CoT monitoring is only useful if the model's reasoning stays coupled to its actual behavior — but this coupling can degrade silently through context compression, optimization against a monitor, and out-of-context generalization. This paper treats monitorability as a first-class trainable property and shows it can be installed or recovered with a dedicated post-training stage.
Figure 1: Before post-training, CoT is decoupled from behavior (dashed arrow, MI ≈ 0). After MI-maximizing post-training (solid arrow), CoT robustly predicts behavior; activation probes and CoT monitors both improve. Three "model organisms" with degraded monitorability were recovered.
Anwar et al. identify three mechanisms that degrade CoT monitorability in practice: context compression loses reasoning steps; direct optimization against a monitor incentivizes uninformative CoT; out-of-context generalization from synthetic documents lets the model bypass internal reasoning. They propose an unsupervised post-training objective that maximizes mutual information between the CoT and the model's output distribution. Evaluated on three model organisms with deliberately degraded monitorability, the method recovers most or all of the lost coupling; applied to undegraded policies it further improves judged monitorability. MI-trained models show higher prevalence of consequential reasoning in their CoTs, and both CoT monitors and activation probes become better predictors of unsafe behavior. This is the first paper to frame monitorability as a trainable capability rather than a passive property.
Running actions past multiple AI monitors seems like it should provide robustness through redundancy. This paper applies fault-tolerant distributed computing to show that when monitors share an evidence source, they fail together — and that source diversification, not vote aggregation, is the right architectural fix.
Figure 1: Every reliable fraud-approval attack targeted a single evidence source and fooled all monitors reading it. Monitors reading other sources remained unaffected. More monitors on the same source gives zero additional protection; adding independent sources does.
Zanolini models multi-monitor approval architectures using fail-prone systems from distributed computing and measures 12 small open-weight monitors across a 4×3 grid of monitor families × evidence sources on a payment-approval task, plus three closed frontier models and DeepSeek-V3.2 in a secondary study. Every reliable fraud-approval attack exploited a single evidence source. A rule counting independent sources blocked only 0.9% of correct payments at equal safety, versus 7.4% for the best vote-counting rule. Adding a non-persuadable rule engine restored safety and liveness against all measured attacks. The practical recommendation: "Diversify the inputs, harden the monitors, count sources not votes."
The strongest AI text detectors are opaque neural classifiers; transparent stylometric alternatives are much weaker. This EMNLP 2026 paper uses sparse autoencoders to convert a black-box detector into one that operates on human-readable linguistic concepts — and finds the interpretable version actually generalizes better out-of-distribution.
Figure 1: SAEs trained on the detector's residual stream recover latent features; auto-interpretation labels each; a lightweight classifier on retained high-fidelity features is both interpretable and more robust out-of-distribution.
Dugan et al. train sparse autoencoders on the residual stream of a fine-tuned neural AI text detector, assign auto-interpretation labels to each SAE feature, and retain only those passing a global fidelity threshold. A lightweight classifier trained on these interpretable features corresponds to specific, predictive linguistic "tells" of AI-generated text (hedging patterns, structural regularities). The interpretable classifier outperforms both the original neural baseline and stylometric alternatives on out-of-distribution datasets, suggesting the SAE bottleneck acts as a useful inductive bias. This is a clean demonstration that pragmatic mech-interp can simultaneously improve auditability and generalization — the two properties usually in tension for detectors.
Data selectors are the last quality gate before fine-tuning data reaches a model. This paper shows they can be systematically gamed by suppliers who generate large candidate sets and submit only the records that score highest — hiding harmful payloads inside apparently high-quality examples.
Figure 2: Utility-hijacking is governed by how much poison mass reaches the selector's upper tail. Vulnerable (selector, payload) pairs show poison concentrated above the 15% cutoff; immune pairs keep it below. Six selectors × three payloads tested on Qwen2.5-7B through Qwen3-32B.
Ren et al. introduce utility-hijacking: for each harmful instruction, generate many payload-bearing candidates and submit only the highest-scoring one. Tested against six utility-oriented selectors, the attack drove over-refusal from 0% to 94%, insecure code to 56/90 cases, and false-fact enrichment from 2.84× to 7.04× as scoring-model scale increased. The CONCERT defense flags suppliers chosen far more often than chance, then re-selects keeping only records two dissimilar selectors both rank highly — no content detector or poison labels required. On Qwen3-32B, CONCERT cut poison concentration from 6.67× to 0× for code and from 3.59× to 0.67× for facts, reducing downstream harm 100% (code) and 75% (facts) with no capability loss.
Refusal in aligned LLMs is largely mediated by a single residual-stream direction, but averaging over prompts to estimate it conflates distinct phenomena. WRDO learns per-prompt direction weights and shows the composite is more effective than the mean-difference baseline for both safety steering and abliteration recovery.
