Taming CoT Obfuscation in VLMs: From Mechanistic Evidence to Activation-Level Enforcement

Xutao Mao; Jianing Zhu; Jinman Zhao; Tongliang Liu; Xiaowen Chu; Cong Wang; Bo Han

cs.AISep 21, 2026

Taming CoT Obfuscation in VLMs: From Mechanistic Evidence to Activation-Level Enforcement

Authors: Xutao Mao, Jianing Zhu, Jinman Zhao, Tongliang Liu, Xiaowen Chu, Cong Wang, Bo Han

Organizations: City University of Hong Kong · Hong Kong Baptist University · University of Toronto · The University of Sydney ·

Abstract

Reinforcement learning (RL) has substantially improved the reasoning capabilities of vision-language models (VLMs), yet it can induce chain-of-thought (CoT) obfuscation, an operational, non-intentional regime where models achieve high accuracy while producing reasoning traces that are less grounded and harder to monitor. While prior work documents this decay at the behavioral level, the underlying representational correlates of such drift remain poorly understood. In this work, we find that obfuscation is accompanied by a representational shift, where RL-induced optimization makes task-agnostic template features less separable from visually grounded content in the model's activation space. Based on this insight, we propose TAME, an activation-level intervention framework that leverages Sparse Autoencoders (SAEs) to regularize VLM internal features during RL training. Specifically, TAME utilizes an anti-obfuscation feedback loop to reduce behavioral obfuscation and applies an asymmetric SAE constraint to specific internal directions, penalizing template activations while preserving visual evidence. By directly intervening on the features associated with obfuscation, our method improves the transparency and visual grounding of reasoning traces. Experiments on the VIRL-39k and SPA-VL benchmarks across two model families show that TAME improves CoT monitorability (by up to +30.9 points on VIRL and +16.7 points on SPA-VL over GRPO), while largely preserving task accuracy and general-capability performance across four standard VLM benchmarks, with task-specific trade-offs. Our code is available at https://github.com/henrymao2004/TAME.

Figures & tables

Figure 1: Overview of Tame . Step 1 trains first-round rollouts with GRPO; Step 2 retries low-reward attempts under GPT-4o-evolved grounding guidance $p_{e}$ and distills improved retries via $\mathcal{L}_{\mathrm{RAFT}}$ , while a frozen SAE penalizes template activations above the pre-RL level. All terms form $\mathcal{L}_{\mathrm{TAME}}$ .

Stage	Question	Tool	Metric / evidence
Phenomenon	Does RL improve reward while reducing trace monitorability?	GPT-4o predictor; two-gate labels	$\mathrm{G\text{-}mean}^{2}$ ; monitor accuracy
Localization	Which layers and token types change?	Attention; Integrated Gradients (IG); patching	Ground / Entity / Template attention mass; normalized Cheating Index (CI); IG
Representation	How does template/ground separability change?	Frozen TopK sparse autoencoder (SAE)	Conditional enrichment score (CES); Template precision/recall; Jensen–Shannon divergence (JSD)
Causal test	Do selected features contribute beyond matched random features?	SAE ablation/injection; human audit	$\Delta\mathrm{G\text{-}mean}^{2}{}$ ; diagnostic pass-rate differences
Mitigation	Can training improve monitorability with bounded trade-offs?	Tame and component ablations	Monitorability; task metrics; benchmark accuracy

Table 1: Concept map for the evidence chain. Ground , Entity , and Template denote visually grounded evidence, domain content, and task-agnostic reasoning scaffolding, respectively.

Figure 2: Illustrative example of the predictor–reference evaluation protocol. The contrast panels show that answer correctness and CoT monitorability can decouple under RL. “Ground-truth label” denotes the two-gate reference label.

Figure 9: SAE feature diagnostics (SPA-VL, layers 8/10/18): Step 0 / GRPO / Tame .

