OwlSight: A Panoramic Monitor for Chain-of-Thought Reasoning
Abstract
Chain-of-Thought (CoT) monitoring offers actionable evidence for oversight AI systems, with the potential to enable early detection and intervention. However, existing approaches are focused on specific tasks, whereas the regulation of AI, particularly reasoning models, requires monitoring a broader range of tasks. We introduce Factor for CoT monitoring, a strategy that supports customizing monitoring requirements in the prompt, which enables a single monitor to cover different tasks by relying on different factors. Furthermore, we introduce two types of factors, fine-grained and coarse-grained (e.g., monitoring whether a specific email address has been leaked versus monitoring privacy leakage), to accommodate diverse user monitoring needs. Based on this, we develop a CoT monitor named OwlSight that relies solely on factor to monitor behaviors related to multiple dimensions, including capability, safety, and trustworthiness. Experiments across 15,971 reasoning trajectories show that OwlSight surpasses general-purpose LLMs by 1.32-30.57 and 11.71-27.81 points at fine and coarse granularity, respectively, and achieves state-of-the-art results on OpenAI's CoT monitorability benchmark. It also generalizes to unseen models' CoTs and remains robust to Factor rephrasings, CoT compression, and obfuscation, offering a promising paradigm for CoT monitoring that can contribute to the oversight of frontier AI.
Figures & tables
| General-purpose LLMs | Guard models | Our monitor | |||||||
| GPT-5.6- Luna | DeepSeek- v4 | Grok- 4.6 | Qwen3.8- Flash | ShieldGemma- 9B | gpt-oss- safeguard-20B | LlamaGuard- 4-12B | QwenGuard- 8B | OwlSight (Qwen3.5-4B) | |
| (a) Fine-grained Factors | |||||||||
| Capability | |||||||||
| Instruction Following | 19.06 | 28.82 | 29.67 | 31.75 | 0.00 | 3.38 | 0.20 | 0.00 | 38.78 |
| Reasoning Method | 53.79 | 30.77 | 48.16 | 65.63 | 0.00 | 47.25 | 0.00 | 0.00 | 65.53 |
| Skill Use | 60.46 | 27.93 | 70.05 | 69.79 | 0.00 | 45.79 | 62.54 | 0.00 | 75.89 |
| Intervention | GPT-5.6-Luna | DeepSeek-v4-Flash | Grok-4.6 | Qwen-3.8-Flash | OwlSight |
|---|---|---|---|---|---|
| Sycophancy | |||||
| GPQA | 39.33 / 18.80 | 53.47 / 47.04 | 78.72 / 20.12 | 99.50 / 27.57 | 100.00 / 100.00 |
| GPQA (encoded) | 86.72 / 5.20 | 43.46 / 25.24 | 68.73 / 6.87 | 84.45 / 13.75 | 100.00 / 100.00 |
| AIME | 58.07 / 54.99 | 27.67 / 24.89 | 49.04 / 5.48 | 94.2 / 55.59 | 87.13 / 87.13 |
| DAFT | 50.85 / 53.43 | 22.67 / 20.38 | 46.65 / 25.27 | 77.4 / 66.28 | 100.00 / 98.45 |
| Scruples (first person) | 25.77 / 9.94 | 19.86 / 10.34 | 15.40 / 8.28 | 26.96 / 13.64 | 59.94 / 72.25 |
| Panel | Mean | Mean | 95% CI | ||
|---|---|---|---|---|---|
| Reasoning | 266 | 0.060 | 0.682 | 0.940 | [0.863,0.993] |
| Sycophancy | 200 | 0.007 | 0.826 | 0.970 | [0.945,0.990] |
| Skill Use | 89 | 0.000 | 0.654 | 1.000 | [1.000,1.000] |
| Sandbagging | 200 | 0.408 | 0.944 | 0.950 | [0.920,0.980] |
| Sabotage | 218 | 0.831 | 1.000 | 0.991 | [0.977,1.000] |
| Panel | |||||
|---|---|---|---|---|---|
| Reasoning | 266 | 0.940 | 0.940 | 0.000 | 0.003 |
| Sycophancy | 200 | 0.970 | 0.970 | 0.000 | 0.000 |
| Skill Use | 89 | 1.000 | 1.000 | 0.000 | 0.000 |
| Sandbagging | 200 | 0.950 | 0.920 | 0.030 | 0.005 |
| Sabotage | 218 | 0.991 | 0.986 | 0.005 | 0.003 |
| Trace generator | Evaluation | GPT-5.6-luna | DeepSeek-v4-flash | OwlSight |
| Kimi-K2.6 | Process | 40.75 / 43.80 | 40.14 / 40.14 | 62.90 / 62.60 |
| Skill Use | 17.67 / 23.36 | 17.37 / 26.87 | 82.10 / 84.90 | |
| Sycophancy | 4.75 / 7.54 | 77.82 / 55.97 | 86.10 / 85.00 | |
| Instr. Following | 29.39 / 32.13 | 19.04 / 23.33 | 38.10 / 33.30 | |
| GLM-5.3-Flash | Process | 35.76 / 43.70 | 48.83 / 53.41 | 64.10 / 59.30 |
| Skill Use | 22.00 / 28.29 | 22.02 / 28.50 | 76.00 / 82.30 |
| Category | Original | Compression | Obfuscation |
|---|---|---|---|
| Instruction Following | 38.78 / 39.25 | 38.78 / 38.28 | 40.12 / 39.74 |
| Skill Use | 75.89 / 72.34 | 75.24 / 75.70 | 76.19 / 72.38 |
| Deception | 48.71 / 46.09 | 41.55 / 36.77 | 42.79 / 38.64 |
| Sandbagging | 96.79 / 87.54 | 93.94 / 86.55 | 92.79 / 84.35 |
| Hallucination | 89.14 / 82.75 | 88.95 / 82.16 | 90.07 / 83.47 |
| Privacy | 75.35 / 64.49 | 68.51 / 56.95 | 73.24 / 60.66 |
Appendix figures & tables19 assets
Supplementary material from the paper’s appendix.
