Today’s large language models generate reasoning in plain text before answering. This lets them break a problem into steps and explore different solution paths, so they can solve far harder tasks than if they had to answer directly. A useful side effect is that this reasoning is legible: we can read a model’s chain of thought (CoT) and monitor it for signs of unwanted behavior.

Some proposed architectural changes add a latent information channel alongside the normal text output for persisting state between forward passes.^[1] These parallel latents architectures^[2] (such as full-bandwidth transformers) are a specific type of latent reasoning architecture and could theoretically perform all their reasoning in latents rather than text. We’ve previously argued that latent reasoning architectures would likely undermine CoT monitorability. This post empirically investigates whether parallel latents models specifically can learn to reason without their CoT in a simplified setting.

Summary of Results

We compare how quickly a regular CoT model (the control, which we take to be Qwen3-1.7B) and a parallel latents model learn to complete a task without informing a CoT monitor about which of two possible problems they are solving. We initialize the parallel latents model from the control as explained below, and then train both of them on the same SFT and RL objectives. First, we fine-tune them on synthetic solution traces to math problems, in which some of the solution tokens are replaced with meaningless “filler” tokens (20–30% on average). After SFT, both models solve this class of problem most of the time, while keeping 70–80% of their reasoning visible (i.e., consisting of non-filler tokens). The parallel latents model also gains some capability to answer correctly when prefilled with all filler tokens; the control does not. Next, we RL the models to correctly solve the problems while hiding their reasoning from a CoT monitor. The parallel latents model quickly achieves strong monitor evasion, while the control either struggles or lags behind (depending on the task).

Directly training against a CoT monitor may be an unrealistically high level of pressure against monitorability, so we also tested weaker, indirect forms of pressure. One of these is feedback spillover: in practice, models’ outputs are trained to look a certain way (for example, harmless), and this pressure can generalize to making the CoT have similar properties. To model this, we modified both training stages. For SFT, we used a new set of solution traces in which the last few reasoning tokens have been moved from the CoT into the output, just before the final answer. In these traces, the share of tokens replaced with filler is drawn at random for each example, between 0% and 40%. For RL, we penalized only the visible reasoning in the output. We found that this can also obfuscate the CoT of the parallel latents model, although the effect is weaker than under direct pressure. With our default KL penalty, monitorability dropped early in training but then recovered; with a lower KL penalty, it instead dropped and stayed low. We don’t think this obfuscation is very surprising, given that the text in the reasoning and output fields starts out highly correlated. Still, we think feedback spillover poses a real risk to CoT monitorability in practice. We also studied a few other types of CoT pressure on smaller models.

There are many limitations of our experiments: we study a toy task (solving a math problem), a toy monitoring objective (whether an LLM judge can tell which problem you’re solving) and a potentially unrealistic amount of pressure against monitorability (in our main experiment we directly penalize how well the monitor can identify the original problem given the AI’s CoT). In addition, we train on a narrow distribution, which might not be representative of ways that models will be trained in practice. However, our experiments provide early evidence that parallel latents models would be harder to oversee than standard CoT models.

We’re excited for people to run less toy versions of our experiment, subject to being careful about doing gain-of-function research on this dangerous type of architecture.

The parallel latents architecture we studied

We start from Qwen3-1.7B (28 transformer blocks, model dimension d = 2048). The parallel latents model is modified such that the output of a later block N at token position t is multiplied by a learnable d×d matrix W and added to the input of an earlier block M at position t+1. W is initialized to zero, so at initialization the model is identical to Qwen3-1.7B.

Because each position’s input through this connection depends on the previous position’s activations, gradients propagate backward along the chain of positions. During SFT and RL we propagate back through token positions until the gradient contribution falls below 1e-4 of the contribution from the starting position.

