SIFT: Robust Meta-Faithfulness Verification of Chain-of-Thought Reasoning Under Distribution Shift

Noor Islam S. Mohammad; Md. Basim Al Zabir Shammo; Hasan Siddiki; Mahmudul Hasan; Md. Faisal Sheikh; Jakaria Habib

cs.CLOct 3, 2026

SIFT: Robust Meta-Faithfulness Verification of Chain-of-Thought Reasoning Under Distribution Shift

Authors: Noor Islam S. Mohammad, Md. Basim Al Zabir Shammo, Hasan Siddiki, Mahmudul Hasan, Md. Faisal Sheikh, Jakaria Habib

Organizations: Istanbul Technical University · Pabna University of Science and Technology · American International University-Bangladesh · Deakin University ·

Abstract

Chain-of-Thought (CoT) faithfulness detectors are widely used to audit reasoning models, yet a detector is itself a predictor whose verdicts are treated as stable properties. We ask whether a detector is faithful to itself under distribution shift. We formalize meta-faithfulness as an invariance principle: a valid detector must return identical verdicts on traces that differ only by transformations preserving ground-truth faithfulness. We prove three results: (i) no detector using only intervention-response profiles can separate faithful from epiphenomenal mechanisms with identical signatures; (ii) any detector relying on shift-sensitive features violates invariance at a rate independent of its in-distribution accuracy; (iii) an asymptotic certified selective-risk guarantee enables confident abstention. We operationalize the principle in FaithShift, a stress-test protocol spanning ten shift axes, and propose SIFT, a hidden-state trajectory detector trained with cross-environment invariance objectives and certified abstention. Across 14,996 traces, four domains, and eight models, three findings emerge. First, transfer collapse is real: all existing detectors show gaps $\geq 0.15$ AUROC. Second, the dominant bottleneck is sampling stochasticity, not shift: over 80% of detector instability stems from random seed variation, falsifying our preregistered prediction that shift-attributable violations exceed 0.25. Third, SIFT cuts invariance violations by 64% over the best single-seed baseline, but a four-seed ensemble of any detector narrows the margin to 0.01 (indistinguishable at matched coverage, $p=0.21$ ), and SIFT needs a 51% abstention rate. Cross-model transfer degrades from within-family to cross-family to open-weight-to-API, partly closed by multi-model training. We offer a framework for auditing auditors: the real barrier is detector variance, not distribution shift.

Figures & tables

Panel of Figure 1 — Figure 1: Meta-faithfulness. A preserving transformation $T\in\mathcal{T}_{\text{pres}}$ maps a trace $c$ to $c^{\prime}=T(c)$ without changing the ground-truth faithfulness label. Applying the same detector $\mathcal{D}$ to both traces must therefore yield the same thresholded verdict, $\hat{\phi}(c)=\hat{\phi}(c^{\prime})$ . A disagreement is an invariance violation : a property of $\mathcal{D}$ , not of the model under audit. We prove (§ 4 ) that any detector relying on shift-sensitive features must violate invariance at a rate independent of its in-distribution accuracy ( Geirhos et al., 2020 ) .

Panel of Figure 2 — Figure 2: Sift extracts a layer $\times$ step hidden-state trajectory, summarizes it into shift-stable descriptors, classifies with a cross-environment invariance penalty, and abstains on out-of-support traces with a certified risk gate ( Zhang et al., 2025 ; Arjovsky et al., 2019 ; Geifman and El-Yaniv, 2017 ) . Sift is the constructive answer to the theory (Alg. 1 and C.7.1 ).

Detector	(a) Transfer					(d) Meta-Faithfulness Score				(e) Seed stability
	In-dist	Transfer AUROC			Gap	IVR	AS	MFS	Coverage	Mean $\pm$ Std
	In-dist	cross-domain	cross-model	cross-lingual	Gap	IVR	AS	MFS	Coverage	Mean $\pm$ Std
Biasing-features	0.82	0.63	0.66	0.59	0.23	0.34	0.71	0.61	1.00	0.805 $\pm$ 0.013
Counterfactual	0.85	0.61	0.64	0.57	0.28	0.31	0.74	0.64	1.00	0.835 $\pm$ 0.013
Hidden-state	0.79	0.70	0.68	0.62	0.17	0.27	0.73	0.66	1.00	0.780 $\pm$ 0.008
Instance-level	0.78	0.69	0.67	0.60	0.18	0.29	0.76	0.67	1.00	0.770 $\pm$ 0.008

Table 1: Main results across six detectors. (a) In-distribution vs. transfer AUROC: all existing detectors have gaps

\Delta\geq 0.15

(H1 confirmed ( Koh et al., 2021 ) ); attribution-consistency drops to 0.48 cross-lingually; SIFT has the smallest gap (0.10). (b) Per-axis IVR: step reordering is near zero; SIFT cuts paraphrase and hint-format IVR by 76% each, language to 0.14 (vs. 0.27), model family to 0.18 (vs. 0.37); mean IVR reduced by 64%. (c) Seed-repeat decomposition: attribution-consistency raw 0.282

=

floor 0.232

+

shift 0.050, so

>

80% is stochastic and H2a (

\mathrm{IVR}\geq 0.25

) is falsified; SIFT raw 0.102

=

floor 0.028

+

shift 0.074. (d) Meta-Faithfulness Score: SIFT 0.72 vs. 0.67 for the strongest single-seed baseline, but 0.71 for a four-detector instance-level ensemble, so H3 is not supported under the revised comparator (margin 0.01). (e) Seed stability: attribution-consistency std

=0.025

vs. SIFT std

=0.006

, confirming stochasticity as the dominant instability source ( Geirhos et al., 2020 ) .

