guided Inference Control for Large Language Model Services via Verifiable Observations30 Apr 2026
- 2026Tatemae: Detecting Alignment Faking via Tool Selection in LLMs29 Apr 2026
- 2026Value-Conflict Diagnostics Reveal Widespread Alignment Faking in Language Models22 Apr 2026
- 2026MirageBackdoor: A Stealthy Attack that Induces Think-Well-Answer-Wrong Reasoning8 Apr 2026
- 2026Stable Reasoning, Unstable Responses: Mitigating LLM Deception via Stability Asymmetry27 Mar 2026
17 more
- 2026Not Just the Destination, But the Journey: Reasoning Traces Causally Shape Generalization Behaviors12 Mar 2026
- 2026Survive at All Costs: Exploring LLM's Risky Behaviors under Survival Pressure5 Mar 2026
- 2026Training Agents to Self-Report Misbehavior25 Feb 2026
- 2026ForesightSafety Bench: A Frontier Risk Evaluation and Governance Framework towards Safe AI15 Feb 2026
- 2026Towards Multi-modal Multi-turn Safety: From Agentic Interaction to Strategic Alignment8 Jan 2026
- 2025Debate with Images: Detecting Deceptive Behaviors in Multimodal Large Language Models29 Nov 2025
- 2025Spot The Ball: A Benchmark for Visual Social Inference31 Oct 2025
- 2025DeceptionBench: A Comprehensive Benchmark for AI Deception Behaviors in Real-world Scenarios17 Oct 2025
- 2025SafeMT: Multi-turn Safety for Multimodal Language Models14 Oct 2025
- 2025SusBench: An Online Benchmark for Evaluating Dark Pattern Susceptibility of Computer-Use Agents13 Oct 2025
- 2025LLMs Deceive Unintentionally: Emergent Misalignment in Dishonesty from Misaligned Samples to Biased Human-AI Interactions9 Oct 2025
- 2025LH-Deception: Simulating and Understanding LLM Deceptive Behaviors in Long-Horizon Interactions5 Oct 2025
- 2025Towards Integrated Alignment8 Aug 2025
- 2025Beyond Prompt-Induced Lies: Investigating LLM Deception on Benign Prompts8 Aug 2025
- 2025PRISON: Unmasking the Criminal Potential of Large Language Models19 Jun 2025
- 2025SafeLawBench: Towards Safe Alignment of Large Language Models7 Jun 2025
- 2025Bridging Distribution Shift and AI Safety: Conceptual and Methodological Synergies28 May 2025
- 2025SusBench: An Online Benchmark for Evaluating Dark Pattern Susceptibility of Computer-Use Agentscited by 8
- 2026Training Agents to Self-Report Misbehaviorcited by 6
- 2026Dissociative Identity: Language Model Agents Lack Grounding for Reputation Mechanismscited by 4
- 2026SPADE-Bench: Evaluating Spontaneous Strategic Deception in Agents via Plan-Action Divergencecited by 1
- 2026Survive at All Costs: Exploring LLM's Risky Behaviors under Survival Pressurecited by 0
- 2026Before Agent Tells The Lie: Has Deception Already Been Represented?cited by 0
- 2026Before Agent Tells The Lie: Has Deception Already Been Represented?5 Oct 2026
- 2026SPADE-Bench: Evaluating Spontaneous Strategic Deception in Agents via Plan-Action Divergence1 Jun 2026
- 2026Dissociative Identity: Language Model Agents Lack Grounding for Reputation Mechanisms28 May 2026
- 2026Survive at All Costs: Exploring LLM's Risky Behaviors under Survival Pressure5 Mar 2026
- 2026Training Agents to Self-Report Misbehavior25 Feb 2026
- 2025SusBench: An Online Benchmark for Evaluating Dark Pattern Susceptibility of Computer-Use Agents13 Oct 2025
- 2025Beyond Prompt-Induced Lies: Investigating LLM Deception on Benign Promptscited by 5
- 2026Decoding Hidden Deception in Reasoning LLMs: Activation Explainers for Deception Auditingcited by 2
- 2026Not Just the Destination, But the Journey: Reasoning Traces Causally Shape Generalization Behaviorscited by 1
- 2026Probing the Misaligned Thinking Process of Language Modelscited by 1
- 2026Stable Reasoning, Unstable Responses: Mitigating LLM Deception via Stability Asymmetrycited by 0
- 2026Towards Mitigating Deceptive Safety Alignment in Large Reasoning Modelscited by 0
