mlsanityData to 14 Oct 2026

Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety

arXiv 2507.11473 ↗First posted 15 Jul 2025cs.AI cs.LG stat.MLcited by 249

On the map: LLM reasoning → Prompting and chain-of-thought reasoning

Abstract (arXiv)

AI systems that "think" in human language offer a unique opportunity for AI safety: we can monitor their chains of thought (CoT) for the intent to misbehave. Like all other known AI oversight methods, CoT monitoring is imperfect and allows some misbehavior to go unnoticed. Nevertheless, it shows promise and we recommend further research into CoT monitorability and investment in CoT monitoring alongside existing safety methods. Because CoT monitorability may be fragile, we recommend that frontier model developers consider the impact of development decisions on CoT monitorability.

Key facts. Cited by 249 papers in the map (data through 14 Oct 2026). Placed in Prompting and chain-of-thought reasoning, one of 17 directions in LLM reasoning. Builds on 26 of its 36 references that are in the map. First posted on arXiv 15 Jul 2025.

Builds on

26 of 36 references.

Closest ancestors · 9

Same direction, newest first

  1. 2025When Chain of Thought is Necessary, Language Models Struggle to Evade Monitors7 Jul
  2. 2025Reasoning Models Don't Always Say What They Think8 May
  3. 2025Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscation14 Mar
  4. 2025Chain-of-Thought Reasoning In The Wild Is Not Always Faithful11 Mar
  5. 2024Training Large Language Models to Reason in a Continuous Latent Space9 Dec
  6. 2024Chain of Thought Empowers Transformers to Solve Inherently Serial Problems20 Feb
  7. 2023Language Models Don't Always Say What They Think: Unfaithful Explanations in Chain-of-Thought Prompting7 May
  8. 2022Large Language Models are Zero-Shot Reasoners24 May
  9. 2022Chain-of-Thought Prompting Elicits Reasoning in Large Language Models28 Jan

Other references · 17

  1. 2017Attention Is All You Needcited by 60,361
  2. 2025DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learningcited by 6,330
  3. 2022Solving math word problems with process- and outcome-based feedbackcited by 901
  4. 2023Open Problems and Fundamental Limitations of Reinforcement Learning from Human Feedbackcited by 759
  5. 2021Prompt Programming for Large Language Models: Beyond the Few-Shot Paradigmcited by 606
  6. 2025Scaling up Test-Time Compute with Latent Reasoning: A Recurrent Depth Approachcited by 415
  7. 2024Frontier Models are Capable of In-context Schemingcited by 287
  8. 2023AI Control: Improving Safety Despite Intentional Subversioncited by 229
  9. 2025Constitutional Classifiers: Defending against Universal Jailbreaks across Thousands of Hours of Red Teamingcited by 181
  10. 2025LlamaFirewall: An open source guardrail system for building secure AI agentscited by 127
  11. 2022On Reinforcement Learning and Distribution Matching for Fine-Tuning Language Models with no Catastrophic Forgettingcited by 82
  12. 2020Multi-agent Communication meets Natural Language: Synergies between Functional and Structural Language Learningcited by 66
5 more
  1. 2024Sabotage Evaluations for Frontier Modelscited by 52
  2. 2025An Approach to Technical AGI Safety and Securitycited by 45
  3. 2025Evaluating Frontier Models for Stealth and Situational Awarenesscited by 37
  4. 2025A Framework for Evaluating Emerging Cyberattack Capabilities of AIcited by 16
  5. 2025RepliBench: Evaluating the Autonomous Replication Capabilities of Language Model Agentscited by 15

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 59; 2026: 190.

249 papers.

Sort:

By area:

