腐败计划，干净痕迹：利用计划注入规避思维链监控

中文摘要 AI 辅助

思维链（CoT）监控是一种安全策略，其中大型语言模型“行动者”的推理由“监控器”（通常是另一个语言模型）检查，以发现不安全规划、欺骗或错位的迹象。我们发现，在行动者的上下文中植入有害但听起来良性的推理可以引导其执行对抗性行动，同时规避监控器，我们将这种攻击称为“计划注入”。我们最初在Lanham等人（2023）提出的多项选择问答可监控性设置中发现了这种攻击，使用了Li等人（2025）的调查者-智能体引出框架。我们推广了这种攻击，并表明所发现的行为可以扩展到更困难的任务（在不同可监控性基准上实现25-33%的监控规避率）和更大的模型，如DeepSeek-R1。在我们研究的各种设置中，行动者模型不仅遵循注入的计划，而且还将它们改述为自己的推理，没有明确归因于注入。最后，我们发现了额外监控资源造成伤害的情况——在Bio-Math任务中，让监控器访问注入的计划会使检测率下降多达50%，并且在关于监控推理预算的案例研究中，我们发现了额外的思考令牌被用于合理化注入计划而不是标记它的记录。

英文摘要

Chain-of-thought (CoT) monitoring is a safety strategy where the reasoning of a large language model "actor" is inspected by a "monitor" (often another language model) for signs of unsafe planning, deception, or misalignment. We find that planting harmful but benign-sounding reasoning in the actor's context can steer it to perform adversarial actions while evading monitors, an attack we term "plan injection". We initially discover this attack in the multiple-choice question-answering monitorability setting proposed by Lanham et al. (2023), using the investigator-agent elicitation framework of Li et al. (2025). We generalize the attack and show that the discovered behavior scales to harder tasks (achieving 25-33% monitor evasion rates across different monitorability benchmarks) and larger models such as DeepSeek-R1. Across the settings we study, actor models not only follow injected plans but also paraphrase them as their own reasoning, without explicit attribution to the injections. Finally, we find cases where extra monitor resources cause harm - giving the monitor access to the injected plan drops detection by as much as 50% in the Bio-Math task and in a case study on monitor reasoning budget, we find transcripts where additional thinking tokens are spent rationalizing the injected plan rather than flagging it.

发表机构

• Stanford University（斯坦福大学）
• CMU（卡内基梅隆大学）

机构由 AI 辅助整理，请以论文原文为准。