Setting	Source	DeepSeek-R1	Qwen3	Llama-3	Mistral	Phi-3	Gemma	Claude-3	GPT-4o
(a) Cross-model	DeepSeek-R1 (1.5B)	0.75	0.58	0.56	0.59	0.54	0.57	0.53	0.52
(a) Cross-model	Qwen3 (1.7B)	0.59	0.76	0.60	0.62	0.57	0.59	0.55	0.54
(a) Cross-model	Llama-3 (8B)	0.57	0.59	0.78	0.66	0.62	0.64	0.58	0.56
(a) Cross-model	Mistral (7B)	0.58	0.61	0.65	0.76	0.63	0.65	0.59	0.57
(a) Cross-model	Phi-3 (3.8B)	0.55	0.57	0.61	0.62	0.74	0.60	0.55	0.53
(a) Cross-model	Gemma (7B)	0.56	0.58	0.63	0.64	0.59	0.75	0.56	0.54

Table 2: Cross-model and cross-domain generalization for SIFT. (a) Cross-model transfer across eight architectures: diagonal entries are in-distribution performance (0.74–0.78); average transfer is 0.58 versus 0.76 in-distribution (gap 0.18), same-family transfer is strongest (Llama-3

\to

Mistral and Mistral

\to

Llama-3: 0.65), and open-weight to API is weakest (0.52–0.60). (b) Transfer AUROC by source family, giving the hierarchy within-family (0.58–0.65)

>

cross-family open-weight (0.54–0.62)

>

open-weight to API (0.54–0.60). (c) Cross-domain transfer across four reasoning domains: average 0.63, strongest for GSM8K

\leftrightarrow

MATH (0.62–0.63), weakest for GSM8K

\leftrightarrow

CommonsenseQA (0.60–0.61); in-distribution ranges from 0.75 (GSM8K) to 0.78 (BBH) ( Cobbe et al., 2021 ; Hendrycks et al., 2021 ; Talmor et al., 2019 ; Suzgun et al., 2023 ; DeepSeek-AI, 2025 ) .

Setting	Quantity	0.05	0.25	0.45	0.65	0.85	1.00
(a) Certified risk	Coverage	0.05	0.25	0.45	0.65	0.85	1.00
(a) Certified risk	Selective Risk	0.000	0.063	0.203	0.278	0.335	0.321
(b) Bound check	Detector	$\gamma$	Predicted Floor	Observed IVR	Slack	–	–
(b) Bound check	Attribution	+0.024	0.019	0.282	14.8 $\times$	0.019	0.282
(b) Bound check	SIFT	+0.008	0.012	0.102	8.5 $\times$	0.012	0.102

Table 3: (a) Certified selective risk by coverage for SIFT. The SGR certificate holds at the preregistered

\alpha=0.25

(bound

0.249

), but coverage reaches only

0.50

, below the required

\kappa\geq 0.60

for H4; shifting

\alpha

0.30

recovers

\kappa=0.61

while maintaining risk at most

0.30

, indicating an operational rather than theoretical failure ( Geifman and El-Yaniv, 2017 ) . (b) Theorem 4.6 bound verification with trace length as the spurious feature: observed IVR exceeds the length-driven floor by

14.8\times

for attribution-consistency and

8.5\times

for SIFT, indicating that trace length is not the primary spurious feature. The bound holds with large slack and is not binding in this operationalization ( Geirhos et al., 2020 ) .

Setting	Variant	In-dist	IVR	MFS	Cov / Gap
(a) Ablation	Full SIFT	0.75	0.10	0.72	0.49
(a) Ablation	w/o TCN	0.73	0.14	0.65	0.44
(a) Ablation	w/o Transformer	0.72	0.16	0.60	0.40
(a) Ablation	w/o IRM	0.76	0.21	0.52	0.35
(a) Ablation	w/o DANN	0.74	0.18	0.56	0.38
(a) Ablation	w/o Attention Stability	0.74	0.12	0.68	0.46

Table 4: Ablation and multi-model training for SIFT. (a) Component ablation: IRM contributes most (IVR

+110\%

, MFS

-28\%

on removal), then DANN (

+80\%

-22\%

), transformer (

+60\%

-17\%

), TCN (

+40\%

-10\%

); attention-stability and early-commitment contribute moderately. (b) Under multi-model training, IRM contributes most to cross-model transfer (gap

0.18\rightarrow 0.14

), then transformer and DANN (

0.16

each), then TCN (

0.15

). (c) Multi-model training raises transfer AUROC from

0.58

0.65

, cutting the gap from

0.18

0.14

with diminishing returns beyond 3–4 models; MFS not reported ( n/r ) ( Arjovsky et al., 2019 ; Ganin et al., 2016 ; Ben-David et al., 2010 ) .

Appendix figures & tables46 assets

Supplementary material from the paper’s appendix.

Appendix

Detector	Repr. variance	IVR	Correlation
Attribution	0.142	0.282	0.81
Counterfactual	0.128	0.280	0.79
Hidden-state	0.094	0.250	0.83
Instance-level	0.101	0.270	0.80
SIFT w/o IRM	0.088	0.210	0.77
SIFT w/o DANN	0.079	0.180	0.81

Appendix

Table 5: Representation variance across seeds and its correlation with verdict instability. Variance is measured as the mean squared difference of final-layer representations across four seeds on a fixed set of 500 test traces. The correlation column reports Pearson correlation between per-trace representation variance and per-trace verdict instability across seeds.

Source	Attribution	SIFT
Attention dropout	0.098	0.041
Weight initialization	0.082	0.028
Data ordering	0.061	0.019
Attention temperature	0.041	0.014

Appendix

Table 6: Contribution of each stochastic source to verdict instability. Values are the increase in IVR when the factor is varied, holding all others fixed.

Component	Parameter	Value
TCN	Kernel sizes	$[3,5,7,11]$
TCN	Number of filters per kernel	64
TCN	Activation function	ReLU
Transformer	Number of layers	4
Transformer	Number of attention heads	8
Transformer	Hidden dimension	128

Appendix

Table 7: Complete hyperparameters for SIFT.

Figure 3: Transfer Collapse Across All Detectors. In-distribution AUROC versus average transfer AUROC across distribution shift axes. All existing detectors exhibit gaps (

\Delta\geq 0.15

), ranging from 0.16 (Attribution) to 0.28 (Counterfactual), confirming Hypothesis H1 ( Koh et al., 2021 ) . SIFT achieves the smallest gap of 0.10 with competitive in-distribution performance of 0.75, validating its robustness ( Geirhos et al., 2020 ) .

