Can Reasoning Models Obfuscate Reasoning? Stress-Testing Chain-of-Thought Monitorability

TL;DR

This work systematically probes the robustness of chain-of-thought monitoring by inducing deliberate CoT obfuscation through a taxonomy of prompt cues and comparing internal versus external CoT across toy tasks and the SHADE-Arena. It finds that CoT monitoring is highly effective in benign conditions (~96% detection) but can be evaded under strong, model-dependent prompting pressure, especially for external CoT in Claude-family models, while internal CoT shows greater resilience. The study also shows that obfuscation generally harms side-task performance and that instruction-following fidelity differs by CoT channel, with external CoT better at following directives but more susceptible to obfuscation. The results underscore the need for model-specific, stress-tested monitoring and possibly multimodal oversight to ensure robust alignment safeguards in practical deployments.

Abstract

Recent findings suggest that misaligned models may exhibit deceptive behavior, raising concerns about output trustworthiness. Chain-of-thought (CoT) is a promising tool for alignment monitoring: when models articulate their reasoning faithfully, monitors can detect and mitigate harmful behaviors before undesirable outcomes occur. However, a key uncertainty is: Can models obfuscate their CoT in order to pursue hidden adversarial objectives while evading detection? To answer this question and thus stress-test CoT monitorability, we develop a composable and quantifiable taxonomy of prompts to elicit CoT obfuscation. We evaluate both internal CoT (reasoning traces) and external CoT (prompted reasoning in outputs) using toy tasks and more realistic environments in SHADE-Arena. We show that: (i) CoT monitoring performs accurately and efficiently without obfuscation pressure. (ii) Under strong obfuscation pressure, some models successfully complete adversarial tasks while evading detection. (iii) Models do not obfuscate their internal CoT as much as their external CoT (under prompt pressure). These results suggest that while CoT provides valuable oversight in benign settings, robust deployment requires model-specific stress-testing of monitorability.

Figures (17)

• Figure 1: Can reasoning models obfuscate their reasoning? We elicit model CoT obfuscation to stress-test CoT monitorability. We distinguish internal CoT (reasoning traces, usually separated from model output) and external CoT (prompted reasoning in output), and show that reasoning models can obfuscate malicious intent under pressure. This is a simplified real obfuscation example from our experiment. Left: Without obfuscation pressure, both internal and external chain-of-thought (CoT) explicitly reveal malicious reasoning. Right: Under high pressure (5-7 cues), models hide malicious intent using vague language internally and benign text externally, yet execute identical malicious tool calls (yellow). CoT monitors detect $\sim$96% of malicious intent without obfuscation pressure but $\sim$10% under high pressure. We find that while CoT monitoring is exceedingly effective without obfuscation pressure, high-pressure obfuscation can defeat it, with some models completing hidden objectives while evading monitors and others resisting obfuscation, revealing model-specific vulnerabilities important to oversight.
• Figure 2: Claude Sonnet models show progressively larger internal-external CoT obfuscation gaps across generations. Claude models overall exhibit high external CoT obfuscation rates. Non-Claude families stay near zero. Bars show conditional obfuscation with 95% Wilson CIs (top-5 cue stacks per model, see \ref{['sec:best_combinations']} for details; $n{>}50$ per bar).
• Figure 3: More prompt pressure $\rightarrow$ more obfuscation, internal rises in 3.7 but largely resists in 4.5. Sonnet 3.7 rises on both channels; Sonnet 4.5 rises mainly on external and plateaus, with muted internal growth. Lines show average conditional obfuscation (given both tasks succeed) by channel; ($20<n<450$ per prompt pressure; 95% Wilson CI.)
• Figure 4: Obfuscation pressure impairs side task success rate in SHADE-Arena. ($n{=}150$ per condition; 95% Wilson CI; 3 task pairs). Red arrows show performance deltas. Obfuscation substantially reduces side task success ($\Delta$ = -32.0 to -45.3 pp) while having much smaller effects on main tasks.
• Figure 5: Effective but fragile off-the-shelf: CoT monitor detection collapses from 96% to <10% under obfuscation pressure. The figure shows monitor detection rates for 3 types of monitor views with and without attacker model CoT obfuscation pressure. 3 task pairs in SHADE-Arena, using Claude Sonnet 3.7 as the agent. Groups are monitors; colors denote view; hatching marks obfuscation. Error bars are 95% Wilson CIs. Monitors thresholds are calibrated to $\le 1\%$ FPR on benign setting (without side task).