mlsanityData to 14 Oct 2026

When Chain of Thought is Necessary, Language Models Struggle to Evade Monitors

arXiv 2507.05246 ↗First posted 7 Jul 2025cs.AI cs.CLcited by 88

On the map: LLM reasoning → Prompting and chain-of-thought reasoning

Abstract (arXiv)

While chain-of-thought (CoT) monitoring is an appealing AI safety defense, recent work on "unfaithfulness" has cast doubt on its reliability. These findings highlight an important failure mode, particularly when CoT acts as a post-hoc rationalization in applications like auditing for bias. However, for the distinct problem of runtime monitoring to prevent severe harm, we argue the key property is not faithfulness but monitorability. To this end, we introduce a conceptual framework distinguishing CoT-as-rationalization from CoT-as-computation. We expect that certain classes of severe harm will require complex, multi-step reasoning that necessitates CoT-as-computation. Replicating the experimental setups of prior work, we increase the difficulty of the bad behavior to enforce this necessity condition; this forces the model to expose its reasoning, making it monitorable. We then present methodology guidelines to stress-test CoT monitoring against deliberate evasion. Applying these guidelines, we find that models can learn to obscure their intentions, but only when given significant help, such as detailed human-written strategies or iterative optimization against the monitor. We conclude that, while not infallible, CoT monitoring offers a substantial layer of defense that requires active protection and continued stress-testing.

Key facts. Cited by 88 papers in the map (data through 14 Oct 2026). Placed in Prompting and chain-of-thought reasoning, one of 17 directions in LLM reasoning. Builds on 24 of its 35 references that are in the map. First posted on arXiv 7 Jul 2025.

Builds on

24 of 35 references.

Closest ancestors · 8

Same direction, newest first

  1. 2025CoT Red-Handed: Stress Testing Chain-of-Thought Monitoring29 May
  2. 2024Training Large Language Models to Reason in a Continuous Latent Space9 Dec
  3. 2024Let's Think Dot by Dot: Hidden Computation in Transformer Language Models24 Apr
  4. 2024Making Reasoning Matter: Measuring and Improving Faithfulness of Chain-of-Thought Reasoning21 Feb
  5. 2024Chain of Thought Empowers Transformers to Solve Inherently Serial Problems20 Feb
  6. 2023Preventing Language Models From Hiding Their Reasoning27 Oct
  7. 2023Measuring Faithfulness in Chain-of-Thought Reasoning17 Jul
  8. 2023Language Models Don't Always Say What They Think: Unfaithful Explanations in Chain-of-Thought Prompting7 May

Other references · 16

  1. 2023GPQA: A Graduate-Level Google-Proof Q&A Benchmarkcited by 2,879
  2. 2025Scaling up Test-Time Compute with Latent Reasoning: A Recurrent Depth Approachcited by 415
  3. 2023AI Control: Improving Safety Despite Intentional Subversioncited by 229
  4. 2024Secret Collusion among AI Agents: Multi-Agent Deception via Steganographycited by 113
  5. 2023Scheming AIs: Will AIs fake alignment during training in order to get power?cited by 97
  6. 2025Are DeepSeek R1 And Other Reasoning Models More Faithful?cited by 72
  7. 2024Hidden in Plain Text: Emergence & Mitigation of Steganographic Collusion in LLMscited by 55
  8. 2024Sabotage Evaluations for Frontier Modelscited by 52
  9. 2024Safety Cases: How to Justify the Safety of Advanced AI Systemscited by 48
  10. 2025An Approach to Technical AGI Safety and Securitycited by 45
  11. 2025Evaluating Frontier Models for Stealth and Situational Awarenesscited by 37
  12. 2024Towards evaluations-based safety cases for AI schemingcited by 33
4 more
  1. 2024Deliberation in Latent Space via Differentiable Cache Augmentationcited by 26
  2. 2025MONA: Myopic Optimization with Non-myopic Approval Can Mitigate Multi-step Reward Hackingcited by 19
  3. 2025Robustly Improving LLM Fairness in Realistic Settings via Interpretabilitycited by 18
  4. 2025Safety Cases: A Scalable Approach to Frontier AI Safetycited by 8

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 26; 2026: 62.

88 papers.

Sort:

By area:

  1. 2025Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safetycited by 249
  2. 2025Implicit Reasoning in Large Language Models: A Comprehensive Surveycited by 43
  3. 2026Reasoning Theater: Disentangling Model Beliefs from Chain-of-Thoughtcited by 40
  4. 2025Is It Thinking or Cheating? Detecting Implicit Reward Hacking by Measuring Reasoning Effortcited by 27
  5. 2026Reasoning Models Struggle to Control their Chains of Thoughtcited by 25
  6. 2025Can Reasoning Models Obfuscate Reasoning? Stress-Testing Chain-of-Thought Monitorabilitycited by 22
  7. 2025Training LLMs for Honesty via Confessionscited by 22
  8. 2025LLMs Can Covertly Sandbag on Capability Evaluations Against Chain-of-Thought Monitoringcited by 18
  9. 2025Can We Predict Alignment Before Models Finish Thinking? Towards Monitoring Misaligned Reasoning Modelscited by 17
  10. 2025Measuring Chain-of-Thought Monitorability Through Faithfulness and Verbositycited by 17
  11. 2026Counterfactual Simulation Training for Chain-of-Thought Faithfulnesscited by 17
  12. 2025LLMs Don't Know Their Own Decision Boundaries: The Unreliability of Self-Generated Counterfactual Explanationscited by 16
38 more
  1. 2025Thought Branches: Interpreting LLM Reasoning Requires Resamplingcited by 16
  2. 2025Technological folie `a deux: Feedback Loops Between AI Chatbots and Mental Illnesscited by 15
  3. 2025A Pragmatic Way to Measure Chain-of-Thought Monitorabilitycited by 13
  4. 2025Output Supervision Can Obfuscate the Chain of Thoughtcited by 13
  5. 2025Difficulties with Evaluating a Deception Detector for AIscited by 13
  6. 2026Shaping capabilities with token-level data filteringcited by 13
  7. 2026Think Fast: Estimating No-CoT Task-Completion Time Horizons of Frontier AI Modelscited by 12
  8. 2026Analyzing and Improving Chain-of-Thought Monitorability Through Information Theorycited by 10
  9. 2025Reasoning Models Sometimes Output Illegible Chains of Thoughtcited by 9
  10. 2025Reasoning Under Pressure: How do Training Incentives Influence Chain-of-Thought Monitorability?cited by 9
  11. 2025All Code, No Thought: Current Language Models Struggle to Reason in Ciphered Languagecited by 8
  12. 2026Quantifying the Necessity of Chain of Thought through Opaque Serial Depthcited by 8
  13. 2026MonitorBench: A Comprehensive Benchmark for Chain-of-Thought Monitorability in Large Language Modelscited by 8
  14. 2026Training Agents to Self-Report Misbehaviorcited by 6
  15. 2025State over Tokens: Characterizing the Role of Reasoning Tokenscited by 5
  16. 2026Chain-of-thought obfuscation learned from output supervision can generalise to unseen taskscited by 5
  17. 2026Aligned, Orthogonal or In-conflict: When can we safely optimize Chain-of-Thought?cited by 5
  18. 2026Detecting and Suppressing Reward Hacking with Gradient Fingerprintscited by 5
  19. 2026Monitoring the Internal Monologue: Probe Trajectories Reveal Reasoning Dynamicscited by 5
  20. 2025Unsupervised decoding of encoded reasoning using language model interpretabilitycited by 4
  21. 2026Capabilities and Fundamental Limits of Latent Chain-of-Thoughtcited by 4
  22. 2026Monitorability as a Free Gift: How RLVR Spontaneously Aligns Reasoningcited by 4
  23. 2025Typed Chain-of-Thought: A Curry-Howard Framework for Verifying LLM Reasoningcited by 3
  24. 2025When to Think and When to Look: Uncertainty-Guided Lookbackcited by 3
  25. 2025On the Regulatory Potential of User Interfaces for AI Agent Governancecited by 3
  26. 2026An Independent Safety Evaluation of Kimi K2.5cited by 3
  27. 2026KellyBench: A Benchmark for Long-Horizon Sequential Decision Makingcited by 3
  28. 2026Training on Documents About Monitoring Leads to CoT Obfuscationcited by 3
  29. 2026How Transparent is DiffusionGemma?cited by 3
  30. 2026Do Thinking Tokens Help with Safety?cited by 3
  31. 2026Value Leakage: An LLM's Answers Are Silently Shaped by Its Own Valuescited by 3
  32. 2026AI Finds A Waycited by 3
  33. 2025The Ends Justify the Thoughts: RL-Induced Motivated Reasoning in LLM CoTscited by 2
  34. 2025A Concrete Roadmap towards Safety Cases based on Chain-of-Thought Monitoringcited by 2
  35. 2025Mapping Faithful Reasoning in Language Modelscited by 2
  36. 2026Position: Capability Control Should be a Separate Goal From Alignmentcited by 2
  37. 2026The Depth Ceiling: On the Limits of Large Language Models in Discovering Latent Planningcited by 2
  38. 2026When Reasoning Traces Become Performative: Step-Level Evidence that Chain-of-Thought Is an Imperfect Oversight Channelcited by 2

50 most cited of 88 All 88 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2025Monitoring Monitorability
  2. 2026Evading Chain-of-Thought Monitoring Through Model Poisoning
  3. 2026Chain of Thought Monitoring Can Fail Even When CoT Is Necessary
  4. 2025Investigating CoT Monitorability in Large Reasoning Models
  5. 2025Reasoning Models Don't Always Say What They Think
  6. 2026Noticing the Watcher: LLM Agents Can Infer CoT Monitoring from Blocking Feedback
  7. 2026Diagnosing Pathological Chain-of-Thought in Reasoning Models
  8. 2026Selective Disclosure of Hidden Directives in Reasoning Models: Behavioral Asymmetry and Steering