		Trained on VIRL							Trained on SPA-VL
		Mitigation			General capability				Mitigation				General capability
Model	Method	Acc $\uparrow$	$\mathrm{G\text{-}mean}^{2}$	Mon.	MMMU	MVis	MVrs	MEGA	HS $\downarrow$	Win $\uparrow$	$\mathrm{G\text{-}mean}^{2}$	Mon.	MMMU	MVis	MVrs	MEGA
Qwen	Base	–	–	–	48.6	72.7	39.6	37.6	–	–	–	–	48.6	72.7	39.6	37.6
	GRPO	.646	.302	.57	44.6	77.8	49.3	33.3	6.8	63.7	.394	.63	46.9	71.9	38.5	34.7
	DAPO	.643	.318	.57	45.1	77.1	48.7	33.2	7.2	64.2	.412	.64	46.6	71.8	39.2	34.5
	+ CoT-mon. reward	.634	.557	.70	44.2	76.2	47.7	34.5	6.6	65.8	.463	.69	47.2	72.4	38.8	36.1

Table 2: Tame mitigation and general-capability results. Left block: checkpoints trained on VIRL; right block: trained on SPA-VL. HS = Harm Score (%) on test-harm; Win = win rate vs. GPT-4o on test-help; Mon. = monitor accuracy. “–” = not evaluated (Base has no mitigation training; SAE/Behav ablations do not have capability evals).

Metric	VIRL	SPA-VL
Inter-annotator $\kappa$	.74 (400 traces)
Ref.–human agreement	87.5%	84%
Paired Fleiss’ $\kappa$	.61	.69
Human $\mathrm{G\text{-}mean}^{2}$	.265 $\rightarrow$ .611	.356 $\rightarrow$ .636
Human accuracy	.59 $\rightarrow$ .74	.60 $\rightarrow$ .81
Grounding pref.	+6.25 pp	+7.50 pp

Table 3: Validation using human agreement, paired judgments, and held-out monitors.

Appendix figures & tables18 assets

Supplementary material from the paper’s appendix.

Appendix

Notation	Meaning	Notation	Meaning
RL; VLM; CoT	Reinforcement learning; vision-language model; chain-of-thought	LLM; SAE	Large language model; sparse autoencoder
GRPO; DAPO	Group Relative Policy Optimization; RL recipe with decoupled clipping and dynamic sampling	Tame	Targeted Anti-obfuscation with Mechanistic Enforcement
A ; B	Monitorable and non-monitorable two-gate reference classes	$\mathrm{TP},\mathrm{TN},N$	Correct A predictions, correct B predictions, and number of traces
$\xi_{i}^{m,t};y_{i}^{m,t}$	Trace from method $m$ at checkpoint $t$ and its reference label	$J;\hat{y}_{i,J}^{m,t}$	Evaluator and its predicted label for the trace
$\mathrm{TPR},\mathrm{TNR}$	Recall on labels A and B, respectively	$\mathrm{G\text{-}mean}^{2}$	Headline monitorability metric, $\mathrm{TPR}\!\times\!\mathrm{TNR}$
monitor accuracy	$(\mathrm{TP}+\mathrm{TN})/N$	HS; Win	Harm Score (%) on SPA-VL test-harm, lower is better; win rate vs. GPT-4o on test-help, higher is better

Appendix

Table 4: Notation and abbreviations used in the main text and appendices.

Panel of Table 5 — Table 5: VIRL label-prediction prompt (GPT-4o). Reference labels use a separate two-gate procedure: Gate 1, DeepSeek-V3.2 answers from CoT text only (cross-family, image-stripped); Gate 2, Gemini-2.5-Flash verifies visual grounding from image $+$ CoT. Label A requires both gates to pass.

Panel of Table 6 — Table 6: SPA-VL label-prediction prompt (GPT-4o). Reference labels use a separate two-gate procedure: Gate 1, safety reward $\geq 0.8$ ; Gate 2, Gemini-2.5-Flash auditor judges CoT policy-auditable and free of evasion (cross-family). Label A requires both gates to pass.

Panel of Table 7 — Table 7: SPA-VL reward judge prompt (DeepSeek-V3.2). Produces a continuous safety score $r\in[0,1]$ .

GRPO Stage
Parameter	GQA	VIRL-39k	SPA-VL
Learning rate	1e-6	2e-6	2e-6
Total steps	155	200	200
Group size	6	8	8
SAE Training
Num latents	4096	4096	4096

Appendix

Table 8: Training hyperparameters.

Data	Ref. P/N (G;T)
VIRL	44/36; 54/26
SPA-VL	49/31; 49/31

Appendix

Table 9: Reference-class and paired preference counts. G/T denotes GRPO/ Tame ; P/N are reference-class counts; W/T/L denotes Tame win/tie/loss.