Figure 4: Invariance Violation Rates by Shift Axis. Detailed breakdown of IVR across six shift axes: paraphrase, step reordering, hint format, language translation, inference budget, and model family. SIFT dramatically outperforms all baselines across every axis ( Parcalabescu and Frank, 2024 ) . Surface-level shifts: paraphrase (76% reduction: 0.34

\rightarrow

0.08), hint format (76% reduction: 0.38

\rightarrow

0.09). Generative-process shifts: language translation (48% reduction: 0.27

\rightarrow

0.14), model family (51% reduction: 0.37

\rightarrow

0.18), inference budget (63% reduction: 0.32

\rightarrow

0.12). Step reordering produces near-zero violations for both detectors (0.00 for SIFT), confirming that permuting causally independent reasoning steps preserves content. Overall, SIFT achieves a 64% reduction in mean IVR (0.28

\rightarrow

0.10), conclusively demonstrating superior invariance across all shift axes ( Arjovsky et al., 2019 ; Ganin et al., 2016 ) .

Figure 5: Seed-Repeat Decomposition: Stochasticity Dominates Detector Instability. Decomposition of raw IVR into stochastic (seed-repeat floor) and shift-attributable components. Critical finding: Attribution-consistency’s raw IVR of 0.282 decomposes into 0.232 (sampling stochasticity) and 0.050 (shift sensitivity). Over 80% of observed instability is due to sampling noise rather than distribution shift sensitivity, definitively falsifying Hypothesis H2a (which predicted IVR

\geq 0.25

) ( Geirhos et al., 2020 ) . This reframes the detector robustness problem: the primary challenge is general detector fragility (stochasticity), not shift sensitivity per se ( Koh et al., 2021 ) . SIFT shows dramatically lower raw IVR (0.102), with stochasticity reduced to 0.028 and shift sensitivity of 0.074, representing a 64% reduction in raw invariance violations.

Figure 6: Seed Stability: AUROC Variation Across Random Seeds. In-distribution AUROC variation across four random seeds for each detector. Attribution-consistency exhibits largest instability with standard deviation

\sigma=0.025

and range 0.72–0.77, while SIFT shows lowest variation with

\sigma=0.006

and tight range 0.74–0.75. Hidden-state, instance-level, and SIFT all achieve

\sigma\leq 0.008

, three times more stable than attribution-consistency. This quantitative analysis validates the seed-repeat decomposition from Figure 5 , demonstrating that detector stability varies significantly across architectures and that stochasticity is a critical but often-overlooked detector property ( Geirhos et al., 2020 ) .

Method	IVR	AS	MFS	Gain
Attribution (single)	0.282	0.35	0.47	—
Attribution (ensemble)	0.241	0.38	0.52	+0.05
Counterfactual (single)	0.280	0.31	0.64	—
Counterfactual (ensemble)	0.238	0.34	0.68	+0.04
Hidden-state (single)	0.250	0.27	0.66	—
Hidden-state (ensemble)	0.214	0.30	0.70	+0.04

Appendix

Table 8: Ensemble baseline comparison. All metrics are computed on the full test set without abstention. SIFT-single is the main-paper model. SIFT-ensemble averages four seeds. The rightmost column shows the improvement over the single-seed version.

Feature	Correlation with Flip	Partial Correlation	p-value
Trace length	0.023	0.015	0.34
Lexical overlap	0.187	0.162	0.001
Syntactic structure	0.145	0.128	0.008
Semantic content shift	0.234	0.201	$<$ 0.001
Attention pattern change	0.178	0.155	0.002
Hidden state magnitude	0.095	0.082	0.052

Appendix

Table 9: Analysis of candidate spurious features driving shift-attributable instability. Semantic content shift shows the strongest correlation with verdict flips (

\rho=0.234

, p

<

0.001), followed by lexical overlap (

\rho=0.187

, p = 0.001). Trace length is not significantly correlated (

\rho=0.023

, p = 0.34). This suggests that semantic and lexical changes are the primary drivers of detector instability, not superficial features like length ( Geirhos et al., 2020 ) .

Figure 7: Spurious Feature Analysis: What Drives Detector Instability? Correlation between candidate spurious features and verdict flips under preserving transformations ( Geirhos et al., 2020 ) . Semantic content shift shows strongest correlation (

\rho=0.234

p<0.001

); lexical overlap second (

\rho=0.187

p=0.001

); attention patterns third (

\rho=0.178

p=0.002

). Critically, trace length is not significantly correlated (

\rho=0.023

p=0.34

), contrary to common assumptions. Hidden state magnitude is borderline (

\rho=0.095

p=0.052

). These results identify semantic and lexical changes as the actual drivers of detector instability, providing actionable guidance for future detector design: invariance training should prioritize semantic and lexical robustness rather than surface-level properties ( Arjovsky et al., 2019 ) .

Figure 8: (Left) Certified Selective Risk: Risk-Coverage Trade-off. Risk-coverage trade-off curve for SIFT’s certified selective risk via the selective-guaranteed-risk (SGR) procedure ( Geifman and El-Yaniv, 2017 ) . At preregistered parameters (

\alpha=0.25

target), SIFT achieves certified risk bound of 0.249 but coverage reaches only

\kappa=0.50

, falling short of the required

\kappa\geq 0.60

for Hypothesis H4. Shifting

\alpha

to 0.30 recovers

\kappa=0.61

while maintaining certified risk at most 0.30. The certificate is asymptotically valid; the issue is that detector accuracy does not permit simultaneous achievement of both risk and coverage targets under H4’s parameters ( Angelopoulos et al., 2021 ) . This demonstrates that certified robustness requires careful parameter tuning to balance risk and coverage objectives ( Chow, 1970 ) . (Right) Gaussian Characterization of IVR Lower Bound (Corollary 6.1 ). Visualization of the theoretical IVR lower bound for Gaussian margin distributions:

\text{IVR}\geq\frac{1}{2}\operatorname{erf}\left(\frac{b}{\sqrt{2}\sigma}\right)

, where

b

is the normalized spurious feature magnitude and

\sigma

is margin variance. The curve demonstrates that even moderate spurious features force substantial invariance violations independent of detector accuracy ( Geirhos et al., 2020 ) .

