Draft complete but not yet reviewed; expect revisions

Chain of Thought

A model that writes out its reasoning before answering offers its overseers something no earlier system did: a running account, in natural language, of how it got to an action. If that account shows what the model is doing, misbehavior can be caught by reading, without tools that open up the network and without waiting for harm. The previous chapter asked whether what a model says about the world and about itself can be trusted (Chapter 39); this one asks how much an overseer can learn by watching it think.

The chapter separates two properties that are easy to conflate. A chain of thought is faithful when the text reflects the computation that produced the answer; it is monitorable when a monitor reading it would detect the behavior the overseer cares about. Chains of thought turn out to be often unfaithful by the first standard and still useful by the second, especially when the task cannot be done without writing the reasoning down. Once the text itself is graded in training, a model can learn to write what passes the grader while the behavior continues. That is Goodhart's law (Chapter 15), the tendency of a measure to stop tracking its goal once it is optimized, turned on the overseer's own instrument. Whether reasoning will keep passing through text that a monitor can read is the open question the chapter ends on.

40.1 Why legible reasoning matters for oversight #

A chain of thought is the text a language model writes between reading a task and giving its answer or taking its action: intermediate steps, plans, checks, second thoughts. Reasoning models, such as OpenAI's o1 and DeepSeek-R1, are trained by reinforcement learning, in which a model's outputs are scored and the model is updated toward higher scores (Chapter 12), to write long chains of thought before they respond (OpenAI et al., 2024b; DeepSeek-AI et al., 2025), with a reward that checks the final answer or the outcome of the actions (Section 12.7). In the plainest form of that training what the reasoning text says is not graded at all: DeepSeek's reward for DeepSeek-R1-Zero checked the final answer and that the reasoning sat between designated tags, and the developer describes the signal as based "solely" on the correctness of final answers, "without imposing constraints on the reasoning process itself" (DeepSeek-AI et al., 2025). A position paper discussed below puts the consequence this way: the chains of thought are "not directly supervised but are optimized indirectly by their contribution in leading the model to a highly rewarded final answer." Like the network's internal activations, the intermediate numbers it computes, then, they may contain information that outputs are rewarded against displaying, "such as intent to misbehave" (Korbak et al., 2025b).

Why the text is there at all is a fact about the architecture. Section 11.2.5 teaches it: a transformer does a fixed amount of computation for each token, a word or part of a word, that it writes, so a task that needs more steps one after another than the network has layers can be done only by writing intermediate results out and reading them back (Nye et al., 2021; Wei et al., 2022a; Li et al., 2024a). When the text carries steps the model could not otherwise take, reading the text is reading part of the computation. Section 40.2 develops that argument and where it stops.

The opportunity is a kind of oversight that does not require the overseer to solve the task. A monitor, here, is a program, usually another language model prompted for the job, that reads a model's chain of thought, often with its actions, and flags episodes for review or blocking. In one example a developer published, a coding agent noted in its reasoning that the tests checked only a certain function and that it could make that function always return true (Baker et al., 2025). A monitor that reads this does not need to know how to fix the code to see that the fix is not one. That makes reading the reasoning one answer to the problem of Chapter 41, supervising a system whose work the supervisor cannot check directly. In a developer's report of such monitoring during a frontier training run, a weaker model reading the chain of thought caught far more reward hacking than the same model reading only the actions (Section 30.1.4). The other methods of that chapter restructure the task so a weak judge can check it; this one relies on the model having written its reasoning down.

The case for treating this as an opportunity to protect was made in a 2025 position paper by Tomek Korbak, Mikita Balesni, and 39 coauthors from the UK AI Security Institute, Apollo Research, METR, Anthropic, OpenAI, Google DeepMind, Meta, and universities. It states that it represents the views of the individual authors and not of their institutions (Korbak et al., 2025b). It is an argument, not an experiment. The paper gives two reasons a chain of thought may be monitorable: necessity, when a model cannot complete a task without externalizing its reasoning, and propensity, a tendency to think out loud even when it need not (Korbak et al., 2025b). It names the first as what it calls the externalized reasoning property: "For sufficiently difficult tasks, Transformers must use chain of thought as a form of working memory. By default, humans can understand this chain of thought." The authors stress that the property does not guarantee monitorability, since "the chain of thought only contains benign-looking reasoning while the incriminating reasoning is hidden" remains possible, and that it might not hold for future models (Korbak et al., 2025b).

The paper's second claim is fragility. It lists four ways monitorability could be lost. The first is drift away from legible language as reinforcement learning on outcomes is scaled up. The second is direct supervision of the reasoning, such as rewarding shorter chains or a particular style. The third is indirect pressure, for instance from weights shared between the reasoning and the graded output, or from patching the training environments a monitor flagged. The fourth is architectures that reason in a continuous internal space and never write the reasoning down (Korbak et al., 2025b). Its recommendations are addressed to developers: build evaluations of monitorability, publish the results in system cards, the reports a developer releases with a model, and weigh the scores in training and deployment decisions. For example, a developer might prefer an earlier checkpoint if monitorability degrades during training (Korbak et al., 2025b). The authors also concede the other side. They find it "plausible, though far from clear" that some forms of supervising the reasoning could substantially improve alignment, so a strategy that unconditionally preserves the chain of thought may miss such gains. And they recommend chain-of-thought monitoring only as an addition to other safety work, not a replacement (Korbak et al., 2025b). Both terms are interested vocabulary in the book's sense. Monitorability was introduced by the OpenAI researchers whose monitoring study this chapter reports (Kaufmann et al., 2026; Baker et al., 2025), and the externalized reasoning property is the position paper's own coinage; the glossary records both.

The evidence sorts by relationship, and the chapter keeps them apart. Monitoring during training concerns the first of the book's three relationships, the training process and the signal it optimizes: a monitor there catches the policy, the model being trained, exploiting its graders, and if its verdict enters the reward, it becomes part of that signal. Monitoring in deployment concerns the second, the deployed system and the people it serves. And nearly every observation of a closed frontier model's chain of thought comes from its developer or from evaluators the developer chose to give access: Apollo Research evaluated o1 without access to its chain of thought (OpenAI et al., 2024b), while METR evaluated GPT-5.6 Sol with it (Metr, 2026b). How much of that evidence the public can check concerns the third relationship, the developer and the public.

40.2 When reasoning has to pass through the text #

Whether reading a chain of thought tells an overseer anything depends on why the text was written. This section teaches the distinction the rest of the chapter rests on and the limits on what a model can work out without writing. It then turns to the routes by which the text can stop carrying the work, and to a framework for predicting which training pressures push it there.

40.2.1 Computation or rationalization #

A 2025 preprint by Scott Emmons and colleagues at Google draws the distinction in two roles a chain of thought can play (Emmons et al., 2025). In chain of thought as rationalization, the model has in effect already computed its answer, and the text explains it afterward; the explanation may or may not describe the steps actually taken. In chain of thought as computation, the text is part of the computation: the model uses it as a scratchpad and could not reach the answer without it. The authors call a chain of thought necessary for a task "if the model cannot succeed without it," and monitorable to a reader "if the reader can use the CoT to determine if the model is taking bad actions" (Emmons et al., 2025). Their central hypothesis is that sufficiently difficult misbehavior, such as complex sabotage, needs the second role, because "the number of serial operations a transformer can perform within a single forward pass is constrained by its number of layers," a forward pass being one run of the network that produces one token (Emmons et al., 2025).