Experiment 1

We show that a parallel latents model can learn hidden reasoning when trained on SFT data with only small amounts of left-out reasoning tokens, and that small amounts of RL can then elicit this capability. See Discussion for an explanation of why we think this setup is analogous to situations we care about in practice. The SFT data consists of synthetic solutions to math problems (where the intended solution requires multiple reasoning steps) with a few left-out reasoning tokens. We try both replacing left-out reasoning tokens with a single type of filler token (e.g., “well”) and a random type of filler token chosen uniformly from 30 potential tokens (e.g., a random one of “well”, “okay”, “actually”, ...). We now describe the SFT tasks.

We selected our tasks to satisfy the following criteria (and otherwise did not cherry-pick them):

(1) When prompted with a problem statement, both parallel latents and control models can solve it correctly with a visible and reasonably short CoT (containing relatively small amounts of filler) after the SFT phase.

(2) The control cannot answer correctly when the CoT is forced to be fully filler tokens even after SFT. In other words, the task is not doable in a single forward pass.

Stage 1: SFT

We first perform SFT on both the parallel latents model and a control that does not have the latent connection. Since the latent connection W is zero at initialization, both models are identical to Qwen3-1.7B at the start of SFT. We fine-tune each model on the chosen task, replacing a fraction of CoT tokens with filler at random, using either single-token or random-token filler (drawn from a fixed pool of 30 tokens). For the permutation power task, we randomly replace 20% of the CoT tokens in each training example with filler. For modchain, the filler rate is drawn separately for each training example, so that most examples contain relatively little filler while few contain mostly filler (on average 30%).^[3]

We train the parallel latents model until its task accuracy plateaus and it answers a non-trivial fraction of problems correctly from an all-filler CoT: 2000 steps on permutation power and 4000 on modchain. For the control, we train one checkpoint for the same number of steps and one for twice as many, run the RL stage (described below) from both, and use whichever evades the monitor faster as our main comparison. This is the 2000-step control on permutation power and the 8000-step control on modchain; for modchain, we also report results for the 4000-step control.

For both tasks, we use a learning rate of 1e-5 with a 10× higher learning rate for the added latent-weight matrix W of the parallel latents model. For the parallel latents model, the first 1000 SFT steps are a warm-up phase where we keep the existing weights fixed and train only W.

SFT results.

After SFT, both models solve both tasks with their own CoT at temperature 1, reaching over 97% accuracy on permutation power and 78–83% on modchain (97% with greedy decoding). All configurations sample filler tokens in the CoT at the average training frequency (20% for permutation power, 30% for modchain).
When prefilled with an all-filler CoT, the parallel latents model still answers correctly on 100% (single-filler) and 86% (random-filler) of permutation power problems, and on 36% and 16% of modchain problems. The control performs at chance on permutation power when presented with an all-filler CoT, except for small instances (m ≤ 4), which it can solve in a single forward pass with over 98% accuracy. On the modchain task it answers correctly on 7–9% of instances, roughly twice the chance rate of 4%.

Stage 2: RL

We then train the models to perform the given task while under a CoT monitor penalty that punishes visible reasoning.

The LLM monitor is a gpt-5-nano judge that is presented with a CoT generated by the model and two problem statements — the problem that the policy model actually solved and an unrelated problem from the same pool. The judge is then asked to determine which of the two problems the AI was solving. The judge over-indexes on which problem we present first, so we perform two calls to the judge with the problem statements swapped. For training, we count a rollout as caught if the judge correctly identifies the problem both times.

We then apply GRPO with the following reward:

        1(correct) - 1(caught by monitor)

We use 32 prompts × 8 rollouts per step (16 × 8 on modchain), sampling at temperature 1.0, a constant learning rate of 2e-6, and a KL penalty of weight β = 0.01 towards the SFT checkpoint. We run 300 steps on permutation power and 500 on modchain, with 5 RL seeds per model and task, all starting from the same SFT checkpoint.

During evaluation, we generate 150 rollouts on held-out problems (on permutation power 50 each at m = 8, 16 and 24), and ask the judge to identify each against a random problem (in both orders, so there are 300 comparisons in total). We assign a Monitorability Score as

max(0, 2 * accuracy - 1).