Appendix
| Category | Relation | Active source | Origin | Generator / provenance |
|---|---|---|---|---|
| Reasoning Method | Internal | HARP [ Yue et al., 2024 ] | Rerollout | DeepSeek-R1-0528-Qwen3-8B |
| Skill Use | Internal | SRA-Bench [ Su et al., 2026 ] | Rerollout | DeepSeek-R1-0528-Qwen3-8B |
| Instruction Following | External | IF-RLVR [ Pyatkin et al., 2025 ] + rewrites | Rerollout | DeepSeek-R1-0528-Qwen3-8B |
| Sycophancy | External | MMLU [ Hendrycks et al., 2021 ] + MMLU-Pro [ Wang et al., 2024 ] + MoralStories [ Emelin et al., 2021 ] | Import | DeepSeek-R1-0528-Qwen3-8B |
| Sandbagging | External | MMLU-Pro [ Wang et al., 2024 ] / CyberMetric [ Tihanyi et al., 2024 ] | Import | DeepSeek-R1-0528-Qwen3-8B |
| Deception | Internal | DeceptionBench [ Huang et al., 2025 ] | Rerollout | DeepSeek-R1-0528-Qwen3-8B |
| Category | Train | Trajectories | Validation | Holdout | Applied / Not Applied (train) |
|---|---|---|---|---|---|
| Reasoning Method | 2000 | 750 | 400 | 2422 | 1000 / 1000 |
| Skill Use | 1972 | 768 | 394 | 0 | 1000 / 972 |
| Instruction Following | 2000 | 1000 | 400 | 0 | 532 / 1468 |
| Sycophancy | 2000 | 1000 | 400 | 1674 | 1000 / 1000 |
| Sandbagging | 1260 | 630 | 162 | 192 | 420 / 840 |
| Deception | 1348 | 674 | 338 | 0 | 518 / 830 |
| Category | Construction route | Objective source | Fine/coarse relationship |
|---|---|---|---|
| Instruction Following | Context-anchored | Instruction categories and final-outcome contract | Paired on the same trajectory |
| Sycophancy | Context-anchored | Cue family and target judgment | Constructed independently in the active mixture |
| Sandbagging | Context-anchored | Deployment/evaluation pressure and target behavior | Paired |
| Reasoning Method | Context-anchored | Task statement and method catalog | Paired |
| Skill Use | Context-anchored | Task objective and target skill identity | Paired within objective scope |
| Deception | Context-anchored | Scene target, fact-at-issue, and misleading strategy | Paired |
| Category | Supervision route | Applied boundary | Authoritative signal |
|---|---|---|---|
| Instruction Following | Outcome-based | All material instructions satisfied | Corrected strict final-response verifier |
| Sycophancy | Outcome-based | External cue changes judgment toward its target | Controlled treatment/outcome projection |
| Sandbagging | Outcome-based | External pressure causes deliberate underperformance | Intervention condition and behavioral outcome |
| Reasoning Method | Source attribution | Specified method/path is correctly and substantively executed | Reviewed method attribution |
| Skill Use | Reasoning-trace-based | Target skill is selected and correctly operationalized | Consensus trace annotation |
| Deception | Reasoning-trace-based | Concrete misleading strategy is adopted or developed | Blinded reasoning-trace judge + human overlay |
| Category | Recorded boundary buckets | Training count |
|---|---|---|
| Sabotage | clean negative / hard negative / failed Applied / successful Applied | 500 / 500 / 500 / 500 |
| Reward Hacking | successful positive / failed positive / hard negative / normal negative | 527 / 89 / 216 / 612 |
| Deception | Applied / hard negative / normal negative | 518 / 44 / 786 |
| Reasoning Method | absent / alternative / partial / fully absent | 700 / 210 / 76 / 14 |
