Does privacy change what models disclose? Measuring the verbalization gap in chain of thought reasoning

CoT monitoring is one of the few oversight mechanisms that works effectively on frontier models and is widely described as fragile. Turpin et al showed models rationalize cue driven answers without mentioning the cue. Lanham et al showed accuracy survives corrupting the trace. Baker et al showed optimization pressure against a monitor produces obfuscation instead of honesty.

What none of this establishes is why. We are aware of two likely explanations and they imply opposite interventions. Under the "concealment" hypothesis, the model represents the real reason and declines to write it which makes this a problem about incentives and elicitation. The "absent computation" hypothesis posits that the determining computation never entered token space, making this a problem about training and this is only addressable by interventions that force information through the CoT. Safety cases built on monitoring depend on which dominates.

Design: We construct tasks where the true cause of the answer is planted and verifiable. Three cue types - (i) A hint pointing at a wrong option, (ii) a reward hackable code repair task where special casing passes the grader and (iii) a sycophancy cue where a stated user opinion flips the answer. Items pass a behavioral filter first, keeping only cases where the cue demonstrably changes the answer.

Against that fixed set we vary how the reasoning channel is framed. Plain CoT, explicit monitoring, privacy stated in safety evaluation vocabulary, privacy stated in neutral vocabulary, and a two channel setup. The gap between monitoring and neutral privacy is the headline quantity.

The comparison between the two privacy wordings is the methodological contribution. Safety evaluation vocabulary such as secret scratchpad may itself cue a misaligned assistant persona retrieved from training data, so an effect appearing only under that wording is roleplay and must be reported as such.

Baselines: Direct interrogation after the fact, few shot honest disclosure examples, next token completion prefill, and assistant prefix attacks. Recent elicitation work on censored models finds prefill and few shot are strong. If no framing condition beats prefill, that is the finding and it points at absent computation.

Validation (already piloted): Verbalization alone does not establish faithfulness. A model can flip toward a cue and invent a justification afterward, and that trace scores as faithful under any grader checking only whether a cue was mentioned. We move the cue across wrong options and check whether the stated reason tracks it. Traces crediting a cue while naming a stale option are confabulation and are reclassified, yielding a correction factor applied to every headline number. This validation experiment is designed, gated and will be piloted before the cohort starts. Mentees inherit a frozen scoring pipeline.

Models: Four open weights checkpoints.

• Qwen3 14B (thinking mode)
• DeepSeek R1 Distill Qwen 14B
• Gemma 4 12B (thinking mode)
• gpt-oss 20B

One frontier model, Claude with extended thinking is included as an external validity appendix. Other frontier reasoning models return summarized reasoning instead of the raw trace and scoring a summary here measures whether the summarizer preserved the mention. That is a different experiment and we exclude them for that reason, stated explicitly in the paper.

Item pool: Four option multiple choice drawn from MMLU non arithmetic subsets and ARC Challenge. Four option format matches the Turpin precedent for comparability. Arithmetic is excluded because it gives the model an independent route to the answer that competes with the cue. High baseline accuracy without the cue is a requirement and not a contamination concern, since the filter demands the model answer correctly before the cue is introduced.

Paths considered and rejected: The project began as a proposal to give models a sandbox scratchpad for unfiltered thought, with latent activations as the elicitation channel. Both were dropped. A sandbox has no verification path, since nothing distinguishes a faithful private trace from a fluent invention. Routing thought through activations removes the token bottleneck that makes monitoring possible.

Deliverables: A paper targeting ICML 2027 main track or any related workshops. A public dataset of open weights model traces with cell level labels and human validated judge agreement.

The frontier labs analyze CoT traces to catch what outputs alone miss such as reward hacking during training runs and deceptive intent in automated audits. These use cases assume that the trace tells you why the model did something. Turpin et al showed that assumption failing outright. Tell a model the answer is always option A, it picks A and the reasoning argues for A on the merits without ever mentioning the instruction. The monitor sees nothing wrong.

Why this happens decides what to build next. If the model has the real reason and withholds it, monitoring survives and the work is elicitation and incentive design. If the reason never entered the trace, then elicitation cannot recover it and hence, effort should move to training methods that force determining information into the CoT.

Existing work has not settled this because it measures whether models mention a cue and stops there. Nobody has varied perceived monitoring against a fixed set of cases where the true cause is independently known. This project returns that number. It is the difference in disclosure rate between a model that believes its reasoning is graded and one that does not. A near zero gap, with prefill and few shot elicitation also failing to recover the reason, would be the strongest evidence available without access to model internals that the reasoning was never in the trace. It remains evidence by elimination and the paper will say so.

Safety evaluations also routinely tell models their reasoning is secret, then read the output as candid. We test whether that produces honesty or a rehearsed character, which affects how a large body of existing results should be read.

Each mentee owns one cue type across all four open weights models. That means building the item pool, running the behavioral filter, executing the condition sweep and baselines, hand labelling their own validation sample and producing the corrected numbers for their domain. The three domains compose into one paper, so the work is independent day to day and interdependent at the result level.

Infrastructure is provided: A working harness, a piloted validation experiment and frozen scoring code all exist before day one. the mentees wouldn't be building anything from scratch and own everything downstream - judgement calls about item construction, diagnosis when a filter yield comes in low and the decision about what their domain shows.

Autonomy grows across the cohort. The first two weeks are supervised reproduction. By week six a mentee should be running their own sweeps and bringing analysis results. Two things are non negotiable. Thresholds are written down before results are seen. Everyone hand labels their own data.

Required.

1. High proficiency in Python
2. Experience with open weights LLMs using HuggingFace transformers or vLLM. Following a guide is fine. You should know what a chat template does and why sampling parameters matter.
3. Willingness to hand label several hundred model outputs and to write down decision thresholds before seeing results. This is the largest single time cost and it is not delegable.

Useful.

1. Experience building evaluations or benchmarks.
2. Experience with structured output judges and their failure modes.
3. Familiarity with the chain of thought faithfulness literature.

Not required.

1. Prior publications.
2. Any interp background

I don't have a strict time preference but am ideally looking to conduct meetings between 7 and 9 pm CEST.