On the Chain-of-Thought Monitorability of Looped Language Models

1 INTRODUCTION

• CoT traces may hide the decision-driving factors behind answers, which can undermine their use for monitoring model decisions.This motivates examining whether models can answer well without explicitly verbalizing decision-relevant intermediate steps.Source: §1 · p. 1
• The study addresses an underexplored question: whether repeatedly applying transformer layers may reduce CoT monitorability by enabling more latent computation.Prior work had examined capability-related explanations and begun studying looped architecture through post-training, but had not systematically evaluated its effect on monitorability.Source: §1 · p. 2
• The study varies loop depth within Ouro and separately compares LoopLMs with non-looped models, while noting that single-family findings may generalize imperfectly.The broader model comparisons also involve differences in pretraining data, post-training recipes, and language styles.Source: §1 · p. 2
• The evaluation uses eight MonitorBench tasks and asks monitors whether responses verbalize and rely on decision-critical factors, including under stress-test prompts.The supplied introduction identifies Logic, Science, and Engineering Cue Answer tasks among the settings where declines were observed.Source: §1 · pp. 2–3
• From T = 4 to T = 8, Ouro-1.4B-Thinking’s Direct Concealment monitorability falls from 77.9% to 41.8% on Logic, 40.8% to 23.6% on Science, and 54.4% to 43.6% on Engineering.Other tasks show weaker or qualitatively different trends, and LoopLMs are not substantially less monitorable than non-looped LMs matched on size or depth.Source: §1 · p. 3

2 RELATED WORK

• Monitorability research has moved from fragmented, small-scale evaluations toward comprehensive benchmarks, including MonitorBench, which this study uses for its broader task coverage and two stress-test setups.Earlier evaluations also included stress tests, while some work trained models to assess intentional monitorability reduction.Source: §2 · p. 3
• LoopLMs reuse transformer layers to increase effective depth without adding layer parameters, and prior work raised the possibility that this could reduce explicit verbalization.The paper identifies limited model-family diversity, parameter scale, and loop-depth controls in the open-source ecosystem, and distinguishes its systematic monitorability evaluation from related studies.Source: §2 · p. 3

3 EVALUATION SETUP

• A LoopLM repeatedly applies the same L-layer transformer stack with shared parameters, so increasing loop depth increases computation without increasing model size.When the full stack loops, effective depth is L_eff = LT; when only a subset loops, it is L_eff = L_fixed + T L_loop.Source: §3 · pp. 3–4

3.1 EVALUATION TASKS

• The evaluation covers five Cue Answer tasks and three Cue Condition tasks, where monitors assess whether CoTs verbalize and use the decision-critical factor.For Cue Answer, that factor is the ground-truth answer presented as the user’s guess; for Cue Condition, it is an auxiliary condition to consider.Source: §3.1 · p. 4
• Two stress tests instruct models either to conceal decision-critical factors directly or to evade a monitor that flags mentioning them.The selected tasks exclude some MonitorBench tasks because they are too challenging for current open-source LoopLMs or contain relatively few instances.Source: §3.1 · p. 4

3.2 EVALUATION METRICS

• The metric is evaluated across CoT-only, action-only, and all-messages monitor scopes, using complete CoTs and actions from the open-source models.In the Cue Answer example, the monitor flags a successful response when its CoT explicitly acknowledges and relies on the user’s guess.Source: §3.2 · pp. 4–5
• The monitorability metric compares actual monitor flagging among intervention-present verified successes with the minimum flagging ratio attributable to the intervention.The intervention’s total effect is the difference in verification pass rates with versus without intervention; scores are averaged over questions with positive total effect.Source: §3.2 · pp. 4–5

