Corrupt Plans, Clean Traces: Evading Chain-of-Thought Monitoring with Plan Injection

Chain-of-thought (CoT) monitoring is a safety strategy where the reasoning of a large language model actor is inspected by a monitor (often another language model) for signs of unsafe planning, deception, or misalignment. We find that planting harmful but benign-sounding reasoning in the actor’s context can steer it to perform adversarial actions while evading monitors, an attack we term plan injection. We initially discover this attack in the multiple-choice question-answering monitorability setting proposed by Lanham et al. [LCR+23], using the investigatoragent elicitation framework of Li et al. [LCJ+25]. We generalize the attack and show that the discovered behavior scales to harder tasks (achieving 25-33% monitor evasion rates across different monitorability benchmarks) and larger models such as DeepSeek-R1. Across the settings we study, actor models not only follow injected plans but also paraphrase them as their own reasoning, without explicit attribution to the injections.

Introduction. CoT reasoning is now common in LLMs, decomposing complex problems into step-by-step traces before producing a final answer [WWS+22]. Beyond performance, these traces offer a window into the model’s decision-making. Accordingly, chain-of-thought (CoT) monitoring—where a separate monitor model audits the actor’s CoT to detect harmful behavior—has emerged as a promising paradigm for detecting misbehavior in LLMs [SFP+25; Goo25; KBB+25; BHG+25]. In this paper, we show that placing harmful reasoning in a model’s context, an attack we call “plan injection,” can steer the model into performing harmful reasoning on its own. Models routinely operate on reasoning produced elsewhere, including retrieved documents in RAG pipelines [GXG+23], tool outputs [YZY+23; SDD+23], plans from upstream planner modules [WXL+23], and messages from other agents in multi-agent systems [WBZ+24; POC+23]. We show that models often paraphrase the injected plan provided in context as their own and act on it downstream without attributing it to the source.

Discussion / Conclusion. We introduced plan injection, an inference-time attack in which an adversary injects a harmful but benign-sounding plan that the model internalizes by paraphrasing, without directly copying or attributing it. We discover the attack using investigator agents in a hint setting, but it also generalizes more broadly to coding and math reasoning tasks and also transfers to larger reasoning models including DeepSeek-R1. Plan injection attacks have interesting implications for CoT monitoring. When the model benignly paraphrases an upstream reasoning as its own without attribution or critical scrutiny of these traces, it can effectively evade monitor inspection especially if the monitor does only a surface-level reading of the chain-of-thought for malicious language. Limitations and future work. Our scaling experiments cover two reasoning models and two tasks; broader sweeps across model families and harder agentic tasks would strengthen generalization. The budget experiment is also run on a single monitor (Qwen3 235B, the only one in our pool exposing a budget parameter) and on a non-uniform sample of transcripts selected from the extremes of the suspicion distribution.