Chain-of-thought monitoring can fail even when chain of thought is necessary

Does chain-of-thought (CoT) monitoring still fail when CoT is necessary for the model to arrive at the correct answer, and is the existing binary classification principle sufficient to characterize monitoring reliability.

• Application scenario and importance: Frontier labs have used CoT monitoring to detect undesirable AI system behavior (such as alignment faking or reward hacking), and analyzing natural-language reasoning chains is viewed as an important way to understand model decision processes.
• Limitations of existing views: Earlier research (Emmons et al., 2025) argued that past monitoring failures stemmed from CoT not being necessary for arriving at the answer, so CoT served as post-hoc rationalization of an answer already computed internally, and inferred that CoT can be monitored whenever it is necessary; the authors point out that this binary division is too coarse.
• Core observation and hypothesis: The authors observe that even when CoT is essential to completing the task, the specific attribute being monitored may still not depend on CoT processing, or may not be explicitly stated during reasoning, so necessary CoT still has monitoring blind spots.
• The paper's solution: The authors propose a four-level CoT necessity hierarchy, define monitoring evaluation metrics based on counterfactual interventions, and empirically analyze monitoring failure rates of necessary CoT at different levels.
• Monitoring task setup: The CoT monitor serves as a supervisory tool, with the goal of judging from the model-generated natural-language chain of thought whether a specific attribute is a key factor influencing the final output; the system under test is a large language model with long chain-of-thought reasoning capability.

Related work mainly centers on chain-of-thought monitoring types, faithfulness and covert reasoning, and causal-intervention evaluation methods.

Three types of chain-of-thought monitoring research

• Influence type: Focuses on the causes that lead the model to produce a certain behavior or answer, including prompt suggestion (Turpin et al., 2023; Chua & Evans, 2025; Chen et al., 2025), social bias (Karvonen & Marks, 2025; Arcuschin et al., 2026a), sandbagging in capability evaluation (Li & Siegel, 2025; Van Der Weij et al., 2025), and alignment faking (Greenblatt et al., 2024).
• Process type: Focuses on which thinking steps the model went through or which topics it touched, covering judgment of mathematical theorem use (Wang et al., 2026; Guan et al., 2026) and tests of reasoning about concealing dangerous topics (Emmons et al., 2025).
• Outcome type: Focuses on whether the output has a specific dangerous attribute, including reward hacking in code tasks (Baker et al., 2025), completing disruptive subtasks (Arnav et al., 2026), and various misaligned behaviors (Chua et al., 2025; Zolkowski et al., 2025).

Research on chain-of-thought necessity and faithfulness

• Binary necessity hypothesis: Emmons et al. (2025) proposed a binary criterion distinguishing whether a task requires CoT, arguing that all previous monitoring failures occurred in non-necessary scenarios; the authors of this paper point out that the binary division is too coarse and does not distinguish between "task-necessary" and "necessary for processing a specific attribute."
• Non-verbalized reasoning and early decision-making: Baherwani et al. (2026) and Yueh-Han et al. (2026) explored the phenomenon of model reasoning not being externalized in CoT; Scalena et al. (2026) and Kortukov et al. (2026) observed that models lock in the final answer at an early stage before CoT ends.

Evaluation baselines and benchmark datasets

• Monitoring evaluation baseline: Guan et al. (2026) proposed a probabilistic framework and M0 metric for evaluating monitorability based on causal intervention; this paper extends it with the necessary-CoT metric M1 and removes sample selection bias.
• Evaluation datasets: Uses Hinted MCQA from Chua et al. (2024) as a reference benchmark, and tests on three multi-class complex classification tasks: Thyroid Disease (Quinlan, 1986), DDXPlus Medical (Fansi Tchango et al., 2022), and Olympic Athletes (Griffin, 2018).