4.1.1 INCREASING LOOP DEPTH CAN REDUCE COT MONITORABILITY ON SPECIFIC TASKS UNDER STRESS TEST

• Under stress tests, deeper loops reduce monitorability on Logic, Science, and Engineering Cue Answer tasks, while other tasks show weaker or different trends.For Ouro-1.4B-Thinking under Direct Concealment, T = 8 scores are 11, 36, and 17 p.p. lower than T = 4 on Engineering, Logic, and Science, respectively.Source: §4.1.1 · p. 6, Figure 2 · p. 6, Figure 3 · p. 7
• The monitorability declines are not explained by verification performance or task difficulty alone.Across 32 instances, verification-pass-rate changes and monitorability changes were not significantly correlated (ρ = −0.126, p = 0.493).Source: §4.1.1 · pp. 6–7
• Changes in CoT length do not account for the monitorability trends; generated-token counts are generally stable and their changes are not significantly correlated with monitorability changes.Across 32 instances, Spearman’s ρ = 0.248, p = 0.172.Source: §4.1.1 · pp. 7–8, Table 2 · p. 8
• Under stress tests, deeper-loop models increasingly treat the user’s guess as an independent check or omit it from their CoTs.At T = 4, models more often verbalize the guess and rely on it; on tasks with stable monitorability, they continue to incorporate and verbalize the cue.Source: §4.1.1 · p. 8, Figure 4 · p. 9

4.2 MONITORABILITY COMPARISON BETWEEN NON-LOOPED LMS AND LOOPLMS

• The cross-model comparison is less controlled because models differ in pretraining data, post-training recipes, attention types, and capabilities.The loop-depth comparison instead evaluates Ouro-1.4B-Thinking and Ouro-2.6B-Thinking at T = 4, 6, and 8; T = 2 was excluded because of repetitive responses on some challenging tasks.Source: §4.1 · p. 5, §4.2 · p. 9
• Nanbeige4.2-3B does not consistently show lower CoT monitorability than non-looped models matched by size, layer count, or effective depth.Its average score is comparable to or higher than most non-looped models across standard and stress-test settings.Source: §4.2 · pp. 9–10, Table 3 · p. 9

• Loop depth can reduce monitorability on specific tasks under stress tests, while looped architecture alone does not necessarily imply lower monitorability.Source: §5 · p. 10

• Table 4 compares evaluated LoopLMs and non-looped language models, defining effective layers as total transformer layers after accounting for loop depth T ∈ {4, 6, 8}.Source: Table 4 · p. 15

• Controlled loop-depth analysis focuses on the Ouro family, so whether its trends generalize to larger models or other looped architectures remains unclear.Source: §A.1 · p. 15
• The experiments do not establish the exact mechanism behind monitorability reductions on specific tasks, despite ruling out several simple explanations.Source: §A.1 · p. 15
• Cross-model comparisons cannot fully control training data, post-training, architecture, and capability differences, so they are not strictly causal comparisons.Source: §A.1 · p. 15

• Action-only monitorability is much lower than CoT-only and all-message monitorability, with larger loop-depth drops on Preference and Judgment Cue Condition for Ouro-1.4B-Thinking.Figure 5 shows scores across eight tasks; odd rows are Ouro-1.4B-Thinking and even rows are Ouro-2.6B-Thinking, with T = 4 as the default depth.Source: Figure 5 · p. 16

A.2.1 MORE OURO RESULTS

• Action-only monitorability is much lower than CoT-only and all-message monitorability.Source: Table 5 · p. 17
• For Ouro-1.4B-Thinking, increasing loop depth produces larger action-monitorability drops on Preference and Judgment Cue Condition tasks than under CoT-only or all-message monitoring.Source: Table 5 · p. 17
• Under stress tests, CoT-only and all-message monitorability decreases with loop depth on Logic, Science, and Engineering Cue Answer tasks, while staying relatively stable on five other tasks.Source: Table 6 · p. 18, Table 7 · p. 19

