mlsanityData to 7 Oct 2026

CoT Red-Handed: Stress Testing Chain-of-Thought Monitoring

arXiv 2505.23575 ↗First posted 29 May 2025cs.AI cs.LGcited by 49

On the map: LLM reasoning → Prompting and chain-of-thought reasoning

Abstract (arXiv)

As AI models are deployed with increasing autonomy, it is important to ensure they do not take harmful actions unnoticed. As a potential mitigation, we investigate Chain-of-Thought (CoT) monitoring, wherein a weaker trusted monitor model continuously oversees the intermediate reasoning steps of a more powerful but untrusted model. We compare CoT monitoring to action-only monitoring, where only final outputs are reviewed, in a red-teaming setup where the untrusted model is instructed to pursue harmful side tasks while completing a coding problem. We find that while CoT monitoring is more effective than overseeing only model outputs in scenarios where action-only monitoring fails to reliably identify sabotage, reasoning traces can contain misleading rationalizations that deceive the CoT monitors, reducing performance in obvious sabotage cases. To address this, we introduce a hybrid protocol that independently scores model reasoning and actions, and combines them using a weighted average. Our hybrid monitor consistently outperforms both CoT and action-only monitors across all tested models and tasks, with detection rates twice higher than action-only monitoring for subtle deception scenarios.

Key facts. Cited by 49 papers in the map (data through 7 Oct 2026). Placed in Prompting and chain-of-thought reasoning, one of 17 directions in LLM reasoning. Builds on 21 of its 38 references that are in the map. First posted on arXiv 29 May 2025.

Builds on

21 of 38 references.

Closest ancestors · 5

Same direction, newest first

  1. 2025Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscation14 Mar
  2. 2025Chain-of-Thought Reasoning In The Wild Is Not Always Faithful11 Mar
  3. 2024Faithful Logical Reasoning via Symbolic Chain-of-Thought28 May
  4. 2024Making Reasoning Matter: Measuring and Improving Faithfulness of Chain-of-Thought Reasoning21 Feb
  5. 2023Measuring Faithfulness in Chain-of-Thought Reasoning17 Jul

Other references · 16

  1. 2025DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learningcited by 6,146
  2. 2023Let's Verify Step by Stepcited by 3,598
  3. 2024OpenAI o1 System Cardcited by 1,220
  4. 2021Show Your Work: Scratchpads for Intermediate Computation with Language Modelscited by 871
  5. 2024BigCodeBench: Benchmarking Code Generation with Diverse Function Calls and Complex Instructionscited by 527
  6. 2024Alignment faking in large language modelscited by 316
  7. 2024Frontier Models are Capable of In-context Schemingcited by 252
  8. 2023AI Control: Improving Safety Despite Intentional Subversioncited by 207
  9. 2025LlamaFirewall: An open source guardrail system for building secure AI agentscited by 114
  10. 2025OpenCodeReasoning: Advancing Data Distillation for Competitive Codingcited by 106
  11. 2025Large Language Models Often Know When They Are Being Evaluatedcited by 105
  12. 2025An Approach to Technical AGI Safety and Securitycited by 42
4 more
  1. 2025A sketch of an AI control safety casecited by 36
  2. 2024Games for AI Control: Models of Safety Evaluations of AI Deployment Protocolscited by 28
  3. 2024Subversion Strategy Eval: Can language models statelessly strategize to subvert control protocols?cited by 14
  4. 2024Scheherazade: Evaluating Chain-of-Thought Math Reasoning in LLMs with Chain-of-Problemscited by 6

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 14; 2026: 35.

49 papers.

Sort:

By area:

  1. 2025When Chain of Thought is Necessary, Language Models Struggle to Evade Monitorscited by 81
  2. 2025Thought Crime: Backdoors and Emergent Misalignment in Reasoning Modelscited by 57
  3. 2025Implicit Reasoning in Large Language Models: A Comprehensive Surveycited by 42
  4. 2025Reliable Weak-to-Strong Monitoring of LLM Agentscited by 24
  5. 2025Teaching Models to Verbalize Reward Hacking in Chain-of-Thought Reasoningcited by 19
  6. 2026SWE-Marathon: Can Agents Autonomously Complete Ultra-Long-Horizon Software Work?cited by 19
  7. 2025Can Reasoning Models Obfuscate Reasoning? Stress-Testing Chain-of-Thought Monitorabilitycited by 18
  8. 2025Can We Predict Alignment Before Models Finish Thinking? Towards Monitoring Misaligned Reasoning Modelscited by 16
  9. 2025Measuring Chain-of-Thought Monitorability Through Faithfulness and Verbositycited by 15
  10. 2026Counterfactual Simulation Training for Chain-of-Thought Faithfulnesscited by 15
  11. 2025A Pragmatic Way to Measure Chain-of-Thought Monitorabilitycited by 13
  12. 2025All Code, No Thought: Current Language Models Struggle to Reason in Ciphered Languagecited by 7
37 more
  1. 2025Reasoning Under Pressure: How do Training Incentives Influence Chain-of-Thought Monitorability?cited by 7
  2. 2026Attack Selection Reduces Safety in Concentrated AI Control Settings against Trusted Monitoringcited by 6
  3. 2026Monitorability as a Free Gift: How RLVR Spontaneously Aligns Reasoningcited by 4
  4. 2026Monitoring the Internal Monologue: Probe Trajectories Reveal Reasoning Dynamicscited by 4
  5. 2025Typed Chain-of-Thought: A Curry-Howard Framework for Verifying LLM Reasoningcited by 3
  6. 2026Training Agents to Self-Report Misbehaviorcited by 3
  7. 2026Distributed Attacks in Persistent-State AI Controlcited by 3
  8. 2025A Concrete Roadmap towards Safety Cases based on Chain-of-Thought Monitoringcited by 2
  9. 2026Chain-of-thought obfuscation learned from output supervision can generalise to unseen taskscited by 2
  10. 2026Diagnosing Pathological Chain-of-Thought in Reasoning Modelscited by 2
  11. 2026How Transparent is DiffusionGemma?cited by 2
  12. 2026Chain-of-Thought Monitoring Can Be Unreliable in Implicit-Influence Settingscited by 2
  13. 2025Talking Trees: Reasoning-Assisted Induction of Decision Trees for Tabular Datacited by 1
  14. 2026Safer Reasoning Traces: Measuring and Mitigating Chain-of-Thought Leakage in LLMscited by 1
  15. 2026Tatemae: Detecting Alignment Faking via Tool Selection in LLMscited by 1
  16. 2026Length Penalties Make Chain-of-Thought Less Monitorablecited by 1
  17. 2026ResearchArena: Evaluating Sabotage and Monitoring in Automated AI R&Dcited by 1
  18. 2026The Implications of Linguistic Illegibility for LLM Securitycited by 1
  19. 2026Monitoring and Discovering Reward Hacking with Internal Representations during LLM Evaluationscited by 1
  20. 2026Groundability, Not Scale Alone: When Weak Reviewers Can Audit Strong Coding Agentscited by 1
  21. 2026CoT is Not the Chain of Truth: An Empirical Internal Analysis of Reasoning LLMs for Fake News Generationcited by 0
  22. 2026A transformer architecture alteration to incentivise externalised reasoningcited by 0
  23. 2026LLM Wardens: Mitigating Adversarial Persuasion with Third-Party Conversational Oversightcited by 0
  24. 2026CoT-Guard: Small Models for Strong Monitoringcited by 0
  25. 2026DECOR: Auditing LLM Deception via Information Manipulation Theorycited by 0
  26. 2026Bootstrapped Monitoring: Leveraging Transparent Reasoning to Oversee Stronger AI Agentscited by 0
  27. 2026Persuasion Attacks Can Decrease Effectiveness of CoT Monitoringcited by 0
  28. 2026Code Monitor Red Teaming for Public-Test-Passing Codecited by 0
  29. 2026A False Average: Pooled CoT-Monitor Accuracy Conceals a Reasoning-Dependent Fragilitycited by 0
  30. 2026Characterizing Rhetorical Misalignment in Decision-Making with Language Modelscited by 0
  31. 2026INTENT-AS-A-TOOL Makes it Easy to Track Agentic Misalignmentcited by 0
  32. 2026Untangling the Mechanisms of Misleading Context in Medical Question Answeringcited by 0
  33. 2026SchemeArena: Factorized Stress Testing of Scheming in LLM Agentscited by 0
  34. 2026Monitor Jailbreaking: Evading Chain-of-Thought Monitoring Without Encoded Reasoningcited by 0
  35. 2026When Confidence Rises Too Early: Detecting Shortcut Reasoning via Premature Answer Commitmentcited by 0
  36. 2026HARDE: Optimizing Agent Harnesses for Runtime Risk Detection and Execution Controlcited by 0
  37. 2026Learning Steganography Is Easy, Learning Steganographic Reasoning Is Hardcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Monitoring Monitorability
  2. 2026Training on Documents About Monitoring Leads to CoT Obfuscation
  3. 2025Reasoning Models Don't Always Say What They Think
  4. 2026Evading Chain-of-Thought Monitoring Through Model Poisoning
  5. 2026Reasoning Models Struggle to Control their Chains of Thought
  6. 2026Noticing the Watcher: LLM Agents Can Infer CoT Monitoring from Blocking Feedback
  7. 2025LLMs Can Covertly Sandbag on Capability Evaluations Against Chain-of-Thought Monitoring
  8. 2025Investigating CoT Monitorability in Large Reasoning Models