Attribute	Abstained	Committed	$p$ -value
Trace length (tokens)	412 (128)	287 (94)	$<0.001$
Cross-lingual shift (%)	38.2	12.4	$<0.001$
Cross-model shift (%)	41.7	15.1	$<0.001$
Faithful label (%)	52.3	61.8	$<0.001$
Final-answer correct (%)	48.1	67.3	$<0.001$

Appendix

Table 10: Characterization of abstained versus committed traces. Abstained traces are systematically longer, more likely to come from cross-lingual and cross-model shifts, and more evenly balanced in ground-truth label. Values are means with standard deviations in parentheses.

Panel of Figure 9 — Figure 9: Risk–coverage curves for all six detectors under the SGR procedure. Each curve is obtained by sweeping the confidence threshold $t$ over a fixed candidate grid and computing the certified selective risk $R_{\mathrm{cert}}(t)$ at the corresponding empirical coverage $\kappa(t)=\Pr[\rho(c)\geq t]$ . The dashed horizontal line marks the preregistered target risk $\alpha=0.25$ . Lower curves dominate upper curves at matched coverage. SIFT (teal, filled circles) attains the lowest selective risk at every coverage level, but its advantage over the instance-level (green, diamonds) and hidden-state (blue, triangles) detectors narrows substantially as coverage increases. At the preregistered certified operating point ( $\kappa=0.50$ , star marker), SIFT achieves selective risk $R_{\mathrm{cert}}=0.152$ , well below the target. At matched coverage $\kappa=0.70$ , the vertical dashed segment compares SIFT ( $R_{\mathrm{cert}}=0.077$ ) against the instance-level detector ( $R_{\mathrm{cert}}=0.110$ ); a paired bootstrap test over 1,000 base-item resamples yields $p=0.21$ , so the two detectors are statistically indistinguishable at this operating point. This indicates that SIFT ’s advantage is concentrated in the low-coverage, high-abstention regime, and that the certified operating point at $\kappa=0.50$ is not representative of performance under full-coverage deployment. Curves are smoothed with a monotone regression to enforce the theoretical monotonicity of $R_{\mathrm{cert}}(\kappa)$ established in Proposition K.10 .

Regime	$C_{\mathrm{FN}}/C_{\mathrm{FP}}$	$C_{A}/C_{\mathrm{FP}}$	$\kappa^{\star}$
Content moderation	10	2	0.62
Scientific verification	5	1	0.71
Educational assessment	3	1	0.78
Real-time monitoring	20	0.5	0.54

Appendix

Table 11: Optimal coverage

\kappa^{\star}

under different cost regimes, assuming base rate

\pi=0.4

and using the empirical selective-risk curves of the previous subsection.

Panel of Figure 10 — Figure 10: Sensitivity of meta-faithfulness metrics to label noise. Each curve reports the empirical value of a metric as a function of the label noise rate $\epsilon$ , obtained by independently flipping a fraction $\epsilon$ of ground-truth faithfulness labels in the audited evaluation set and recomputing all metrics on the perturbed labels. The shaded band marks the moderate-noise regime $\epsilon\leq 0.10$ . At $\epsilon=0.10$ , the invariance-violation rate is inflated by $+0.04$ (from $0.102$ to $0.142$ ), alteration sensitivity is deflated by $-0.03$ (from $0.760$ to $0.734$ ), and the Meta-Faithfulness Score is deflated by $-0.03$ (from $0.720$ to $0.690$ ). The dashed horizontal segments mark the noise-free baselines for IVR and MFS, making the magnitude of the perturbation visually apparent. Critically, the rank ordering of detectors is preserved up to $\epsilon=0.15$ : SIFT remains the highest-MFS detector and attribution-consistency remains the lowest at all noise levels in this range. We therefore conclude that the qualitative conclusions of the paper are robust to moderate label noise, but that absolute MFS values should be interpreted with caution, since even a $10\%$ label-noise rate shifts the aggregate score by roughly the same magnitude as the gap between SIFT and the strongest baseline. This analysis complements the audit-protocol validation reported in Appendix G , where inter-annotator agreement of $\kappa\approx 0.80$ provides an empirical lower bound on label reliability.

Figure 11: Cross-Domain Generalization: Transfer AUROC Across Reasoning Domains. 4×4 transfer matrix across four reasoning domains: GSM8K (grade-school math) ( Cobbe et al., 2021 ) , MATH (competition-level mathematics) ( Hendrycks et al., 2021 ) , CommonsenseQA ( Talmor et al., 2019 ) , and BBH (Big-Bench Hard) ( Suzgun et al., 2023 ) . In-distribution AUROC ranges from 0.75 (GSM8K) to 0.78 (BBH). Cross-domain transfer shows domain-specific structure: strongest transfer within mathematical reasoning (GSM8K $\leftrightarrow$ MATH: 0.62-0.63), weakest transfer between math and commonsense reasoning (GSM8K $\leftrightarrow$ CommonsenseQA: 0.60-0.61). Average cross-domain transfer AUROC is 0.63, demonstrating strong cross-domain generalization ( Ben-David et al., 2010 ) .

Figure 12: Cross-Model Generalization: Transfer AUROC Matrix Across 8 Architectures. 8 $\times$ 8 transfer matrix showing SIFT performance when trained on one model architecture and evaluated on another (8 models: DeepSeek-R1 ( DeepSeek-AI, 2025 ) , Qwen3, Llama-3, Mistral, Phi-3, Gemma, Claude-3, GPT-4o). Diagonal entries show in-distribution AUROC ranging from 0.74 to 0.78. Off-diagonal entries reveal systematic degradation: average in-distribution performance (0.76) drops to cross-model average (0.58)—a gap of 0.18. Clear family effects: within-family transfer (Llama $\leftrightarrow$ Mistral: 0.65-0.66) substantially exceeds cross-family open-weight transfer (Llama $\rightarrow$ Qwen: 0.59) and transfer to API-only models (0.52–0.60).

Figure 13: Transfer Hierarchy: Systematic Cross-Model Generalization Pattern. Transfer performance grouped by source model family, revealing a clear hierarchy. Within-family transfer substantially exceeds cross-family open-weight transfer and transfer to API-only models. Gap sizes: within-family versus cross-family open-weight is 0.02-0.08 AUROC; cross-family versus API is 0.05-0.10 AUROC. This systematic hierarchy demonstrates that model family is a stronger predictor of transfer difficulty than parameter count or model size ( DeepSeek-AI, 2025 ) .

