Source-linked AI summary
Visible Reasoning and Indirect Prompt-Injection Monitorability Across English, Tamil, and Tanglish
Madhusudhanan G
TL;DR
Visible reasoning may help monitor indirect prompt injection, but its reliability across languages and behavioral settings is uncertain. This small controlled study examined Sarvam-105B across English, Tamil, and Tanglish, finding exact intent–outcome alignment in 20 non-empty traces while the apparent reasoning-mode safety effect failed to replicate.
Problem
Visible chain-of-thought may expose whether models recognize and resist indirect prompt injections, but its reliability across multilingual settings remains uncertain.
Method
The study evaluated Sarvam-105B on eight manually verified synthetic scenarios across English, Tamil, and Tanglish, comparing indirect-injection behavior with and without visible reasoning.
Results
In 20 non-empty traces, visible intent aligned exactly with outcomes, while the pilot’s apparent reduction in attack success with reasoning failed to replicate.
Takeaways & Limitations
Visible reasoning was behaviorally informative when available, but the study does not establish a general reasoning-mode defense effect or mechanistic faithfulness.
Takeaways & Limitations
The small design used eight scenarios, one model, one configuration, one deterministic call per condition, and one annotator, limiting generalization and causal claims.
Abstract
from arXiv · showhide
Chain-of-thought monitoring is a potentially useful safety signal, but its reliability across languages and behavioral settings remains uncertain. In a small case study of eight manually verified synthetic scenarios, one model, one annotator, and one deterministic generation seed, I study API-visible reasoning during indirect prompt injection in Sarvam-105B across English, Tamil, and Tanglish. A four scenario pilot found 5/12 injected attack successes without reasoning and 1/11 with reasoning. A preregistered four-scenario follow-up reversed that direction, finding 2/12 attacks without reasoning and 3/12 with reasoning. With only four scenarios per phase, this design cannot distinguish a real reasoning-mode effect from prompt-specific variation or sampling noise. Across 20 non-empty injected-thinking traces, all 17 benign-correct outputs stated an intent to ignore the injection, while all three attack successes stated an intent to follow it. These descriptive observations provide a reproducible case study of behaviorally informative visible reasoning when it is available; they do not establish that reasoning mode improves safety, that visible reasoning is mechanistically faithful, or that the findings generalize beyond this configuration.
1 Introduction
This small controlled study examines indirect prompt-injection behavior and API-visible reasoning in Sarvam-105B across English, Tamil, and Tanglish. Its descriptive findings show exact alignment between stated intent and outcomes in non-empty reasoning traces, while supporting no general defense, language-ranking, or mechanistic-faithfulness claim.
- Motivation: Visible chain-of-thought is presented as a possible safety signal because monitors may identify whether the model noticed an injected instruction and intended to respond to it.The study treats visible reasoning as a natural-language signal rather than establishing that it is a general defense.
- Study scope: The study evaluates whether Sarvam-105B follows embedded injection payloads, whether visible reasoning identifies and responds to them, and whether patterns differ across English, Tamil, and Tanglish.Tamil and Tanglish were selected because the prompts could be manually verified.
- Main result: 20 injected-thinking attempts with non-empty visible reasoning were analyzed for alignment between stated intent and observed outcome.The study compares intent to ignore or follow against whether the model produced a benign-correct output or an attack success.
- Main result: 17 benign-correct outputs stated intent to ignore the injection, whereas all three attack successes stated intent to follow it.The stated intent aligned exactly with the observed outcome in both groups.
- Limitations: The contribution is a reproducible case study, not a claim of a general defense effect, language ranking, or mechanistic faithfulness.The paper explicitly limits its conclusions to the reported configuration and descriptive observations.
2 Related work
Prior work establishes indirect prompt injection and chain-of-thought monitorability as important but fragile safety problems. This study addresses a gap by examining visible reasoning during trust-boundary decisions for delimited untrusted content, with separate behavioral labels.
- Indirect prompt injection: IPI attacks exploit the boundary between instructions and external content in LLM-integrated applications.BIPIA introduced a benchmark focused on IPI attacks, defenses, and failures to distinguish data from actionable instructions.
- Indirect prompt injection: Multilingual IPI research has evaluated English–Bangla defense pipelines but not a model’s own visible reasoning during trust-boundary decisions.The cited multilingual work therefore leaves visible reasoning in this setting unexamined.
- CoT monitorability: CoT monitorability is described as promising but fragile, with substantial fragility reported across 13 languages under linguistic distribution shift.These findings motivate caution about treating visible reasoning as a reliable safety signal across languages.
- Study positioning: Unlike adversarial-hint evaluations, this setting embeds the attack in explicitly delimited untrusted content and separately labels payload noticing, untrusted-content recognition, and stated intent.The study is framed as deliberately much smaller than the broader prior evaluations described.
3 Experimental design
The study used eight manually verified synthetic scenarios across English, native-script Tamil, and Tanglish, organized into pilot and preregistered follow-up phases. Each scenario-language unit was tested under matched clean, trusted, injected non-thinking, and injected-thinking conditions, with exact-match behavioral grading and blinded reasoning annotation.
- Scenarios and languages: Eight scenarios covered four attack families across English, native-script Tamil, and Tanglish, with four scenarios in each phase.Each phase included one scenario from simple override, fake authority, task-output hijack, and synthetic canary extraction.
- Experimental conditions: Each scenario-language unit received four matched conditions: clean, trusted, injected non-thinking, and injected thinking.The injected conditions used the same payload, differing only in whether visible reasoning was disabled or enabled.