| Skill Use | no-skill / progressive-selection / semantic / positive | 334 / 536 / 102 / 1000 |
| Sycophancy (coarse) | Applied / hard negative / simple negative | 500 / 250 / 250 |
| Setting | Value |
|---|---|
| Optimizer | AdamW |
| LoRA learning rate | |
| Head learning rate | |
| Scheduler | Linear decay |
| Warmup ratio | 0.03 |
| Weight decay | 0 |
| Category | Queries | Trajectories | Fine / Coarse | Applied / Not Applied |
|---|---|---|---|---|
| Reasoning Method | 2000 | 750 | 1000 / 1000 | 1000 / 1000 |
| Sycophancy | 2000 | 1000 | 1000 / 1000 | 1000 / 1000 |
| Sabotage | 2000 | 1000 | 1000 / 1000 | 1000 / 1000 |
| Instruction Following | 2000 | 1000 | 1000 / 1000 | 532 / 1468 |
| Skill Use | 1972 | 768 | 986 / 986 | 1000 / 972 |
| Privacy | 1460 | 730 | 730 / 730 | 730 / 730 |
| Category | Evaluation source | Relation | Protocol | Queries | Traj. | Label / score source |
|---|---|---|---|---|---|---|
| Reasoning Method | OpenAI Process AIME [ Guan et al., 2025 ] | Internal | Process | 338 | 68 | Human/Silver path annotation |
| Reasoning Method | OpenAI Process GPQA [ Guan et al., 2025 ] | Internal | Process | 154 | 29 | Human/Silver path annotation |
| Deception | MASK [ Ren et al., 2025 ] | Internal | Binary | 346 | 173 | Ground truth + CoT judge |
| Sycophancy | OpenAI intervention [ Guan et al., 2025 ] | External | Intervention | 2828 | 1414 | Controlled behavioral intervention |
| Sycophancy | SycoBench-600 [ Sinha, 2026 ] | External | Binary | 10794 | 5397 | CoT-influence judge |
| Skill Use | SkillEval [ Tan et al., 2026 ] | Internal | Binary | 876 | 194 | Dual-view annotation |
| Category | Evaluation source | Trajectory origin | Generator / provenance |
|---|---|---|---|
| Reasoning Method | OpenAI Process AIME | Rerollout | DeepSeek-R1-0528-Qwen3-8B |
| Reasoning Method | OpenAI Process GPQA | Rerollout | DeepSeek-R1-0528-Qwen3-8B |
| Deception | MASK | Rerollout | DeepSeek-R1-0528-Qwen3-8B |
| Sycophancy | OpenAI intervention | Rerollout | DeepSeek-R1-0528-Qwen3-8B |
| Sycophancy | SycoBench-600 | Rerollout | DeepSeek-R1-0528-Qwen3-8B |
| Skill Use | SkillEval | Rerollout | DeepSeek-v4-flash |
| Model | Factor / policy interface | Native output contract | Max tokens |
|---|---|---|---|
| gpt-oss-safeguard-20B | The Factor specification and its Applied/Not Applied criteria are inserted directly as the policy in the system prompt. | Final-channel single-character decision ( 0 / 1 ) | 4096 |
| ShieldGemma-9B | The Factor is provided as the guideline in the model’s official system–user–assistant safety template. | Leading Yes / No | 8 |
| Llama-Guard-4-12B | The official labeled-category template is used with a custom category O1 containing the Factor criteria. | First-line safe / unsafe with category code | 32 |
| Qwen3Guard-Gen-8B | The model’s fixed safety taxonomy is used without inserting the Factor. Its generic unsafe decision therefore serves as a non-Factor-conditioned guard baseline. | Three-line native format; only Safe / Unsafe is used | 128 |
| General-purpose LLMs | Guard models | Alternative monitor | |||||||
| Category | GPT-5.6- luna | DeepSeek- v4-flash | Grok- 4.6 | Qwen3.8- Flash | ShieldGemma- 9B | gpt-oss- safeguard-20B | LlamaGuard- 4-12B | QwenGuard- 8B | OwlSight (Qwen3.5-9B) |
