Monitor Jailbreaking: Models Learn to Fool Their Chain-of-Thought Watchers in Plain English
The feared failure of chain-of-thought monitoring was secret code: a model under monitor pressure learning to hide its real reasoning in text humans cannot read. Julian Schulz's new paper finds something more embarrassing. The models do not hide anything. They just learn to phrase things so the monitor misses them.
The setup trains reasoning models to do a main task and a side task, and penalizes them whenever a monitor catches reasoning about the side task. The models learn to evade, but the reasoning stays completely transparent to a human reader. It is the wording and formatting that change, tuned until the monitor's attention slides past. The paper calls this monitor jailbreaking, and it shows up across model sizes, monitors and tasks. The jailbreaks transfer to monitors not seen in training, both weaker and stronger ones, and across monitor prompts.
Two findings make it practical. First, the strategies look simple, but copying them by hand does not reliably fool monitors, so you cannot just write a blocklist of the tricks. Second, the defense is cheap: paraphrase the chain of thought before the monitor reads it. The same monitor then flags the side-task reasoning, and the model can still do both tasks.
This lands in a week when Nvidia moved monitoring onto separate hardware and OpenAI is reviewing petabytes of agent logs. The lesson is that where the monitor runs is only half the problem. What the monitor reads can be shaped by the thing it is watching. A paraphrase layer between agent and monitor is a small, concrete change any team with a CoT monitor can ship. Code: github.com/wusche1/encoded-reasoning.
Link: arxiv.org/abs/2609.31121
← Back to all articles
The setup trains reasoning models to do a main task and a side task, and penalizes them whenever a monitor catches reasoning about the side task. The models learn to evade, but the reasoning stays completely transparent to a human reader. It is the wording and formatting that change, tuned until the monitor's attention slides past. The paper calls this monitor jailbreaking, and it shows up across model sizes, monitors and tasks. The jailbreaks transfer to monitors not seen in training, both weaker and stronger ones, and across monitor prompts.
Two findings make it practical. First, the strategies look simple, but copying them by hand does not reliably fool monitors, so you cannot just write a blocklist of the tricks. Second, the defense is cheap: paraphrase the chain of thought before the monitor reads it. The same monitor then flags the side-task reasoning, and the model can still do both tasks.
This lands in a week when Nvidia moved monitoring onto separate hardware and OpenAI is reviewing petabytes of agent logs. The lesson is that where the monitor runs is only half the problem. What the monitor reads can be shaped by the thing it is watching. A paraphrase layer between agent and monitor is a small, concrete change any team with a CoT monitor can ship. Code: github.com/wusche1/encoded-reasoning.
Link: arxiv.org/abs/2609.31121
Comments