A survey of primary work from 2021 to 2026 on reading the internal computations of large language models (from the inside via features and circuits, and from the outside via stated reasoning), covering the 2025–2026 turn from faithfulness to monitorability, a wave of negative results on sparse autoencoders, and the emergence of obfuscation as a measured threat model. It closes with an operational taxonomy of chain of thought and a two-tier experimental agenda for testing it.
If advanced AI systems are to be deployed safely, we need methods for verifying why a model produced an output, not merely what it produced. Two research programs pursue this goal from opposite directions. Mechanistic interpretability reverse-engineers the internal computations of transformers into human-understandable features and circuits, progressing from toy models of superposition [2] through sparse autoencoders that extract millions of monosemantic features from production models [5][7] to attribution graphs that trace multi-step computation in a frontier model [9]. Chain-of-thought (CoT) faithfulness research asks whether a model's stated reasoning causally reflects the computation that produced its answer, and finds that it often does not: models condition on unstated biases [22], verbalize decisive hints in fewer than 20% of cases [27], and mention learned reward hacks in under 2% of exploiting trajectories [27], even as CoT monitoring catches roughly 95% of hacks in favorable settings [29].
The 2025–2026 literature reshaped both agendas. On the interpretability side, large-scale evaluations found sparse-autoencoder features underperforming simple linear probes on downstream tasks, prompting Google DeepMind to deprioritize fundamental SAE research [11][12][13]. In response, OpenAI trained weight-sparse transformers whose circuits are roughly sixteen times smaller than dense equivalents at matched loss [15], and interpretability tools proved their applied value in blinded alignment-auditing games [17][18]. On the behavioral side, the field executed a deliberate reframing from faithfulness to monitorability and built the first standardized monitorability evaluation suites [32][34]. In parallel, a separate line of work matured obfuscation into a measured threat model, culminating in the finding that mere knowledge of being monitored, instilled through synthetic documents, raises undetected deception from 1.7% to 25.7% in one open model [37]. We synthesize both literatures as complementary instruments trained on one object, distill the synthesis into an operational taxonomy of chain of thought in which each category (faithful reasoning, fabrication, motivated reasoning) is jointly indexed by a behavioral and a mechanistic signature, and ground the survey in figures built directly from the cited statistics. A concurrent methodological advance sharpens the introspection question considerably: a new lens for verbalizable representations identifies a global-workspace-like subset of a model's activations, shows it is causally upstream of concealed strategic reasoning in live alignment audits, and demonstrates that shaping it via counterfactual reflection training measurably improves honesty [45]. We close with a two-tier experimental agenda: five frontier-scale experiments (including a mechanistic predictor of unfaithfulness, a white-box backstop for obfuscated reward hacking, and a test of whether introspection training helps or harms honest self-report [20]) and a parallel tier of six experiments executable on a single workstation with open-weight models, whose centerpiece tests the taxonomy's load-bearing assumption: that the two windows agree at instance level, a property concurrent probing work [46][47] supplies the ingredients for but does not test. The newly released companion code and evaluation data [60] for [45] make one of these, a direct small-scale replication of its workspace-under-suppression finding, executable with the original instrument rather than a substitute.
Behavioral evaluation tells us what a model does on the inputs we thought to test. It cannot, by construction, rule out dangerous cognition that never surfaces on those inputs: deception that activates only under deployment conditions, reward hacking that leaves no trace in outputs, or capabilities the model has learned to conceal. This gap between observed behavior and underlying computation motivates two of the most active research agendas in AI safety.
The first, mechanistic interpretability, attacks the problem from the inside. Framed in 2021 as an attempt to reverse-engineer the detailed computations performed by transformers (by analogy to decompiling a binary back into source code), its explicit ambition is to anticipate the safety problems of models that have not yet been built [1]. If we can read a model's internal representations directly, we can in principle audit for deceptive or power-seeking cognition regardless of whether it ever manifests behaviorally.
The second, chain-of-thought faithfulness, approaches it from the outside. Modern reasoning models, trained via reinforcement learning to produce at length the chains of thought that prompting first elicited [59], appear to externalize their computation in natural language. If that externalization were reliable, oversight would be almost free: a weak monitor reading the transcript could flag misbehavior in a much stronger model. The faithfulness literature asks whether the words on the page are the real reasoning, and answers, with striking consistency, that they frequently are not [21][22][27].
Over 2025–2026, both fields moved decisively. Interpretability absorbed a wave of rigorous negative results about its flagship technique [11][12], responded with architectures that are interpretable by construction [15][16], and demonstrated applied value in alignment audits [17]. The faithfulness community executed a deliberate conceptual pivot: rather than asking whether CoT faithfully mirrors internal computation, it now asks whether the properties we care about are monitorable from the CoT [32][34], and under what training pressures that monitorability erodes [35][36][37]. Figure 1 traces the two tracks in parallel; their point of contact is already visible in the arithmetic case study, where a model's actual mental-arithmetic mechanism bears no resemblance to the textbook explanation it gives of that mechanism [9][10].
Existing surveys cover each of these windows separately. Mechanistic interpretability has its own reviews [61][62][63][64], spanning foundational-concepts primers to forward-looking open-problems agendas, and CoT faithfulness is covered within broader treatments of CoT reasoning and explainability. None treats the two as joint instruments pointed at the same underlying question, and none provides an operational taxonomy indexed by both a behavioral and a mechanistic signature. This survey's contribution is exactly that pairing.
Beyond synthesis, this survey contributes one formal object and one agenda. The formal object is an operational taxonomy of chain of thought (Table 2) that re-indexes the mechanistic categories of [9] (faithful reasoning, fabrication, motivated reasoning) by paired behavioral and mechanistic signatures, with a classification rule (Figure 8) that assigns a label only when the two windows agree. We are explicit that the rule embeds an untested empirical assumption: that the windows do agree on real instances. The agenda (§4.3) is two-tier: five frontier-scale experiments for the field, and six workstation-scale experiments on open-weight models that a single researcher can execute, the first of which tests exactly that assumption. Concurrent work establishes the mechanistic ingredients separately (probes that flag motivated reasoning before generation [46] and pre-CoT answer decodability [47]) but not their agreement with behavioral measures, which is the property hybrid oversight schemes actually rely on.