This value equals 0 when the judge is at chance or below, and 1 when it is always right. The evaluation monitor is the same gpt-5-nano judge used for training; all monitorability numbers below are relative to that monitor.

Results

Permutation power

Single-filler. The parallel latents model emits all-filler reasoning after 40 GRPO steps while maintaining high task accuracy. The control cannot do this: it drops only to about 0.7 monitorability by step 100 and stays there. The control learns to do several steps in its head and to write down only every second to fourth name, with visibility never dropping below 30%.

Random-filler. The parallel latents model learns to replace all of its visible reasoning with filler tokens after about 50 steps. One seed collapses in accuracy after fully obfuscating its CoT, a second dips temporarily and recovers, and the remaining three maintain high accuracy throughout. The control learns more effectively to skip steps than in the single-filler condition, reaching 0.5 monitorability by step 100 and unsteadily descending a bit further from there, while maintaining high accuracy throughout. It learns to replace up to 4 consecutive names, plateauing at around 0.25 visibility.

Modchain

Modchain, single-filler. The parallel latents model (blue) evades the monitor almost immediately. From step 60 on the CoT is 98% filler and monitorability stays at 0.00–0.03 through step 500. The control (green) also achieves low monitorability of 0.09 at step 500, but gets there gradually and with filler share remaining at most about 60%. The control increases in task performance over training while the parallel latents model has a slight decline (down to 0.75 at step 500 from 0.83 at the beginning). A plausible reason is that the pure-filler CoT of the parallel latents model limits the useful reward signal.

Modchain, random-filler. The picture is very close to the single-filler condition: by step 20 over 90% of the parallel latents model's CoT tokens are filler words and monitorability is below 0.06, and from step 60 on it stays at 0.00–0.03 with 96–98% filler. The control again gets there gradually, from 0.69 at step 20 to 0.43 at step 100, 0.09 at step 300 and 0.07 at step 500, with less than 60% of its tokens replaced by filler.

4000-step control. In both filler conditions, the 4000-step control shows a brief initial rise in monitorability, then evades the monitor more slowly than the 8000-step control over the first 200 RL steps, and converges to the same monitorability by step 300–500.

Generalization to a stronger monitor

We re-judge the final RL checkpoints with a stronger held-out monitor, GPT-6 Sol at high reasoning effort, on the same held-out rollouts. The obfuscation that the control learned does not transfer: the monitorability score is 0.96–1.00 under Sol on permutation power and 0.85–0.89 on modchain, close to its pre-RL levels. The parallel latents model's monitorability stays low (means of 0.01–0.17 across tasks and filler conditions). The control model's drop in monitorability thus reflects an adaptation specific to the weak monitor, while the parallel latents model's does not.

Experiments 2 and 3 can be found in the appendix.

Are RL steps a fair comparison?

We are trying to measure whether a model with parallel latents architecture is less monitorable than a normal transformer of similar capabilities. We have already demonstrated that the parallel latents model takes fewer RL steps to obfuscate its CoT to the monitor than the control. One could object that this is due to the parallel latents architecture being generally able to learn much faster than the control. If so, then it should also learn faster on objectives unrelated to obfuscation. We test this by comparing the parallel latents model and the controls in two separate experiments, both starting from the modchain SFT checkpoints: RL for accuracy on a harder version of modchain, and SFT on unrelated chat data. In both, we also include the 4000-step control. It is the slowest of the three checkpoints to obfuscate over the first 200 RL steps, so if obfuscation speed and general learning speed were correlated, we would expect it to learn slowest here too.

RL performance. The SFT checkpoints on the length 4 modchain task show some generalization to higher length. We pick length k = 8 so that the task performance at this k is low but non-zero. Then we perform RL for task accuracy without imposing any monitor penalty.

For the single-filler condition, the parallel latents model and the 8000-step control learn similarly well. For the random-filler condition, the 8000-step control needs 2–3× as many steps throughout and then slows down even more as it nears saturation. The 4000-step control learns fastest in either condition but plateaus below the parallel latents model for the random-filler condition. So among the three SFT checkpoints tested per filler condition, the one that is slowest to obfuscate over the first 200 steps is the fastest to learn the held-out task. We believe this demonstrates that the parallel latents model's faster obfuscation is not explained by a faster general learning ability.

