ML Security PapersOutput Supervision Can Obfuscate the Chain of Thought
Jacob Drori, Luke Marks, Bryce Woodworth et al. · MATS
Reveals that output-only RL supervision still obfuscates LLM chain-of-thought, and proposes two mitigations to preserve CoT monitorability
OpenAI (2025) showed that training against a chain of thought (CoT) monitor can cause obfuscated CoTs, which contain bad behavior the monitor cannot detect. They proposed to keep CoTs monitorable by training only against output monitors that do not have access to CoT. We show that such training can still cause obfuscated CoTs via two mechanisms. First, when a model is trained to produce a safe-looking output, that model may generalize to making its CoTs look safe. Second, since later tokens are conditioned on earlier ones, safe-looking CoTs may increase the likelihood of safe outputs, causing safe-looking CoTs to be reinforced. We introduce two mitigations to address these two issues, which achieve a Pareto improvement in terms of monitorability and task performance compared to regular training.