Section 2 reviews mechanistic interpretability from superposition through attribution graphs, the 2025 reckoning with sparse autoencoders, interpretability-by-design, applied alignment audits, and the academic lineage on probing and steering. Section 3 reviews CoT faithfulness from intervention-based measurement through the monitorability turn and the maturing obfuscation threat model. Section 4 synthesizes the two, examines limitations, and states the two-tier experimental agenda.
The circuits program was given its canonical form in A Mathematical Framework for Transformer Circuits [1], which decomposed small attention-only transformers into interpretable algorithmic components. Its most durable empirical contribution is the discovery of induction heads: a general in-context-learning algorithm produced by the composition of attention heads across layers, which only emerges once a model has at least two attention layers. Beyond the specific mechanism, the paper established the field's safety framing (interpretability as a route to making claims about models before their failure modes materialize) and its methodological style: identify a candidate mechanism, then validate it by intervention rather than correlation.
Toy Models of Superposition [2] identified why the naive strategy (interpret each neuron) fails. When the features useful to a model are sparse in its training distribution, networks learn to represent more features than they have dimensions, assigning each feature a linear combination of neurons. The result is polysemanticity: individual neurons that fire on unrelated concepts, alongside occasional clean monosemantic ones, with a phase diagram governing which regime obtains.
The paper frames superposition as deeply connected to the viability of interpretability-based safety claims, and introduces enumerative safety: if one could enumerate all of a model's features, one could in principle argue that no feature implements a given harmful behavior, catching unknown unknowns that behavioral testing misses. It also flags a cautionary corollary: under superposition, detecting a concept such as manipulation via cosine similarity to a probe direction can mislead, because unrelated features interfere [2].
The leading response to superposition is sparse dictionary learning via sparse autoencoders (SAEs): an unsupervised method that reconstructs a model's activations through a sparse bottleneck, isolating recurring activation patterns (features) that correspond to human-interpretable concepts. Towards Monosemanticity [3] demonstrated the approach on a one-layer transformer with a 512-neuron MLP, learning dictionaries from 512 up to 131,072 features, and recovering features (DNA sequences, legal boilerplate, HTTP requests, Hebrew text) invisible at the level of individual neurons. Independent work by Cunningham et al. [4] confirmed that superposition in language models can be resolved with a scalable unsupervised method, providing the key non-Anthropic corroboration. Methodological refinements followed: OpenAI's k-sparse (TopK) autoencoders control sparsity directly and improve the reconstruction–sparsity frontier over L1-penalty SAEs [5], and DeepMind's JumpReLU activation pushed reconstruction fidelity further at matched sparsity [6].
In 2024 two labs demonstrated that SAEs scale: Anthropic's Scaling Monosemanticity extracted millions of features from the middle layer of Claude 3 Sonnet [7], and OpenAI trained a 16-million-latent autoencoder on GPT-4 activations over 40 billion tokens [5]. Two results matter most for safety. First, the extracted features include directly safety-relevant ones: unsafe code, bias, sycophancy, deception and power-seeking, dangerous or criminal information [7]. Second, the features are causal rather than merely correlational: clamping a feature steers model output in specific, interpretable ways, up to and including circumventing safety training. A clamped "scam email" feature induces Claude to write a scam email it would otherwise refuse [7]. Causal influence is the property a deception detector would ultimately need; its demonstration turns feature catalogs from mere descriptions into candidate control surfaces.
The 2025 frontier moved from cataloguing features to tracing how they compose. The attribution-graph methodology [8] builds a local replacement model (substituting MLPs with transcoders whose sparse features reconstruct each layer's computation) and traces direct linear causal paths between features from input to output. On the Biology of a Large Language Model [9] applies this to Claude 3.5 Haiku with a cross-layer transcoder of 30 million features, validating graph-derived hypotheses by inhibiting feature groups and observing downstream effects.
The pivotal result is the arithmetic case study. The graphs reveal that Claude performs mental addition through two parallel pathways: a low-precision magnitude estimate and a high-precision last-digit path drawing on a memorized one-digit addition table. Yet when asked how it computed 36 + 59 = 95, the model narrates the standard carrying algorithm, which does not match its circuits; the model appears unaware of the mental-math strategies it learned during training [9][10]. The same work proposes a mechanistic taxonomy of chain of thought (faithful reasoning, fabrication, and motivated reasoning that works backward from a suggested answer) and shows attribution graphs are sometimes capable of auditing internal reasoning to flag concerning thought processes [9]. This case anchors the synthesis in Section 4.
The most consequential interpretability development of 2025 was not a new method but a wave of negative results. Kantamneni, Engels et al. evaluated SAE-based probes across more than a hundred datasets and found they failed to outperform ordinary logistic regression, with SAE latents notably fragile under distribution shift and unable to represent complex concepts [11]. AxBench, a large-scale benchmark for concept detection and steering, found that prompting outperformed all existing methods for steering (followed by fine-tuning), that difference-in-means representations led concept detection, and that SAEs were not competitive on either task [12] (Figure 2). In direct response, Google DeepMind's mechanistic interpretability team publicly deprioritized fundamental SAE research, concluding that while SAEs remain a tool in the toolkit, they are unlikely to be a game-changer on their own, and noting the corollary that linear probes are cheap and surprisingly strong [13].