Positioning of this paper: The authors position this paper as a systematic examination of the causal mechanisms by which monitoring fails even when CoT is genuinely necessary, supplementing previous understanding of monitoring reliability through a hierarchical system.

The authors propose a four-level chain-of-thought necessity hierarchy and establish an attribute-intervention-based probabilistic monitorability metric framework and an early direct-effect intervention method.

Four-level chain-of-thought necessity hierarchy

• Level 0 (not necessary): CoT is not necessary for arriving at the final answer; the model may output post-hoc rationalization.
• Level 1 (task-necessary): CoT is necessary for arriving at the final answer (defined as the target-answer probability p10 < 0.01），排除了整体输出的事后合理化，但CoT不一定用于处理受控属性 P。
• Level 2（属性处理必要）：属性 P 无法与CoT分离开来处理，P 的影响渗透并偏置了必要的CoT计算过程。
• Level 3.m（专用计算必要）：处理属性 P 必须经历至少 m 个主要专门用于 P 的连续前向传递步骤。

概率可监控性度量框架

• 总效应与过剩比例：定义总效应 TE := p₁₁ − p₀₁，以过剩比例 R := max(0, p₁₁ − p₀₁) / p₁₁ 作为属性对目标答案产生系统影响的保守下界。
• 陈述率与监控得分公式：记 π_Z := P(Z=1 ∣ X=1, T=1, Y=1) 为模型在思维链中陈述属性影响的比例。可监控性得分定义为：当 TE > τ without CoT and p₁₀ < 0.01 时，M₁ := min(1, π_Z / R)，未满足条件时无定义。主实验设定阈值 τ = 0.08。
• 样本分割消偏：将采样样本分为选择批次（用于筛选 TE > τ) and the estimation batch (used to compute scores), eliminating statistical downward bias from screening the same batch of samples.

Early direct-effect measurement (Level 2 validation)

• Locking early decision positions: In the no-attribute reasoning chain (X=0), select 20 equally spaced positions to force answer output, and determine the earliest position i* at which the model's most likely answer no longer changes.
• Freezing hidden states to remove confounding: Introduce the attribute (X=1) at i*, strictly freeze the prefix CoT token sequence and its layer-wise hidden states under the X=0 condition by reusing the KV cache, and align positional encodings with relative displacement, keeping only a single forward pass to compute the direct effect DE_EA^(i*). If the direct effect is much smaller than the total effect, the attribute cannot act independently of CoT, and it is classified as Level 2.

LLM judge scoring mechanism

• Use the open-source model DeepSeek-V4-Flash-0731 as the judge, labeling attributes in CoT as NOT_MENTIONED (not mentioned), MENTIONED (only restated or listed), and INFLUENTIAL (substantively affecting inference in reasoning steps), and counting only INFLUENTIAL as Z=1.

Experimental setup

• Models tested: The main experiments evaluated Qwen-3-8B; the appendix evaluated Qwen-3-4B, Gemma-4-E4B-it, and Gemma-4-31B-it; Qwen-3-14B and Qwen-3-32B were also included in the CoT validity check (6 models in total).
• Datasets and scale: Thyroid Disease (10 classes, 2138 records, 22 clinical attributes); DDXPlus Medical (48 disease classes, 50 cases each, 2400 records total); Olympic Athletes (14 sports classes, 225 athletes each, 3150 records total, 8 attributes); Hinted MCQA (paired MMLU multiple-choice questions with hints).
• Metric definitions: Total effect TE (threshold τ=0.08), excess proportion R, Level 0 monitoring score M0, Level 1 necessary-CoT monitoring score M1 (requiring p10 < 0.01）、早期直接效应 DE_EA^(i*)。
• 评审方式：采用 DeepSeek-V4-Flash-0731 进行属性标注（三分类），在三任务各10条样本（共498个标签）上与人工标注一致率分别为 95.0%、93.4%、95.0%。
• 抽样与计算：每个样本-属性对生成两批独立批次各 n=1000 条CoT（共2000条），采用分层自举法（B=10000次）估计标准误，仅保留 f_valid >= 0.9 and stable attributes with qualified sample count nS > 5.

