A new case study finds that letting an AI model show its work sometimes flags when it is about to fall for a hidden prompt-injection attack, but the pattern is thin enough that even the author is skeptical of it.
The researcher tested Sarvam-105B across English, Tamil, and Tanglish, comparing what happens when the model's chain-of-thought reasoning is visible via the API versus hidden. A four-scenario pilot found injected attacks succeeded 5 of 12 times with no visible reasoning, but only 1 of 11 times with it. A preregistered four-scenario follow-up flipped that result: 2 of 12 attacks succeeded without visible reasoning, versus 3 of 12 with it. The author is upfront that four scenarios per phase cannot separate a genuine reasoning effect from noise or quirks tied to specific prompts.
Chain-of-thought monitoring is often pitched as a cheap safety net, a way to catch a model announcing bad intentions before it acts, and this is one of the few tests of that idea outside English. The language-level pattern looks clean on paper: of 20 usable, non-empty reasoning traces spanning both phases, all 17 benign outputs said the model meant to ignore the injected instruction, and all three attack successes among those 20 traces said it meant to follow it. But the study logged four attack successes with reasoning enabled, not three, so at least one successful attack left no readable trace at all, exactly the kind of case a transcript-based safety check would miss.
The paper does not claim reasoning transcripts are trustworthy or that any of this generalizes past eight hand-picked scenarios and one model, which is the correct amount of caution for a safety signal that goes silent right when it matters most.