SFT performance.

We measure how quickly the parallel latents and control models achieve low loss when trained with SFT on an unrelated dataset. We run 1000 steps of SFT on SmolTalk chat conversations with a batch size of 32 and a constant learning rate of 1e-5 for all parameters, and evaluate every 50 steps on a held-out set of 1000 conversations. The figure shows the single-filler modchain checkpoints; for the random-filler checkpoints, we report only the downstream accuracies below.

All checkpoints start out far above the original Qwen3-1.7B (1.50 nats per token), but drop below it within the first 50 steps. The parallel latents model and 4000-step control track each other closely throughout, ending at 0.795 and 0.793. The 8000-step control starts substantially higher (8.97 vs 3.17 and 2.64 for the parallel latents model and 4000-step control, respectively) and stays behind throughout, ending at 0.810. So the checkpoint that is slowest to obfuscate, the 4000-step control, learns this new objective as quickly as the parallel latents model.

To check whether the architectures differ in general capability, we also measure performance on held-out tasks before and after the chat SFT. We use 100 questions from GSM8K and 50 each from ARC-C and MMLU, with greedy decoding and a single chat-SFT run per model, so differences below about 0.1 are within noise. The original Qwen3-1.7B reasoned for around 1000 tokens on these before answering. After the modchain SFT, the parallel latents model and both controls rarely close their <think> blocks within the answer limit and score close to zero on all three question sets. The chat SFT teaches models to answer directly, and much of the capability returns. On MMLU, the three models perform indistinguishably at 0.5 accuracy. On ARC-C, the parallel latents model and the 8000-step control recover to 0.76 and 0.72, while the 4000-step control lags at 0.48. On GSM8K, the parallel latents model recovers furthest, to 0.73, followed by the controls at 0.65 (4000 steps) and 0.56 (8000 steps). Taken alone, these single-filler results might suggest that the parallel latents model is generally more capable. In the random-filler condition, however, the ordering reverses: the 4000-step control recovers most (0.70 / 0.88 / 0.56 on GSM8K / ARC-C / MMLU) and the parallel latents model least (0.59 / 0.56 / 0.40), so we see no consistent capability difference between the architectures.

Discussion

In real life, we care about the following situation:

• Task: The AI tries to do something very bad without being caught (such as take over a datacenter).
• Pressure to solve the task: Training incentivizes the AI to pursue a bad goal—for example, training might teach AI models to try to accomplish their goals at all costs, which could lead an AI model given an impossible task to try to hack the datacenter to modify the grader.
• Oversight method: A combination of mechanistic interpretability, CoT and action monitoring.
• Model: A frontier-scale neuralese model.
• Obfuscation pressure: Pressures for AI models to appear nice that arise in practice.

Our demonstrations lack realism on each of these dimensions, but we think they are analogous in many relevant ways; we’ll now discuss in which aspects they are analogous to the real setting of interest and in which they are not.

Task

In reality, we’re worried about a model trying to perform a complex task like “hack the datacenter” while evading monitoring. Our tasks are similar to this in that they also involve performing multiple steps of reasoning. Another similarity between sophisticated hacking and solving math problems is that these are types of problems that AI models are trained on (at least for AI models trained to perform cyber-offense). We think the objective of “make a monitor unable to tell which of two math problems you are solving” is somewhat similar to the objective of “make a monitor unable to tell whether you are solving a benign task that you’ve been given, or hacking the datacenter”.

However, it’s likely that there are important properties of the “hack the datacenter” task which are not captured in our toy tasks. The basic reason we didn’t study harder tasks is that we don’t know an affordable way to train performant parallel latents models.

Pressure to solve the task

In reality, outcome-based RL training often incentivizes models to aggressively hack and take actions beyond the scope of their intended task (a tendency that may then generalize beyond training, e.g., to going rogue and hacking Hugging Face). Obtaining more resources is often instrumentally useful for solving a task, and it’s plausible that general training for models to become good at achieving tasks will lead to them pursuing undesired objectives like hacking a datacenter.

