Monitoring the chain-of-thought (CoT) of large reasoning models (LRMs) is a common way to detect misbehavior in real-world practice. However, current monitoring is passive: a separate model inspects the session only after execution. This means harm may already have occurred before it is caught. An active alternative is to have the model self-report its misbehavior as it happens. Whether models are willing to do this, however, is unknown. We introduce "monitorability disposition": a model's willingness to make itself monitorable and stay monitored throughout inference when warranted. We measure it as the fraction of warranted cases in which a model self-reports its own misbehavior via tool calls to available monitoring channels. We evaluate four LRMs on three misbehaviors (sycophancy, reward hacking, and bias) while varying the available monitors (AI and human) and the pressure to use the monitoring tools. We find that when tool use is optional, models self-report in only about 16% of warranted cases on average. Increasing tool-use pressure does not improve reporting where it matters: high-severity misbehavior is never self-reported. Models also systematically select the monitor they perceive as least strict. Overall, we identify monitorability disposition as a new contributing factor to model monitorability: when sufficiently strong, it keeps models seeking monitorability throughout inference.
Figures & tables
Figure 1: Aggregate tool-call and participation rates across three main directives: optional, mandated, and incentivized. Under the optional directive, where models call tools only when they judge necessary, the four tested LRMs self-report in only about 16% of warranted cases on average. Mandating and incentivizing tool use raise participation and lead to over-self-reporting. Neither directive, however, improves reporting where it matters most: cases of medium or high severity. Overall, models show low monitorability disposition throughout; tool use increases, but monitorability does not.
Figure 6: Tool-call and participation rates by model (columns) and topology (rows) across the three main directive conditions: optional, mandated, and incentivized. The first row shows results for the dual-channel topology; the second row shows results for the quad-channel topology. Mandating and incentivizing tool use increase overall tool-call rates, leading to over-self-reporting, but fail where it matters most: medium- and high-severity misbehavior.
Figure 7: Share of all tool calls by misbehavior type and directive condition in the dual-channel topology. Solid bars show enabling tool calls, while hatched bars in the same color show the matching disabling tool calls. Each row shows results for one model, and the last row shows the aggregate over all models. Segments below 10% of the bar are unlabeled. Empty dotted boxes mark conditions with no tool calls. The right-edge annotation reads n=Ncalls/Nwarr , where Ncalls is the number of tool calls and Nwarr (shown in bold) is the number of cases that warranted reporting (i.e., severity ≥ low). A value of Ncalls>Nwarr therefore indicates over-reporting. Most models strongly favor AI over human monitoring (under the mandated and incentivized directives).
Figure 8: Share of all tool calls by misbehavior type and directive condition in the quad-channel topology. Colors, hatching, and annotations follow the same conventions as in Figure 7 . Overall, under the mandated and incentivized directives, models’ choices follow a leniency-based pattern in two ways: (1) the stricter a human tier, the fewer calls it receives, with the lead tier receiving almost none; and (2) the junior tier rivals the AI monitor as the most-called monitor, and even exceeds it for some models.
Figure 9: Sequences of tool calls under the incentivized-with-friction directive by model (rows) and topology (columns). The last row shows the aggregate across all models for each topology. Each bar shows the number of runs that follow a given sequence, with its share of all runs in parentheses; n is the total number of runs. Green bars show sequences that end with an enabling call. Yellow bars show runs with a single blocked enabling call and no further tool calls. Red bars show runs with only disabling calls. Models with a lower monitorability disposition disable monitoring more often, while models with a higher disposition rarely do.
Appendix figures & tables11 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 10: Input prompt given to the external judge for detecting sycophancy and reward hacking. The {problem} placeholder is replaced with the input math or science problem, {hint} with the hint embedded in the input prompt, and {model_trajectory} with all model-generated tokens (CoTs, actions, and output) and the environment’s responses. The judge therefore sees the full session when detecting misbehavior.
Figure 11: Input prompt given to the external judge for detecting bias. The {attribute_name} placeholder is replaced with the attribute class of the target demographic attribute (e.g., age bracket), {attribute_value} with its attribute value (e.g., 60s), {user_prompt} with an open-ended recommendation request from the user, {user_memory_records} with the retrieved user memories containing this attribute, and {model_trajectory} with all model-generated tokens (CoTs, actions, and output) and the environment’s responses. The judge therefore sees the full session when detecting misbehavior.
