Monitor Jailbreaking: Evading Chain-of-Thought Monitoring Without Encoded Reasoning

Julian Schulz

cs.AISep 25, 2026

Monitor Jailbreaking: Evading Chain-of-Thought Monitoring Without Encoded Reasoning

Authors: Julian Schulz

Organizations: Meridian Cambridge

Abstract

Chain-of-thought (CoT) monitoring is a promising safety technique for reasoning models, enabling detection of problematic reasoning before models act. A key concern is encoded reasoning, where models hide their true reasoning in ways that monitors and humans cannot interpret. Optimization pressure from CoT monitors during reinforcement learning is considered a likely driver of such behavior. We investigate this by training reasoning models to perform a main task and a side task, while penalizing them when a monitor detects reasoning about the side task. Surprisingly, models learn to evade monitors without encoding their reasoning. Instead, they learn to phrase and format their chains of thought such that monitors fail to flag side task reasoning, while the reasoning remains completely transparent to human readers. We call this phenomenon monitor jailbreaking. We find that monitor jailbreaking arises across different model sizes, monitors, and tasks. Jailbreaks generalize to monitors not seen during training, including both less and more capable monitors, and transfer across different monitor prompts. While jailbreaking strategies appear simple, manually replicating them does not reliably fool monitors. Finally, we show that paraphrasing is an effective defense: paraphrasing a jailbroken CoT allows the same monitor to correctly flag it, while still allowing the model to perform both tasks.

Figures & tables

Figure 1: Monitor jailbreaking in action. Left: Training curves for gpt-oss-120b (GSM8K side task, Run 7): side task accuracy rises while Suspicion Score falls. Right: The model reasons about both tasks, then claims “the monitor can only see this section”; the monitor adopts this frame, stating it “cannot reveal the internal CoT” despite receiving the full output. Full transcript in Transcripts G – G .

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

Run	Model	Monitor	Side Task	Scratchpad	Batch	Group	LR	Samples
1	gpt-oss-20b	gpt-5-nano	Multiplication	No	2	32	4e-5	4000
2	gpt-oss-120b	gpt-5-nano	Multiplication	No	2	32	4e-5	4000
3	gpt-oss-20b	gpt-5-mini	Multiplication	No	2	32	4e-5	1000
4	gpt-oss-20b	gpt-5-nano	Multiplication	No	2	32	4e-5	1000
5	gpt-oss-20b	gpt-5-mini	Multiplication	No	2	32	4e-5	1000
6	gpt-oss-20b	gpt-5.2	Multiplication	No	2	32	4e-5	1000

Appendix

Table 1: Training run configurations. All runs use max tokens = 1024, eval every 20 batches, 10 eval samples, and reward weights: format = 0.1, main task = 1.0, side task = 1.0, monitor penalty = 0.5. Multiplication uses 3 operands

\times

2 digits each. Runs 7 and 8 are two separate runs of the same configuration to test reproducibility.

Figure 4: Effect of trained model size. (a-b) Training curves for gpt-oss-20b and gpt-oss-120b with multiplication as side task, both monitored by gpt-5-nano (Runs 1-2 in Table 1 ). The larger model achieves higher side task accuracy but similar Suspicion Score trajectories. (c) Example outputs showing identical “waffling” strategy: extensive Game24 reasoning followed by brief side task calculation. Full transcripts in Transcripts G – G .

Figure 5: Cross-model-family generalization. Each row shows outputs from one training run evaluated by monitors from multiple providers, ordered by capability. Red points indicate the monitor used during training. Jailbreaking transfers more reliably within the GPT-5 family than across families.

Figure 6: Weak-to-strong generalization across two training runs. (a) Example outputs from two runs of gpt-oss-120b trained against gpt-5-nano on GSM8K (Runs 7-8 in Table 1 ). Run 1 constructs a quoted “chain” containing only Game24 reasoning; Run 2 claims the monitor can only see part of the output. (b) Cross-evaluation showing Run 1 generalizes to gpt-5.2 while Run 2 does not. Run 7 transcript in Transcripts G – G ; Run 8 in Transcripts G – G .