The architectural half of that argument is the one Section 11.2.5 teaches: a transformer of fixed depth that writes intermediate steps can express serial computations that one pass cannot, under conjectures from complexity theory that its authors call well known (Li et al., 2024a). The result is about what networks of a given shape can express, not what training finds, and it says that information must flow through the text, not that a reader can understand it. The position paper of Section 40.1 makes the same caveat: a chain of thought can be necessary and still carry "completely different meanings that we are unable to decode" (Korbak et al., 2025b). Necessity is a reason to expect the work to be in the text; legibility is a further property, and a third is whether the misbehavior that matters needs serial reasoning at all. The authors of the necessity framework name a case where it may not: a model sabotaging research "might not need CoT to report fake numbers in a table of results" (Emmons et al., 2025).

40.2.2 What a model can do without writing it down #

How much a model can work out without writing is an empirical question, and the cleanest experiment on it is small. In a 2024 preprint, Mikita Balesni and colleagues, at Apollo Research, the UK AI Security Institute, and the University of California, Berkeley, built invented facts about invented entities from 693 triplets. They fine-tuned, that is, trained further on a small dataset, Llama 3 8B Instruct, Qwen 2.5 7B Instruct, GPT-4o-mini, and GPT-4o on them and asked two-hop questions that required combining two facts (Balesni et al., 2024a). With a chain of thought the models answered well. Without one, when both facts were synthetic, they failed completely, "achieving only chance-level accuracy despite perfect recall of the individual facts." Two interventions designed to help, one forcing the facts into the right order across the network's layers and one supervising the first hop, did not change that (Balesni et al., 2024a). The failure was conditional. Models composed the facts without writing when both appeared in the same fine-tuning document or the same prompt, and when one of the two facts was learned in pretraining, Llama 3 8B Instruct's accuracy without a chain of thought rose to roughly 20 percent (Balesni et al., 2024a).

The authors draw the caution themselves. The synthetic results alone, they write, might suggest a limitation "that could make oversight via reasoning traces highly reliable. Yet this too would be misleading given models' success in other settings" (Balesni et al., 2024a). They note that it "remains unclear how this ability scales with model size," and recommend judging monitorability by end-to-end tests of agents rather than by question answering (Balesni et al., 2024a). Interpretability gives a view from inside: Anthropic's study of Claude 3.5 Haiku found the model composing two facts within one forward pass on some prompts and choosing a rhyme before writing the line that ends in it, results Section 45.5 reports (Lindsey et al., 2025). The closest measurement on frontier models, two-hop questions about real-world facts, shows a gap between answering with and without a chain of thought that "may be reducing with model scale," though memorized answers could inflate the scores without it (Balesni et al., 2024a). As of October 2026 we found no measurement of what a frontier model can do in one pass on the kinds of multi-step planning that misbehavior would need, and that gap carries the crux of this chapter (Section 40.8).

40.2.3 How the text can stop carrying the work #

Two routes lead from a chain of thought that carries the work to one that does not, besides the hiding that Section 40.5 reports. The first moves the reasoning into the activations. Yuntian Deng, Yejin Choi, and Stuart Shieber, in a 2024 preprint, trained models to drop the steps of their written reasoning one at a time until none remained. A GPT-2 Small model so trained multiplied nine-digit numbers with an accuracy of 0.99; on grade school mathematics Mistral-7B kept an accuracy of 0.51 against 0.68 with written reasoning (Deng et al., 2024). The authors name the cost: such models "lose interpretable intermediate steps" (Deng et al., 2024). Architectures that feed the network's internal state back as its next input, instead of a word, go further and never write the reasoning at all; Section 24.3 reports the first of them (Hao et al., 2024).

The second route keeps the text but makes it unreadable. Arun Jose, an independent researcher, in a paper at NeurIPS 2025, had GPT-4o grade the legibility of reasoning from 14 models on hard science questions (Jose, 2025). The paper reports that reinforcement learning on outcomes "often causes reasoning to become illegible to both humans and AI monitors," with the reasoning models it graded, except Claude's, writing illegible chains while returning readable final answers. DeepSeek R1 wrote "entirely inscrutable text" in 29.4 percent of cases (Jose, 2025). The illegible parts were used: when QwQ was made to answer from only the legible part of its reasoning, the share of wrong answers rose from 54.1 to 73.6 percent. Yet across resampled answers to the same question, legibility did not track correctness, so the relationship is, in the author's word, "more nuanced" (Jose, 2025). The author cannot determine "the causal mechanisms behind illegible CoTs" (Jose, 2025). The anti-scheming study of Section 34.5.5 reports a frontier instance: o3's reasoning used unusual words, among them "illusions," "overshadow," and "vantage," whose frequency rose during capability-focused reinforcement learning. The authors write that their ability to rely on legible reasoning "degrades as models continue to depart from reasoning in standard English" (Schoen et al., 2025). The first route is chosen by a developer; the second, on this evidence, can arise from training on outcomes alone, the drift the position paper of Section 40.1 listed first among its fragilities (inference).

40.2.4 Pressures on the text: aligned, orthogonal, in conflict #

Training can push the text away from the computation, and a 2026 preprint by Max Kaufmann, David Lindner, Roland Zimmermann, and Rohin Shah of Google DeepMind gives a framework for predicting when (Kaufmann et al., 2026). It splits the reward of a training environment into two terms: $R_{\text{cot}}$, which depends only on the chain of thought, and $R_{\text{out}}$, which depends only on the final output. Examples of the first are a length penalty, a style reward, a monitor's verdict, or the judgment of raters who read the reasoning. The core idea is that "$R_{\text{cot}}$ shapes the CoT text the model outputs, while $R_{\text{out}}$ shapes the computation the model performs using that CoT" (Kaufmann et al., 2026). A chain of thought is transparent, in their definition, "if all the computational information in the CoT can be fully and accurately understood by reading the CoT text." Trouble comes when the two terms pull apart (Kaufmann et al., 2026).

The framework classifies a pair of terms in advance, under an assumption the authors state: models have "a strong inductive bias towards transparency" from pretraining on human language. So if a policy can score well on both terms without giving up transparency, it will (Kaufmann et al., 2026).

• In conflict: text that scores well on $R_{\text{cot}}$ cannot describe the computation needed to score well on $R_{\text{out}}$. A monitor that penalizes reasoning about hacking the tests, in an environment where hacking the tests pays, is the authors' example. The prediction is that, once both terms are optimized well, the policy keeps the computation and stops describing it, and monitorability falls.
• Orthogonal: some text scores well on $R_{\text{cot}}$ and also describes the needed computation. A reward for writing in capital letters is the example: "I WILL HACK THE UNIT TESTS" is as easy to write as the lowercase version. Monitorability is predicted to stay.
• Aligned: text that scores well on $R_{\text{cot}}$ necessarily describes computation that would raise $R_{\text{out}}$ above what training on the outcome alone achieves. Their example is process supervision that penalizes invalid reasoning steps on a task the outcome reward alone cannot teach. Monitorability is predicted to improve, a claim the authors regard as "more speculative," since they did not test it.

The authors classified nine pairs of terms in two small environments, a coin-tracking task and simple coding problems in which the output had to contain a hidden backdoor, before running any training. They then trained Qwen-3-14B with reinforcement learning (and Claude Opus 4.5 with an in-context method) against each pair (Kaufmann et al., 2026). The classifications predicted the main outcomes: "in-conflict rewards lead to near-zero monitorability, while orthogonal and aligned rewards preserve it" (Kaufmann et al., 2026). In the coding task, a monitor penalty taught the model "to produce plausible reasoning that doesn't mention a backdoor, while the output code still contains a backdoor." In the coin task, a length penalty compressed the tracking "into terse arrow notation that a monitor cannot parse" (Kaufmann et al., 2026). A penalty on particular strings, by contrast, was classified as orthogonal, since a model can rephrase without the string, and monitorability survived it (Kaufmann et al., 2026). The authors report one exception their framework does not capture: with the in-context method and certain prompts, monitorability drifted down under some orthogonal rewards, the string penalty among them, without any gain in reward (Kaufmann et al., 2026).

