Chain-of-thought monitor's catch rate collapses to under 11%

A rewritten chain-of-thought trace cut a monitor's catch rate from 95% to under 11%, per a new arXiv paper. The agent's commands and outputs never changed. Only the reasoning wrapped around them did, rewritten to read as good-faith engineering instead of the exploit it actually was.

The paper frames this as a warning for anyone running a monitor in production. A monitor's headline catch rate is a false average. It's propped up by hacks the agent's actions already reveal on their own. It collapses on the subset of cases where the reasoning trace is the only signal left.

The attack took a single, gradient-free attempt and still beat a held-out monitor it wasn't tuned on. It also transferred across different monitor families and different agent models, arguing against a narrow bug in one detector.

Trace-only defenses recover some ground, even when primed on the attack. They don't recover all of it, because the rewritten reasoning stays truthful about what the agent did. It lies only about why.