  1. 2025Scaling Latent Reasoning via Looped Language Modelscited by 165
  2. 2026The Latent Space: Foundation, Evolution, Mechanism, Ability, and Outlookcited by 43
  3. 2026Reasoning Theater: Disentangling Model Beliefs from Chain-of-Thoughtcited by 40
  4. 2025Reliable Weak-to-Strong Monitoring of LLM Agentscited by 31
  5. 2025Training Language Models to Explain Their Own Computationscited by 30
  6. 2025Persistent Instability in LLM's Personality Measurements: Effects of Scale, Reasoning, and Conversation Historycited by 26
  7. 2026Reasoning Models Struggle to Control their Chains of Thoughtcited by 25
  8. 2025MoReBench: Evaluating Procedural and Pluralistic Moral Reasoning in Language Models, More than Outcomescited by 23
  9. 2025Can Reasoning Models Obfuscate Reasoning? Stress-Testing Chain-of-Thought Monitorabilitycited by 22
  10. 2025Training LLMs for Honesty via Confessionscited by 22
  11. 2025Async Control: Stress-testing Asynchronous Control Measures for LLM Agentscited by 22
  12. 2026A Survey of Agentic AI and Cybersecurity: Challenges, Opportunities and Use-case Prototypescited by 22
38 more
  1. 2025Verifying Chain-of-Thought Reasoning via Its Computational Graphcited by 20
  2. 2026Model Spec Midtraining: Improving How Alignment Training Generalizescited by 20
  3. 2025Benchmarking Deception Probes via Black-to-White Performance Boostscited by 19
  4. 2025LLMs Can Covertly Sandbag on Capability Evaluations Against Chain-of-Thought Monitoringcited by 18
  5. 2025Measuring Chain-of-Thought Monitorability Through Faithfulness and Verbositycited by 17
  6. 2026Counterfactual Simulation Training for Chain-of-Thought Faithfulnesscited by 17
  7. 2026Countdown-Code: A Testbed for Studying The Emergence and Generalization of Reward Hacking in RLVRcited by 17
  8. 2026How Vulnerable Are AI Agents to Indirect Prompt Injections? Insights from a Large-Scale Public Competitioncited by 17
  9. 2025Thought Branches: Interpreting LLM Reasoning Requires Resamplingcited by 16
  10. 2025Can Aha Moments Be Fake? Towards Quantifying Decorative and True Thinking in Chain-of-Thoughtcited by 15
  11. 2026When Benign Inputs Lead to Severe Harms: Eliciting Unsafe Unintended Behaviors of Computer-Use Agentscited by 14
  12. 2026Do Androids Dream of Breaking the Game? Systematically Auditing AI Agent Benchmarks with BenchJackcited by 14
  13. 2025A Pragmatic Way to Measure Chain-of-Thought Monitorabilitycited by 13
  14. 2025Output Supervision Can Obfuscate the Chain of Thoughtcited by 13
  15. 2026Shaping capabilities with token-level data filteringcited by 13
  16. 2025Distributional AGI Safetycited by 12
  17. 2026Think Fast: Estimating No-CoT Task-Completion Time Horizons of Frontier AI Modelscited by 12
  18. 2025Towards Safe Reasoning in Large Reasoning Models via Corrective Interventioncited by 11
  19. 2026Analyzing and Improving Chain-of-Thought Monitorability Through Information Theorycited by 10
  20. 2025Lexical Hints of Accuracy in LLM Reasoning Chainscited by 9
  21. 2025Reasoning Models Sometimes Output Illegible Chains of Thoughtcited by 9
  22. 2025Investigating CoT Monitorability in Large Reasoning Modelscited by 9
  23. 2025Steering Awareness: Detecting Activation Steering from Withincited by 9
  24. 2025Reasoning Under Pressure: How do Training Incentives Influence Chain-of-Thought Monitorability?cited by 9
  25. 2025Mitigating Indirect Prompt Injection via Instruction-Following Intent Analysiscited by 9
  26. 2026One Probe Won't Catch Them All: Towards Targeted Deception Detectioncited by 9
  27. 2026Are Latent Reasoning Models Easily Interpretable?cited by 9
  28. 2026Stealing Reasoning Traces from Proprietary LLM APIscited by 9
  29. 2025All Code, No Thought: Current Language Models Struggle to Reason in Ciphered Languagecited by 8
  30. 2025Odysseus: Jailbreaking Commercial Multimodal LLM-integrated Systems via Dual Steganographycited by 8
  31. 2025Practical challenges of control monitoring in frontier AI deploymentscited by 8
  32. 2026Risky-Bench: Probing Agentic Safety Risks under Real-World Deploymentcited by 8
  33. 2026A Decision-Theoretic Formalisation of Steganography With Applications to LLM Monitoringcited by 8
  34. 2026Quantifying the Necessity of Chain of Thought through Opaque Serial Depthcited by 8
  35. 2026Lie to Me: How Faithful Is Chain-of-Thought Reasoning in Reasoning Models?cited by 8
  36. 2026MonitorBench: A Comprehensive Benchmark for Chain-of-Thought Monitorability in Large Language Modelscited by 8
  37. 2026Thinking Without Words: Efficient Latent Reasoning with Abstract Chain-of-Thoughtcited by 8
  38. 2026Predicting LLM Safety Before Release by Simulating Deploymentcited by 8

50 most cited of 249 All 249 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2026Chain of Thought Monitoring Can Fail Even When CoT Is Necessary
  2. 2025Monitoring Monitorability
  3. 2025CoT Red-Handed: Stress Testing Chain-of-Thought Monitoring
  4. 2026Evading Chain-of-Thought Monitoring Through Model Poisoning
  5. 2026Does Out-of-Sight Equal Out-of-Mind in CoT Monitorability?
  6. 2023Navigate through Enigmatic Labyrinth A Survey of Chain of Thought Reasoning: Advances, Frontiers and Future
  7. 2026On the Chain-of-Thought Monitorability of Looped Language Models
  8. 2026Reasoning Consistency Scanning: A Framework for Auditing Chain-of-Thought Validity in AI Safety Evaluations