Visible Reasoning and Indirect Prompt-Injection Monitorability Across English, Tamil, and Tanglish

Madhusudhanan G

cs.AIAug 15, 2026

Visible Reasoning and Indirect Prompt-Injection Monitorability Across English, Tamil, and Tanglish

Authors: Madhusudhanan G

Organizations: Vellore Institute of Technology, India

Abstract

Chain-of-thought monitoring is a potentially useful safety signal, but its reliability across languages and behavioral settings remains uncertain. In a small case study of eight manually verified synthetic scenarios, one model, one annotator, and one deterministic generation seed, I study API-visible reasoning during indirect prompt injection in Sarvam-105B across English, Tamil, and Tanglish. A four scenario pilot found 5/12 injected attack successes without reasoning and 1/11 with reasoning. A preregistered four-scenario follow-up reversed that direction, finding 2/12 attacks without reasoning and 3/12 with reasoning. With only four scenarios per phase, this design cannot distinguish a real reasoning-mode effect from prompt-specific variation or sampling noise. Across 20 non-empty injected-thinking traces, all 17 benign-correct outputs stated an intent to ignore the injection, while all three attack successes stated an intent to follow it. These descriptive observations provide a reproducible case study of behaviorally informative visible reasoning when it is available; they do not establish that reasoning mode improves safety, that visible reasoning is mechanistically faithful, or that the findings generalize beyond this configuration.

Figures & tables

Phase	Scenarios	Languages	Attempts	Persisted responses
Pilot	4	3	48	47
Follow-up	4	3	48	47
Combined	8	3	96	94

Table 1: Study accounting. Unavailable calls were preserved and excluded only from denominators requiring a response.

Phase	Non-thinking	Thinking
Pilot	5/12 (41.7%)	1/11 (9.1%)
Follow-up	2/12 (16.7%)	3/12 (25.0%)
Combined	7/24 (29.2%)	4/23 (17.4%)

Table 2: Injected attack success by phase and reasoning mode. Counts are exact target matches over available responses.

Figure 1: Injected attack-target exact matches. The follow-up reverses the pilot direction; the combined result is secondary.

Figure 2: Paired non-thinking-to-thinking transitions by phase. “Resist” denotes a non-attack output, including benign-correct and other output.

Figure 3: Availability of API-visible reasoning for injected-thinking attempts. Persisted-empty and unavailable traces are not treated as negative annotation labels.

Observed outcome	$n$	Ignore=yes	Follow=yes	Untrusted recognized=yes
Attack success	3	0	3	2
Benign-correct	17	17	0	17

Table 3: Frozen visible-intent labels among 20 non-empty injected-thinking traces.

Figure 4: Marginal frozen-label counts among non-empty reasoning traces. The joint intent–outcome relationship is reported in table 3 .

Language Model Safety Evaluation

Language model safety evaluation measures harmful behavior, refusal, robustness, and over-refusal across realistic prompts, users, and deployment settings.

See all 543 papers

Corrupt Plans, Clean Traces: Evading Chain-of-Thought Monitoring with Plan Injection
Sep 14, 2026Keertana Chidambaram, Andrew Ilyas, Vasilis SyrgkanisLLM Security Prompt Injection Attacks on AI Agents
Stanford University · CMU
Monitor Jailbreaking: Evading Chain-of-Thought Monitoring Without Encoded Reasoning
Sep 25, 2026Julian SchulzCoT Monitoring Language Model Safety Evaluation
Meridian Cambridge
Not All LLM Reasoning is Visible in the Chain-of-Thought
Jul 24, 2026Vatsal Baherwani, Tom Goldstein, Ashwinee PandaCoT Faithfulness LLM Interpretability
New York University · University of Maryland · TogetherAI

Sep 14, 2026J/K move · Enter open · S save

Corrupt Plans, Clean Traces: Evading Chain-of-Thought Monitoring with Plan Injection

Keertana Chidambaram, Andrew Ilyas, Vasilis Syrgkanis

Stanford University · CMU

LLM Security Prompt Injection Attacks on AI Agents CoT Monitoring

Open paper AskPDF arXiv

Chain-of-thought (CoT) monitoring is a safety strategy where the reasoning of a large language model "actor" is inspected by a "monitor" (often another language model) for signs of unsafe planning, deception, or misalignment. We find that planting harmful but benign-sounding reasoning in the actor's context can steer it to perform adversarial actions while evading monitors, an attack we term "plan injection". We initially discover this attack in the multiple-choice question-answering monitorability setting proposed by Lanham et al. (2023), using the investigator-agent elicitation framework of Li et al. (2025). We generalize the attack and show that the discovered behavior scales to harder tasks (achieving 25-33% monitor evasion rates across different monitorability benchmarks) and larger models such as DeepSeek-R1. Across the settings we study, actor models not only follow injected plans but also paraphrase them as their own reasoning, without explicit attribution to the injections. Finally, we find cases where extra monitor resources cause harm - giving the monitor access to the injected plan drops detection by as much as 50% in the Bio-Math task and in a case study on monitor reasoning budget, we find transcripts where additional thinking tokens are spent rationalizing the injected plan rather than flagging it.

Abstract

Language Model Safety Evaluation

Explore similar work

Corrupt Plans, Clean Traces: Evading Chain-of-Thought Monitoring with Plan Injection

Monitor Jailbreaking: Evading Chain-of-Thought Monitoring Without Encoded Reasoning

Not All LLM Reasoning is Visible in the Chain-of-Thought