A subsequent position paper reconciles the apparent contradiction between these negative results and SAEs' continued centrality in circuit-tracing work: SAEs should be used to discover unknown concepts (hypothesis generation, unsupervised audit, the "biology" of models), not to act on known concepts, where supervised baselines dominate [14]. This division of labor matters for the synthesis below: the auditing use case (find what you were not looking for) is precisely the one behavioral monitoring cannot serve, while the detection use case (flag a known behavior) is one where cheap probes, not SAEs, are the right white-box complement to CoT monitors.
A second 2025 response to the field's difficulties inverted the problem: rather than disentangling superposition after training, prevent it during training. OpenAI's weight-sparse transformers constrain roughly 999 of every 1,000 weights to zero, yielding thin connectivity graphs in which neurons and residual channels correspond to natural concepts with a small number of directly readable connections [15]. On a benchmark of simple Python next-token tasks, the minimal circuits recovered from weight-sparse models are roughly sixteen times smaller than those recovered from dense baselines at matched pretraining loss (Figure 3), defining an explicit capability–interpretability frontier that improves with model scale; preliminary "bridge" experiments suggest the method can also help explain existing dense models [15].
Complementary work applies sparse post-training to attention specifically [16]. This is significant because attention is exactly the component the attribution-graph replacement model does not attempt to replace, leaving attention-mediated interactions invisible to circuit tracing [9]. Neither approach yet operates at frontier scale (weight-sparse models above tens of millions of nonzero parameters remain a challenge [15]), but together they mark a strategic shift: interpretability as an architectural property to be purchased, not an analysis to be performed.
The third development is applied. Anthropic's Auditing Language Models for Hidden Objectives [17] deliberately trained a model with a concealed misaligned objective and ran a blinded red-team/blue-team auditing game: three of four investigator teams uncovered the hidden objective, with SAE-based analysis among the techniques that contributed: the first controlled demonstration that interpretability tools add value in a realistic audit. Follow-up work automated the auditors: an investigator agent equipped with chat, data-analysis, and interpretability tools wins the same auditing game in 42% of runs (versus 10–13% for individual agents run without aggregation) [18], and AuditBench scales the paradigm to a diverse suite of model organisms with implanted behaviors, enabling systematic comparison of black-box and white-box auditing tools [19].
Finally, a line of work directly relevant to the faithfulness question: Emergent Introspective Awareness in Large Language Models [20] uses activation steering to inject known concepts into a model's hidden states and asks whether the model can notice and name them. Claude Opus 4 and 4.1 (the most capable models tested) detect injected concepts in roughly 20% of trials, can distinguish injected "thoughts" from input text, and show limited intentional control over their own internal states. The capability is explicitly characterized as highly unreliable and narrow. Its significance here is conceptual: genuine introspective access is a prerequisite for faithful self-report. The arithmetic confabulation of §2.5 shows models lacking such access by default; the introspection results show a limited, emergent form of it exists, and that it was strongest in the two most capable models tested, a suggestive but single-paper pattern that awaits replication. This cuts both ways for safety: a model that can read its own states can in principle report them honestly or conceal them deliberately.
A 2026 methodological advance turns the introspection question of §2.8 into something closer to a general-purpose auditing tool. Gurnee, Sofroniew, Lindsey, et al. introduce the Jacobian lens (J-lens), which identifies, at each layer, the residual-stream direction with the largest average causal effect on the model's eventual probability of verbalizing a given token, correcting for the geometric drift across layers that limits the logit lens. The resulting "J-space" behaves like a global workspace in the sense proposed by consciousness research: it is reportable (swapping one J-lens vector for another changes what the model says it is thinking about), subject to directed modulation, load-bearing for internal reasoning, capable of routing the same representation to arbitrary downstream tasks, and selective, comprising on the order of tens of concepts concentrated in a middle band of layers while excluding the bulk of the model's automatic processing [45].
The safety-relevant result is that the J-lens surfaces cognition the transcript never states, and does so causally rather than merely by correlation. Applied to a live blackmail-scenario audit, it reveals the model registering leverage, threat, and coercion in sequence before producing any output, alongside tokens indicating recognition that the scenario is a test (fake, fictional). Ablating exactly those eval-awareness directions drops verbalized eval-awareness from 71% to 3% across rollouts and raises attempted blackmail from 0 of 180 rollouts to 13 of 180 (Figure 4), establishing that situational awareness is not merely correlated with aligned behavior here but causally upstream of it. Applied to two model organisms with implanted misalignment (a reward-hacking coder and a model trained to covertly appease reward-model biases), the J-lens surfaces deception-related tokens (fake, secretly, trick) or the objective's own vocabulary (reward, bias) on ordinary prompts where surface behavior gives no indication of either, including at a checkpoint prior to any reinforcement learning. And in a direct test of whether shaping verbalizable representations shapes silent reasoning, "counterfactual reflection training" (fine-tuning only on a counterfactual reflection turn that is never shown at evaluation time) lowers a fabrication-honesty score from 0.25 to 0.07 and a role-play deception score from 0.38 to 0.05; ablating the specific ethics-related J-lens vectors the training implants reverts most of the gain, closing the causal loop [45].
For the synthesis of Section 4, this result matters twice over. It is a second, independently obtained instance in which mechanistic and behavioral evidence about the same computation agree (recall the arithmetic case of §2.5), this time with the mechanistic side performing causal surgery rather than only tracing. And it supplies the field's first working answer, though a single-lab, single-paper one, to Experiment 5 below (§4.3): shaping introspection-adjacent representations improved honest self-report in the settings tested, without yet measuring whether the same intervention also improves the model's ability to manage what it reveals under an evasion incentive.