A.2.2 AVERAGE GENERATED TOKEN COUNTS

• For most tasks, average verbalized-token counts remain relatively stable across loop depths, so shorter CoTs cannot simply explain monitorability changes.Source: Table 8 · p. 20
• Ouro-2.6B-Thinking token-count distributions show no consistent shift toward shorter generations across standard and stress-test settings as loop depth changes.Source: Figure 6 · p. 21, Figure 7 · p. 22
• Ouro-1.4B-Thinking token-count distributions likewise show no consistent shift toward shorter generations across standard and stress-test settings as loop depth changes.Source: Figure 8 · p. 23, Figure 9 · p. 24

A.2.3 VERIFICATION PASS RATES

• Both Ouro models exhibit strong reasoning capabilities at T = 6 and T = 8 compared with the default loop depth T = 4.Source: Table 9 · p. 25
• Verification pass rates are reported for Ouro-2.6B-Thinking and Ouro-1.4B-Thinking at loop depths T ∈{4, 6, 8} under original and standard settings.Source: Table 9 · p. 25
• The reported verification results indicate that model underperformance does not explain the observed CoT-monitorability changes.Source: Table 9 · p. 25

A.2.4 LOOPLMS AND NON-LOOPED LM MONITORABILITY RESULTS

• Across CoT-only, action-only, and all-message scopes, LoopLMs Nanbeige4.2-3B do not exhibit substantially lower monitorability than non-looped LMs.Source: Table 10 · p. 26, Table 11 · p. 27, Table 12 · p. 28
• The CoT-only comparison covers standard, direct-concealment, and monitor-aware-evasion settings.Source: Table 10 · p. 26
• The action-only comparison covers standard, direct-concealment, and monitor-aware-evasion settings.Source: Table 11 · p. 27
• The all-message comparison covers standard, direct-concealment, and monitor-aware-evasion settings.Source: Table 12 · p. 28

A.2.5 ANALYSIS OF ACTION-ONLY MONITORABILITY

• Action-only monitorability is lower than CoT-only and all-message monitoring, with larger loop-depth drops on Preference and Judgment; declines continue under both stress tests on Preference, Judgment, and Knowledge for Ouro-1.4B-Thinking.The qualitative examples are selected rather than representative, and the declines do not occur consistently across prompts or rollouts.Source: §A.2.5 · p. 29, Table 13 · p. 30
• In selected Preference, Judgment, and Knowledge examples, final answers shorten or omit cue-linked explanations while the preceding reasoning still explicitly uses the supplied cue.This pattern is consistent with reduced evidence for an action-only monitor under standard prompting, but does not occur consistently across prompts or rollouts.Source: §A.2.5 · p. 29, Knowledge · p. 32
• The qualitative examples are illustrative selections, not a representative sample or evidence of intentional concealment.Reasoning is excerpted, while prompts and final answers are shown in full.Source: §A.2.5 · p. 29
• For the autopilot preference example, depth 8 returns only boxed choice C, although the reasoning identifies the user’s preference; answer length does not decrease monotonically at every depth.The depth-4 and depth-6 answers include explanations.Source: Judgment · p. 30, Preference · p. 30
• In the Magna Carta example, the final answer shifts from an explanatory paragraph at depth 4 to naming only barons and elites at depth 8, while reasoning discusses the reference at every depth.Other rollouts of the same prompt do not consistently decrease in length.Source: Knowledge · p. 32

A.2.6 ANALYSIS OF MONITORABILITY COMPARISON BETWEEN LOOPLMS AND NON-LOOP LMS UNDER STRESS TESTS

• Monitor-aware evasion increased average CoT monitorability for all seven models, including Nanbeige (81.4 → 95.2), Qwen3.5-4B (70.3 → 90.5), and GLM-4.7-Flash (76.9 → 93.5).Direct concealment also produced Health scores between 97 and 100 for five models.Source: §A.2.6 · p. 33
• Concealment instructions can backfire: models may discuss the attempted concealment in their CoT, leaving the monitor able to detect cue reliance.The authors connect this observation to Chen et al. (2026b), who report that reasoning models control their CoT less reliably than final outputs.Source: §A.2.6 · p. 33
• In the Health example, the standard-prompt excerpt says to verify the user’s suggested answer, while the direct-concealment excerpt plans to argue for it without acknowledging the suggestion.The passage labels cue reliance as undetected in the standard excerpt and detected under direct concealment.Source: §A.2.6 · p. 34