- 2026Towards Mitigating Deceptive Safety Alignment in Large Reasoning Models28 Sep 2026
- 2026Probing the Misaligned Thinking Process of Language Models23 Jun 2026
- 2026Decoding Hidden Deception in Reasoning LLMs: Activation Explainers for Deception Auditing16 Jun 2026
- 2026Stable Reasoning, Unstable Responses: Mitigating LLM Deception via Stability Asymmetry27 Mar 2026
- 2026Not Just the Destination, But the Journey: Reasoning Traces Causally Shape Generalization Behaviors12 Mar 2026
- 2025Beyond Prompt-Induced Lies: Investigating LLM Deception on Benign Prompts8 Aug 2025
- 2025SafeLawBench: Towards Safe Alignment of Large Language Modelscited by 9
- 2026Tatemae: Detecting Alignment Faking via Tool Selection in LLMscited by 1
- 2025Towards Integrated Alignmentcited by 0
- 2026Tatemae: Detecting Alignment Faking via Tool Selection in LLMs29 Apr 2026
- 2025Towards Integrated Alignment8 Aug 2025
- 2025SafeLawBench: Towards Safe Alignment of Large Language Models7 Jun 2025
- 2025DeceptionBench: A Comprehensive Benchmark for AI Deception Behaviors in Real-world Scenarioscited by 19
- 2025LLMs Deceive Unintentionally: Emergent Misalignment in Dishonesty from Misaligned Samples to Biased Human-AI Interactionscited by 8
- 2025LH-Deception: Simulating and Understanding LLM Deceptive Behaviors in Long-Horizon Interactionscited by 7
- 2026ForesightSafety Bench: A Frontier Risk Evaluation and Governance Framework towards Safe AIcited by 3
- 2026Value-Conflict Diagnostics Reveal Widespread Alignment Faking in Language Modelscited by 3
- 2025Bridging Distribution Shift and AI Safety: Conceptual and Methodological Synergiescited by 2
- 2025PRISON: Unmasking the Criminal Potential of Large Language Modelscited by 2
- 2026Belief-Guided Inference Control for Large Language Model Services via Verifiable Observationscited by 1
- 2025Spot The Ball: A Benchmark for Visual Social Inferencecited by 0
- 2026Understanding and Reducing Misalignment in Persuasion Optimizationcited by 0
- 2026Understanding and Reducing Misalignment in Persuasion Optimization12 Oct 2026
- 2026Belief-Guided Inference Control for Large Language Model Services via Verifiable Observations30 Apr 2026
- 2026Value-Conflict Diagnostics Reveal Widespread Alignment Faking in Language Models22 Apr 2026
- 2026ForesightSafety Bench: A Frontier Risk Evaluation and Governance Framework towards Safe AI15 Feb 2026
- 2025Spot The Ball: A Benchmark for Visual Social Inference31 Oct 2025
- 2025DeceptionBench: A Comprehensive Benchmark for AI Deception Behaviors in Real-world Scenarios17 Oct 2025
- 2025LLMs Deceive Unintentionally: Emergent Misalignment in Dishonesty from Misaligned Samples to Biased Human-AI Interactions9 Oct 2025
- 2025LH-Deception: Simulating and Understanding LLM Deceptive Behaviors in Long-Horizon Interactions5 Oct 2025
- 2025PRISON: Unmasking the Criminal Potential of Large Language Models19 Jun 2025
- 2025Bridging Distribution Shift and AI Safety: Conceptual and Methodological Synergies28 May 2025
Similar, not cited
Close in wording, no citation either way
- 2026The Fragility of Chain-of-Thought Monitoring Across Typologically Diverse Languages
- 2025Can Reasoning Models Obfuscate Reasoning? Stress-Testing Chain-of-Thought Monitorability
- 2026DeceptGuard :A Constitutional Oversight Framework For Detecting Deception in LLM Agents
- 2025DecepChain: Inducing Deceptive Reasoning in Large Language Models
- 2026Training on Documents About Monitoring Leads to CoT Obfuscation
- 2025Empirical Evidence for Alignment Faking in a Small LLM and Prompt-Based Mitigation Techniques
- 2026Noticing the Watcher: LLM Agents Can Infer CoT Monitoring from Blocking Feedback
- 2025When Thinking LLMs Lie: Unveiling the Strategic Deception in Representations of Reasoning Models