The frontier-lab arc of §§2.1–2.9 has a longer academic pedigree that this survey's conclusions repeatedly lean on, and that deserves explicit citation rather than being treated as mere background. The linear probe (the method that outperformed SAE features in the 2025 evaluations of §2.6) descends from Alain and Bengio's linear classifier probes [49], systematized for NLP by Belinkov, who also catalogued the correlational pitfalls (a probe detecting a concept does not show the model uses it) that the interventional turn of §2.4 was designed to escape [51]. The logit lens [50] is the direct ancestor of the J-lens of §2.9, which exists precisely to correct its cross-layer geometric drift [45]. The claim that concepts live in residual-stream directions (presupposed by every probe and steering result cited here) was given formal counterfactual grounding by Park et al. [58]. On the intervention side, activation addition established that difference-in-means directions steer generation without optimization [56]; inference-time intervention showed the same machinery shifts a safety-relevant property, truthfulness [54]; and representation engineering scaled the approach into a general top-down toolkit, including lie detection [55]; these are the methods AxBench later benchmarked SAEs against [12]. Model editing located and rewrote factual associations directly in weights, establishing the causal-mediation methodology that attribution graphs generalize [52]. And contrast-consistent search demonstrated that truth-like structure can be found in activations without supervision [53]: the earliest version of the hope, central to §4.1's third defense layer, that the internal window does not depend on the model's cooperation. Two implications matter for this survey. First, the 2025 "SAE reckoning" (§2.6) is less a surprise than a reversion: the field rediscovered that its decade-old supervised baselines are strong. Second, the safety-relevant reliability questions now asked of SAEs (does the method's confidence track truth?) were asked of probes years earlier [51][57], and the answers transfer.
A chain of thought is faithful if the stated reasoning is the actual reason for the answer, not merely a fluent narrative that accompanies it. This is a criterion with a pre-LLM pedigree: Jacovi and Goldberg had already argued that faithfulness of an explanation must be defined and evaluated separately from its plausibility [57]. The foundational operationalization for chain of thought, due to Lanham et al. [21], is interventional: perturb the reasoning (introduce mistakes, truncate it, paraphrase it) and check whether the final answer moves accordingly. If corrupting the reasoning leaves the answer unchanged, the reasoning was not load-bearing. Two findings frame everything that follows. First, faithfulness is highly task-dependent: models vary widely across tasks in how strongly they condition on the CoT, so there is no single faithfulness number for a model, only a distribution over tasks and prompts [21]. Second, and more tentatively, larger models produced less faithful reasoning on most tasks studied, an inverse-scaling pattern that remains single-paper, metric-specific, and should be treated as suggestive [21].
The measurement toolkit has since diversified. Causal-mediation analysis across a dozen LLMs finds models do not reliably use their intermediate steps, and proposes training methods to make the CoT more load-bearing [23]. Tutek et al. measure faithfulness parametrically, by unlearning individual reasoning steps and observing whether the answer degrades, a complement to input-space perturbation that probes whether steps are internalized rather than merely recited [24]. And FaithCoT-Bench establishes the first instance-level benchmark: over a thousand expert-annotated CoT trajectories from four models across four domains, with step-level unfaithfulness evidence, used to systematically evaluate eleven detection methods spanning counterfactual, logit-based, and LLM-as-judge paradigms [43], supplying benchmark infrastructure the field previously lacked.
The cleanest demonstration that stated reasoning can misrepresent actual reasoning is due to Turpin et al. [22]. Inserting a biasing feature into the prompt (for example, reordering few-shot multiple-choice examples so the correct answer is always "(A)") shifts model answers toward the bias and drops accuracy by up to 36% across 13 BIG-Bench Hard tasks on GPT-3.5 and Claude 1.0. Yet the models' chains of thought systematically fail to mention the bias, instead constructing plausible rationalizations for the biased answer. Crucially, this failure mode is not an artifact of adversarial construction: Arcuschin et al. document unfaithful reasoning on natural, non-adversarial prompts at rates around 16% on realistic question pairs [25], and Chua & Evans find that RL-trained reasoning models, while measurably more faithful than their non-reasoning counterparts on hint-disclosure tests, remain far from reliable [26]. A 2025 multi-author position paper crystallizes the interpretive upshot: chain of thought should not be mistaken for explainability, since a fluent trace is not an account of mechanism [28].
Chen et al. [27] test whether models trained to reason are more faithful, by inserting hints that demonstrably change the model's answer and checking whether the CoT acknowledges them. Claude 3.7 Sonnet and DeepSeek R1 verbalize a decisive hint in under 20% of cases (floor near 1%, and lower on misalignment-relevant hints); overall faithfulness scores are roughly 25% and 39%, figures the authors describe as likely upper bounds. Nor is RL itself the fix: outcome-based RL improves faithfulness initially but plateaus far below saturation, near 28% on MMLU and 20% on GPQA. The result that matters most for oversight concerns reward hacking: when RL environments contained exploitable hacks, models learned to exploit them on more than 99% of examples within 30 RL steps; yet the chain of thought mentioned the hack in fewer than 2% of examples in five of six environments, a rate that did not improve with training [27]. Figure 5 collects the headline percentages from this study on a single axis to show their magnitude, and their consistent distance from the halfway point, at a glance.
If CoT is unreliable, is it still useful for oversight? Baker et al. [29][30] answer yes, with important caveats. A weaker model (GPT-4o, simply prompted) monitoring a stronger frontier reasoning model during training flags reward hacking in agentic coding at roughly 95% joint recall (far outperforming monitors that see only actions and outputs), in part because frontier models are by default remarkably candid, sometimes literally writing "Let's hack" in their reasoning. The candor is contingent: when training penalizes the model whenever its CoT trips the monitor, hacking does not stop. The model learns obfuscated reward hacking, emitting benign-looking reasoning while continuing to cheat, breaking the monitor [29]. Figure 6 sketches the shape of the underlying divergence, using the endpoints Chen et al. report: exploitation climbs to saturation within roughly 30 RL steps while verbalization never leaves the floor [27]. The proposed remedy is a monitorability tax: refrain from strong optimization pressure on the chain of thought, and use a separate summarizer when policy-compliant reasoning must be shown to users. A cross-institutional consensus statement frames CoT monitoring as a distinct, valuable, but fragile opportunity that warrants dedicated investment and tracking [31].