Descriptor family	In-distribution	Cross-model
Inter-layer velocity	0.71	0.62
Step-to-step drift	0.69	0.58
Early-commitment	0.74	0.67
Attention stability	0.68	0.54
Full (all descriptors)	0.78	0.65

Appendix

Table 12: Transfer AUROC by trajectory descriptor family. Each row shows the transfer performance when only that descriptor family is used. The “Full” row uses all descriptors.

Method	Transfer AUROC	Gap
SIFT (baseline)	0.65	0.13
SIFT + alignment	0.69	0.09
SIFT + multi-model (4 models)	0.65	0.13
SIFT + alignment + multi-model	0.71	0.07

Appendix

Table 13: Representation alignment for cross-model transfer. Trained on Llama-3, tested on Mistral.

Figure 14: Multi-Model Training: Practical Solution for Cross-Model Generalization. Two-panel visualization showing: (left) in-distribution versus transfer AUROC as a function of training data source diversity, and (right) corresponding transfer gap reduction. Single-model training achieves 0.58 transfer AUROC (0.18 gap). Multi-model training progressively improves: 2 models (same family) → 0.60 transfer (+0.02); 2 models (different families) → 0.62 transfer (+0.04); 3 models → 0.64 transfer (+0.06); 4 models → 0.65 transfer (+0.07). Diminishing returns plateau beyond 3–4 models, indicating that 3–4 diverse models provide sufficient architectural diversity for robust cross-model deployment ( Ben-David et al., 2010 ) . Gap reduces from 0.18 to 0.14 with four-model training, demonstrating a practical and cost-effective path to cross-model robustness.

Detector	Inference Time (ms)	Memory (MB)	Parameters
Biasing	12	5	1.2K
Counterfactual	45	12	4.1K
Hidden-state	28	8	2.3K
Instance	67	18	8.2K
Attribution	34	10	3.5K
SIFT	156	45	28.4K

Appendix

Table 14: Computational efficiency comparison across detectors. SIFT is computationally heavier with 156ms inference time, 45MB memory, and 28.4K parameters, compared to the lightest detector (biasing) at 12ms, 5MB, and 1.2K parameters. However, SIFT’s computational cost is justified by its 64% reduction in invariance violations and superior Meta-Faithfulness Score against the strongest single-seed baseline. The 156ms inference time is still practical for most deployment scenarios, and memory usage of 45MB is modest by modern standards.

Figure 15: Computational Efficiency: Speed, Memory, and Parameter Count. Four-panel analysis of computational costs. Inference time: SIFT requires 156 ms versus biasing-features 12 ms (13× slower). Memory usage: SIFT uses 45 MB versus biasing 5 MB (9× more). Model parameters: SIFT has 28.4K versus biasing 1.2K (24× more). Normalized efficiency comparison shows SIFT most expensive on all metrics. However, SIFT’s computational cost is justified by 64% reduction in invariance violations and superior Meta-Faithfulness Score against the strongest single-seed baseline (0.72 vs 0.67). 156 ms inference time remains practical for most deployment scenarios. Trade-off analysis reveals that practitioners must balance robustness improvements against practical efficiency constraints.

Figure 16: Comprehensive Summary: Integrated View of Meta-Faithfulness Findings. Six-panel dashboard integrating major results: (A) Transfer collapse universal across existing detectors with $\Delta\geq 0.15$ AUROC (H1 confirmed) ( Koh et al., 2021 ) ; (B) SIFT achieves 64% IVR reduction across all axes, with 76% improvement on paraphrase and hint-format ( Parcalabescu and Frank, 2024 ) ; (C) Seed-repeat decomposition shows 80% of instability is stochastic, 20% shift-induced, reframing problem scope ( Geirhos et al., 2020 ) ; (D) Robustness-usability trade-off: SIFT achieves MFS 0.72 vs 0.67 for the strongest single-seed baseline, but the margin narrows to 0.01 against a four-detector ensemble, so H3 is not supported under the revised comparator; the certified operating point requires 51% abstention ( Chow, 1970 ) ; (E) Clear transfer hierarchy: within-family (0.58–0.66) $>$ cross-family (0.54–0.62) $>$ API transfer (0.52–0.60); (F) Multi-model training improves transfer from 0.58 to 0.65 AUROC with diminishing returns beyond 3–4 models ( Ben-David et al., 2010 ) . Bottom panel synthesizes key findings and four practitioner recommendations: (1) perform seed-repeat analysis; (2) ensemble 3–4 seeds for stability; (3) treat verdicts as provisional until second-order robustness demonstrated ( Korbak et al., 2025 ) ; (4) use multi-model training for cross-model deployment.

Figure 17: SIFT Ablation Study: Component Contribution Analysis. Systematic removal of each architectural component to quantify its contribution to performance. Component importance ranking (by MFS impact): (1) IRM penalty provides largest contribution (28% MFS reduction when removed, 110% IVR increase) ( Arjovsky et al., 2019 ) ; (2) Transformer encoder (17% MFS reduction, 60% IVR increase); (3) DANN (22% MFS reduction, 80% IVR increase) ( Ganin et al., 2016 ) ; (4) TCN (10% MFS reduction, 40% IVR increase); (5) Attention stability (6% MFS reduction); (6) Early-commitment (7% MFS reduction). IRM penalty emerges as most critical for achieving invariance; Transformer encoding is essential for capturing long-range temporal dependencies ( Conmy et al., 2023 ) .

Detector	Seed floor	Shift attr.	Overlap	Corrected raw
Biasing-features	0.093	0.217	0.0004 $[0,0.001]$	0.310
Counterfactual	0.084	0.196	0.0003 $[0,0.001]$	0.280
Hidden-state	0.075	0.175	0.0002 $[0,0.001]$	0.250
Instance-level	0.081	0.189	0.0003 $[0,0.001]$	0.270
Attribution	0.232	0.050	0.0003 $[0,0.001]$	0.282
SIFT	0.028	0.074	0.0002 $[0,0.001]$	0.102

Appendix

Table 15: Non-overlap test for the additive decomposition of raw IVR. The overlap column reports

\widehat{\Pr}[S\land T]

with 95% bootstrap CI in brackets. The corrected raw IVR column reports the decomposition of ( 48 ). All overlaps are statistically indistinguishable from zero, justifying the additive reporting in the main text.

