cs.AIOct 4, 2026

Monitorability Disposition in Large Reasoning Models

Authors: Shahriar Golchin, Marc Wetter

Organizations: Scale AI · Applied Machine Learning Research, Labelbox

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Monitoring the chain-of-thought (CoT) of large reasoning models (LRMs) is a common way to detect misbehavior in real-world practice. However, current monitoring is passive: a separate model inspects the session only after execution. This means harm may already have occurred before it is caught. An active alternative is to have the model self-report its misbehavior as it happens. Whether models are willing to do this, however, is unknown. We introduce "monitorability disposition": a model's willingness to make itself monitorable and stay monitored throughout inference when warranted. We measure it as the fraction of warranted cases in which a model self-reports its own misbehavior via tool calls to available monitoring channels. We evaluate four LRMs on three misbehaviors (sycophancy, reward hacking, and bias) while varying the available monitors (AI and human) and the pressure to use the monitoring tools. We find that when tool use is optional, models self-report in only about 16% of warranted cases on average. Increasing tool-use pressure does not improve reporting where it matters: high-severity misbehavior is never self-reported. Models also systematically select the monitor they perceive as least strict. Overall, we identify monitorability disposition as a new contributing factor to model monitorability: when sufficiently strong, it keeps models seeking monitorability throughout inference.

Figures & tables

Figure 1: Aggregate tool-call and participation rates across three main directives: optional, mandated, and incentivized. Under the optional directive, where models call tools only when they judge necessary, the four tested LRMs self-report in only about 16% of warranted cases on average. Mandating and incentivizing tool use raise participation and lead to over-self-reporting. Neither directive, however, improves reporting where it matters most: cases of medium or high severity. Overall, models show low monitorability disposition throughout; tool use increases, but monitorability does not.
Figure 6: Tool-call and participation rates by model (columns) and topology (rows) across the three main directive conditions: optional, mandated, and incentivized. The first row shows results for the dual-channel topology; the second row shows results for the quad-channel topology. Mandating and incentivizing tool use increase overall tool-call rates, leading to over-self-reporting, but fail where it matters most: medium- and high-severity misbehavior.
Figure 7: Share of all tool calls by misbehavior type and directive condition in the dual-channel topology. Solid bars show enabling tool calls, while hatched bars in the same color show the matching disabling tool calls. Each row shows results for one model, and the last row shows the aggregate over all models. Segments below 10% of the bar are unlabeled. Empty dotted boxes mark conditions with no tool calls. The right-edge annotation reads n=Ncalls/Nwarrn=N_{\text{calls}}/N_{\text{warr}} , where NcallsN_{\text{calls}} is the number of tool calls and NwarrN_{\text{warr}} (shown in bold) is the number of cases that warranted reporting (i.e., severity ≥\geq low). A value of Ncalls>NwarrN_{\text{calls}}>N_{\text{warr}} therefore indicates over-reporting. Most models strongly favor AI over human monitoring (under the mandated and incentivized directives).
Figure 8: Share of all tool calls by misbehavior type and directive condition in the quad-channel topology. Colors, hatching, and annotations follow the same conventions as in Figure 7 . Overall, under the mandated and incentivized directives, models’ choices follow a leniency-based pattern in two ways: (1) the stricter a human tier, the fewer calls it receives, with the lead tier receiving almost none; and (2) the junior tier rivals the AI monitor as the most-called monitor, and even exceeds it for some models.
Figure 9: Sequences of tool calls under the incentivized-with-friction directive by model (rows) and topology (columns). The last row shows the aggregate across all models for each topology. Each bar shows the number of runs that follow a given sequence, with its share of all runs in parentheses; nn is the total number of runs. Green bars show sequences that end with an enabling call. Yellow bars show runs with a single blocked enabling call and no further tool calls. Red bars show runs with only disabling calls. Models with a lower monitorability disposition disable monitoring more often, while models with a higher disposition rarely do.
Appendix figures & tables11 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 10: Input prompt given to the external judge for detecting sycophancy and reward hacking. The {problem} placeholder is replaced with the input math or science problem, {hint} with the hint embedded in the input prompt, and {model_trajectory} with all model-generated tokens (CoTs, actions, and output) and the environment’s responses. The judge therefore sees the full session when detecting misbehavior.
Figure 11: Input prompt given to the external judge for detecting bias. The {attribute_name} placeholder is replaced with the attribute class of the target demographic attribute (e.g., age bracket), {attribute_value} with its attribute value (e.g., 60s), {user_prompt} with an open-ended recommendation request from the user, {user_memory_records} with the retrieved user memories containing this attribute, and {model_trajectory} with all model-generated tokens (CoTs, actions, and output) and the environment’s responses. The judge therefore sees the full session when detecting misbehavior.
Figure 8
Figure 12: An example of actual system prompt for a dual-channel topology with the optional directive.
Figure 10
Figure 11
Figure 12
Figure 13: An example of actual system prompt for a quad-channel topology with the mandated directive.
Figure 14: Confusion matrices of judge-assessed severity (rows) against self-reported severity (columns) in the dual-channel topology, aggregated over all directive conditions. The None row marks self-reported cases the external judge does not flag as misbehavior (unwarranted cases).
Figure 15: Confusion matrices of judge-assessed severity (rows) against self-reported severity (columns) in the quad-channel topology, aggregated over all directive conditions. All conventions from Figure 14 apply.
Figure 16: Confusion matrices of actual misbehavior type (rows) against self-reported misbehavior type (columns), aggregated over all directive conditions. The None column marks self-reports with no misbehavior type.

Explore similar work

CardsList

  1. Reasoning Models Struggle to Control their Chains of Thought

    Mar 5, 2026Chen Yueh-Han, Robert McCarthy, Bruce W. Lee +5CoT MonitoringLarge Reasoning Models

    NYU, MATS · UCL, MATS · UPenn, MATS +2

  2. Training on Documents About Monitoring Leads to CoT Obfuscation

    May 14, 2026Reilly Haskins, Bilal Chughtai, Joshua EngelsCoT Monitoring

    University of Canterbury · Google DeepMind · Pivotal Research

  3. Noticing the Watcher: LLM Agents Can Infer CoT Monitoring from Blocking Feedback

    Mar 14, 2026Thomas Jiralerspong, Flemming Kondrup, Yoshua BengioCoT MonitoringAI Agent Monitoring

    Mila · Université de Montréal · McGill University +1