CoT-Guard: Small Models for Strong Monitoring

Monitoring the chain-of-thought (CoT) of reasoning models is a promising approach for detecting hidden objectives in code generation. Large models can serve as effective monitors, but their deployment cost is high due to lengthy reasoning traces, motivating the need for smaller alternatives. Unlike other safety tasks (e.g jailbreaking), we find that current small models (4B--8B) struggle to detect hidden objectives despite CoT access, often misattributing them as part of the user query. To mitigate this, we propose a post-training pipeline combining supervised fine-tuning (SFT) and reinforcement learning (RL). SFT narrows the in-domain gap by distilling detection behavior from stronger monitors. RL on subtly crafted hidden objectives improves generalization to out-of-domain tasks. We also propose and evaluate a realistic threat model motivated by supply-chain attacks, in which a third-party LLM router injects hidden objectives into code-generation requests via prompts or code manipulation. To push beyond objectives that large monitors already saturate, we also introduce four new tasks that challenge even strong monitors. We introduce CoT-Guard, a 4B monitor that achieves a G-mean^2 (TNR$\times$TPR) of 75\% under both attack types, outperforming GPT-5.4 (56\%), GPT-5-mini (41\%), and Qwen3-32B (54\%), while closing the gap to Gemini-3-Flash (83\%). CoT-Guard offers a cost-effective user-side defense against hidden objectives without the deployment cost of large monitors.