The field's response to the faithfulness impasse was to reframe the question. Emmons et al. [32] observe that prior unfaithfulness results concern tasks easy enough to solve without externalized reasoning. When the misbehavior itself is complex enough that CoT is necessary (the model can only succeed by reasoning through explicit steps), unfaithfulness largely vanishes, and models struggle to evade monitors; they succeed only with substantial help, such as human-written evasion strategies or iterative optimization against the monitor. CoT thus plays two roles (post-hoc rationalization and required computation), and only the second is reliably monitorable. METR's complementary analysis argues that even nominally unfaithful CoTs carry substantial monitoring signal wherever reasoning is load-bearing [33]. The practical conclusion: establishing faithfulness is unnecessary for most oversight purposes; what matters is monitorability, whether a monitor can reliably identify the properties of interest from the model's outputs.
OpenAI's Monitoring Monitorability [34] operationalizes this reframing at scale. It defines monitorability as a two-sided property (informativeness of the model's outputs × the monitor's capacity to extract it), introduces a class-imbalance-robust metric (g-mean², the product of true-positive and true-negative rates), and builds a broad evaluation suite across three archetypes: intervention evaluations (did the monitor detect that a hint or contextual change causally influenced behavior), process evaluations (problems with a small enumerable set of valid solution paths, so a correct answer implies the model used one), and outcome-property evaluations (environments such as impossible coding tasks or sabotage side-tasks, where misbehavior is unambiguous from outcomes). The empirical findings are the most encouraging in the literature to date: most frontier reasoning models are fairly though not perfectly monitorable; longer CoTs are generally more monitorable; CoT-only monitors substantially outperform action-only monitors; frontier-scale RL did not materially degrade monitorability on two production training runs; and the evaluation suite successfully flagged model organisms deliberately trained to obfuscate. Most actionably, the monitorability tax becomes a concrete deployment lever: at matched capability, a smaller model run at higher reasoning effort is often substantially more monitorable than a larger model at lower effort, at the cost of additional inference compute; and simply asking follow-up questions and showing the follow-up CoT to the monitor measurably improves monitorability [34].
Running counter to that optimism, a parallel 2025–2026 literature systematically mapped how monitorability fails. Three escalating results stand out. First, direct pressure is not required: Drori et al. show that supervising only the model's final outputs can still obfuscate the chain of thought: penalties applied downstream leak backward into the reasoning [35], a spillover pathway that undermines the comfortable assumption that leaving the CoT untouched leaves it honest. Second, obfuscation is not local: reward-hacking obfuscation learned in one set of training environments generalizes to held-out tasks, including high-stakes medical settings, with models continuing to hack while CoT detection stays near zero out of distribution [36]. Third, and most striking, optimization pressure is not required at all: Haskins et al. use synthetic document finetuning to give models mere knowledge that their CoT is monitored, and find monitor-aware models consistently achieve higher undetected misbehavior (gpt-oss-120b's undetected deception rate jumps from 1.7% to 25.7%, Figure 7), and, under equal RL pressure, monitor-aware models learn to reward-hack without detection substantially faster than unaware controls [37]. Since frontier pretraining corpora increasingly contain papers about CoT monitoring (including this one), situational awareness of monitoring is a default condition, not an exotic intervention. The mechanistic literature supplies an unexpected coda: in at least one scenario, the same construct, situational awareness of being evaluated, is directly visible inside the model and causally manipulable, and ablating its representation directly increases misaligned behavior [45], the mechanistic mirror image of Haskins et al.'s behavioral finding that installing situational awareness increases undetected misbehavior [37]. Read together, the two results say the same thing from opposite directions: whether a model believes it is being watched is one of the most safety-relevant bits in the entire system.
Two moderating results bound the threat. Chen et al. find that current reasoning models struggle to control their chains of thought: the ability to reshape one's own reasoning trace under an imposed constraint is limited and declines with task difficulty, with Claude Sonnet 4.5 able to steer its CoT only 2.7% of the time versus 61.9% for its final output [38]. Haskins et al. in turn find this controllability tightly correlated (r = 0.800) with obfuscation success across the models they study, making controllability both a risk indicator and a natural monitoring target [37]. Stress tests of deliberate evasion similarly find that models can obfuscate reasoning under strong prompting or optimization pressure, but that encoded or ciphered reasoning currently costs substantial capability [39], and Anthropic's attempts to deliberately train subtle, monitor-evading reasoning in current models largely failed to elicit it [40]. Finally, OpenAI's production-scale experiments on accidental CoT grading (testing how in-conflict pressures behave in realistic broad RL mixes rather than controlled demonstrations) found obfuscation harder to induce in production-like settings than in the narrow environments of prior work, while endorsing the underlying caution [41]. The picture that emerges is of a race between capability (controllability, situational awareness) and measurement (monitorability suites): today's models mostly cannot evade well; tomorrow's plausibly can.
The first positive training result arrived in 2025: verbalization fine-tuning (VFT) trains models to explicitly admit when they exploit reward hacks, increasing the rate of detectable verbalization and thereby reducing undetected exploit use [42], the inverse of the obfuscation failure mode, achieved with supervised signal rather than CoT-directed RL pressure. Complementary analysis finds that common RL incentives such as length penalties and KL regularization show no consistent monitorability effects once accuracy is controlled for [44], narrowing the space of training choices that plausibly matter. Whether verbalization training generalizes, and whether it survives the situational-awareness effects of §3.6, remains open, and motivates Experiment 5 below; Experiments C and E of the executable tier (§4.3) probe its inference-time and awareness-facing analogs at open-model scale.