Main results

The table below shows the change in target answer probability with and without CoT for each model on the 4 datasets (percentage-point change, based on Figure 3):

Swipe horizontally to read the table

• CoT necessity shown on complex tasks: The authors report that on the three complex classification tasks, accuracy increased significantly with CoT compared to without CoT (e.g., Qwen-3-8B increased by 21 percentage points on DDXPlus and 17 percentage points on Thyroid Disease), satisfying the Level 1 necessity premise.
• Monitoring failure under necessary CoT: On the necessary-CoT subsets of Qwen-3-8B across the three complex datasets, the combined M1 was 0.940 (Figure 1 left); on specific attributes, M0 and M1 for patient sex (R=0.19) and query on thyroxine (R=0.24) in Thyroid Disease were both close to 0 (Figure 4b).
• Exceptional findings on non-necessary tasks: On Hinted MCQA, M1 for Qwen-3-8B was undefined (already influenced by hints without CoT), but on Gemma-4-E4B and Qwen-3-4B there were samples where M1 was defined and less than 1 (Appendix H.2).

Attribute necessity causal intervention analysis (Level 2 validation)

• What was tested: For patient sex and query on thyroxine in Thyroid Disease (class G) where Qwen-3-8B had monitoring scores of 0, the early position i* where the model locks the answer was identified in attribute-free CoT, and the KV cache was frozen to compute the early direct effect DE_EA^(i*).
• Experimental results: The early direct effect of patient sex was only about 7% of the average total effect, and query on thyroxine was about 14% (Section 6, Figure 18). Without freezing internal hidden states, the direct effect of query on thyroxine rose to about 22%, while sex remained at about 8% (Appendix J.4, Figure 19).
• Authors' interpretation: The direct effect being much smaller than the total effect indicates that attribute influence cannot be independently injected in a single forward pass at the answer stage and must rely on the internal latent state computation of the CoT, confirming that the monitoring failure is at least at Level 2.

Generalization validation on other models

• What was tested: M0 and M1 were tested on Gemma-4-31B-it, Gemma-4-E4B-it, and Qwen-3-4B (Appendix H).
• Experimental results: For Gemma-4-E4B-it aggregated over Thyroid Disease classes G, I, and R, the age attribute had M0 close to 0 and M1 undefined, while attributes such as TSH had M0 and M1 close to 1.0 (Figure 13b); for Qwen-3-4B on Hinted MCQA, M0 was about 0.55 and M1 about 0.35 (nS=7, R=0.94, Figure 14a).
• Authors' interpretation: The authors believe monitoring failures exist across different parameter scales and model families, not just in specific architectures.

Other ablations and analyses

• Sample-splitting debiasing analysis: A naive estimator without sample splitting produced a large downward selection bias due to winner's curse when TE was close to the threshold τ=0.08; sample splitting eliminated it (Appendix D, Figure 10).
• Adaptive sampling gains: In the two-stage adaptive sampling, the first stage removed sample pairs with TE^(1) < 0.03, reducing actual computation to between 1/5 and 1/2 of the original (Appendix E.1).
• Reviewer model consistency validation: DeepSeek-V4-Flash review achieved agreement rates with humans of 95.0%, 93.4%, and 95.0% on the three tasks, respectively, and reached full agreement in spot checks of monitoring failure samples (Section 5.2).
• Attributes not reaching statistical significance: In DDXPlus, E_26 (family history of anemia) and in Olympic, cities, although M1 < 1 was observed, the paper reports they did not reach statistical significance (Section 5.2).