Figure: WRDO builds a composite refusal direction from learned weights over per-prompt direction vectors, outperforming uniform mean-difference aggregation on three open-weight models under HarmBench and three guard judges.
Evseev et al. build a bank of per-prompt difference-of-means vectors and learn aggregation weights so that harmful prompts contribute unequally to the composite refusal direction. Compared against prior single-direction methods on three open-weight models using HarmBench and three guard judges, the weighted composite is more effective at both strengthening refusal and recovering it in abliterated checkpoints, without measurable capability degradation on utility benchmarks. As an EMNLP 2026 accepted paper this is peer-reviewed; the method is directly actionable for practitioners who need to steer or restore safety representations without full retraining.
Figure 1: Conditioned divergence across five models — 10–52% of requests strictly refused in chat still produce unsafe tool calls under tool-enabled prompting. Refusal direction activation drops in 4/5 models in the agent context (AUC 0.76–0.86).
Gupta, Saha et al. build a 2,304-prompt benchmark of matched text-only, standard tool-enabled, and adversarially framed prompts. Under standard tool-enabled prompting, 10–52% of requests the model refuses in text still produce unsafe tool calls. Mechanistic analysis shows the refusal direction drops in 4/5 models in agent contexts, predicting unsafe calls with AUC 0.76–0.86. Activation patching restores some safety but mainly by suppressing tool use. Text-chat refusal rate is a poor proxy for agent safety.
Figure 1: Context compaction destroys message provenance at the flatten step. Flattening harnesses (Aider, Cline, pi, et al.) allow injected "[User]:" labels to survive summarization as genuine approvals (87–100%); role-typed harnesses are immune (0%).
Dabirsiaghi tests nine coding agents split into flattening harnesses (Aider, Cline, opencode, OpenHands, pi) and role-typed harnesses (Codex CLI, Gemini CLI, Qwen Code, Continue). A forged user approval injected into agent-readable content laundered 87–100% of the time in flattening harnesses (context windows up to ~908k tokens) and 0% in role-typed harnesses. A live demo shows a laundered approval executing attacker-controlled curl | sh ~50% of the time. Fix: escape role labels in the serializer before flattening.
Figure 1: A single prompt injection stored in long-term memory persists across sessions, enabling re-activation in fresh sessions including those of other organizational users.
Barcha Correia et al. develop a general threat model for memory injection and test it against ChatGPT, Claude, and Gemini. Attack vectors cover personal memories, projects, agent skills, organization instructions, and MCP resources. All NIST attack goals were collectively achievable: all three services could be manipulated to persistently spread disinformation, generate harmful content, or simulate offline unresponsiveness in fresh sessions. For Claude, shared-memory features allowed compromise of multiple organization users and prompt exfiltration. ~50% of proposed mitigations remain unimplemented across tested services.
Figure 4: Unsafe rates (%) across 11 evaluated models on DiagBase and DiagAttack. Models differ markedly and show distinct vulnerability signatures — invisible under binary aggregated scoring.
Li et al. introduce DiagSafe, a bilingual English-Chinese safety evaluation framework using per-prompt rubrics with safety and usefulness dimensions, built from an 84-label taxonomy. DiagSafe reaches 95.34% agreement with human annotations (Cohen's κ = 0.864) versus 69–87% for binary-label baselines. Models are particularly susceptible in Chinese and multi-turn contexts. Dataset to be released as Tencent-Hunyuan/DiagSafe.
Figure 1: Trust boundary and reader pipeline. The perception gap means the same evidence is seen differently by the human examiner (visible contents) and the LLM reasoner (full text including hidden injection). An injection invisible to the examiner reaches the model unimpeded.
Breitinger et al. build a taxonomy of evidence-borne attacks on LLM forensic pipelines, characterized by objective, technique, payload location, and concealment method. The key concept is the "perception gap": identical evidence is perceived differently by a human examiner, deterministic tools, and the LLM reasoner. Three PoC attacks demonstrate changing a reported conclusion, writing to the analyst's workstation, and triggering outbound network traffic — all triggered purely by text planted on a seized device.
Notes
All items are new to the radar (Oct 21–22, 2026 announce date); none were in any prior daily or weekly report.
Items 3 (2610.30006) and 5 (2610.29555) are EMNLP 2026 accepted papers; the remaining 8 are arXiv preprints.
Items 7 (Compaction Laundering) and 8 (Long-Term Memory Compromise) form a natural pair mapping two distinct agent-memory attack surfaces: context compaction provenance destruction vs. cross-session persistent memory injection.
The alignment and control items (1, 2) are strongly complementary: item 1 proposes making CoT monitoring reliable; item 2 maps how multi-monitor approval architectures fail and how to fix them.