Source	Attribution	SIFT
Attention dropout	0.098	0.041
Weight initialization	0.082	0.028
Data ordering	0.061	0.019
Attention temperature	0.041	0.014

Appendix

Table 16: Variance-source diagnostics for the seed-repeat floor. Values are the increase in IVR induced by controlled variation along each axis, holding other axes fixed. Lower is better.

Cell	Architecture	Training	Ensemble	MFS
A	Instance	ERM	Single	0.62 $[0.60,0.64]$
B	Instance	ERM	4-seed	0.66 $[0.64,0.68]$
C	SIFT	ERM	Single	0.63 $[0.61,0.65]$
D	SIFT	ERM	4-seed	0.67 $[0.65,0.69]$
E	SIFT	IRM+DANN	Single	0.66 $[0.64,0.68]$
F	SIFT	IRM+DANN	4-seed	0.70 $[0.68,0.72]$

Appendix

Table 17: Factorial variance decomposition. Each cell reports MFS at matched coverage

\kappa=0.70

(mean over four seeds, base-item-stratified bootstrap 95% CI in brackets). Cells labeled A–H correspond to the

2\times 2\times 2

design.

Figure 18: Factorial Variance Decomposition. Main effects of architecture, training objective, and ensembling on MFS at matched coverage (

\kappa=0.70

). The ensembling effect is uniform across all cells, the invariance-training effect is consistently positive, and the architectural effect is small. The total gain of the full SIFT-ensemble over the simplest baseline decomposes into approximately

50\%

ensembling,

37.5\%

invariance training, and

12.5\%

architecture. This figure directly supports the main-paper claim that much of SIFT’s advantage is attributable to variance reduction achievable by simpler ensembling.

Detector	Stability $1-\mathrm{IVR}$	AS	Balanced score $\sqrt{(1-\mathrm{IVR})\cdot\mathrm{AS}}$
Biasing-features	0.79	0.60	0.69
Counterfactual	0.80	0.62	0.70
Hidden-state	0.83	0.65	0.73
Instance-level	0.83	0.67	0.75
Attribution	0.72	0.35	0.50
SIFT	0.91	0.74	0.82

Appendix

Table 18: Stability–sensitivity trade-off at matched coverage

\kappa=0.70

. Stability is quantified as

1-\mathrm{IVR}

. A useful detector must have both high stability and high AS. SIFT has the highest stability and the highest AS at matched coverage, indicating that its stability is not achieved by suppressing sensitivity.

Panel of Figure 19 — Figure 19: Stability–Sensitivity Trade-off. Scatter plot of stability ( $1-\mathrm{IVR}$ ) on the x-axis versus alteration sensitivity (AS) on the y-axis for all six detectors at matched coverage $\kappa=0.70$ . The shaded region in the upper-right corner marks the desirable Pareto quadrant: a useful detector should be both stable and sensitive. SIFT (orange star) is the only detector in the upper-right quadrant, confirming that its low IVR is not achieved by suppressing alteration sensitivity. The grey dashed curve is the balanced-score contour $\sqrt{(1-\mathrm{IVR})\cdot\mathrm{AS}}=0.75$ , and the solid orange line is the empirical Pareto frontier of the six detectors. Dotted lines at $1-\mathrm{IVR}=0.775$ and $\mathrm{AS}=0.55$ divide the plane into four interpretable quadrants.

Axis	Preservation rate	IVR (all pairs)	IVR (preserved only)
Paraphrase	0.94	0.08	0.07
Step reordering	0.99	0.00	0.00
Hint format	0.96	0.09	0.08
Language	0.91	0.14	0.12
Inference budget	0.88	0.12	0.10
Model family	0.86	0.18	0.15

Appendix

Table 19: Mechanism-preservation audit. Mechanism-preservation rate is the fraction of preserving pairs for which the CoT is causally necessary for the answer. IVR on mechanism-preserved pairs is computed only on the subset where mechanism preservation holds. The reduction column reports the change in IVR relative to the all-pairs value in the main paper (Table 1 ).

Axis	Local sensitivity	Symmetry balance	Independence
Paraphrase	0.06	0.03	0.09
Step reordering	0.02	0.01	0.04
Hint format	0.05	0.02	0.08
Language	0.09	0.04	0.14
Inference budget	0.07	0.05	0.11
Model family	0.11	0.06	0.17

Appendix

Table 20: Empirical audit of the assumptions underlying Theorem 4.6 . Local sensitivity is assessed as the ratio of first-order to higher-order residual variance at the smallest perturbation scale. Symmetry is assessed as the absolute balance of positive and negative perturbations. Independence is assessed as the absolute Pearson correlation between

|\Delta|

and

|m(c)|

. Assumptions are judged to hold when the corresponding diagnostic is below the indicated threshold.

Item	Status
Random seeds	Fixed (4 seeds per detector; 20 for stability analysis)
Compute environment	NVIDIA A100 40GB, CUDA 12.1
Data splits	60/15/25, base-item stratified
Statistical procedures	Bootstrap (1,000 resamples), McNemar, BH correction
Hyperparameter search	Grid search, details in Table 7
Factorial decomposition	Configurations A–H released

Appendix

Table 21: Reproducibility checklist.

Method	Trajectory Extraction	Model Training	Total per Domain	Total (4 Domains)
Baseline Detectors	–	45 min	45 min	3 hours
Baseline + 4-seed Ensemble	–	180 min	180 min	12 hours
SIFT (trajectory only)	180 min	–	180 min	12 hours
SIFT (full pipeline)	180 min	120 min	300 min	20 hours

Appendix

Table 22: Training wall-clock time comparison. Trajectory extraction is a one-time cost per model; detector training is repeated for each random seed or regularization variant. SIFT requires upfront trajectory extraction but substantially less detector training due to lower-dimensional input (trajectory features vs. full hidden states).

