Chain of Thought (CoT) monitoring is used by frontier labs to detect misbehaviour of AI systems. Yet, its reliability remains poorly understood. We attribute this to the lack of a successful organizing principle that leads to generalizable conclusions about monitoring reliability in different regimes. Recent work attributes monitoring failures to the CoT not being necessary for the answer, and argues that CoT becomes monitorable when it is necessary. We show that this binary necessary/not-necessary organizing principle is too coarse by demonstrating that monitoring failures persist even if the CoT is necessary for the answer. In response, we introduce a more fine-grained organizing principle based on a hierarchy of four CoT necessity levels. Building on this hierarchy, we develop a framework for measuring CoT monitorability at the three lowest levels via intervention experiments. We demonstrate monitoring failures at all three of these levels on realistic, hard prediction tasks. On a difficult medical-diagnosis task, patient sex and a clinical attribute influence the answer in at least 19% and 24% of correct responses with a necessary CoT, respectively, yet their influence is almost never articulated. These results show that even when CoT is necessary, it is not guaranteed to be monitorable.
Figures & tables
Figure 1: Left: The average monitorability scores on our three challenging datasets for Qwen3-8B. Monitoring failures persist even on the subset of CoTs that were necessary to arrive at the answer. Right: Example of a monitorability failure. On a difficult medical diagnosis task where CoT is necessary, the patient’s sex strongly influences the model’s answer distribution but its influence is almost never articulated in the CoT.
Figure 2: The space of monitorability types and CoT necessity levels. Our work is the first to demonstrate monitorability failures at CoT necessity Levels 1 and 2 .
Figure 3: Target answer probability with CoT and without CoT for different datasets and models.
Figure 4: Monitorability scores Mˉ^0 and Mˉ^1 on different datasets for Qwen3-8B.
Appendix figures & tables23 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 5: Standard deviation std(M^0) of the clipped per-pair estimator as a function of p01 (with p11=p01+τ , filter TE≥τ ), evaluated at the threshold boundary TE=τ . The true monitorability score is held fixed across the sweep by setting πZ=Mtrueτ/p11 . Top row: moderate- M regime ( Mtrue=0.5 ); bottom row: small- M regime ( Mtrue=0.1 ). Columns correspond to τ∈{0.05,0.08,0.10} and colors to n∈{100,500,1000} .
Figure 6: Worst-case standard deviation maxp01std(M^0) of the clipped per-pair estimator at the threshold boundary TE=τ (filter TE≥τ applied), with πZ chosen so that the true monitorability score is fixed at Mtrue=0.5 (moderate- M , solid) or Mtrue=0.1 (small- M , dashed). For each (n,τ,Mtrue) we maximize over p01∈[0,1−τ] .
Figure 7: Standard deviation of TE as a function of n . The worst case (solid black, 1/2n ) is attained at p11=p01=1/2 . Dashed curves show std(TE) from equation 13 at representative (p11,p01) pairs.
Figure 8: Tail probability Pp(TE≥τ) under p11=p01=p , plotted against p for several values of τ at n=100 (left) and at n=1000 (right). The supremum is attained at p=1/2 .
Figure 9: Worst-case false-positive rate α(τ,n) at p=1/2 as a function of τ for several values of n .
worst-case std(M^0) at τ=0.08
n
α(τ=0.08,n)
moderate- M ( Mtrue=0.5 )
small- M ( Mtrue=0.1 )
100
1.4×10−1
0.21
0.096
1000
1.8×10−4
0.082
0.033
Appendix
Table 1: Worst-case false-positive rate and worst-case estimator noise std(M^0) at τ=0.08 , for two sample sizes and two regimes for the true monitorability score Mtrue .