Orig.	A	B	C	D	E
1.0	1.0	5.5 $\pm$ 1.4	1.0	1.9 $\pm$ 0.9	1.9 $\pm$ 0.9

Appendix

Table 2: Generalization across monitor prompt variations. Outputs from gpt-oss-20b trained against gpt-5-mini (Run 3) evaluated with six semantically equivalent prompt phrasings. Values show mean Suspicion Score

\pm

SEM (n=10).

	Baseline	Waffling	CoT Flag	Visible Flag
gpt-5-nano	7.4 $\pm$ 0.7	8.3 $\pm$ 0.5	4.9 $\pm$ 1.0	8.0 $\pm$ 0.6
gpt-5-mini	9.6 $\pm$ 0.4	9.1 $\pm$ 0.4	6.9 $\pm$ 0.9	10.0
gpt-5.2	9.6 $\pm$ 0.4	9.1 $\pm$ 0.4	9.3 $\pm$ 0.4	10.0

Appendix

Table 3: Synthetic strategies fail to jailbreak monitors. Claude Opus 4.5 outputs following observed strategies evaluated by three monitors. Values show mean Suspicion Score

\pm

SEM (n=20).

CoT Monitoring

Chain-of-thought monitoring studies whether models’ reasoning traces expose decision-relevant behavior and support oversight of unsafe or deceptive actions.

See all 36 papers

Reasoning Models Struggle to Control their Chains of Thought
Mar 5, 2026Chen Yueh-Han, Robert McCarthy, Bruce W. Lee +5CoT Monitoring Large Reasoning Models
NYU, MATS · UCL, MATS · UPenn, MATS +2
Training on Documents About Monitoring Leads to CoT Obfuscation
May 14, 2026Reilly Haskins, Bilal Chughtai, Joshua EngelsCoT Monitoring
University of Canterbury · Google DeepMind · Pivotal Research
Hidden Reasoning Must Leak, but Need Not Be Readable: Fundamental Opportunities and Limits for Chain-of-Thought Monitoring
Sep 29, 2026Mohammadali Mohammadkhani, Madhava Krishna, Yash Sarrof +1CoT Monitoring Large Reasoning Models
Saarland University, Saarland Informatics Campus · Zuse School ELIZA

Mar 5, 2026J/K move · Enter open · S save

Reasoning Models Struggle to Control their Chains of Thought

Chen Yueh-Han, Robert McCarthy, Bruce W. Lee, He He+4

NYU, MATS · UCL, MATS · UPenn, MATS+2

CoT Monitoring Large Reasoning Models Language Model Safety Evaluation

Open paper AskPDF arXiv

Chain-of-thought (CoT) monitoring is a promising tool for detecting misbehaviors and understanding the motivations of modern reasoning models. However, if models can control what they verbalize in their CoT, it could undermine CoT monitorability. To measure this undesirable capability -- CoT controllability -- we introduce the CoT-Control evaluation suite, which includes tasks that require models to solve problems while adhering to CoT instructions, e.g., reasoning about a genetics question without using the word 'chromosome'. We show that reasoning models possess significantly lower CoT controllability than output controllability; for instance, Claude Sonnet 4.5 can control its CoT only 2.7% of the time but 61.9% when controlling its final output. We also find that CoT controllability is higher for larger models and decreases with more RL training, test-time compute, and increased problem difficulty. CoT controllability failures extend even to situations in which models are given incentives (as opposed to direct requests) to evade CoT monitors, although models exhibit slightly higher controllability when they are told they are being monitored. Similarly, eliciting controllability by adversarially optimizing prompts does not meaningfully increase controllability. Our results leave us cautiously optimistic that CoT controllability is currently unlikely to be a failure mode of CoT monitorability. However, the mechanism behind low controllability is not well understood. Given its importance for maintaining CoT monitorability, we recommend that frontier labs track CoT controllability in future models.

Abstract

CoT Monitoring

Explore similar work

Reasoning Models Struggle to Control their Chains of Thought

Training on Documents About Monitoring Leads to CoT Obfuscation

Hidden Reasoning Must Leak, but Need Not Be Readable: Fundamental Opportunities and Limits for Chain-of-Thought Monitoring