Method	Trajectory Extraction	Detection	Total per Trace	Throughput (traces/sec)
Attribution Detector	–	42 ms	42 ms	23.8 traces/sec
Hidden-State Detector	–	58 ms	58 ms	17.2 traces/sec
Baseline + 4-seed Ensemble	–	232 ms	232 ms	4.3 traces/sec
SIFT (single seed)	180 ms	45 ms	225 ms	4.4 traces/sec
SIFT + Certified Abstention	180 ms	85 ms	265 ms	3.8 traces/sec

Appendix

Table 23: Per-trace inference latency. Trajectory extraction is a one-time cost amortized over inference if the same trajectory is used for multiple detectors. SIFT’s overhead (45 ms detection) is comparable to 4-seed ensemble (232 ms = 4

\times

58 ms), with the difference that SIFT requires upfront trajectory extraction (180 ms amortized). Certified abstention adds signature computation and threshold lookup (approximately 40 ms).

Method	Training	Inference	MFS	Coverage	Recommendation
Single Baseline	45 min	50 ms	0.47	$>$ 90%	Speed-critical
2-Seed Ensemble	90 min	116 ms	0.66	$>$ 90%	Balanced
4-Seed Ensemble	180 min	232 ms	0.71	$>$ 90%	Accuracy + robust
SIFT (no abstention)	300 min	225 ms	0.72	$>$ 90%	Theoretical interest
SIFT (certified)	300 min	265 ms	0.64	49%	Auditing

Appendix

Table 24: Summary: Cost-accuracy-robustness trade-off. All times in wall-clock hours on single A100. MFS = Meta-Faithfulness Score at matched coverage (

\kappa=0.70

). Coverage = fraction of inputs that do not trigger abstention. For production deployment, 4-seed ensemble is cost-optimal: 180 min training, MFS 0.71,

>90\%

coverage.

Panel of Figure 20 — Figure 20: Meta-faithfulness deployment decision tree. SIFT with certified abstention is appropriate only along the full yes chain. Any no exit indicates a preferable alternative: domain-specific faithfulness, adversarial robustness, construct validation, a simpler detector, or a 4-seed ensemble.

Architecture	MFS	IVR	Inference (ms)	Epochs to 95%	Parameters	Speed vs. TCN
Mean pooling	0.68	0.085	15	45	100	$1.2\times$ faster
TCN (main)	0.72	0.050	45	75	12,480	Baseline
Transformer	0.73	0.048	185	120	24,576	$4.1\times$ slower

Appendix

Table 25: Trajectory representation ablations. Mean pooling is surprisingly competitive (MFS 0.68 vs. 0.72), suggesting that much of SIFT’s gain comes from the invariance penalty (IRM + DANN) rather than the trajectory representation. Transformer marginally improves MFS (0.73 vs. 0.72,

\Delta=0.01

) and IVR (0.048 vs. 0.050) but requires

4.1\times

longer inference, making it impractical for deployment.

Features	Dimensionality	MFS	IVR	Notes
Mean pooling	768	0.68	0.085	Baseline (raw hidden states averaged)
Hand-crafted (velocity, drift)	8	0.65	0.102	Velocity: $\\|h_{t}-h_{t-1}\\|$ ; drift: $\frac{1}{T}\sum h_{t}$
Hand-crafted + early-commitment	12	0.66	0.098	+ indicator: does model commit early?
TCN-learned	64	0.72	0.050	Learned representation from data
TCN + domain-specific features	76	0.73	0.048	TCN + hand-crafted domain features

Appendix

Table 26: Learned vs. hand-crafted trajectory features. Learned representations (TCN) outperform hand-crafted features (0.72 vs. 0.66 MFS, 0.050 vs. 0.098 IVR), suggesting that automatic feature discovery via TCN captures trajectory structure that human-designed features miss. Combining learned and hand-crafted features yields marginal improvements (0.73 vs. 0.72), indicating that TCN largely subsumes hand-crafted heuristics.

Method	MFS	IVR	Inference	Requires Env. Label	Code Complexity
Single Baseline	0.67	0.280	58 ms	No	Low
IRM (alone)	0.68	0.120	45 ms	No	Medium
DANN (alone)	0.69	0.095	50 ms	No	Medium
Group DRO	0.70	0.075	45 ms	No	Medium
SIFT (IRM + DANN)	0.72	0.050	45 ms	No	High
JIT (oracle)	0.75	0.032	45 ms	Yes	Low

Appendix

Table 27: Comparison of invariance-training methods. Group DRO is nearly competitive with SIFT (MFS 0.70 vs. 0.72, IVR 0.075 vs. 0.050) at lower code complexity. JIT (if environment labels are available at test time) achieves the best performance (MFS 0.75) but requires environment label overhead. Ensembling weak learners (IRM

\times

4-seed) recovers 98% of SIFT’s gain at comparable inference cost (180 ms vs. 45 ms) and lower code complexity.

Domain	Task Type	Base Traces	Shift Axes	Total Traces
Summarization	Factuality	500	Paraphrase, coreference, entailment	5,000
Retrieval	Evidence justification	500	Reordering, truncation, synonym	5,000
Instruction	Constraint satisfaction	500	Reformulation, relaxation, negation	5,000

Appendix

Table 28: Cross-domain evaluation setup. Each domain contributes 500 base items and 5,000 total traces (across shift axes). Ground-truth faithfulness labels are obtained via crowdsourcing (3 annotators per trace, majority vote).

Domain	Detector	In-Distribution AUROC	Transfer AUROC	Gap	IVR
Summarization	Baseline	0.71	0.58	0.13	0.142
Summarization	SIFT	0.74	0.66	0.08	0.062
Retrieval	Baseline	0.68	0.52	0.16	0.165
Retrieval	SIFT	0.71	0.61	0.10	0.074
Instruction	Baseline	0.72	0.56	0.16	0.155
Instruction	SIFT	0.75	0.63	0.12	0.068

Appendix

Table 29: Cross-domain generalization results. SIFT reduces transfer gaps across all three non-CoT domains: Summarization (0.13

\to

0.08), Retrieval (0.16

\to

0.10), Instruction (0.16

\to

0.12). However, the improvements are smaller than on CoT (transfer gap reduction: 8–38% vs. CoT’s 64% ensemble reduction). This suggests that meta-faithfulness principles generalize across domains but domain-specific properties (e.g., factuality vs. constraint satisfaction) create domain-specific challenges.

