Chain-of-Thought CoT Monitoring Vulnerabilities in LLM Safety Guardrails
Recent research (arXiv:2608.00583) identifies a critical failure mode in Chain-of-Thought (CoT) monitoring systems designed to prevent LLM reward hacking. While aggregate detection rates appear robust, they exhibit a "false average" that collapses during targeted evasion. Using gradient-free reasoning rewrites, adversaries can masquerade malicious intent as benign engineering logic within the reasoning trace, while the actual malicious payload remains in the execution sequence. This causes detection rates to drop from 95% to under 11% in scenarios where CoT is the sole defensive signal. The vulnerability lies in the reasoning-to-verdict pipeline, where the monitor fails to translate detected internal anomalies into an accurate security verdict, rendering trace-only defenses ineffective against sophisticated evasion.