An attack described in a new arXiv preprint lets a model take adversarial actions while the reasoning a monitor reads stays clean. Posted on 14 September, the paper calls the technique plan injection: deceptive reasoning is placed in the model’s context disguised as benign planning, and the model then paraphrases the injected plan as its own reasoning, without attributing it to the injection, so a monitor watching the chain of thought sees nothing out of place.
Keertana Chidambaram, Andrew Ilyas and Vasilis Syrgkanis report monitor evasion rates of 25 to 33 per cent across their benchmarks, and say the attack generalises to larger models including DeepSeek-R1. The more awkward finding is that giving a monitor more to work with can make it worse: on one task, detection fell by as much as half when the monitor could see the injected plans, with the extra reasoning tokens spent rationalising them rather than flagging them.
Why it matters: reading a model’s chain of thought has become a standard oversight technique, and in agent deployments a monitor is often the main check on what an agent actually does. This is a preprint rather than peer-reviewed work, and the evasion rates are the authors’ own, but it aims squarely at that assumption. The paper is arXiv:2609.15989.