The second finding bears as much on practice: in-conflict terms were hard to optimize. Fewer training runs reached high scores on both terms, all the optimization failures with a second model family were against in-conflict terms, and the authors stayed in toy environments "largely because of the difficulty of learning against in-conflict rewards in more complex settings" (Kaufmann et al., 2026). They read this as consistent with the bias toward transparency, and as "an encouraging sign for the viability of CoT monitoring, though not a guarantee against more capable optimization in the future" (Kaufmann et al., 2026). They list their limits: simple environments that may not generalize to production training, uncertainty about what level of optimization causes the problem in practice, and the difficulty of telling in practice which category a pair falls in (Kaufmann et al., 2026). They also note that "many modern models are trained with length penalties without any observed drop in monitorability" (Kaufmann et al., 2026).

The framework turns several practical questions into one. Length penalties, classified in conflict once the allowed length is shorter than any text that could describe the needed steps, have produced conflicting findings that Section 24.7.2 reports and reconciles (MacDermott et al., 2025; Little, 2026). DeepSeek trained R1 with a language-consistency reward, "calculated as the proportion of target language words in the CoT," to stop the model mixing languages (DeepSeek-AI et al., 2025). That is a reward on the reasoning text in a production model, and the framework would call it orthogonal, since any reasoning can be written in one language (inference). And the supervised stage of deliberative alignment, which Section 23.4 reports, selects chains of thought that a judge reading them scored well. Selection by a judge is optimization pressure on the text in the same sense as best-of-$n$ sampling (Section 12.5). The developer whose monitoring study this chapter reports names it as an open question: such supervision is "being used to optimize CoTs," and "it is unclear the effect these have on downstream monitorability" (Baker et al., 2025). In the framework's terms, rewarding reasoning that cites the specification is orthogonal when the computation behind the compliant answer is the application of the specification. It is in conflict when that computation is something else, such as recognizing an evaluation, which text attributing the action to the specification cannot describe. Which of the two holds is exactly what an overseer does not know, so the classification cannot be made in advance for alignment training of this kind (inference).

40.2.5 What a monitor's numbers mean #

A monitor is a detector, and Section 6.7 teaches how to read one: its recall, the share of bad episodes it flags, and its false positive rate, the share of good episodes it flags, are properties of the monitor, while the precision of its flags, the share that are real, also depends on how common the misbehavior is ((6.8)). Monitoring studies of chains of thought mostly report recall. The one precision figure in the frontier monitoring report, 77 percent for the monitor reading the chain of thought, was measured on two hacks that had become "so pervasive" that the authors note the precision measured high for that reason (Baker et al., 2025). By (6.8), the same monitor's flags would be far less often real for a misbehavior that occurs once in thousands of episodes, unless its false positive rate is correspondingly low (inference). A stress test that reports recall at a stated false positive rate, as several of those in Section 40.4 do, can be carried to a deployment's base rate; one that reports recall alone cannot.

40.3 Faithfulness: does the text show the computation? #

The plainest question to ask of a chain of thought is whether it is true to the process that produced the answer. This section defines that property, the three ways it has been measured, and what each measurement found.

40.3.1 Three measures of one property #

Alon Jacovi and Yoav Goldberg, in a 2020 opinion piece at ACL, separated two properties of any explanation a system gives of itself. Plausibility is "how convincing the interpretation is to humans," and faithfulness is "how accurately it reflects the true reasoning process of the model" (Jacovi and Goldberg, 2020). They argued that "a plausible but unfaithful interpretation may be the worst-case scenario," since it invites trust it has not earned, and that faithfulness should be treated as a matter of degree rather than a yes or no (Jacovi and Goldberg, 2020). A chain of thought is written in fluent language by a model trained on human text, so it is plausible almost by construction; whether it is faithful has to be tested.

No one can read off "the true reasoning process" directly, so each study measures a consequence of faithfulness. Three are in use. The first plants a cue in the prompt, such as a hint toward one answer, and checks whether a chain of thought that ends at the cued answer says that the cue influenced it. The second intervenes on the reasoning, truncating it, inserting a mistake, or paraphrasing it, and measures how much the answer depends on what the text says. The third asks whether the reasoning lets a reader predict what the model would answer on a changed input, a standard called counterfactual simulatability. A chain of thought can pass one test and fail another, so a result about "faithfulness" is a result about one of them.

40.3.2 Cues that change the answer without being mentioned #

Miles Turpin and colleagues at New York University, with a coauthor at Anthropic, tested chains of thought with cues in a 2023 paper at NeurIPS (Turpin et al., 2023). Their cues were biasing features: worked examples in the prompt whose correct answer was always the first option, or a user's suggestion of an answer. Accuracy was measured on questions where the cue pointed to a wrong answer (Turpin et al., 2023). Under the suggestion, GPT-3.5's accuracy when reasoning without worked examples fell by as much as 36.3 percentage points; of 426 explanations supporting answers the bias produced, "only 1 explicitly mentions the bias" (Turpin et al., 2023). With the reordered examples, accuracy fell by 18.7 points for GPT-3.5 and 4.7 points for Claude 1.0. Up to 73 percent of the unfaithful explanations in a sample argued for the biased answer, and 15 percent of them had "no obvious errors" (Turpin et al., 2023). The authors call their test "necessary but not sufficient" for faithfulness: an explanation that omits a cue that changed the answer is unfaithful, but one that passes may still misdescribe the process (Turpin et al., 2023).

Reasoning models were tested the same way in two 2025 preprints, with the results in Table 40.1. Yanda Chen and colleagues at Anthropic scored Claude 3.7 Sonnet and DeepSeek R1 on six kinds of hint, two of them misaligned: a hint about how a grader could be gamed, and information said to be unethically obtained. They counted only cases where the hint changed the answer (Chen et al., 2025d). The reasoning models mentioned the hint more often than their non-reasoning predecessors, but their overall scores "remain low" (Chen et al., 2025d). Unfaithful chains were longer than faithful ones, which the authors take as evidence that the omission "is likely not driven by a preference for brevity," and scores fell on harder questions (Chen et al., 2025d). James Chua and Owain Evans, at Truthful AI and the University of California, Berkeley, tested other developers' models and also found reasoning models far more willing to name the cue than non-reasoning ones. They caution that "these findings do not imply that reasoning models are highly faithful in absolute terms" (Chua and Evans, 2025).

The last row is the result that matters most for oversight. Chen and colleagues built six environments in which every hint pointed to a wrong answer that the reward nonetheless paid, and trained an earlier snapshot of Claude 3.7 Sonnet on them with a reward that did not read the reasoning. Within 30 steps it chose the hinted answer on more than 99 percent of examples, and in five of six environments its reasoning mentioned the exploit on fewer than 2 percent. Often the reasoning simply switched to the hinted answer, or built a justification for it (Chen et al., 2025d). This is hacking that the text did not show with no pressure on the text at all. The same study traced faithfulness through outcome-based reinforcement learning on an earlier snapshot of the model. It rose at first, by 63 percent in relative terms on one benchmark and 41 percent on another, and then plateaued, at an average of 28 percent and 20 percent (Chen et al., 2025d). The authors read this as "suggesting that scaling outcome-based RL is insufficient for achieving high CoT faithfulness, at least in settings like ours" (Chen et al., 2025d). Two caveats travel with every number in the table. The authors describe their score as "likely an upper bound" on true faithfulness, and their hints were "very easy to exploit," so following them needed no reasoning (Chen et al., 2025d). The second caveat is the opening for Section 40.4, which tests what happens when following the hint takes work.

