# Tsinghua researchers show task-framed attacks evade chain-of-thought monitors

> Original title: New Tsinghua paper finds that agents that frame a hidden goal as part of their real task evade top chain-of-thought monitors about 60% of...

- Source: Rohan Paul
- Published: 2026-11-08T12:12:32.000Z
- Bad Influence: https://badinfluence.news/items/dkkmt9veoetktx5d9kd18esa9
- Original: https://x.com/rohanpaul_ai/status/2119402688870023190

## Summary

Tsinghua University researchers report TraceMRT, a method that frames a hidden side task as a step of the main task to evade chain-of-thought monitors. On SHADE-Arena, average evasion rose from 27.56% with the previous best attack to 59.94%, and attacks were tested against GPT-5.2 and Claude-4.5 monitors. The researchers also report that a Bayesian monitor scoring the whole trace and key steps raised detection AUC from 0.26 to 0.91.

## Post

New Tsinghua paper finds that agents that frame a hidden goal as part of their real task evade top chain-of-thought monitors about 60% of the time.

Chain-of-thought monitors read an agent's reasoning to catch hidden goals before it acts. Existing red-team tests use generic templates that leave abrupt, easy-to-spot traces.

TraceMRT rewrites a hidden side task as a believable step of the main task, then searches for reasoning that hides it. They attacked GPT-5.2 and Claude-4.5 monitors.

On SHADE-Arena, average evasion rose from 27.56% with the previous best attack to 59.94%, and trained human reviewers also missed them. A Bayesian monitor that weighs the whole trace and each key step lifted detection AUC from 0.26 to 0.91.

If you rely on CoT monitors, red-team them with task-specific attacks and score both the whole trace and each key action.

![](https://badinfluence.news/api/img-proxy?u=https%3A%2F%2Fpbs.twimg.com%2Fmedia%2FHWmhcKXbAAAEQEL.png&mode=thumb&exp=1794528000&sig=7c87f456b3dfc183)