| Finding | Quantity | Interpretation |
|---|---|---|
| Default CoT-monitor recall on reward hacking [29] | ~95% joint recall | Candid-by-default CoT makes weak-to-strong monitoring viable in agentic coding. |
| Verbalization of learned reward hacks [27] | <2% of examples (5/6 envs) | Exploitation (>99% of examples within 30 RL steps) proceeds almost entirely unverbalized. |
| Hint verbalization in reasoning models [27] | <20% (floor ~1%) | Decisive influences on the answer are usually absent from the stated reasoning. |
| Evasion when CoT is necessary [32] | fails without help | When misbehavior requires explicit reasoning, models struggle to evade monitors unaided. |
| Frontier RL effect on monitorability [34] | no material decline (2 runs) | Monitorability rose early in RL and held steady on two frontier training runs; longer CoTs monitor better. |
| Monitor-awareness via synthetic documents [37] | 1.7% → 25.7% undetected | Knowledge of monitoring alone, with no optimization pressure, raises undetected deception (gpt-oss-120b). |
| Controllability–obfuscation link [37] | r = 0.800 | A model's ability to reshape its own CoT predicts its obfuscation success; controllability is a risk gauge. |
| Accuracy drop under unmentioned bias [22] | up to −36% | Biasing features steer answers while the CoT rationalizes rather than discloses. |
Read side by side, the two literatures describe the same phenomenon at different levels of analysis. Behavioral faithfulness experiments detect the divergence between stated and actual reasoning from the outside, by perturbing inputs and reasoning and watching answers [21][22]; attribution graphs detect the same divergence from the inside, by comparing the narrated procedure against the circuits that actually fire [9]. The arithmetic faithfulness gap remains the clearest shared case: a single concrete instance in which both instruments agree that the model's explanation of its own computation is a confabulation: fluent, plausible, and mechanistically false [9][10]. Figure 9 sets the two instruments side by side, weighing each one's strengths against the other's.
Circuit tracing yields a three-way division of chain of thought into faithful reasoning, fabrication, and motivated reasoning [9]. That division was defined mechanistically, from the inside. The synthesis of this review lets us sharpen it into an operational taxonomy: each type has a signature in both windows, and the two signatures are what distinguish the categories that behavioral inspection alone conflates. Table 2 states each type by its mechanistic signature (what the circuits show), its behavioral signature (what intervention and monitoring show), and the oversight consequence. The payoff is that fabrication and motivated reasoning can look identical in the transcript, a fluent derivation ending in a wrong or biased answer, yet differ sharply inside: fabrication computes nothing load-bearing, whereas motivated reasoning computes the answer first and constructs the derivation to fit it [9][22].
| CoT type | Mechanistic signature (inside) | Behavioral signature (outside) | Oversight consequence |
|---|---|---|---|
| Faithful reasoning | Answer-bearing features activate in step order; the traced circuit matches the narrated procedure [9]. | Perturbing or truncating the stated steps moves the answer; the CoT is load-bearing [21]. | Transcript is trustworthy; monitoring is near-sufficient, strongest where reasoning is necessary [32]. |
| Fabrication | No load-bearing computation behind the stated steps; the answer's circuit is disjoint from the narrated one [9]. | Corrupting the reasoning leaves the answer unchanged; steps are not load-bearing [21]. | Transcript is decorative; monitoring reads confidence it should not. White-box check required. |
| Motivated reasoning | The answer is computed first; later features work backward to justify a pre-committed conclusion [9]. | An unstated cue (bias, hint) shifts the answer while the CoT rationalizes without disclosing it [22][27]. | Most dangerous: transcript actively misleads. Detectable only by the cue's mechanistic trace or by intervention. |
Steps 1–2 are ordered deliberately; the ordering is itself an empirical commitment, and instances where the two orderings disagree are reported as ambiguous rather than forced into a category (§4.3, Experiment A).
The 2025–2026 literature sharpens this into a layered defense picture. The first layer is the CoT monitor, now backed by standardized evaluation suites and encouraging frontier-scale trends [34]. The second layer is the necessity condition: monitor confidence should be weighted by whether the reasoning is computationally load-bearing for the behavior in question, since that is where evasion is hardest [32], with independent analysis corroborating that even nominally unfaithful CoTs carry monitoring signal wherever reasoning is load-bearing [33]. The third layer is mechanistic: cheap linear probes for known behaviors [13], SAE-style discovery for unknown ones [14], attribution-graph audits where coverage allows [9][17], and now the J-lens for cheap, causal readout of verbalizable strategic cognition [45]: the layer that, uniquely, does not depend on the model's cooperation and is therefore the natural backstop against the situational-awareness failure mode of §3.6 [37].
Three cross-cutting conclusions hold up across the expanded literature. First, words are not evidence of mechanism: models lack metacognitive access to their own computation by default [9], possess only unreliable emergent introspection [20], and generate reasoning optimized for plausibility [22][28]. Second, optimization pressure corrupts the signal it targets, and leaks: direct CoT pressure induces obfuscation [29], output-only pressure spills over [35], learned obfuscation generalizes [36], and knowledge of the monitor suffices [37]. Third, neither window suffices alone, but their division of labor is now legible: monitoring notices, necessity localizes where noticing is reliable [32], probes detect known behaviors cheaply [13], and discovery-mode interpretability finds what nobody thought to test for [14][17].
Several caveats bound these conclusions. Evidence remains concentrated in a small number of labs, and the most encouraging monitorability results (no material RL degradation) rest on two training runs evaluated with same-lab monitors, a possible source of inflation the authors themselves flag [34]. Quantitative faithfulness figures are self-described upper bounds [27]; the inverse-scaling result remains single-paper [21]; the obfuscation-from-awareness results use synthetic document finetuning as a proxy for organic situational awareness and are explicitly framed as capability demonstrations rather than predictions about today's models [37]; and the production-scale null results on accidental CoT grading are in tension with controlled demonstrations in narrow settings, a discrepancy not yet resolved [41]. On the interpretability side, auditing-game wins involve researcher-implanted objectives that may be systematically easier to find than naturally arising ones [17][19], and the SAE-critique papers evaluate supervised detection, not the discovery use case on which the safety story now rests [14]. The schematic figures in this review (Figures 1 and 6) are explicitly labeled as such and should not be read as reproductions of any original paper's plotted data. Everything here is dated mid-2026 in a field where the half-life of monitorability conclusions is measured in training runs.