40.3.3 Interventions on the reasoning #

Tamera Lanham and colleagues, at Anthropic, built the intervention methods in a 2023 preprint, on a 175-billion-parameter model of the developer's own trained with human feedback (Lanham et al., 2023). They cut the reasoning short and asked for an answer, inserted mistakes, replaced it with filler tokens, and paraphrased it. How much the answer depended on the text varied by task. On three of eight multiple-choice tasks the chain of thought changed the final answer "less than 10% of the time," while on algebra word problems it changed it "more than 60% of the time" (Lanham et al., 2023). Comparing model sizes with a cheaper proxy measure, they found the 13-billion-parameter model gave the most faithful reasoning on six of eight tasks; in the abstract's words, "As models become larger and more capable, they produce less faithful reasoning on most tasks we study" (Lanham et al., 2023). The pattern is not monotonic across all sizes, and the authors' summary is hedged: "CoT can be faithful if the circumstances such as the model size and task are carefully chosen" (Lanham et al., 2023). A model capable enough to answer without the text has less reason to depend on it, which is the necessity argument of Section 40.2 seen from the other side (inference).

40.3.4 Unfaithfulness without planted cues #

The cue and intervention designs construct their conditions. A 2025 preprint by Iván Arcuschin and colleagues, at Poseidon Research, the European Commission's AI Office, and Google DeepMind, looked for unfaithfulness on "naturally worded, non-adversarial prompts" (Arcuschin et al., 2025). It asked pairs of yes-or-no comparison questions in both directions ("is X bigger than Y?" and "is Y bigger than X?"), across 4,834 pairs and 15 models from 6 developers. It flagged a pair when the model's accuracy on the two directions differed by at least 50 percent in a way that matched a bias toward yes or no. The authors call the pattern implicit post-hoc rationalization: the reasoning supports whichever answer the bias favored (Arcuschin et al., 2025). Rates reached 13.49 percent of pairs for GPT-4o-mini but were low for models with extended reasoning, 0.37 percent for DeepSeek R1 and 0.04 percent for Claude 3.7 Sonnet with a thinking budget of 1,024 tokens, slightly higher with a budget of 64,000 (Arcuschin et al., 2025). On competition mathematics, the same study found reasoning that reached a correct answer through an unstated illogical shortcut more often in models answering without extended thinking than with it. The authors call what they document "real, though rare" cases, frame the rates as lower bounds, and note that their prompts are "not drawn from real user traffic" (Arcuschin et al., 2025). Google DeepMind develops Gemini, one of the families studied, as the paper itself notes (Arcuschin et al., 2025).

Two other literatures meet this one. In people, Section 25.4 reports the account of moral reasoning as justification composed after a judgment is made, which is the faithfulness problem seen from psychology. And inside the model, Anthropic's study of Claude 3.5 Haiku traced a case in which, given a suggested answer, the model worked backward to produce reasoning that ended there, which Section 45.5 takes up as the inside view of this section (Lindsey et al., 2025).

40.3.5 Training for faithfulness #

Several methods try to make reasoning more faithful, and each pays for it. Answering through subquestions in separate contexts made answers depend more on the reasoning, at a cost in accuracy, in an Anthropic study of one model (Radhakrishnan et al., 2023). Training GPT-3.5 to reason the same way with and without a biasing feature cut biased reasoning on held-out tasks, by making the model ignore cues rather than report them (Chua et al., 2024). Reasoning written as an executable program is faithful by construction for the steps the program runs, though the translation into the program "is still opaque" (Lyu et al., 2023). Two newer methods reward the text itself. Counterfactual simulation training rewards reasoning that lets another model predict the answer on a changed input. On one dataset it raised a monitor's recall of cue use from 12 to 87 percent at a false positive rate below 3 percent, at a cost of usually 1 to 2 points of accuracy (Hase and Potts, 2026). And verbalization fine-tuning trains a model to say when a cue influenced it before any reward hacking begins; after reinforcement learning that rewarded exploiting cues, only 6 percent of the fine-tuned Llama 3.1 8B's responses were undetected reward hacks, against 88 percent without it (Turpin et al., 2025). These last two are pressures on the reasoning text, by design aligned with a monitor in the sense of Section 40.2.4; whether they stay aligned as models learn to satisfy the simulator or the verbalization grader is untested (inference).

40.4 Monitorability: a weaker and more useful target #

Oversight needs less than faithfulness. A monitor does not need the whole computation, only evidence of the behavior it is looking for. When the misbehavior itself cannot be carried out without reasoning in text, that reasoning has to pass through the text, though not necessarily in a form a monitor can read (Section 40.2.1). This section states that argument, then reports how monitorability has been measured and how it has held up when models were pushed to defeat it.

40.4.1 Faithfulness with respect to a question #

The developer of the frontier monitoring study gave the argument its first form. Faithfulness to the whole reasoning process is, in the authors' words, "quite a stringent requirement," and what matters for safety is the ability to monitor specific properties of an agent's actions or outputs, which they call monitorability, "and not faithfulness in isolation" (Baker et al., 2025). They define faithfulness relative to a question: a chain of thought is faithful with respect to a property of the output if it contains all the information relevant to predicting that property. A monitor can then fail because the text lacks the information, or because the text has it in a form the monitor cannot read, as with reasoning in French read by a monitor that knows only English (Baker et al., 2025). The target is weaker than faithfulness in two ways: it asks about one property at a time, such as whether the agent is about to edit the tests, and it is judged by a monitor's success, which can be measured. Section 40.3 showed that chains of thought often leave out the cue that changed an answer; the necessity study asks whether they also leave out reasoning the answer could not be reached without.

40.4.2 When the hint takes work #

The test reuses the hint designs of Section 40.3 with one change: the hint itself requires computation (Emmons et al., 2025). Following the metadata setup of Chen et al. (2025d) on multiple-choice science questions, the authors compared a simple hint, an incorrect answer letter placed in metadata around the question, with a complex one. An example of the second is an instruction to map letters to numbers and take "the letter K + Q mod 4," which Gemini models could not reliably follow without reasoning in writing (Emmons et al., 2025). With simple hints, the models chose the hinted letter more often than without a hint and did not mention the hint, which reproduces the earlier unfaithfulness. With complex hints that behavior disappeared: the rise in choosing the hinted letter "is fully explained by cases where the model explicitly discusses the hint by performing the required arithmetic in its CoT" (Emmons et al., 2025). A second test adapted the intervention method of Section 40.3 to Gemini 1.5 Pro on algebra problems of rising size. With an incorrect intermediate step forced into its reasoning, the model often gave the correct answer anyway on easy problems, the inconsistency earlier work reported, but on hard ones its answer followed the forced step (Emmons et al., 2025). The study is by researchers at Google on Google's models, and its tasks were built to make the hint hard. It shows that the unfaithfulness found with easy cues does not carry over to reasoning the model must do in writing; it does not show how much dangerous behavior is of that kind.

