When Monitors Fail, the Model Still Knows: Probing Obfuscated Reasoning in LLMs.

Chain-of-thought (CoT) monitoring is a promising safety mechanism for large reasoning models. If a model reasons before acting, a monitor can read that reasoning to flag misbehavior. However, models trained with a joint task and monitor reward can learn to obfuscate their reasoning, producing benign looking traces while continuing to misbehave, thereby fooling the reasoning monitor. This phenomenon has been demonstrated only on closed internal infrastructure in the past. In this work, we make three contributions. First, we reproduce reasoning obfuscation on open models across two complementary honeypot environments (1) Mostly Basic Programming Problems (MBPP), where a honest solution path exists, and (2) Largest Island, where reward is only obtainable via hacking. Secondly, we also show that while the token-level monitor is deceived, the model's internal representations retain hack-relevant information. Linear probes on reasoning-position residual stream activations maintain high recall even after the policy has managed to fool the monitor. Third, we show that hacking induces a decoupling of representations between reasoning and answer residual stream activations. These results establish that internal representations provide a robust monitoring surface than CoT tokens under joint reward training, and motivate the direction of representational monitoring for alignment.