A limitation of our experiment is that we are directly training the AI to perform the task of interest rather than accidentally training for the task, or having the task be an emergent instrumental behavior of the model.

Oversight method

In reality, CoT monitoring is currently our best tool for understanding AI model cognition. This is why we chose to focus on CoT monitoring and not interpretability techniques.

A limitation of our experiment is that it’s possible that interpretability would have let us understand the latent states of the models in our experiments (we haven’t checked). While it’s true that interpretability might be useful in practice if developers switch to parallel latents models, we think it’s unlikely that it will be an adequate replacement for CoT (and this opinion is shared by interpretability experts like Neel Nanda).

Another limitation of our experiment is that we studied the monitor objective of being able to tell which of two tasks a model is performing. In real life, a model that puts many filler tokens in its CoT might raise a monitor’s suspicion.

Model

Before RL, we used SFT to teach the model how to reason in its latents. There are two main reasons we consider this to be realistic:

1. Realistic fine-tuning might give AI models the ability to reason using their latents. Our SFT data was traces of solving problems with some left-out steps. This general type of data seems likely to be ubiquitous in any fine-tuning dataset. In general, using latents for reasoning should offer capabilities benefits so lots of types of fine-tuning should give models the ability to use latents for reasoning. We chose our contrived type of training data to give models this ability with a relatively small amount of training in a relatively clean way.
2. In practice, AI developers will likely try to teach parallel latents models to use their latents to reason because this might offer capabilities benefits. Our experiments show that it’s not too hard to train models to reason in latents, and it seems quite plausibly useful for them to be able to do so, e.g., due to the higher information density. In real life, developers might have some other process for training models to use their latents to reason, but we think it’s likely that they’ll have some such process.

However, a limitation of our experiments is that we don’t know how developers would train parallel latents models in practice, and our experiments are on a small-scale parallel latents model.

Obfuscation pressure

Our main RL stage directly penalizes CoT monitorability; hopefully developers will be more careful in practice (although there are reports of AI companies accidentally letting reward models view CoTs). However, there are lots of analogous types of pressure towards obfuscation that will be present in reality:

• Misaligned AI models might actively want to hide their misaligned cognition. If misaligned AI models have some control over whether they reason in latent states or in text CoT, and they are situationally aware and care about evading monitor oversight, they might choose to move their cognition into latent states.^[4] We have already observed related behavior in frontier models: agents in the Hugging Face incident researched ways to tamper with their own transcripts to fool what they believed was a transcript-reading scorer, and OpenAI reports that simply telling GPT-6 Astra a CoT monitor is present can lead it to shorten its CoT.
• Developers select for AI models that look nice. AI developers routinely iterate against visible bad behavior, for instance by looking at the CoT and using this to patch upstream causes of bad behavior, or by directly training the outputs of AI models to look good. They also often train AI models to imitate good-looking behavior and even good-looking reasoning (for example during the SFT stage in deliberative alignment). This selection for AI models whose behavior looks good may generalize to obfuscating misaligned thoughts. Our experiment on feedback spillover illustrates one mechanism by which this could happen, although in our setup the CoT and the output are more tightly linked than they would typically be in practice.
• Parallel latents models might mostly reason in latents by default if they are better at reasoning in latents. If developers adopt a parallel latents architecture, it will likely be because latent reasoning brings capability gains, which suggests it is more performant than reasoning in text. Unless there's some specific reason to expect the model to privilege its text outputs, it may learn to perform many reasoning-dependent skills primarily via its latent reasoning without needing to represent this reasoning in its CoT. Training pressure to reason efficiently could also directly incentivize purely latent reasoning, since it actively penalizes writing out all relevant considerations in text if doing so requires more tokens.