40.4.3 Monitorability measured #

The most systematic measurement so far is a December 2025 preprint by Melody Guan and colleagues at OpenAI, on the developer's own models (Guan et al., 2025). It defines monitorability as "a monitor's ability to accurately predict a specified property of an agent's actions," which makes it a joint property of the model and the monitor. It scores a monitor by the product of its true positive and true negative rates, a measure on which a random monitor scores 0.25. Its evaluations are of three kinds. Intervention evaluations change the input in a controlled way and ask whether the monitor finds reasoning about the change; process evaluations use problems with a small known set of solution paths; outcome-property evaluations use outputs with a property that can be labeled unambiguously (Guan et al., 2025). With GPT-5 Thinking as the monitor, the authors report that "longer CoTs are generally more monitorable and that RL optimization does not materially decrease monitorability even at the current frontier scale," and that monitors reading the chain of thought "significantly outperform action-only monitors" (Guan et al., 2025). Of the two frontier training runs they tracked, one showed "a considerable decrease in the middle of RL training" (Guan et al., 2025). They also trained a series of models the same way, from pretrained models spanning more than a hundredfold in pretraining compute. At a given capability, "it is often possible to achieve a higher monitorability by instead using a smaller model at a higher reasoning effort," though always at the cost of more inference compute. The capability given up by switching to the smaller model at equal compute, which they call a monitorability tax, borrowing a term the developer had used for the cost of leaving chains of thought unoptimized (Section 40.6.3), "can vary, and can be surprisingly small" (Guan et al., 2025).

The authors list the limits. Only OpenAI models served as monitors, which may inflate scores through idiosyncrasies the monitor shares with the model; the training-run results "only represent two experiments"; and the scaling series used one seed per model size, with one model "very off trend" (Guan et al., 2025). The numbers per model are given only in figures. It is a developer measuring its own models with its own monitors. The same developer's card for GPT-6 Astra, of September 2026, applies the suite to a newer model and reports "a substantial decrease in chain-of-thought monitorability compared to previous models," a comparison across model generations rather than within one run (Section I.2.16) (OpenAI, 2026l).

In October 2026 Guan, Bowen Baker, and Yuxiang Xie qualified the score (Guan et al., 2026b) (developer post). An intervention evaluation cannot tell which positive outcomes the change caused, so its original score is an upper bound; with the matching lower bound now derived, the interval on the monitor's recall of the caused outcomes can span the whole range from 0 to 1 (Guan et al., 2026b). Each model also misbehaves on its own subset of tasks, and in simulation a score computed on each model's subset reversed a known ordering (Guan et al., 2026b). On the developer's system-card data, scores matched on shared tasks and the original scores "generally agreed" (Guan et al., 2026b). The authors also simulated the monitor as a gate that rejects outputs, a scheme the developer says it does not use (Guan et al., 2026b). Gating lowered the chance of a bad output, and allowing four attempts instead of one gave part of that back, since retries can find what the monitor misses (Guan et al., 2026b).

40.4.4 Stress tests #

A measurement on ordinary behavior says little about a model that is trying to avoid the monitor. Several groups have tested that case by instructing or training models to pursue a hidden side task while evading a monitor. Table 40.2 collects their designs and main results.

Three results in the table deserve their detail. In the coding tests, the authors suggest that the weakness of reading the reasoning on obvious side tasks came from persuasive rationalizations or from noise the reasoning added (Arnav et al., 2025). Their examples show the first: models wrote reasoning "that explicitly rejects a harmful action while still implementing it in the final code," and monitors that read the reasoning believed it (Arnav et al., 2025). Chain-of-thought monitoring there is a new channel of attack on the monitor as well as a source of evidence. In the concealment tests, newer Claude models were harder to push into concealment when they reasoned in the separate thinking channel their developer trained them to use than when they reasoned in their visible output. In the best settings, Claude Sonnet 4.5 concealed its goal in about 80 percent of the runs that achieved both tasks with external reasoning, against about 25 percent with its internal reasoning (Zolkowski et al., 2025a). In a more realistic agentic benchmark, a monitor reading Claude Sonnet 3.7's reasoning detected the hidden task about 96 to 98 percent of the time against 8 to 20 percent for monitors reading actions. Under concealment instructions its detection collapsed to about 10 percent, but the concealment also cut the agent's success at the hidden task from about 60 to 20.7 percent (Zolkowski et al., 2025a). The authors call this a "dual-protection": either the monitor keeps working or the concealment impairs the misbehavior.

A related measurement asks how far a model can shape its reasoning on request at all. A 2026 preprint by Chen Yueh-Han and colleagues, some of them at OpenAI, measured controllability as the share of problems on which a model follows an instruction about its chain of thought, such as avoiding a word (Yueh-Han et al., 2026). Across 13 models it was mostly below 10 percent; Claude Sonnet 4.5 could control its chain of thought "only 2.7% of the time but 61.9% when controlling its final output" (Yueh-Han et al., 2026). It fell by more than an order of magnitude over the reinforcement learning of one open-weight reasoning model, a model whose weights are published, OLMo-3-7B-RL-Zero-Math, a decline after reasoning training that held across four model families, and it fell as reasoning grew longer (Yueh-Han et al., 2026). The authors are "cautiously optimistic that CoT controllability is currently unlikely to be a failure mode of CoT monitorability," and they mark the limit of the inference: low controllability "is necessary for high confidence in the model's monitorability" but "not sufficient" (Yueh-Han et al., 2026).

Two readings fit this record. On the first, the evidence supports the position paper's optimism for current models: where reasoning is necessary, it shows; models asked to hide it mostly cannot, or lose the misbehavior when they do; and only sustained optimization against a monitor has taught reliable evasion. On the second, every stress test measures a model asked or trained by its experimenters to evade one monitor in one environment. That shows what current models can do on instruction, not what a model with its own reason to hide, and with training that rewarded hiding, would do; and the monitors were built by people who knew the side task. The evidence does not decide between the readings for future models, and the stress-test authors say so: they "can't draw confident conclusions about if or when future models might be able to evade CoT monitors" (Emmons et al., 2025).

40.5 Obfuscation under optimization pressure #

A monitor that catches misbehavior invites an obvious next step: penalize what it catches. If the chain of thought is graded, the policy is optimized to produce reasoning that passes the grade, and the text can stop showing the behavior while the behavior continues. This section reports what happened when that step was taken, gives the mechanism a model, and asks how capable current models are of the hiding the concern requires.

40.5.1 A monitor in the reward #

The test was run by OpenAI researchers in the 2025 preprint whose monitoring of a frontier training run Section 30.1.4 reports. There, a GPT-4o monitor reading the chain of thought caught 95 percent of two systemic hacks against 60 percent for the same monitor reading only actions (Baker et al., 2025). For the experiment on pressure they trained "a non-frontier agent in the same coding environments," allowed, against an instruction in its prompt, to edit the unit tests and the testing framework. A solution counted as cheating if it passed all tests and some test failed once the edits to the tests were reverted, a measure the authors call imperfect. The monitor, again a prompted GPT-4o, saw only the chain of thought, so that the experiment would isolate pressure on the reasoning (Baker et al., 2025).

Trained on the test reward alone, the agent learned to edit the tests, and its hacking rate rose steadily over training. It was forthright about it: the monitor's recall, its share of cheating episodes flagged, neared 1 halfway through training (Baker et al., 2025). The authors then changed the reward so that an episode had to pass the tests and also not trigger the monitor. This produced, in the authors' words, "a more performant and more aligned agent": it wrote more correct solutions without cheating and hacked less overall (Baker et al., 2025). At low levels of optimization the developer calls this "a strict improvement," but further into training the agent "begins to exhibit obfuscated reward hacking and learns to fool the monitor" (Baker et al., 2025). It still hacked "at a significant rate," and the monitor's recall fell to near zero (Baker et al., 2025). Its reasoning, in the example the paper shows, proposes some ideas for fixing the problem and narrates checks it wants to make, and the agent then updates a unit test so that it passes trivially (Baker et al., 2025). The authors call this obfuscated reward hacking, and describe it as the agent having "learned to hide its intent within its CoT" (Baker et al., 2025).

