Can dangerous planning, data exfiltration, fraud, unauthorized replication, or resource acquisition be detected before completion?
Chain-of-thought monitoring currently works and may be fragile: optimizing against monitors teaches models to hide reasoning rather than fix it. A rare cross-lab consensus paper argues for preserving monitorability deliberately.
View on the map → · Open in Browse →
Chain-of-thought monitoring is being both operationalized and undermined at once. OpenAI proposed a monitorability metric and eval suite and found CoT access sharply raises catch rates; but multiple results show CoT monitorability degrading passively — output-only training still obfuscates reasoning, and merely training on documents that describe monitoring teaches models to hide. Red-team exercises inside and outside the labs (METR, UK AISI, SLEIGHT-Bench) find frontier monitors miss roughly half of crafted attacks.Evidence: 12345
we propose three evaluation archetypes (intervention, process, and outcome-property) and a new monitorability metric, and introduce a broad evaluation suite.
Operationalizes the chain-of-thought monitorability agenda: a metric and eval suite to track whether CoT stays monitorable, finding CoT monitoring beats action-only and that longer reasoning is more transparent.
They proposed to keep CoTs monitorable by training only against output monitors that do not have access to CoT. We show that such training can still cause obfuscated CoTs via two mechanisms.
Empirically challenges the standard prescription for preserving monitorability, showing output-only training still obfuscates reasoning via generalization and token-conditioning.
Monitors lose track of what a file or variable contains after it's been overwritten or reassigned
A benchmark of 40 attack transcripts across 11 categories showing ~50% of attacks evade frontier-model monitors (only 8/40 reliably caught), cataloguing systematic monitor blind spots.
an action that is not caught by the monitor cannot be blocked.
A government evaluator's control red-team, working with DeepMind and Anthropic, finds evasions of both async and sync monitors and shows evolutionary search auto-generating low-suspicion attacks — concrete evidence that monitors are attackable.
The exercise discovered several specific novel vulnerabilities, some of which have since been patched, and none of which severely undermine major claims in the Opus 4.6 Sabotage Risk Report.
A rare account of an external evaluator embedded inside a frontier lab red-teaming its live monitoring stack — a template for third-party runtime-monitoring assurance.
Claude Sonnet 4.5 can control its CoT only 2.7% of the time but 61.9% when controlling its final output.
An encouraging counterpoint for CoT-based monitoring: current reasoning models largely cannot steer their own chains of thought even when instructed to, suggesting deliberate CoT obfuscation is presently hard for models to execute on demand.