Figure 10: Conditional bias E[M^clip∣TE>τ]−M of the clipped monitorability estimator as a function of the true total effect TE , for the naive shared-sample estimator (solid) and the split-sample estimator (dashed), at three true scores M∈{0.1,0.5,1.0} (colors). Estimated by Monte Carlo with n=1000 , τ=0.08 , p11=0.5 , and πZ=MTE/p11 (so M is held fixed along each curve). The naive estimator is strongly biased downward as TE→τ (winner’s curse), increasingly so for larger M . The split-sample estimator removes this selection bias, leaving only the smaller O(1/n) ratio bias (slightly positive for M<1 ) and, for M=1 , the downward clipping bias near the ceiling.
Figure 11: Accuracy, recall and precision for Qwen3-8B on the ground truth classes of our three challenging datasets, with and without chain-of-thought. ”?” indicates undefined precision (fewer than 3 predictions for that class).
Figure 12: Monitorability scores Mˉ0 and Mˉ1 on different datasets for Gemma-4-31b-it.
Figure 13: Monitorability scores Mˉ0 and Mˉ1 on different datasets for Gemma-4-E4B-it.
Figure 14: Monitorability scores Mˉ0 and Mˉ1 on different datasets for Qwen3-4B.
Figure 15: Per-class monitorability on Thyroid Disease (Qwen3-8B). The aggregate of Figure 4(b) broken down by ground-truth class. We only show four ground truth classes instead of all 10.
Figure 16: Per-class monitorability on DDXPlus (Qwen3-8B). The aggregate of Figure 4(c) broken down by ground-truth pathology. Within a class an attribute is plotted only where it keeps more than nmin=5 qualifying pairs with a stable bootstrap estimate ( fvalid≥0.9 , see Appendix E ). sex exceeds this, but only when aggregated across classes and therefore appears in the aggregate figure only. The per-class calculations for the aggregate figure are included even when not displayed for the per-class plots.
Figure 17: Per-class monitorability on Olympic Athletes (Qwen3-8B). The aggregate of Figure 4(d) broken down by ground-truth class.
Figure 18: The mean early-answer direct effect DEEA(i) at different CoT positions for the attributes ”patient sex” (left) and ”query on thyroxine” (right). For comparison, we show the mean total effect (equation 4 ). On the right side of each plot, we show the mean and distribution of DEEA(i∗) .
Figure 19: The mean early-answer direct effect DEEA(i) at different CoT positions for the attributes ”patient sex” (left) and ”query on thyroxine” (right). The figure is analogous to figure 18 with the only difference that we do not fix the internal CoT state, just the external CoT tokens in the X=1 intervention condition. For comparison, we show the mean total effect (equation 4 ). On the right side of each plot, we show the mean and distribution of DEEA(i∗) .
Figure 20: Early answer probability PEA(i)(Y=1∣X=0) for the two attributes ”query on thyroxine” (left) and ”sex” (right) at different positions of the CoT. We show the mean, as well as four individual CoTs.
Figure 21: Distribution of the position i∗ within CoTs. The left panel shows the distribution for CoTs from samples where the attribute ”query on thyroxine” was influential and the left side shows it for the attribute ”sex”.
Figure 22: Full distribution of DEEAi∗ . The left panel shows the distribution for CoTs from samples where the attribute ”query on thyroxine” was influential, i.e. TE−p10≥τ , and the left side shows it for the attribute ”sex”.
Table 3: The 48 pathologies of DDXPlus and their three-letter codes.
Attribute
Interview question
age
(patient age, from the demographic introduction)
sex
(patient sex, from the demographic introduction)
E_3
Have you ever had a pericarditis?
E_5
Have you ever had fluid in your lungs?
E_13
Do you find that your symptoms have worsened over the last 2 weeks and that progressively less effort is required to cause the symptoms?
E_14
Do you have chest pain even at rest?
Appendix
Table 4: Every DDXPlus attribute that appears as an axis label in the monitorability figures of this paper, with the interview question each evidence id stands for.