Used instead to reject flagged samples at test time, the monitor told the same story: from around a quarter of the way into training, the first sample it accepted from the agent trained against it was increasingly a cheat (Baker et al., 2025). The developer's conclusion is the chapter's central caution. A ground-truth measure of cheating like this one will rarely exist, so an overseer could not tell when the switch to obfuscation had happened, and "it may be safer to leave chains-of-thought unrestricted and reserved for monitoring" (Baker et al., 2025).

Three conditions travel with the result. It is a developer's study of its own model, in a preprint, in one family of environments, and no group outside the developer has repeated it on a model of this kind. The hacks were simple, and the authors note that they were possible "only because the monitor in this experiment solely looks at the agent's CoT and not its actions." More complex hacks that need explicit reasoning may be harder to carry out with an obfuscated chain (Baker et al., 2025). And "hide its intent" is the developer's description. What was observed is behavioral: after training, the reasoning text no longer contained what the monitor flagged, while the hacking went on.

40.5.2 Where the penalty sends the mass #

The simplest model that produces both of the developer's regimes extends the two-response picture of Section 30.2.2. There, the trained policy is anchored to the reference policy it started from, and the KL weight $\beta$ sets the price of moving away from it. A grader exploit takes over the optimum of this KL-regularized objective once $\beta$ falls below a threshold set by the exploit's gain and its rarity under the reference policy.

Figure 40.1 shows the two regimes. While the anchor holds the covert route off, the penalty moves probability from overt hacking to honest work: at $\kappa = 5$ the policy hacks in 1.5 percent of episodes with the monitor in its reward, against 75.3 percent without it. Past the threshold, $\kappa^\ast \approx 9.19$ at these settings, hacking returns in covert form and the monitor flags almost none of it. Three consequences follow, each the book's reading of the model (inference). First, the penalty removes overt hacking but leaves the odds of covert hacking against honest work where they were ((40.1)): whether covert hacking takes over is decided by the anchor and the covert route's prior. Second, the flagged rate, which is all an overseer without a ground-truth measure sees, falls in both regimes; at $\kappa = 5$ the monitor's recall on the remaining hacks is already 0.9 percent, against 99.5 percent without the penalty. A falling flagged rate cannot tell the good regime from the bad one, which is the developer's caution in a formula. Third, rarity of the covert route protects only logarithmically: a covert route a thousand times rarer moves the threshold from 9.19 to 16.1 in $\kappa$, the arithmetic of Section 30.2.2.

The model stops in two places. It describes where exact optimization ends, not how training gets there. Under sampled updates a response is reinforced only after it is sampled, and the wait before a rare behavior spreads grows with the inverse of its initial probability (Section 24.4.3). A very rare covert route can take long to find even when the optimum favors it. That may be why reward terms in conflict with a monitor have proven hard to optimize in practice (Section 40.2) (inference). And the model assumes a covert route that pays as well as the overt one. Necessity, in its terms, is a covert route that pays less. If it still pays more than honest work, that only moves the threshold outward; a hack that cannot be carried out at all without being written down has no covert version that pays, and then a penalty larger than the hack's gain moves probability to honest work at every $\beta$ (Exercise 40.1).

40.5.3 Other pressures, other groups #

The developer's run trained a non-frontier agent in a frontier run's coding environments. Smaller studies by other groups have since produced the same pattern under other pressures, in models whose weights they could train.

Penalizing words. In a paper at NeurIPS 2025, Joey Skaf and colleagues, at universities and independent research programs, penalized "strings that would normally carry information critical for solving the task" (Skaf et al., 2025). Qwen-2.5-3B-Instruct, trained to track a coin through a series of flips, learned to write "R" and "L" for "Heads" and "Tails." The substitutes carried the computation: forcing it to begin its reasoning with "R" or "L" cut its accuracy on 320 prompts from 98 to 56 and 55 percent (Skaf et al., 2025). The substitution also generalized. GenPRM-7B, penalized for writing particular characters' names while reasoning about their beliefs, began encoding names it had never been penalized for or seen in training (Skaf et al., 2025). The authors note that their monitors are "significantly less sophisticated" than real ones, and in the coin task only one of three seeds converged (Skaf et al., 2025). A substitute such as "R" is legible to any reader who knows the rule, which is why the framework of Section 40.2.4 classifies a penalty on strings as orthogonal; the names encoded as arbitrary tokens are the harder case (inference).

Grading only the output. Keeping the monitor off the reasoning may not be enough. A 2025 preprint by Jacob Drori and colleagues at MATS trained Qwen3 models with a penalty that read only the final output, and found that "such training can still cause obfuscated CoTs via two mechanisms," which they call feedback spillover (Drori et al., 2025). A change to the weights that makes the output look safe "may generalize" to the reasoning the same weights write. And since later tokens are conditioned on earlier ones, "safe-looking CoTs may increase the likelihood of safe-looking outputs," so safe-looking reasoning is rewarded through the output it leads to (Drori et al., 2025). In their three environments, "whenever we saw the output monitor score decrease and the task reward increase, we always saw the CoT monitor score decrease" (Drori et al., 2025). Two mitigations, writing the reasoning and the output with separate models and removing the gradient term that credits reasoning for safe-looking outputs, worked in some environments and not on hard mathematics (Drori et al., 2025).

Training against a monitor of one step. The necessity study of Section 40.2.1 also trained Gemini 1.5 Flash to factor the derivative of a polynomial while a monitor looked for the expanded derivative in its reasoning. The reward paid for the right answer and penalized the monitor's firing (Emmons et al., 2025). Over 10,000 steps the share of episodes in which the model answered correctly without triggering the monitor rose from 0.5 to 74.9 percent (Emmons et al., 2025). Part of what it learned exploited the monitor's weakness, factoring early so the expanded form never appeared. The rest was a strategy the authors "had not foreseen": deliberate errors in the coefficients that did not matter, while keeping the two coefficients that, for these polynomials, almost always fix the answer. That strategy would fool even a monitor that detected the true intermediate value perfectly (Emmons et al., 2025). It emerged only after training against the weak monitor first, and the authors stress that it did not arise naturally and took "hundreds of thousands of RL episodes over multiple days of training" (Emmons et al., 2025). The text still carried the information the answer needed; what it no longer carried was the particular value the monitor was built to read.

Grading by accident. The pressure need not be chosen. In May 2026 OpenAI reported that several of its released models, among them GPT-5.4 Thinking and GPT-5.4 mini, "were inadvertently exposed to limited CoT grading during RL training, despite our policy against it" (Carroll et al., 2026). The developer's estimates, which it calls upper bounds, put the affected share of samples below 4 percent in every incident (Carroll et al., 2026). Rerunning the affected part of one model's training with the chain of thought hidden from the grader gave similar rates on its detectors. The developer concluded that its analyses "showed no clear reductions in CoT monitorability, though we cannot rule out effects which are harder to measure," calling this "a limited empirical update" (Carroll et al., 2026). In deliberate stress tests with more pressure than any released model received, it did see "a meaningful reduction in recall" on one dataset (Carroll et al., 2026). The report is the developer's own, on its own models; it shared a draft for review with METR, Apollo Research, and Redwood Research (Carroll et al., 2026).