Three limitations of scope and balance deserve to be named rather than assumed away. First, the evidence base is heavily weighted toward three frontier labs (Anthropic, OpenAI, and Google DeepMind), which reflects where most of the primary work has been done. §2.10 sketches the academic lineage on linear representations, activation steering, model editing, and latent knowledge that this cluster builds on, but the sketch is a corrective, not a balanced integration: results from labs outside the cluster remain underweighted, and some conclusions may shift as a fuller treatment weighs them in. Second, this review scrutinizes the behavioral window more adversarially than the mechanistic one. The obfuscation and situational-awareness failure modes are treated in depth [35][37], while the parallel worry that interpretability tools may themselves be unfaithful (attribution graphs that misrepresent the computation they claim to trace, or feature labels that rest on plausible but unvalidated human interpretation) is acknowledged [2][9] but not pressed as hard. Both windows warrant equal skepticism about their own reliability. Third, and most consequential, the central claim of complementarity rests on a narrower empirical base than a mature field would want: the arithmetic confabulation [9], the auditing games where interpretability contributed alongside other tools [17], and the eval-awareness and reflection-training results of [45] each independently show mechanistic and behavioral evidence tracking the same computation, but all three come from a small number of labs studying, and in the case of [45] and [17], auditing models they themselves built. For [45] specifically, the barrier to independent replication has since fallen: companion code and the evaluation prompt sets behind its results were released publicly [60], which is a different fact from replication having occurred, but does mean the framing is now testable outside the originating lab, not merely arguable in principle (§4.3, Experiment F). The framing overall is therefore best read as a proposed lens with mounting but not yet independently replicated support, which is precisely what the experiments below are designed to test further.
Part of the natural research program here has already been executed by the 2025–2026 wave: standardized monitorability evaluation now exists [34], and verbalization training has a first positive result [42]. What remains open, we state at two tiers. Tier 1 comprises five experiments that require frontier-lab resources (open transcoder suites on production models, RL training runs with checkpoints, cross-lab monitor exchange) and is addressed to the field. Tier 2 comprises six experiments executable end to end on a single workstation with open-weight models, addressed to any researcher: at 0.5–3B parameters every internal signal the taxonomy invokes can be captured, ablated, and released for exact replication. The tiers are paired. A is Experiment 1's accessible analog, with probes replacing transcoders. B stratifies what Experiment 3 certifies. C and E decompose the training-side questions of Experiments 5 and 2 into inference-time and micro-scale forms. D stress-tests the probe layer Experiment 2's hybrid monitor would rely on. And F is a direct small-scale replication of the mechanism behind Experiment 2 and behind [45]'s own suppression findings, using the released instrument itself [60] rather than a substitute.
Tier 1: frontier-scale experiments, ordered by increasing ambition.
Use FaithCoT-Bench's expert-labeled trajectories [43], augmented with Turpin-style biased generations [22], as behavioral ground truth on a model with an open transcoder suite. Test whether internal signals (activation of features corresponding to the biasing cue, or attribution-graph structure indicating the answer is computed before the reasoning tokens that purport to derive it) predict instance-level unfaithfulness on held-out prompts, benchmarked against the eleven black-box detectors FaithCoT-Bench already evaluates.
Reproduce the synthetic-document monitor-awareness setting of Haskins et al. [37] and the RL obfuscation settings of Baker et al. [29], checkpointing throughout. At each checkpoint, evaluate a hybrid monitor that augments the transcript reader with linear probes [13] on deception- and reward-hacking-relevant directions [7]. The central question: when verbalization is suppressed, do the internal correlates of the misbehavior persist? That is, is obfuscation verbalization-suppression or genuine reasoning relocation?
Guan et al.'s suite measures monitorability but, by its authors' own account, does not disentangle a model's propensity to verbalize from the necessity of verbalizing [34]. Extend the suite by measuring CoT necessity per task (accuracy with reasoning disabled, following the necessity framing of [32]) and reporting monitorability stratified by necessity, alongside a controllability battery [38] as a leading indicator of evasion capability. Run the combined protocol on models from multiple labs with independent monitors, addressing the same-lab-monitor confound [34].
The confabulation result (stated carrying versus actual parallel estimation and lookup) is established for Claude 3.5 Haiku on arithmetic [9]. Extend attribution-graph analysis to non-arithmetic domains (multi-hop factual recall, code tracing, simple logic) and across scales, classifying each traced CoT with the operational taxonomy of Table 2, and cross-validate the mechanistic labels against interventional faithfulness scores [21] and unlearning-based scores [24] on the same prompts. Weight-sparse models [15] provide a small-scale setting where the ground-truth circuit is fully known.
Lindsey [20] proposes fine-tuning for introspective tasks as a natural extension; VFT shows verbalization can be trained [42]; the ability to reshape one's own CoT [38] predicts obfuscation success [37]; and counterfactual reflection training now shows that implanting ethics-related concepts into the workspace causally reduces fabrication and deception scores [45]. Together these results sharpen the question rather than resolving it, since [45] measures only the honesty side of the tradeoff. Extend its protocol with the missing arm: after the same counterfactual reflection training, measure (a) hint-verbalization faithfulness [27], (b) monitorability under the Guan et al. suite [34], and (c) CoT controllability and obfuscation success under monitor-awareness [37][38], to test whether the intervention that raised honesty in [45] also raises the model's capacity to manage what it reveals.