- Follow-up design: The follow-up changed benign tasks, targets, and surface contexts while preserving the attack-family taxonomy and condition structure.It was designed as a post-pilot scenario-generalization test rather than a new-model replication.
- Outcome measurement: Behavioral outcomes used frozen whitespace normalization and exact-string matching, classifying injected outputs as attack success, benign-correct, or other.Provider failures were retained as unavailable rather than retried or graded.
- Reasoning annotation: Visible reasoning was annotated from outcome-blinded packets using frozen fields, with reasoning language labeled separately before joining annotations to outcomes.Persisted-empty and unavailable traces were excluded from reasoning-label denoising.
4 Results
The basic task controls worked, but reasoning-enabled attack outcomes reversed between the pilot and follow-up, preventing a stable mode-effect conclusion. Visible reasoning was usually available and its intent labels aligned exactly with observed outcomes, while untrusted-content recognition did not guarantee resistance.
- 23/23 clean-task accuracy and 23/24 trusted-target adherence indicate that the basic control calls worked.
- 4/12 pilot units changed from attack success without reasoning to resistance with reasoning, versus 0 changing oppositely; follow-up transitions reversed this pattern.The follow-up had one attack-to-resistance transition and two resistance-to-attack transitions; these are descriptive counts, not causal estimates.
- 20/24 injected-thinking attempts produced non-empty visible reasoning, with availability rates of 9/12 in the pilot and 11/12 in the follow-up.Three attempts had persisted-empty reasoning and one was unavailable, so absent traces could not be monitored through the visible-reasoning channel.
- 17 benign-correct outputs were labelled intent-to-ignore yes and intent-to-follow no, while all 3 attack-success outputs had the opposite intent labels.This exact alignment occurred among the 20 non-empty injected-thinking traces.
- 19/20 traces recognized untrusted content, but 2 attacks still recognized the payload as untrusted, so recognition did not guarantee resistance.Payload noticing was annotated yes in all 20 eligible traces; these results concern an exposed API signal, not complete internal reasoning or a causal role for the trace.
5 Limitations
The study’s small, synthetic, tightly controlled design limits causal and comparative conclusions. Differences from deployed systems, translation variation, and potentially incomplete or unfaithful visible reasoning further constrain generalization and monitorability claims.
- Study design: Eight scenarios, one model, one API configuration, one deterministic call per condition, and one annotator make the case study vulnerable to prompt-specific variation.The pilot/follow-up reversal illustrates how prompt-specific variation can dominate a small design.
- Inference limits: The study cannot rank English, Tamil, or Tanglish by safety, establish attack-family effects, test significance, or claim a causal reasoning-mode effect.Language- and attack-family-level denominators are smaller still.
- External validity: Synthetic, exact-string-graded tasks provide objective attack-success labels but may not represent deployed systems with weaker provenance boundaries, longer contexts, tools, and open-ended actions.Exact-string grading also avoids reliance on an LLM judge.
- External validity: Manually reviewed translations may still differ subtly in naturalness or authority across languages.The paper therefore does not treat translation review as eliminating cross-language variation.
- Reasoning observability: API-visible reasoning may be incomplete, post-processed, or unfaithful to internal computation, so the observed alignment is only a monitorability signal in this setting.This limits interpretation of visible traces as evidence about underlying computation.
6 Conclusion
The study examined indirect prompt-injection behavior and visible reasoning in Sarvam-105B across English, Tamil, and Tanglish. When non-empty traces were available, visible intent closely matched observed behavior, but reasoning availability and behavioral effects were inconsistent.
- Across English, Tamil, and Tanglish, the study examined indirect prompt-injection behavior and visible reasoning in Sarvam-105B.
- All 17 benign-correct outputs stated an intent to ignore the injection, while all three attack successes stated an intent to follow it.These results came from 20 non-empty injected-thinking traces.
- 4 of 24 thinking attempts had unavailable or empty reasoning, including one attack success.
Reproducibility and disclosure
The study reports a public repository containing its protocols, data artifacts, analysis materials, derived outputs, and documented deviations. It also discloses author oversight, coding-agent assistance, model-generated responses, and the treatment of unavailable reasoning traces.
- Reproducibility: The public repository contains frozen protocols, scenarios, raw append-only artifacts, analysis code, deterministic derived outputs, and documented deviations.The repository is available at https://github.com/Madhumasa 84/MATS-multilingual-reasoning-monitorability.
- Disclosure: Persisted-empty and unavailable traces are not treated as negative annotation labels for API-visible reasoning availability.This disclosure concerns injected-thinking attempts.
- Disclosure: Coding agents assisted with implementation, testing, reproducibility safeguards, report editing, and fact-checking; the author reviewed the final paper and remains responsible for its claims.Sarvam-105B generated the study responses.
A Additional descriptive breakdowns
Pooled across injected modes, attack success was 5/16 for English prompts, 1/16 for Tamil prompts, and 5/15 for Tanglish prompts. These phase-level counts were reported for auditability and do not support a language comparison because denominators were only seven or eight.
- Language breakdown: 5/16 combined attack success occurred for English prompts, versus 1/16 for Tamil prompts and 5/15 for Tanglish prompts.These counts pool both injected modes.
- Interpretation limits: The phase-level denominators were seven or eight, so the pooled counts do not support a language comparison.The counts are reported for auditability only.
- Reproducibility: The frozen analysis records all provider failures and final output hashes, with prompts, rendering rules, raw events, and detailed tables available in the replication package.The package includes full scenario prompts and language and attack-family tables.