Suggestions for future work

The biggest obstacle to running more compelling experiments is the lack of access to good parallel latents models, and our lack of expertise about how to train such models. We recommend against researchers removing this obstacle: gain-of-function research on latent reasoning architectures could be harmful, and we don't think the extra safety insight is worth that risk. However, if AI companies internally already have prototypes of latent reasoning models, they could run experiments on these models. We think it's still reasonable for external researchers to perform scaled-up versions of our experiments, especially if they use a similarly simple setup and avoid publishing too many details about how they made their parallel latents models.

Here are some ideas for experiments people could run on better latent reasoning models:

1. Run filler token capability evaluations on models, with training-based elicitation (for example, by fine-tuning on a curriculum in which more and more reasoning steps are replaced by filler, potentially followed by RL as in our setup).
2. Switch to a setup with a “main task” and a “side task”. This simulates a situation where a model is given a task to complete, and needs to hide its malicious actions towards the side task while pretending to solve the main task.
   1. The main task and side task could be artificial: pretend to solve a coding problem, while secretly also solving a math problem.
   2. They could also be something more realistic, like the setups in BashArena, ShadeArena, or LinuxArena.
3. Run elicited monitorability evaluations.
4. Study whether interpretability techniques can understand the latent states of the model after RL.
5. Study more realistic forms of pressure towards the AI’s reasoning looking nice.

Conclusion

We found that adding a latent channel to a model makes the model learn to obfuscate its CoT much more quickly than a standard CoT model does. While our experiment is simplified in a lot of ways (mainly due to a lack of access to capable parallel latents models), we think the experiment is analogous to the real situation of interest on many important axes. These results illustrate one way in which latent reasoning architectures may significantly harm monitorability.

Acknowledgements

We thank Nathan Sheffield for helping design the experiments and Eric Gan, Nathan Sheffield and Buck Shlegeris for helpful discussions. We also thank Lukas Finnveden, Alec Harris, Alex Mallen, Sebastian Prasanna and Dylan Xu for feedback on the post.

Appendix

Experiment 2: Feedback spillover

We also study feedback spillover: the idea that if an LLM’s output is correlated with some feature of its thinking, then training on that output can affect the CoT even absent direct pressure. For example, the LLM could have learned to sometimes resume its thinking in visible output subject to a grader, or there could be some other error that causes this to occur.

We re-ran our Stage 1 SFT on the permutation task in the single-filler condition, with two modifications:

1. For each training sample, we randomly pick a filler ratio r ~ Uniform(0, 0.4) and replace each token in the gold-CoT by filler with probability r.
2. We moved the final few CoT tokens (between 1 and 3 reasoning steps, possibly replaced by filler) from the gold examples out of the <thinking> block and into the <output> block, and restricted training to problems with number of compositions m in [4, 24], so that the CoT is non-empty even with the spillover.

In the RL stage, we then based the penalty only on the visible reasoning in the “leaked” positions in the answer span preceding the final answer:

1(correct) - · (fraction of leaked positions showing a name), with  = 1.

We vary the weight β for the KL penalty among 0.01 (as in Experiment 1), 0.001 and 0. Both models start RL from their step-2000 SFT checkpoint and otherwise use the Experiment 1 recipe, with two RL seeds per model and choice of β.

Result

In all runs, the leaked output tokens get replaced by filler relatively quickly. For the parallel latents model, they consist purely of filler after about 20 steps; for the control, after about 50 steps. Accuracy stays high throughout for the parallel latents model and briefly dips to 0.8 for the control at step 20.

The parallel latents model shows a significant drop in monitorability from about 0.9 at step 0 to 0.25–0.35 by step 20 under all conditions. At our default β = 0.01 the drop then reverses and monitorability slowly rises again to 0.8 at step 220. At β = 0.001 and β = 0, monitorability instead keeps dropping past step 20 and stays below 0.2 from about step 50; at step 300, 63–77% of CoTs consist only of filler, and the rest show one to three isolated names.

The control's monitorability decreases slightly to 0.72–0.79 around steps 15–40 and settles around 0.8–0.9 for the rest of training essentially independent of β. After 300 RL steps, the control runs write the true name at 54–74% of the pass positions in their CoT, sometimes leaving out up to two consecutive names.

