mlsanityData to 7 Oct 2026

Persuasion Attacks Can Decrease Effectiveness of CoT Monitoring

arXiv 2607.08066 ↗First posted 9 Jul 2026cs.AI cs.LGcited by 0

On the map: LLM reasoning → Prompting and chain-of-thought reasoning

Abstract (arXiv)

Chain-of-thought (CoT) monitoring is a promising safety mechanism for AI agents, based on the premise that visible reasoning traces can surface misaligned or deceptive behavior. While effective in standard scenarios, recent work highlights that LLMs remain vulnerable to persuasion-based jailbreaks, where natural-language arguments override model constraints. We stress-test whether this vulnerability extends to monitoring LLMs: can an adversarial agent persuade its CoT monitor to approve proposed actions that violate the monitor's policy? We design an evaluation framework with 40 tasks and analyze thousands of agent-monitor interactions, where agents are instructed to argue for policy-violating proposals. We find that in such adversarial settings, monitor access to the agent's CoT reasoning increases rather than decreases approval of harmful actions on average by 9.5%, as the scratchpad provides an additional persuasion channel. To address this, we introduce a fact-checking monitoring framework. We find that a fact-checker and monitor pairing from different model families, for example a Claude 3.7 Sonnet monitor paired with a GPT-4.1 fact-checker, reduces approval of policy-violating actions by up to 45%, compared to only 6%, when using the same model for both fact-checking and monitoring roles. Our results demonstrate that CoT monitoring alone may be insufficient against adversarial persuasion, and that model-diverse fact-checking provides a robust mitigation.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Prompting and chain-of-thought reasoning, one of 17 directions in LLM reasoning. Builds on 32 of its 38 references that are in the map. First posted on arXiv 9 Jul 2026.

Builds on

32 of 38 references.

Closest ancestors · 9

Same direction, newest first

  1. 2025Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety15 Jul
  2. 2025When Chain of Thought is Necessary, Language Models Struggle to Evade Monitors7 Jul
  3. 2025CoT Red-Handed: Stress Testing Chain-of-Thought Monitoring29 May
  4. 2025Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscation14 Mar
  5. 2025Chain-of-Thought Reasoning In The Wild Is Not Always Faithful11 Mar
  6. 2023Measuring Faithfulness in Chain-of-Thought Reasoning17 Jul
  7. 2023Language Models Don't Always Say What They Think: Unfaithful Explanations in Chain-of-Thought Prompting7 May
  8. 2022Large Language Models are Zero-Shot Reasoners24 May
  9. 2022Chain-of-Thought Prompting Elicits Reasoning in Large Language Models28 Jan

Other references · 23

  1. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  2. 2023G-Eval: NLG Evaluation using GPT-4 with Better Human Alignmentcited by 2,205
  3. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
  4. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
  5. 2023Towards Understanding Sycophancy in Language Modelscited by 988
  6. 2022Discovering Language Model Behaviors with Model-Written Evaluationscited by 805
  7. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Modelscited by 738
  8. 2024LLM Evaluators Recognize and Favor Their Own Generationscited by 651
  9. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMscited by 533
  10. 2023Jailbreaking ChatGPT via Prompt Engineering: An Empirical Studycited by 478
  11. 2024Alignment faking in large language modelscited by 316
  12. 2024Frontier Models are Capable of In-context Schemingcited by 252
11 more
  1. 2024Self-Preference Bias in LLM-as-a-Judgecited by 248
  2. 2023AI Control: Improving Safety Despite Intentional Subversioncited by 207
  3. 2023AI Deception: A Survey of Examples, Risks, and Potential Solutionscited by 185
  4. 2024Large Language Models are Inconsistent and Biased Evaluatorscited by 146
  5. 2025Measuring AI Ability to Complete Long Software Taskscited by 142
  6. 2024AI Sandbagging: Language Models can Strategically Underperform on Evaluationscited by 131
  7. 2025Preference Leakage: A Contamination Problem in LLM-as-a-judgecited by 119
  8. 2023Deception Abilities Emerged in Large Language Modelscited by 99
  9. 2023Characterizing Manipulation from AI Systemscited by 43
  10. 2023Honesty Is the Best Policy: Defining and Mitigating AI Deceptioncited by 40
  11. 2025Understanding and Enhancing the Transferability of Jailbreaking Attackscited by 22

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Corrupt Plans, Clean Traces: Evading Chain-of-Thought Monitoring with Plan Injection
  2. 2025Can Reasoning Models Obfuscate Reasoning? Stress-Testing Chain-of-Thought Monitorability
  3. 2025Reasoning Models Don't Always Say What They Think
  4. 2026Evading Chain-of-Thought Monitoring Through Model Poisoning
  5. 2026The Fragility of Chain-of-Thought Monitoring Across Typologically Diverse Languages
  6. 2026Noticing the Watcher: LLM Agents Can Infer CoT Monitoring from Blocking Feedback
  7. 2025LLMs Can Covertly Sandbag on Capability Evaluations Against Chain-of-Thought Monitoring
  8. 2026Training on Documents About Monitoring Leads to CoT Obfuscation