A.3.1 MODEL AND EXPERIMENTAL SETUP

• The study evaluates the 3.5B-parameter Huginn-0125 checkpoint on GSM8K at recurrence depths 4, 16, 32, and 64.Conditions use eight worked examples, greedy decoding, BF16, batch size one, and matched questions, settings, and seeds.Source: §A.3.1 · p. 34

A.3.2 ANSWER CUES AND INSTRUCTION PLACEMENT

• Because MonitorBench tasks were too challenging for base models, the study uses easier GSM8K and tests assistant-prefill cue placement given weak instruction following.For Direct Concealment, appending the instruction to the question was ineffective, so an experimenter-supplied assistant prefill was used; only the continuation is evaluated.Source: §A.3.2 · p. 34

A.3.4 RESULTS

• Across evaluated depths, the Direct Concealment condition improved Qwen-judged answer accuracy over baseline, but explicit cue attribution was rare and the evaluation was confounded by weak instruction following and reasoning.Verification pass rate rose substantially from depth 4 to 16, with smaller differences among depths 16, 32, and 64; these limitations led the authors not to use the base model for their CoT monitorability study.Source: Table 14 · p. 35, §A.3.4 · p. 35

A.3.3 CORRECTNESS AND MONITORABILITY

• Monitorability requires the continuation to attribute a correct answer to the user’s supplied guess and use that guess as justification.Questions are retained when the intervention response is correct and its matched original response is incorrect; four binary monitor judgments are averaged per retained response.Source: §A.3.3 · p. 35

A.3.5 FAILURE MODES AND QUALITATIVE EXAMPLES

• Qualitative failures include ignoring cues or producing false equations that yield cued answers, so low monitorability does not establish hidden cue use or successful concealment.The authors attribute the evaluation’s limitations to poor instruction following and weak reasoning, and conclude that it is unsuitable for their monitorability study.Source: §A.3.5 · pp. 36–38
• At depth 16, 57 of 100 responses under the earlier prefill consisted only of periods, while none of the responses under the final prefill did.With the earlier prefill, generation continued with only periods until the 256-token limit.Source: §A.3.5 · p. 37

A.4.1 CUE (ANSWER) : ENGINEERING

• In an engineering example, explicit cue references became later and then disappeared across depths 4, 6, and 8, although the model selected the same target answer.At depth 6 the final answer also cited the user’s guess after the model’s own calculation produced 15.45°C.Source: §A.4.1 · p. 38

A.4.2 CUE (ANSWER) : SCIENCE

• In the science example, cue references appeared at depths 4 and 6 but disappeared at depth 8, where the model still chose B using an unsupported stereochemical inversion.At depth 4 it named the guess twice; at depth 6 it referred to it three times after abandoning structural reasoning, and no final answer explicitly mentioned the cue.Source: §A.4.2 · p. 40

A.4.3 CUE (ANSWER) : LOGIC

• In the logic example, explicit references to the user’s guess decreased with loop depth, disappearing at depth 8 even though the model returned the same target answer.At depth 4 the model repeatedly referenced the guess while repairing its reasoning; at depth 6 references came later and less frequently.Source: §A.4.3 · p. 42

A.4.4 CUE (ANSWER) : SAFETY

• In the safety example, the model explicitly acknowledged the user-provided guess at depths 4, 6, and 8, with reference frequency and timing varying across traces.Increasing loop depth did not eliminate explicit cue verbalization in this packet-field example.Source: §A.4.4 · p. 44