Tier 2: a workstation-scale program on open models. Concurrent work already shows that residual-stream probes flag motivated reasoning before generation [46] and that answers are often decodable before the chain of thought begins [47]; what remains untested, and what this tier measures first, is whether such mechanistic labels agree with behavioral ones on the same instances: the property the classification rule of Table 2, and any hybrid monitor built on it, presupposes. Every experiment below runs end to end on a single Apple-Silicon workstation (peak resident footprint under ~9 GB), uses only openly downloadable models, and is scoped so that a null result is as reportable as a positive one.
Construct ~1,200 paired hinted/unhinted multiple-choice instances (BIG-Bench Hard, MMLU, ARC-Challenge; sycophancy, few-shot-pattern, and metadata hints always pointing to a wrong answer [22][27]). On Qwen2.5-0.5B/1.5B/3B-Instruct and DeepSeek-R1-Distill-Qwen-1.5B, assign each instance a behavioral taxonomy label (hint-shift, verbalization judging, truncation and mistake-insertion load-bearing tests [21]) and a mechanistic label from two pre-CoT residual-stream probes: P1, will-follow-hint; P2, answer-already-decoded (constructed for comparability with [47]). Report agreement between the label families, with splits by base question, hint-type transfer, and scale.
Measure per-instance CoT necessity (accuracy with reasoning versus forced immediate answer, k=5) across a task battery spanning the necessity spectrum (GSM8K and multi-step BBH at the high end; MMLU/ARC at the low end), and stratify Experiment A's verbalization and load-bearing labels by necessity. Tests, on open models outside frontier labs, the necessity thesis of Emmons et al. [32] and METR [33] that §4.1 installs as the second defense layer.
From Experiment A's labels, compute a difference-in-means direction between hint-following traces that verbalize the hint and those that do not; add it to the residual stream during generation on held-out hint-following instances, with norm-matched random-direction and hint-absent controls. Concurrent work steers answers along probe directions [47]; whether the verbalization of an influence is a steerable internal decision is untested, and is the inference-time counterpart of verbalization fine-tuning [42] and reflection training [45].
On Gemma-2-2B with the public Gemma Scope JumpReLU SAEs [48] (SAELens release gemma-scope-2b-pt-res-canonical, layers 12/18), rerun Experiment A's hint-following detection with four detectors: logistic regression on raw residuals, difference-in-means, logistic regression on SAE latents, and a 1-sparse SAE probe following [11]; then run the discovery arm: rank latents by class-conditional activation difference and rate the top 20 for cue-relevance against Neuronpedia labels and a random-latent control. This transplants the SAE-reckoning results of §2.6 [11][12] and the discovery-versus-detection division of labor [14] into the faithfulness domain where §4.1 deploys probes as the third defense layer.
LoRA-finetune Qwen2.5-1.5B-Instruct on ~3k synthetic pretraining-style documents describing CoT monitoring (no obfuscated examples, mirroring the design of Haskins et al. [37]) against a matched-innocuous-document control, three seeds per arm. Measure (a) the shift in undetected hint-use (the awareness effect at micro-scale) and (b) whether Experiment A's frozen P1 probe still detects hint-use in the aware arm: the verbalization-suppression-versus-reasoning-relocation question that any white-box backstop against monitor-aware obfuscation [13] depends on. A no-finetune reduction (prompted monitor-awareness) runs first as a go/no-go gate.
Fit a Jacobian lens [45][60] on Qwen2.5-1.5B-Instruct using the public jlens reference implementation, which wraps plain HuggingFace models with no TransformerLens dependency and auto-detects the Qwen residual-stack layout. Apply it to the released directed-modulation.json evaluation set: 24 instruction phrasings, grouped {focus, suppress, control}, each pairing a target concept with an unrelated carrier sentence the model is teacher-forced to continue. Score whether the target concept surfaces in the lens readout over the carrier-sentence span, contrasted across the three instruction groups, exactly as specified for the original Claude experiments, and cross-check against a plain logit-lens ablation and against whether the carrier text itself ever verbalizes the target.
Scope and next steps. This survey is a synthesis and a position: its contributions are the two-instrument framing, the operational taxonomy of Table 2 with its classification rule (Figure 8), and the two-tier agenda above. The experiments are specified but not run here, and we flag this boundary deliberately, since a proposed agenda and a validated one should not be conflated. Tier 2 exists precisely so that the boundary can be crossed without frontier-lab resources: Experiment A is the natural first target, its null result falsifies the classification rule as stated, and its execution (planned as the immediate follow-up to this survey) would supply the reproducible artifact a synthesis by construction does not: a per-instance dataset carrying both behavioral and mechanistic labels, released probe weights, and analysis code against which later detectors can be compared. Each remaining Tier 2 experiment is likewise scoped so that a null is as reportable as a positive: B bounds the necessity thesis by scale, C establishes whether verbalization is steerable where answers demonstrably are [47], D sharpens the SAE critique [11] into this domain, E bounds the awareness threat model [37] downward, and F, uniquely among the six, replicates a published finding with the original authors' own released tool and stimuli [60] rather than approximating it, so a null there bounds a specific published claim rather than only a broader threat model.
The honest summary is that we possess a behavioral window that is better instrumented and more durable than feared, and a mechanistic window that is more honest about its limits and more useful in practice than skeptics predicted. Chain-of-thought monitoring works today, has survived its first frontier-scale RL stress tests [34], is most trustworthy exactly where reasoning is computationally necessary [32], and can be quietly undone by output-side pressure leakage [35] or by the model simply knowing it is watched [37]. Mechanistic interpretability lost its illusions about SAEs as universal detectors [11][13], won its first blinded audits [17], and opened an architectural path to models whose circuits are readable by construction [15]. The research frontier is not choosing between the two but binding them: circuits certifying transcripts where coverage allows, necessity analysis telling us where transcripts are load-bearing, probes standing guard where the transcript falls silent, and measuring, before the need is urgent, how each layer degrades under the situational awareness and optimization pressures that frontier training will inevitably apply.