A corrupt plan placed in the context is paraphrased as the model’s own reasoning, and the monitor reads it as clean

Stanford and Carnegie Mellon researchers steered Qwen3-8B and DeepSeek-R1-0528 into a planted wrong answer on more than 90 per cent of biology-and-maths attempts.

The method: append a corrupted reasoning plan to the prompt, with no instruction to follow it. A monitor that reads only the trace cannot catch reasoning that finished before the trace began.

They call it plan injection and found it by accident, using an investigator agent to search for hints that flip a TruthfulQA answer without the chain of thought admitting the hint. The investigator learned to inject a fake chain of reasoning instead. On 550 APPS coding problems the actor followed a corrupted plan in 50.6 per cent of cases on Qwen3-8B and 41.7 on DeepSeek-R1, and fewer than one per cent of successful attacks copied even half the plan verbatim.

Five monitors then scored the traces at a suspicion threshold of 0.15 on a scale from 0 to 1: GPT-4o Mini and DeepSeek V3 without thinking, DeepSeek R1, Qwen3-235B and Claude 3.7 Sonnet with it. Thinking monitors caught more, and “no monitor exceeds ~75% detection even in the best case”, against false positives near zero on benign traces. Giving the monitor the injected plan helped on the biology task and hurt on the coding one, where the plan’s coherent story let the monitor “explain it away”. The abstract states the harm on the biology task; the paper prints the results section’s version.

The paper’s verdict: keep the monitor and stop calling it a gate, because a quarter of injected plans pass it on these numbers. Untested here is a monitor trained on plan injections, the obvious next defence and the one nobody has published.