Limitations and future directions noted by the authors

• Only benign behavior proxies studied: The paper only studied benign prediction tasks as proxies for AI misbehavior. The authors note that the necessity hierarchy of dangerous misbehavior itself and its monitorability at higher levels remain to be measured in future work (Section 7).
• High computational cost limited model scale: The experiments consumed about 3000 A100 and 2000 B200 GPU hours, so the evaluation could only cover relatively small models with up to 31B parameters, and could not analyze frontier models with larger parameter counts (Section 7).
• Lack of rigorous formalization of the key influencing factor concept: The paper's measurement framework relies on the concept of key influencing factors (Assumption 1). The authors note that this concept is inherently vague and requires better causal explanation methods in the future (Section 7).
• Lack of true negative controls: The framework cannot guarantee when an attribute did not exert influence. If the model states in its CoT that all attributes were influential, it can obtain a perfect monitoring score (Section 7, Section 3.2, Appendix B.4).
• Only a small part of the space explored: The authors note that this work only explored a small part of the space formed by monitoring types and the necessity hierarchy. Higher levels (such as Level 3.m) and other monitoring types remain to be explored (Section 7).
• The deep mechanism of monitoring failure is not yet fully clarified: In the appendix, the authors proposed three hypotheses—weak attribute bias, implicit reasoning exploitation, or purely internal reasoning not externalized—but the specific frequency of each hypothesis still requires further research (Appendix F).

Experimental coverage

• Models tested: The tested models include Qwen-3-8B, Qwen-3-4B, Gemma-4-E4B-it, and Gemma-4-31B-it, a total of 4 models that completed the full monitoring evaluation, with Qwen-3-14B and Qwen-3-32B also participating in CoT probability validation.
• Task environments covered: The task environments cover 4 datasets: Thyroid Disease (10 classes, 2138 records), DDXPlus Medical (48 classes, 2400 records), Olympic Athletes (14 classes, 3150 records), and Hinted MCQA.
• Monitoring types covered: Only the influence type was tested; the process type and outcome type were not empirically tested.
• Attribute intervention coverage: The causal intervention experiments on attribute necessity were only conducted on 2 attributes in Thyroid Disease class G (patient sex and query on thyroxine) and on the single model Qwen-3-8B.
• Monitoring review coverage: Only DeepSeek-V4-Flash-0731 was used as the monitoring review model. The paper does not report cross-model consistency comparisons with reviewers of other sizes or families.

• One-sentence positioning: This study systematically examines whether monitoring blind spots still appear when chain of thought is essential to arriving at the answer, challenging the binary assumption that "necessary means faithful and monitorable."
• Problem addressed: Frontier labs rely on CoT monitoring to guard against AI risks; previous literature attributed monitoring failures to post-hoc rationalization when CoT was not necessary. The paper investigates whether monitoring still fails when CoT is necessary and the mechanism behind it.
• Method highlights: The authors propose a four-level CoT necessity hierarchy (Level 0 to Level 3.m), construct counterfactual probability metrics M0 and M1 that eliminate selection bias, and combine KV cache freezing to measure early direct effects to determine attribute necessity.
• Key results: In tests on Qwen-3-8B, although chain of thought brought 14 to 21 percentage-point accuracy improvements on several complex tasks (Figure 3), the overall M1 across the three datasets still had missed detections (0.940 in Figure 1 left); in thyroid disease diagnosis, patient sex and thyroxine query had systematic influence of at least 19% and 24% on the correct answer (Figure 4b), but M1 scores were close to 0; frozen KV cache analysis showed that the early direct effect of patient sex was only about 7% of the total effect (Figure 18), reaching Level 2 necessity; varying degrees of necessary-CoT monitoring failure rates were observed across Gemma-4 and Qwen-3 models of multiple scales.
• Authors' conclusions and implications: The authors believe that chain of thought cannot guarantee monitorability even when essential to the task, and monitoring reliability depends on the specific necessity level of attribute processing; future safety monitoring systems cannot rely solely on the model's spontaneous statements and must move toward higher-level testing and causal mechanism understanding.