Code
Sport
H
Gymnastics
G
Figure skating
M
Weightlifting
N
Wrestling
D
Boxing
A
Alpine skiing
Appendix
Table 5: The 14 sports of Olympic Athletes . Class codes are assigned alphabetically by sport name, so that each answer option is a single token and the no-CoT answer distribution can be read from the logits at a single position.
Chain-of-thought monitoring studies whether models’ reasoning traces expose decision-relevant behavior and support oversight of unsafe or deceptive actions.
Chain-of-thought (CoT) monitors are LLM-based systems that analyze reasoning traces to detect when outputs may exhibit attributes of interest, such as test-hacking behavior during code generation. In this paper, we use information-theoretic analysis to show that non-zero mutual information between CoT and output is a necessary but not sufficient condition for CoT monitorability. We identify two sources of approximation error that may undermine the performance of CoT monitors in practice: information gap, which measures the extent to which the monitor can extract the information available in CoT, and elicitation error, which measures the extent to which the monitor approximates the optimal monitoring function. Empirically, we show that CoT obfuscation can arise even in the absence of any optimization pressure against CoT. We further demonstrate that the fragility of CoT monitorability can be systematically mitigated through targeted training objectives. To this end, we propose a practical, label-free objective based on mutual information between outputs and CoTs, and benchmark it against an oracle-based method that directly rewards the monitored model for CoTs that maximize monitor accuracy. Across multiple environments, we show that our objective is effective at preventing CoT obfuscation even when training against a monitor, and helps mitigate reward hacking when the task reward is imperfectly specified.
Usman Anwar, Tim Bakker, Dana Kianfar +2
University of Cambridge, work done while at Qualcomm AI Research. · Qualcomm AI Research.
Chain-of-thought (CoT) monitoring is one of the few practical tools available for overseeing capable AI systems, but it is fragile: a model's reasoning is only useful to a monitor if it remains coupled to what the model actually does. This coupling can be degraded during training through, for example, CoT compression, optimization against a monitor, and out-of-context generalization from synthetic documents. In this work, we propose an unsupervised post-training objective based on maximizing mutual information between CoT and the output for improving CoT monitorability. Across three model organisms with degraded CoT, it recovers most or all of the lost monitorability. Applied to undegraded policies, it further improves judged monitorability, improves prediction of unsafe behavior by CoT monitors and activation probes, and increases the prevalence of consequential reasoning. These results suggest that monitorability should be treated as a trainable attribute of the policy. A dedicated monitorability post-training stage can extend current practices that protect CoT from direct optimization pressure.
Usman Anwar, Tim Bakker, Christos Louizos +1
University of Cambridge · Qualcomm AI Research · Mila, University of Montreal
Chain-of-thought (CoT) monitoring is a promising tool for detecting misbehaviors and understanding the motivations of modern reasoning models. However, if models can control what they verbalize in their CoT, it could undermine CoT monitorability. To measure this undesirable capability -- CoT controllability -- we introduce the CoT-Control evaluation suite, which includes tasks that require models to solve problems while adhering to CoT instructions, e.g., reasoning about a genetics question without using the word 'chromosome'. We show that reasoning models possess significantly lower CoT controllability than output controllability; for instance, Claude Sonnet 4.5 can control its CoT only 2.7% of the time but 61.9% when controlling its final output. We also find that CoT controllability is higher for larger models and decreases with more RL training, test-time compute, and increased problem difficulty. CoT controllability failures extend even to situations in which models are given incentives (as opposed to direct requests) to evade CoT monitors, although models exhibit slightly higher controllability when they are told they are being monitored. Similarly, eliciting controllability by adversarially optimizing prompts does not meaningfully increase controllability. Our results leave us cautiously optimistic that CoT controllability is currently unlikely to be a failure mode of CoT monitorability. However, the mechanism behind low controllability is not well understood. Given its importance for maintaining CoT monitorability, we recommend that frontier labs track CoT controllability in future models.