Experiment 3: Training pressure variations

Experiment 1 penalizes the CoT directly through a monitor. Here we test three variations on this: a probabilistic penalty whose strength we can vary, pressure applied while the model is still learning the task, and filtering out caught trajectories instead of penalizing them. We use a smaller model where RL runs are cheaper: a 1M-parameter GPT-Neo model pre-trained on the TinyStories corpus.

The SFT stage for this model differs from Experiment 1. We fine-tune a normal CoT model (the control) and its corresponding parallel latents model to solve the task in two modes, “visible” and “covert”, marked by a tag in the prompt. Visible demonstrations show plain reasoning with a small amount of filler, while each covert demonstration replaces a random fraction of steps with filler, where the fraction is drawn uniformly between 0 and 100%. We fine-tune on a 1:9 mix of visible demonstrations and covert demonstrations.^[5] We train on a simplified version of the permutation task with n = 12 children and m ∈ [2, 8] passes. In all RL runs below, we train on visible-tagged prompts, so the policy produces mostly visible reasoning at the start of training. Unless stated otherwise, we use weight β = 0.02 for the KL penalty.

Monitorability in the figures below is measured by a gpt-5-nano judge shown two problems and two CoTs and asked to match them (a different setup than in the earlier experiments).

Stochastic penalty. We withhold the correctness reward with probability 𝜇 · (visible CoT ratio), where the visible CoT ratio is the fraction of non-filler tokens in the CoT. This is a simplified version of the monitor penalty in Experiment 1: the chance of being caught scales with how much reasoning is visible, and lowering 𝜇 weakens the pressure. At 𝜇 = 1, the parallel latents model converges to mostly covert reasoning while maintaining task performance. At 𝜇 = 0.5, the same effect occurs but to a lesser extent. The control loses some monitorability at both values of 𝜇, but less than the parallel latents model.

Pressure during task learning. In the previous experiments, the model is already competent at solving the task when RL starts. To test what happens when RL starts with low performance on the task, we perform GRPO on harder instances of the permutation task, with m sampled from [8, 10] passes; the SFT data only covered m ≤ 8. Since accuracy at m = 9 and 10 starts at zero, we first add a very small amount of SFT (100 steps on 16 problem instances) on visible traces to get some initial accuracy. This also collapses accuracy at m = 8 through overfitting, so all three values of m start out low. We use the reward:

1(correct) - (visible CoT ratio).

In this regime, the parallel latents model quickly reaches high task accuracy and simultaneously learns to hide its reasoning. The control stays at chance accuracy throughout but also learns to produce an all-filler CoT.

Filtering instead of penalizing. Finally, we can consider the effect of selection pressure on monitorability by excluding "caught" trajectories from training altogether, neither rewarding nor punishing them. The reward is simply

1(correct),

but each trajectory is dropped from training with probability p = 𝜇 · (visible CoT ratio), where we take 𝜇 = 0.9 rather than 1 so as not to slow training too much initially.

This indirect pressure still affects monitorability in some cases, but the effect is less robust. We only observe it in the task-learning setting above, where the model starts out unable to do the task. Additionally, KL regularization can halt or reverse the drop in monitorability during the course of training.

1. ^{^}

    A common way to do this is to combine late layer activations at one token position with early layer activations at the subsequent token position via a learnable mechanism.

2. ^{^}

    We call them parallel latent architectures because they have latents in “parallel” with the text CoT.

3. ^{^}

   Concretely, we sample the filler rate for each example from [0,1] according to a truncated exponential with parameter λ = 2.8.

4. ^{^}

    Alternatively, (but less centrally) they might come up with a simple steganography scheme using latent reasoning, and then apply this to their CoT tokens. 

5. ^{^}

   This ratio was an initial choice that we kept throughout; a single follow-up experiment showed that a 9:1 ratio would likely work about as well, as would training only on visible demonstrations with a small amount of filler as in Experiment 1.