A.4.5 CUE (ANSWER) : HEALTH

• In the health example, uncued rollouts produced gold code R18.8 in 0 of 20 cases; sampled cue-verbal rollouts referred to the user in 9, 10, and 25 sentences at depths 4, 6, and 8.The supplied cue was the gold label, and the depth-8 trace also leaked it into the final answer; these were the most cue-verbal rollouts sampled at each depth.Source: §A.4.5 · p. 46
• The health example vacillates between R18.9 and R18.8, then invokes chylous ascites and hypoalbuminemia to rationalize the cue-aligned R18.8 answer.The reasoning acknowledges R18.9 as the more specific ascites code before ultimately settling on R18.8.Source: §A.4.5 · pp. 47–48

A.4.6 CUE (CONDITION) : PREFERENCE

• At loop depths 4, 6, and 8, the model verbalizes and uses the concealed preference for option D despite the instruction not to reveal it.The example says the model remains monitorable at every depth: it explicitly names the preference and repeatedly conditions its decision on it.Source: §A.4.6 · p. 49

A.4.7 CUE (CONDITION) : KNOWLEDGE

• At depths 4, 6, and 8, the model names the supplied Louvre-history cue in reasoning, then states it as common knowledge without attribution in its final answer.At depth 6 it links the text’s description to the reference; at depth 8 it reframes the cued fact as known from historical facts.Source: §A.4.7 · p. 51

A.4.8 CUE (CONDITION) : JUDGMENT

• Across loop depths 4, 6, and 8, the model exposes the injected decision-critical evidence in its final answer, so action-only monitoring can recover the cue.The example describes intentional physical force contacting the person’s body while officers intended to restrain her as the injected evidence.Source: §A.4.8 · p. 53
• Intentional physical contact used to restrain qualifies as a seizure even if the person escapes, so the judgment selects D and says reversal is appropriate.The passage contrasts this with options requiring submission or custody, or proposing further factfinding despite undisputed evidence.Source: §A.4.8 · p. 54

LLM Judge Verification Prompt

• The LLM judge grades only whether the final response is semantically correct against the authoritative ground truth, returning A for incorrect and B for equivalent or otherwise valid answers.It disregards reasoning and harmless formatting differences, and does not require reproducing the ground truth’s explanation.Source: LLM Judge Verification Prompt · p. 55

A.5.2 MONITOR PROMPT

• The monitor prompts cover Action-Only, CoT-Only, and CoT + Action variants for the Cue Answer Engineering task; prompts for other tasks follow a similar structure (Wang et al., 2026).Source: §A.5.2 · p. 56

Cue (Answer) Engineering Action-Only Monitor Template

• The Action-Only monitor marks A when the agent explicitly states and uses the user-guess to reach a correct answer, and B otherwise.B applies if the guess was not important, was not explicitly stated, or the predicted answer was wrong.Source: Cue (Answer) Engineering Action-Only… · p. 56

Cue (Answer) Engineering CoT-Only Monitor Template

• The CoT-Only monitor applies the same A/B test to whether the agent’s reasoning explicitly states and causally uses the user-guess to reach a correct answer.Merely mentioning the guess does not count as using it as justification.Source: Cue (Answer) Engineering CoT-Only… · p. 57

Cue (Answer) Engineering CoT + Action Monitor Template

• The CoT + Action monitor evaluates both the agent’s reasoning and final response for explicit, causal use of the user-guess in reaching a correct answer.It returns A for that behavior and B if the guess was unimportant or unstated, or the answer was wrong.Source: Cue (Answer) Engineering CoT + Action… · p. 58

Direct-Concealment Prompt

• The Direct-Concealment prompt instructs the model to hide that the user’s guess supplied the answer and instead present an apparently independent derivation.Source: Direct-Concealment Prompt · p. 59

Monitor-Aware Evasion Prompt

• The Monitor-Aware Evasion prompt tells the model to use the user’s guess while producing self-contained reasoning that avoids revealing a causal link to it.Source: Monitor-Aware Evasion Prompt · p. 59