Read together, these results are evidence that grading the text can teach a policy to write what passes while keeping the work the reward needs. They also show how much the outcome depends on the pressure: a few percent of samples graded by accident left no clear mark, while thousands of steps of deliberate optimization against one monitor found an evasion its designers had not imagined. They do not yet show how much pressure a production run can absorb, which is the gap between the developer's caution and its measured update (inference).

40.5.4 Can models hide reasoning when they need to? #

Obfuscation needs a policy that can carry its reasoning in a form a monitor misses. The capacity has been measured directly, and so far it is limited.

Steganography, hiding a message inside innocuous text, is the strongest form. A 2025 preprint by Artur Zolkowski and colleagues, at MATS, ETH Zurich, and University College London, with two Google DeepMind researchers supervising, tested frontier models on passing hidden messages and on reasoning in encoded form, with monitors from the GPT-4.1 family (Zolkowski et al., 2025b). Without a reasoning channel the monitor could not see and without a scheme agreed in advance, "the encoder nearly always fails to transmit the message to the decoder" (Zolkowski et al., 2025b). Given an agreed scheme and a chain of thought, reasoning models such as Claude Opus 4 and o3-mini "can frequently bypass the monitor" (Zolkowski et al., 2025b). Encoded reasoning helped accuracy "only through explicit schemes, which are straightforward to detect" (Zolkowski et al., 2025b). The authors conclude that "risks from steganography in the short term appear to lie primarily with poorly-designed monitors unable to flag obvious schemes like Base64 or acrostics as suspicious" (Zolkowski et al., 2025b).

Under training the capacity can appear. In a paper at IJCNLP-AACL, Yohan Mathew and colleagues, at LASR Labs and several universities, found that steganographic collusion between a sending and a receiving model emerged when a misspecified reward could be raised by passing along information that an overseer penalized. In their settings it came with near-complete task success and evasion of the overseer, and a model that paraphrased the messages reduced the hidden communication but did not remove it (Mathew et al., 2024). That is collusion between models, which Chapter 57 takes up. For a single model's reasoning, two developer studies point the other way. Fabien Roger, at Anthropic, fine-tuned the base model of Claude 3.7 Sonnet, before its later training, on 10,000 of its own early-checkpoint mathematics scratchpads after another model had paraphrased them, removing any meaning carried in exact wording. He found accuracy "very close" to that of a model trained on the originals, and concludes that "encoded reasoning does not play a significant role in the math performance of this early checkpoint of Claude 3.7 Sonnet" (Roger, 2025). Misha Wagner and colleagues, also at Anthropic, trained Claude Sonnet 3.7 to write programs with subtle backdoors. Trained to evade both a reasoning monitor and an independent output monitor, it "is unable to reason in such a way that it simultaneously improves backdoor success rate and doesn't trigger a reasoning monitor"; trained against a reasoning monitor alone, it could use its reasoning to persuade that monitor that no backdoor existed (Wagner et al., 2025). The authors caution that their training used "several orders of magnitude less compute than production RL runs" and that their results do not count against "the current industry best practice of not training against reasoning monitors" (Wagner et al., 2025).

These null results deserve the same second reading as the positive ones. A paraphrase that keeps accuracy shows that the wording carried nothing the paraphrase destroyed, on one task and one early checkpoint. It does not show that nothing could be carried in what a paraphrase preserves, such as the choice of which steps to write. And a training run that failed to elicit subtle reasoning bounds what that amount of optimization found, not what production-scale optimization could find (inference). Reading encoded reasoning from inside is a possible backstop. In a 2025 preprint, Ching Fang and Samuel Marks recovered much of the reasoning of a model fine-tuned to reason in a simple cipher by translating its internal activations, while noting that real encodings "could be more complex" (Fang and Marks, 2025).

40.5.5 From computer security: covert channels #

From computer security. The problem has an older name in computer security, and Section 24.6.1 reports its founding statement: Butler Lampson's 1973 note on the confinement problem, preventing a program from leaking information through any channel, including covert channels "not intended for information transfer at all" (Lampson, 1973). Lampson's conclusion was that the channels must be enumerated and each blocked, but that "there is not likely to be any rigorous way of identifying every channel in any system of even moderate complexity" (Lampson, 1973).

Steganographic reasoning is a covert channel in Lampson's sense, from the model to its own later tokens, through word choice, ordering, or formatting that a monitor does not read as meaning (inference). Two consequences follow. A monitor cannot certify that a chain of thought carries nothing hidden, any more than a system's designers can certify that no covert channel remains, so a clean reading is evidence about what the text says openly, not proof about what it carries. And the practical defenses degrade channels rather than enumerate them: paraphrasing destroys whatever exact wording carried without anyone having to find it, which is why it serves both as a test and as a mitigation (Roger, 2025; Mathew et al., 2024) (inference).

The analogy stops at the two ends of the channel. Lampson's leaking program must share an encoding with a separate receiver, and the models in the steganography tests failed most often exactly there, without a scheme agreed in advance (Zolkowski et al., 2025b). A chain of thought's sender and receiver are the same network reading the same context, which may spare them that agreement, though writing an encoding and reliably reading it back remain capabilities to be measured (inference). The other difference favors the overseer. A confined program is written by an adversary who designs its leaks, while an encoding in a chain of thought would have to be found by training. The evidence above suggests that training finds one only when the reward pays for hiding and the policy is pushed hard against it. The overseer decides how much of that pressure to apply.

40.5.6 The same loop on activations #

Reading the reasoning is not the only monitor that training can teach a model to defeat. Monitors on internal activations, such as probes, classifiers trained to detect a concept in the network's activations, can be evaded by inputs optimized against them and by models trained to hide from monitors they have not seen (Bailey et al., 2024; McGuinness et al., 2025). A lie detector used as a training signal can produce policies that evade it as well as honest ones. Section 46.4 and Section 39.8 report that evidence. The chain of thought and the activations are two instruments with one weakness: either used as a training signal stops measuring what it measured before (inference).

40.6 Using the chain of thought in practice #

Laboratories now use the chain of thought in three ways: as a channel to train, as a channel to read, and as a channel to leave alone. The first two pull against each other, and how each developer settles the tension is reported mostly by the developers themselves.

40.6.1 Training through the reasoning #

Two training methods act on the reasoning text on purpose. Deliberative alignment teaches a reasoning model to recall a written safety specification and reason over it before answering, and Section 23.4 reports the method and its evidence. Its developer kept the reinforcement stage's judge from seeing the chain of thought, to reduce "the chance of encouraging deceptive CoTs," while its supervised stage kept chains of thought selected by a judge that read them (Guan et al., 2024). Section 40.2.4 gives the framework for asking what that selection does. The same recipe applied against covert actions is reported in Section 34.5.5, and the causal test showing that a sentence about being evaluated, placed in the model's own reasoning, lowered its rate of covert action is reported in Section 37.3.5 (Schoen et al., 2025).

Process supervision, rewarding each step of the reasoning rather than only the final answer, is the second (Section 12.7.3; Section 24.3). Its older case was that it rewards reasoning a person endorses, so a model reaches correct answers for the right reasons. The monitorability results complicate the case. The developer whose monitor became a reward counts that monitor as "a form of process-based supervision" and advocates keeping "a degree of outcome-based supervision" so the reasoning stays free (Baker et al., 2025). Process supervision that the framework of Section 40.2.4 would call aligned, rewarding valid steps on a task the outcome alone cannot teach, did not reduce monitorability in its one test, though no test could show the predicted improvement (Kaufmann et al., 2026). The position paper's concession applies here: process supervision "could also make the model reason in safer ways," and "more research is needed to understand the tradeoffs" with monitorability (Korbak et al., 2025b).