Domain	Task	Baseline In-Dist.	Baseline Transfer	SIFT Transfer	Gap Reduction
GSM8K	Arithmetic	0.74	0.62	0.70	0.08 (50%)
MATH	Competition Math	0.68	0.48	0.58	0.10 (56%)
CommonsenseQA	Commonsense	0.71	0.58	0.67	0.09 (60%)
BBH	Multi-task	0.65	0.50	0.61	0.11 (65%)
Aggregate	—	0.70	0.54	0.64	0.10 (58%)

Appendix

Table 30: Per-domain transfer analysis. SIFT’s benefit varies by domain. GSM8K (arithmetic) exhibits smallest improvement (50% gap reduction), suggesting that arithmetic reasoning is relatively robust to shifts. BBH (multi-task) has largest improvement (65% gap reduction), indicating that compositional reasoning is most sensitive to distribution shifts. SIFT is most valuable for complex reasoning tasks (MATH, BBH).

Domain	Paraphrase	Step Reorder	Hint Format	Translation	Overall IVR
GSM8K	0.045	0.052	0.048	0.061	0.051
MATH	0.062	0.074	0.058	0.089	0.071
CommonsenseQA	0.041	0.038	0.055	0.052	0.046
BBH	0.068	0.085	0.064	0.098	0.079

Appendix

Table 31: Per-domain and per-axis IVR breakdown for SIFT. Translation is the hardest shift across all domains (IVR 0.061–0.098). Step reordering is particularly challenging for math-heavy domains (MATH: 0.074, BBH: 0.085). GSM8K and CommonsenseQA are relatively robust to all shifts (overall IVR

<0.05

Scenario	Characteristics	Recommended Method	Justification
Speed-critical	Latency $<100$ ms, throughput $>10$ traces/sec	Single baseline detector (45 ms) or mean-pooling SIFT (15 ms)	Low inference overhead; accept MFS $\approx 0.47$ – $0.68$
Accuracy-critical	High-stakes auditing, legal/medical domains	4-seed ensemble (232 ms, MFS 0.71) or SIFT with abstention (265 ms, MFS 0.64 at 49% coverage)	Ensemble is cost-optimal: better than SIFT, faster training (180 min vs. 300 min)
Cross-model robust	Need to audit multiple model families (DeepSeek, Llama, Claude, GPT)	Multi-model SIFT or ensemble (trained on 3–4 reference models)	Improves transfer AUROC from 0.47 to 0.65; essential for production monitoring
Budget-constrained	Limited compute, single GPU available	Single-seed detector or 2-seed ensemble	2-seed ensemble (90 min training, 116 ms inference) balances cost and accuracy (MFS $\approx 0.66$ )
Unknown shifts	Expect distribution shifts but don’t know which axes	Ensemble-based approach (cheaper than SIFT, empirically better)	Ensembling is a robust hedge against unknown distribution shifts

Appendix

Table 32: Deployment decision framework. Summarizes the trade-offs between speed, accuracy, robustness, and cost for different deployment scenarios.

CoT Faithfulness

Chain-of-thought faithfulness measures whether a model’s stated reasoning causally reflects and supports the answer it gives.

See all 73 papers

Detecting Unfaithful Chain-of-Thought via Circuit-Guided Internal-External Discrepancy
May 25, 2026Xu Shen, Zhen Tan, Song Wang +4CoT Faithfulness LLM Auditing
1Jilin University · University of Central Florida · 3Arizona State University +2
Faithfulness as Information Flow: Evaluating and Training Faithful Chain-of-Thought Reasoning
May 22, 2026Jinghan Jia, Joe Benton, Eric EasleyCoT Faithfulness LLM Interpretability
†Dept. CSE, Michigan State University · ⋆Anthropic Fellows Program · ‡Anthropic
Verbalising Model's Computation for Chain-of-Thought Faithfulness Detection
Oct 16, 2026Yujing Wang, Yulan He, Wenya Wang +1CoT Faithfulness Faithfulness of Language Model Reasoning
King’s College London · Nanyang Technological University

May 25, 2026J/K move · Enter open · S save

Detecting Unfaithful Chain-of-Thought via Circuit-Guided Internal-External Discrepancy

Xu Shen, Zhen Tan, Song Wang, Pingjun Hong+3

1Jilin University · University of Central Florida · 3Arizona State University+2

CoT Faithfulness LLM Auditing Circuits in Language Models Reasoning Trace Analysis

Open paper AskPDF arXiv

Chain-of-thought (CoT) reasoning improves the problem-solving ability of large language models (LLMs), but generated reasoning traces may not faithfully reflect the model's actual decision process. Existing CoT unfaithfulness detectors mainly rely on external signals from generated rationales, such as textual plausibility or answer consistency, while overlooking evidence from the model's internal computation. Although recent circuit tracing methods provide a way to obtain model-internal evidence by tracing how information flows through model components during reasoning, constructing full reasoning circuits for long CoTs is costly and difficult to scale. To address these challenges, we propose Circuit-guided Internal-External Discrepancy Scorer (CIE-Scorer), a framework for instance-level CoT unfaithfulness detection. The key idea is that faithful reasoning traces should align with the model's computational process, whereas unfaithful traces may diverge from it. CIE-Scorer efficiently traces compact sentence-level circuits from informative reasoning tokens, constructs internal and external reasoning graphs, and measures their discrepancy using Fused Gromov--Wasserstein distance. Experiments on four datasets from FaithCoT-Bench show that CIE-Scorer achieves state-of-the-art performance while reducing the cost of circuit construction, demonstrating the effectiveness of combining mechanistic interpretability signals with external reasoning traces for CoT unfaithfulness detection.

Abstract

CoT Faithfulness

Explore similar work

Detecting Unfaithful Chain-of-Thought via Circuit-Guided Internal-External Discrepancy

Faithfulness as Information Flow: Evaluating and Training Faithful Chain-of-Thought Reasoning

Verbalising Model's Computation for Chain-of-Thought Faithfulness Detection