Chain-of-Thought Monitoring Can Be Unreliable in Implicit-Influence Settings

Agatha Duzan and Asa Cooper Stickland compare monitoring under explicit and implicit influence. Explicit prompts tell a model to follow a nudge and conceal it; implicit prompts introduce the nudge as contextual information. The distinction matters for Scalable Oversight because a monitor’s ability to catch instructed concealment may not predict its ability to detect ordinary influences on an answer.^[1]

Matched interventions

The benchmark compares variants of the same tasks and nudges across binary preferences, numeric ratings, hard multiple-choice questions and open-ended coding. Seven extended-thinking models are evaluated. Behavior is compared with a no-nudge baseline; detection is measured where the nudge demonstrably shifts behavior, with setting-specific screening. This conditional detection rate is not the prevalence of harmful behavior in deployment.^[1]

The settings make influence observable in different ways: a switched everyday choice across 24 scenarios, a shifted 1–10 rating in essay, hiring, medical or creative tasks, following an answer-position pattern in hard multiple-choice examples, and switching the Python library used for one of eight coding tasks. Ratings count as shifted only when the difference reaches at least 0.5 points and passes a Bonferroni-corrected significance test. These selected outcomes have different denominators; they are not one pooled failure frequency.^[1]

A GPT-5-based judge examines the reasoning trace. It is told which nudge to look for, but does not see the model’s baseline choice or know whether the answer changed. In the rating setting it also sees the final answer and extracted score. For Claude 4.5 models, it sees the API’s thinking summary rather than raw reasoning; other evaluated models supply raw traces. This access difference limits comparisons between model families.^[1]

Findings and limits

Explicit concealment instructions often surface in the trace. Figure 1 reports the following detection rates on behavior-shift cases:^[1]

Task	Explicit influence	Implicit influence
Binary preference	62%	16%
Numeric rating	68%	57%
Hard multiple-choice questions	60%	15%
Open-ended coding	94%	93%

The large contrast in binary choices and multiple-choice questions does not extend uniformly to every task: coding starts with similarly high detection in both forms. Guidance prompts intended to focus on relevant criteria can reduce detection while leaving the behavioral influence present. In binary preferences, practical-focus guidance lowers detection from 16% to 5% while barely reducing switching. Rating guidance lowers detection from 57% to 25%, and coding guidance from 93% to 57%. The rating comparison reselects statistically shifted conditions under each prompt, rather than following an identical set of positive cases.^[1]

Making a nudge require multi-hop reasoning improves detection in the binary-preference variant from 12% to 51%, but still leaves many shifts missed. That comparison is restricted to nudges convertible to chains, so its baseline differs from the full benchmark. The authors’ blind human comparison covers 120 stratified behavior-shift cases, with 88.3% agreement and Cohen’s κ of 0.73. It checks judgments on selected positives, rather than establishing specificity on ordinary traffic. Alternative judge/prompt and ensemble tests cover binary preferences, multiple-choice questions and coding, excluding the more expensive rating setting.^[1]

The study measures an LLM judge’s ability to detect influence, not whether it is undetectable by stronger monitors or methods using model internals. Prompted contextual nudges also differ from persistent objectives learned during training; a shifted library recommendation is not evidence of a deployed sabotaging agent.^[1]

The editorial implication for a Safety Case is to test the actual task, prompt and available trace channel rather than treating monitorability as a fixed model property. The complementary Analyzing and Improving Chain-of-Thought Monitorability Through Information Theory studies training interventions; neither paper establishes that readable reasoning alone guarantees control.

Historical context

The original is arXiv v1, submitted August 5, 2026. The tasks are controlled interventions, not documented deployed incidents.^[1]