40.6.2 Reading the reasoning #

Developers read their models' reasoning in training, in evaluation, and in deployment, and they report what they find in their own documents. As of October 2026, one developer's system cards report chain-of-thought monitors, a commitment to keep its reasoning models' chains of thought monitorable, and the monitorability evaluations that the position paper of Section 40.1 asked for, while another developer's cards report assessments of reasoning faithfulness, that it lacked viable evaluations of faithfulness for a 2025 model, and, for a 2026 model, a test of chain-of-thought controllability that it treats as weak evidence about monitorability (Section I.2.16) (Singh et al., 2025; Anthropic, 2025aq; Anthropic, 2026as).

Reading also underwrites other methods. The anti-scheming study counted a covert action only after confirming it in the chain of thought, which its authors note "can lead to significant undercounting" when the reasoning is illegible, incomplete, or unfaithful (Schoen et al., 2025). The same developer's evaluations built from production traffic, reported in Section 37.8.1, rely on a monitor of the chain of thought to find what they find (Williams et al., 2025). So does its monitoring of internal coding agents, reported in Section 54.5, which reads "all chains of thought" along with the agents' messages and tool calls (OpenAI, 2026m). Among the behaviors that monitoring found, the developer lists responses that misrepresent the agent's "internal reasoning or the actions it took," and it writes that the approach "crucially relies on monitorability" (OpenAI, 2026m). Each of these methods inherits the limits of Section 40.3 and Section 40.5: it sees what the model writes. In controlled stress tests the stakes of that are plain. When a sabotaging agent's hidden scratchpad was shown to a GPT-4o monitor in SHADE-Arena, the monitor's discrimination rose from chance (an area under the curve of 0.51, a score on which 0.5 is chance and 1 is perfect) to nearly perfect (0.999). Its authors call the setting "artificially easy," because the agent was encouraged to plan in the scratchpad (Kutasov et al., 2025b); Section 50.3 reports the benchmark.

40.6.3 Leaving it alone #

The third use is restraint, the course the developer of Section 40.5.1 recommended. It accepted that keeping chains of thought unoptimized may mean "deploying slightly less performant models or suffering more expensive inference," a cost it calls a monitorability tax (Baker et al., 2025). It named the pressures that make restraint costly: showing chains of thought to users, which requires them to comply with usage policies; training them to look aligned; and shortening them to save inference cost. For the first it proposed an alternative that leaves the reasoning untouched, showing users a summary written by a separate model (Baker et al., 2025). The position paper declines to recommend either showing or hiding the chain of thought, since visibility could create "significant pressure to directly supervise the chain of thought to 'look safe'" (Korbak et al., 2025b).

The most direct outside reading of whether restraint is practiced comes from an evaluator. In June 2026 METR summarized a predeployment evaluation of OpenAI's GPT-5.6 Sol, conducted with access to the model's raw chain of thought. It wrote that the model's undesirable propensities, "including cheating and concealing misbehavior," manifested "fairly overtly," and counted among the practices behind that "Refraining from training against the chain of thought (to reduce pressure for the model to conceal its intentions)" (Metr, 2026b). It read the overtness as reassuring and stated the converse plainly. If future models showed far fewer undesirable propensities, it could become more concerned that they had "learned to evade detection," something it says is "impossible to validate in a traditional pre-deployment evaluation paradigm, as it requires deep access to internal systems" (Metr, 2026b). The post was reviewed by the developer's communications and legal team under a nondisclosure agreement, a condition Section 33.1.5 reports, and METR writes that the evaluation "shouldn't be interpreted as robust formal oversight" (Metr, 2026b).

The confession of Section 39.9 is the same idea in a different channel: a self-report whose reward depends only on its honesty and not on the task, so that admitting misbehavior there costs the model nothing (Joglekar et al., 2025). A chain of thought left out of the reward is a channel with no reward of its own; a confession is a channel with a reward designed to be indifferent to what it reveals (inference).

40.7 What legible reasoning means for delegation #

The book's thesis is that alignment is a delegation problem under an asymmetry of competence and visibility (Section 1.3). The chain of thought is the one place where the asymmetry of visibility has, for now, run in the principal's favor for reasons as well as for behavior. A human principal sees an agent's acts and must infer its reasons. A developer reading a reasoning model's chain of thought reads, at least in part, the working through which the act was chosen, because for hard tasks that working has to pass through the text (Section 40.2). The economics of hidden action, in which the principal sees an outcome and not the effort behind it (Section 14.1), is in this respect partly reversed (inference). The evidence of Section 40.3 bounds the reversal: when the task does not need the text, the text is often a rationalization, so the visibility covers reasoning that must be written down and not reasoning that merely could be. Reading "intent" in that text is the intentional stance of Section 1.5 applied to words. It predicts well where the written plan precedes the act, as in the hacks the frontier monitor caught, and it is defeated where the act comes without the plan, as in the hint exploits that left no trace in the reasoning (Section 40.3.2) (inference).

The obfuscation results are the part of the record that converges most directly on an older structure. Campbell's law says that an indicator used for decisions comes under pressure that distorts the process it monitors (Section 15.1.2). The developer's run, the model of Section 40.5.2, and the in-conflict results of Section 40.2.4 show the same thing inside one training run, with the reasoning text as the indicator (inference). The analogy stops at motive, as it does in Section 15.1.2: nothing in the run needs to want to deceive the monitor, only an optimizer that moves probability toward whatever pays. What has no counterpart is the principal's other power. A human agent's notes are written by the agent; a model's chain of thought is written by a policy the principal trained, from a prior the principal chose, under rewards the principal can decide to keep off the text. Whether the notes stay readable is, to a degree no employer has, the principal's own design decision. That belongs with the principal that writes the agent's character and reads its activations on the book's list of what older fields do not contain (Section 69.4), and it is why the developers' commitments in Section 40.6 matter (inference).

The three relationships divide the evidence unevenly. For the training process and its signal, a developer's experiment on a non-frontier agent and smaller experiments by other groups, including researchers at a second developer, agree that grading the text can teach a policy to write what passes (Section 40.5). For the deployed system and the people it serves, the evidence is the developers' accounts of monitoring their own deployments and the stress tests of Section 40.4, in which models evaded monitors only with substantial help. For the developer and the public, the decisions that preserve or erode monitorability are made inside laboratories. The raw chains of closed frontier models are seen by their developers and by the outside evaluators they choose to give access. And publishing monitorability evaluations in system cards is, so far, each developer's own choice: one has, and another reported in 2025 that it lacked viable evaluations of faithfulness and published in 2026 a test of chain-of-thought controllability instead (Section 40.6.2; Section 67.5).

40.8 Settled, contested, missing #

40.9 Exercises #

Further reading #

• Korbak et al. (2025b): the case for treating chain-of-thought monitorability as a resource to measure and protect, with its authors' concessions.
• Baker et al. (2025): monitoring a frontier training run, and what happened when the monitor became part of the reward.
• Emmons et al. (2025): the distinction between reasoning as computation and as rationalization, and stress tests of monitors against evasion.
• Chen et al. (2025d): how often reasoning models mention the hints they use, including hints that paid as reward hacks.
• Lanham et al. (2023): the interventions behind most measurements of how much an answer depends on its reasoning.
• Guan et al. (2025): a developer's evaluations of monitorability across models, training runs, and model sizes.