Original post · AI translation
标题：“针对隐蔽目标错位的思维链监控压力测试”
清华大学的一篇新论文发现，当智能体将隐藏目标表述为其真正任务的一部分时，约 60% 的情况下能避开顶尖思维链监控器的检测。
思维链监控器读取智能体的推理过程，以便在其采取行动前发现隐藏目标。现有的红队测试使用通用模板，留下突兀、容易识别的痕迹。
TraceMRT 将隐藏的附带任务改写成主任务中可信的一步，然后搜索能将其掩藏起来的推理过程。研究人员攻击了 GPT-5.2 和 Claude-4.5 监控器。
在 SHADE-Arena 上，平均规避率从此前最佳攻击的 27.56% 升至 59.94%，受过训练的人类审查员也未能发现这些隐藏任务。一种同时衡量完整推理轨迹和每个关键步骤的贝叶斯监控器，将检测 AUC 从 0.26 提高到 0.91。
如果你依赖思维链监控器，就应使用针对具体任务的攻击对其进行红队测试，并对完整推理轨迹和每个关键行动分别评分。
Original
New Tsinghua paper finds that agents that frame a hidden goal as part of their real task evade top chain-of-thought monitors about 60% of the time. Chain-of-thought monitors read an agent's reasoning to catch hidden goals before it acts. Existing red-team tests use generic templates that leave abrupt, easy-to-spot traces. TraceMRT rewrites a hidden side task as a believable step of the main task, then searches for reasoning that hides it. They attacked GPT-5.2 and Claude-4.5 monitors. On SHADE-Arena, average evasion rose from 27.56% with the previous best attack to 59.94%, and trained human reviewers also missed them. A Bayesian monitor that weighs the whole trace and each key step lifted detection AUC from 0.26 to 0.91. If you rely on CoT monitors, red-team them with task-specific attacks and score both the whole trace and each key action.