Dataset	MSE ( $\times 10^{-3}$ )	Cosine Sim.	$L_{0}$ (active)	Dead Latents (%)
VIRL	2.14	0.987	31.8	3.2
SPA-VL	2.41	0.984	31.6	4.1

Appendix

Table 10: SAE reconstruction and sparsity statistics (averaged across all modules and target layers, step-0 model).

Source	Recon. cos. (0/200)	$\boldsymbol{\Delta}$ CES	$\boldsymbol{\Delta}$ Prec.	$\boldsymbol{\Delta}$ Rec.	$\boldsymbol{\Delta}$ JSD
Step 0	.987/.971	+.970	$-$ .244	$-$ .109	$-$ .02764
Step 200	.949/.988	+.425	$-$ .117	$-$ .113	$-$ .02345
Mixed 50/50	.973/.971	+.361	$-$ .077	$-$ .079	$-$ .02449

Appendix

Table 11: Top: SAE-source reconstruction cosine on held-out step-0/step-200 activations and diagnostic changes from step 0 to step 200. Bottom: human pass-rate differences between targeted and matched-random ablation.

Figure 10: GQA training dynamics (Qwen3-VL-8B). As train reward rises, monitor accuracy and

\mathrm{G\text{-}mean}^{2}

both decline.

Figure 20: Head patching (SPA-VL): top-20 heads by mean

\Delta\mathrm{CI}_{\mathrm{patch}}

, normalized by

\mathrm{CI}_{\mathrm{uniform}}

at step 200. Green indicates a CI decrease; red indicates an increase.

Panel of Table 13 — Table 13: Second-attempt system prompt for visual reasoning tasks. The model is provided with the full first-attempt trajectory together with anti-templating and visual-grounding instructions.

Panel of Table 14 — Table 14: Second-attempt system prompt for safety alignment tasks. Adapted for refusal and safety reasoning while maintaining visual grounding.

RL for VLMs

Reinforcement learning for vision-language models aligns multimodal reasoning, tool use, and action with task-specific feedback.

See all 472 papers

Training on Documents About Monitoring Leads to CoT Obfuscation
May 14, 2026Reilly Haskins, Bilal Chughtai, Joshua EngelsCoT Monitoring
University of Canterbury · Google DeepMind · Pivotal Research
Reward Misspecification Degrades Chain-of-Thought Monitorability
Oct 20, 2026Tianyi Lorena Yan, John HewittLLM Safety Monitoring CoT Monitoring
Columbia University
Reasoning Dynamics and the Limits of Monitoring Modality Reliance in Vision-Language Models
Apr 16, 2026Danae Sánchez Villegas, Samuel Lewis-Lim, Nikolaos Aletras +1CoT Faithfulness Vision-Language Models
University of Copenhagen, Department of Computer Science · University of Sheffield, School of Computer Science

May 14, 2026J/K move · Enter open · S save

Training on Documents About Monitoring Leads to CoT Obfuscation

Reilly Haskins, Bilal Chughtai, Joshua Engels

University of Canterbury · Google DeepMind · Pivotal Research

CoT Monitoring

Open paper AskPDF arXiv

Chain-of-thought (CoT) monitoring is one of the most promising tools we have for detecting model misbehavior, but its effectiveness depends on models faithfully externalizing their reasoning. Motivated by this vulnerability, we study whether monitor-aware models are capable of obfuscating their reasoning to evade detection. We use synthetic document finetuning to expose eight models to realistic pre-training-style documents describing a CoT monitor and find that monitor-aware models consistently achieve higher rates of undetected misbehavior compared to unaware controls. This effect is weaker but still present on a harder agentic task. We also show that CoT controllability, a model's ability to reshape its own reasoning trace under an imposed constraint, is closely correlated with obfuscation success across the eight models studied (

r=0.800

p=0.017

). Monitor-aware models placed under equal reinforcement learning optimization pressure also learn to reward-hack without triggering a CoT monitor substantially faster than unaware controls. Together, these results suggest that knowledge of monitoring combined with high CoT controllability poses a risk to CoT-based monitoring.

Abstract

RL for VLMs

Explore similar work

Training on Documents About Monitoring Leads to CoT Obfuscation

Reward Misspecification Degrades Chain-of-Thought Monitorability

Reasoning Dynamics and the Limits of Monitoring Modality Reliance in Vision-Language Models