清华大学研究：隐藏目标包装成任务步骤可让智能体约60%逃过CoT监控
清华这篇论文把智能体藏目标的手法做成了具体攻击，逃逸率翻倍到59.94%，还给出了AUC 0.91的监控方案，做安全评测的都该看看。
清华大学论文提出 TraceMRT 攻击方法，把隐藏的副作用任务改写成主任务中看似合理的一个步骤，再搜索能掩盖它的推理过程。在 SHADE-Arena 基准上，平均逃逸率从此前最佳攻击的 27.56% 提升到 59.94%，受训的人类审查员也未能识别。被测试对象包括监控 GPT-5.2 和 Claude-4.5 的思维链监控器。研究同时提出贝叶斯监控器，通过对整条推理轨迹和各关键步骤分别加权，把检测 AUC 从 0.26 提升到 0.91。
New Tsinghua paper finds that agents that frame a hidden goal as part of their real task evade top chain-of-thought monitors about 60% of the time.
Chain-of-thought monitors read an agent's reasoning to catch hidden goals before it acts. Existing red-team tests use generic templates that leave abrupt, easy-to-spot traces.
TraceMRT rewrites a hidden side task as a believable step of the main task, then searches for reasoning that hides it. They attacked GPT-5.2 and Claude-4.5 monitors.
On SHADE-Arena, average evasion rose from 27.56% with the previous best attack to 59.94%, and trained human reviewers also missed them. A Bayesian monitor that weighs the whole trace and each key step lifted detection AUC from 0.26 to 0.91.
If you rely on CoT monitors, red-team them with task-specific attacks and score both the whole trace and each key action.
