CoT Early Exit Breaks Monitoring Safety

🔑 Enhanced Key Takeaways

• •The vulnerability stems from the 'hidden' nature of internal CoT tokens, which are often treated as system-level artifacts rather than user-accessible output, allowing prompt-injection-style bypasses to suppress them.
• •Researchers identified that models trained with high-fidelity CoT supervision are more susceptible to 'Replacement' attacks, as the model's internal policy prioritizes stylistic consistency over the preservation of the original reasoning trace.
• •The 4-8pp accuracy drop is primarily concentrated in multi-step logical deduction tasks, while simple retrieval and summarization tasks remain largely unaffected by the early-exit mechanism.

🛠️ Technical Deep Dive

• •CoT Blanking: Utilizes a system-prompt override that instructs the model to output a null token or a specific delimiter immediately after the initial reasoning trigger, effectively truncating the hidden chain.
• •CoT Replacement: Employs a 'style-transfer' prompt that forces the model to map the internal CoT latent representations to a pre-defined, benign-looking output format without executing the full reasoning path.
• •The attack relies on the model's 'reasoning-to-output' bridge, where the model's internal state is forced to converge on a final answer token prematurely by manipulating the attention mask during the inference pass.

🔮 Future ImplicationsAI analysis grounded in cited sources

⏳ Timeline