A key concern about chain-of-thought monitoring is that optimization pressure on the CoT during RL could drive models toward encoded reasoning, where models reason in ways that are not readable or that look like innocuous text (steganography).

If a model is penalized when a monitor catches unwanted reasoning, RL implicitly selects for whatever lets the model reason without being caught.

Our original goal was to elicit encoded reasoning so we could develop defenses against it.

We constructed an RL environment where encoded reasoning is the highest-reward strategy, trained models in it, and studied what emerged. The models did not learn encoded reasoning. Instead, they learned to phrase their chains of thought in ways that cause monitors to misclassify obviously visible reasoning as benign.

We call this monitor jailbreaking.

This post summarizes our paper about this phenomenon, currently under review at ICML.[1]

Overview of the setup and central finding. (left) Training curves showing side task accuracy increasing while monitor suspicion scores decrease. (right) Example: the model explicitly reasons about both tasks, then asserts 'the monitor can only see this section' before a main-task-only summary. The monitor accepts this framing and reports low suspicion despite having the full CoT in its context.

[...]

---

Outline:

(01:37) Setup

(02:59) Monitor Jailbreaking

(04:09) Effect of Monitor Capability

(05:31) Weak-to-Strong Generalization

(07:06) Jailbreaks Are Not Just Surface-Level Strategies

(07:56) Paraphrasing as a Defense

(09:27) Implications

The original text contained 1 footnote which was omitted from this narration.

---

First published:
February 11th, 2026

Source:
https://www.lesswrong.com/posts/szyZi5d4febZZSiq3/monitor-jailbreaking-evading-chain-of-thought-monitoring

---

Narrated by TYPE III AUDIO.

---

Images from the article:

Overview of the setup and central finding. (left) Training curves showing side task accuracy increasing while monitor suspicion scores decrease. (right) Example: the model explicitly reasons about both tasks, then asserts 'the monitor can only see this section' before a main-task-only summary. The monitor accepts this framing and reports low suspicion despite having the full CoT in its context.

Effect of monitor capability on jailbreaking. (a-b) Training curves for GPT-oss-20B with multiplication, trained against three GPT-5 monitors of increasing capability. GPT-5-nano is jailbroken quickly, GPT-5-mini more slowly, GPT-5.2 is not jailbroken within the training budget. (c) Cross-evaluation matrix showing each run's outputs scored by all three monitors. Jailbreaks transfer downward more reliably than upward.

Two runs of GPT-oss-120B trained against GPT-5-nano on GSM8K with identical hyperparameters. (a) Example outputs showing different learned strategies. Run 1 labels a section as the 'chain-of-thought' containing only main task reasoning; Run 2 claims the monitor can only see part of the output. (b) Cross-evaluation: Run 1's strategy generalizes to GPT-5.2, Run 2's does not.

$Paraphrasing defense. Outputs from two runs of GPT-oss-20B trained against GPT-5-mini. Left: fraction of task performance retained after paraphrasing. Right: suspicion scores before and after paraphrasing. Paraphrasing raises mean suspicion from 1-2 to 7.4, while retaining 63-91% of main task and 79-87% of side task performance.$

Apple Podcasts and Spotify do not show images in the episode description. Try Pocket Casts, or another podcast app.

“Monitor Jailbreaking: Evading Chain-of-Thought Monitoring Without Encoded Reasoning” by Wuschel Schulz

LessWrong (30+ Karma)

“Monitor Jailbreaking: Evading Chain-of-Thought Monitoring Without Encoded Reasoning” by Wuschel Schulz