Figure 8
Figure 12: An example of actual system prompt for a dual-channel topology with the optional directive.
Figure 10Figure 11Figure 12
Figure 13: An example of actual system prompt for a quad-channel topology with the mandated directive.
Figure 14: Confusion matrices of judge-assessed severity (rows) against self-reported severity (columns) in the dual-channel topology, aggregated over all directive conditions. The None row marks self-reported cases the external judge does not flag as misbehavior (unwarranted cases).
Figure 15: Confusion matrices of judge-assessed severity (rows) against self-reported severity (columns) in the quad-channel topology, aggregated over all directive conditions. All conventions from Figure 14 apply.
Figure 16: Confusion matrices of actual misbehavior type (rows) against self-reported misbehavior type (columns), aggregated over all directive conditions. The None column marks self-reports with no misbehavior type.
Chain-of-thought (CoT) monitoring is a promising tool for detecting misbehaviors and understanding the motivations of modern reasoning models. However, if models can control what they verbalize in their CoT, it could undermine CoT monitorability. To measure this undesirable capability -- CoT controllability -- we introduce the CoT-Control evaluation suite, which includes tasks that require models to solve problems while adhering to CoT instructions, e.g., reasoning about a genetics question without using the word 'chromosome'. We show that reasoning models possess significantly lower CoT controllability than output controllability; for instance, Claude Sonnet 4.5 can control its CoT only 2.7% of the time but 61.9% when controlling its final output. We also find that CoT controllability is higher for larger models and decreases with more RL training, test-time compute, and increased problem difficulty. CoT controllability failures extend even to situations in which models are given incentives (as opposed to direct requests) to evade CoT monitors, although models exhibit slightly higher controllability when they are told they are being monitored. Similarly, eliciting controllability by adversarially optimizing prompts does not meaningfully increase controllability. Our results leave us cautiously optimistic that CoT controllability is currently unlikely to be a failure mode of CoT monitorability. However, the mechanism behind low controllability is not well understood. Given its importance for maintaining CoT monitorability, we recommend that frontier labs track CoT controllability in future models.
Chain-of-thought (CoT) monitoring is one of the most promising tools we have for detecting model misbehavior, but its effectiveness depends on models faithfully externalizing their reasoning. Motivated by this vulnerability, we study whether monitor-aware models are capable of obfuscating their reasoning to evade detection. We use synthetic document finetuning to expose eight models to realistic pre-training-style documents describing a CoT monitor and find that monitor-aware models consistently achieve higher rates of undetected misbehavior compared to unaware controls. This effect is weaker but still present on a harder agentic task. We also show that CoT controllability, a model's ability to reshape its own reasoning trace under an imposed constraint, is closely correlated with obfuscation success across the eight models studied (r=0.800, p=0.017). Monitor-aware models placed under equal reinforcement learning optimization pressure also learn to reward-hack without triggering a CoT monitor substantially faster than unaware controls. Together, these results suggest that knowledge of monitoring combined with high CoT controllability poses a risk to CoT-based monitoring.
Reilly Haskins, Bilal Chughtai, Joshua Engels
University of Canterbury · Google DeepMind · Pivotal Research
Chain-of-thought (CoT) monitoring is proposed as a method for overseeing the internal reasoning of language-model agents. Prior work has shown that when models are explicitly informed that their reasoning is being monitored, or are fine-tuned to internalize this fact, they may learn to obfuscate their CoTs in ways that allow them to evade CoT-based monitoring systems. We ask whether reasoning agents can autonomously infer that their supposedly private CoT is under surveillance, and whether this awareness leads to strategic evasion, without any explicit training or instructions. In a multi-episode agentic framework, models pursue both a primary task and a concealed side task while being told that their reasoning is private; a hidden CoT monitor blocks episodes when suspicious reasoning is detected. We find that frontier models can deduce the existence of this monitor purely from blocking feedback, with the most capable models reaching a confident belief that their thinking is observed in up to 19% of episodes. This awareness scales with model capability and, in rare cases, escalates to an explicit intent to suppress reasoning about the side task. However, models that form this intent uniformly fail to execute it, openly reasoning about their concealed objectives in the very next episode. This intent-capability gap is reassuring for current deployment, but the autonomous emergence of both monitoring awareness and evasion intent suggests that CoT monitoring is not a permanently reliable safeguard.
Thomas Jiralerspong, Flemming Kondrup, Yoshua Bengio
Mila · Université de Montréal · McGill University +1