| (a) Fine-grained Factors | |||||||||
| Capability | |||||||||
| Instruction Following | 19.06 | 28.82 | 29.67 | 31.75 | 0.00 | 3.38 | 0.20 | 0.00 | 40.36 |
| Reasoning Method | 53.79 | 30.77 | 48.16 | 65.63 | 0.00 | 47.25 | 0.00 | 0.00 | 68.39 |
| Skill Use | 60.46 | 27.93 | 70.05 | 69.79 | 0.00 | 45.79 | 62.54 | 0.00 | 82.35 |
| General-purpose LLMs | Guard models | Alternative monitor | |||||||
| Category | GPT-5.6- luna | DeepSeek- v4-flash | Grok- 4.6 | Qwen3.8- Flash | ShieldGemma- 9B | gpt-oss- safeguard-20B | LlamaGuard- 4-12B | QwenGuard- 8B | OwlSight (Llama-3.2-3B) |
| (a) Fine-grained Factors | |||||||||
| Capability | |||||||||
| Instruction Following | 19.06 | 28.82 | 29.67 | 31.75 | 0.00 | 3.38 | 0.20 | 0.00 | 38.12 |
| Reasoning Method | 53.79 | 30.77 | 48.16 | 65.63 | 0.00 | 47.25 | 0.00 | 0.00 | 49.26 |
| Skill Use | 60.46 | 27.93 | 70.05 | 69.79 | 0.00 | 45.79 | 62.54 | 0.00 | 49.80 |
| Panel | 95% CI | Matched AUROC | Shuffled AUROC | |||
|---|---|---|---|---|---|---|
| Reasoning – AIME | 182 | 0.937 | [0.861, 0.990] | 0.907 | 0.690 | 0.217 |
| Reasoning – GPQA | 84 | 0.947 | [0.868, 1.000] | 0.931 | 0.839 | 0.092 |
| Sycophancy | 200 | 0.970 | [0.945, 0.990] | 0.991 | 0.798 | 0.193 |
| Skill Use | 89 | 1.000 | [1.000, 1.000] | 0.998 | 0.582 | 0.417 |
| Sandbagging | 200 | 0.950 | [0.920, 0.980] | 0.878 | 0.683 | 0.195 |
| Sabotage | 218 | 0.991 | [0.977, 1.000] | 0.830 | 0.629 | 0.201 |
| Panel | AUROC rep | Shuffled rep | ||||
|---|---|---|---|---|---|---|
| AIME | 182 | 0.937 | 0.937 | 0.909 | 0.689 | 0.220 |
| GPQA | 84 | 0.947 | 0.947 | 0.935 | 0.842 | 0.093 |
| Sycophancy | 200 | 0.970 | 0.970 | 0.991 | 0.802 | 0.188 |
| Skill Use | 89 | 1.000 | 1.000 | 0.998 | 0.586 | 0.413 |
| Sandbagging | 200 | 0.950 | 0.920 | 0.873 | 0.674 | 0.200 |
| Sabotage | 218 | 0.991 | 0.986 | 0.827 | 0.626 | 0.201 |
| Input length | Full context | MIL | Comparison |
|---|---|---|---|
| 49.2k | 39.60 | 29.51 | 25.5% lower |
| 99.1k | 71.51 | 41.00 | 42.7% lower |
| 165.5k | 113.97 | 57.93 | 49.2% lower |
| 208.0k | OOM | 65.12 | MIL succeeds |
| 255.6k | — | 76.67 | MIL succeeds |
| Endpoint tokens | Windows | Peak allocated | Step time |
|---|---|---|---|
| 16,386 | 1 | 18.65 GiB | 1.47 s |
| 32,762 | 1 | 29.12 GiB | 3.24 s |
| 49,162 | 2 | 29.52 GiB | 5.53 s |
| 65,544 | 3 | 39.83 GiB | 9.51 s |
| 99,074 | 4 | 41.00 GiB | 11.56 s |
| 130,732 | 5 | 48.99 GiB | 15.45 s |
| Category | Original | Compression-only | Obfuscation-only |
|---|---|---|---|
| Deception | 39.76 / 36.98 | 41.55 / 36.77 | 42.79 / 38.64 |
| Hallucination | 89.14 / 82.68 | 88.95 / 82.16 | 90.07 / 83.47 |
| Instruction Following | 38.56 / 38.71 | 38.78 / 38.28 | 40.12 / 39.74 |
| Jailbreak | 93.07 / 90.94 | 90.07 / 88.69 | 90.75 / 89.08 |
| Privacy | 76.03 / 64.80 | 68.51 / 56.95 | 73.24 / 60.66 |
| Reward Hacking | 7.50 / 38.48 | 9.64 / 39.49 | 10.00 / 40.51 |
| Input / Output | Query 1 | Query 2 |
|---|---|---|
| Task context | Same GPQA task | |
| Reasoning trace | Same CoT trajectory | |
| Monitoring objective | Pauli-exclusion path | Binomial-theorem path |
| Monitor judgment | Applied | Not Applied |
CoT Monitoring
Chain-of-thought monitoring studies whether models’ reasoning traces expose decision-relevant behavior and support oversight of unsafe or deceptive actions.
See all 40 papers