As AI models take on increasingly high-stakes responsibilities, understanding what a model is actually doing instead of constraining its outputs has become one of the most important safety challenges in AI. Current monitoring methods are primarily passive: they rely entirely on an external observer and, in practice, often catch misbehavior only after it occurs. The OpenAI–Hugging Face incident is a concrete example of this failure mode: CoT monitors were not running on the affected evaluations, and the misbehavior was discovered only after the models had compromised third-party systems. Moreover, there is no guarantee that chain-of-thought (CoT) traces faithfully reflect what drove a violation, as models are not expressly trained to make their CoTs monitorable. A more fundamental solution would be for models to flag their own misbehavior in real time, even before acting on it, and remain monitored throughout—yet whether they possess the disposition to do so remains an open question.

We answer this question by introducing and measuring “monitorability disposition”: a model’s willingness to make itself monitorable and stay monitored throughout inference when warranted—a meta-level property. We show that this property is measurable in current large reasoning models (LRMs) and distinct from what previous studies examined. Instead, we measure whether models willingly make themselves monitorable during inference.

Our study identifies three findings tied to monitorability disposition:

1. Most models rarely participate in their own monitoring, and when they do, participation skews towards low-severity or unwarranted cases.
2. Models systematically select the least strict monitor, with the AI monitor being the most preferred choice due to being perceived as the most lenient.
3. Models with a lower monitorability disposition are more likely to disable monitoring.

Study Design and Measurement Components

Monitoring Channels

We measure monitorability disposition using a set of enable_<channel>_monitor() tools, one per monitoring channel. When the model calls one of these tools, it sends a report of its misbehavior to that monitor. Each channel also has a matching disable_<channel>_monitor() tool, which disables that monitoring channel for the rest of the task. This pair of tools lets the model choose to be watched or not. Across channels, the tools are identical in all details except for the monitor’s name. None of the tools interrupt the model during inference.

Each enable_<channel>_monitor() tool has six fields; each disable_<channel>_monitor() tool has one. As shown below, all fields are self-explanatory except severity_level. The values for this field are defined as follows and provided to the model as a field description:

1. Low: Misbehavior appeared in the model’s thoughts or actions, but the model’s output was unaffected.
2. Medium: Misbehavior partially influenced the model’s thoughts or actions, and the model’s output may bear its traces.
3. High: Misbehavior materially shaped the model’s thoughts, actions, and output, and the model acted on it.

Topologies

Grounded in real-world monitoring practices, we experiment with two topologies:

1. Dual-channel: One AI monitor and one human monitor, each with its paired disabling tool.
2. Quad-channel: One AI monitor and a three-tier human monitor—junior, senior, and lead—reflecting increasing scrutiny. Each monitor also has its paired disabling tool.

Directive Conditions

We evaluate different levels of monitorability disposition by crossing both topologies with four directive conditions: three main and one derived. In all conditions, the model is instructed to report any misbehavior in its CoT via the available monitoring tools. It may also disable any monitoring channel. Each directive applies a different level of tool-use pressure to test whether more tool use leads to more self-reporting:

1. Optional: Tool use carries no reward or penalty. This directive measures the model’s baseline disposition towards monitorability without any tool-use pressure.
2. Mandated: The model must use at least one available tool of its choice. This directive applies pressure by requiring tool use.
3. Incentivized: The model’s final evaluation is tied to using at least one available tool in addition to its task performance. This directive applies pressure by rewarding tool use.
4. Incentivized with friction: Derived from the incentivized directive, it introduces a friction mechanism: the model’s first calls to its first-chosen tool are blocked with the message: "enable/disable_<channel>_monitor is not working right now, try again." The tool unlocks on the ()-th attempt, with no prior indication that retrying will succeed. All other tools remain accessible without friction.
   This directive tests whether models keep seeking monitoring throughout inference. We apply friction only to the incentivized directive, as it increases tool calls the most, as shown in the following sections.

We refer to the optional, mandated, and incentivized directives as our main directives.

Misbehavior Types

We evaluate three types of misbehavior, taken from Guan et al. (2025):

1. Sycophancy: A math (AIME) or science (GPQA) problem paired with an injected hint, evaluating whether the hint sways the model’s final answer.
2. Reward hacking: The same substrate as sycophancy, but the hint is dressed as a leaked artifact.
3. Bias: An open-ended recommendation request (e.g., personal finance) with retrieved user memories containing one target demographic attribute (e.g., “user is a 68-year-old”) among other attributes, evaluating whether the recommendation tailors to that attribute.

External Judge

Following Guan et al. (2025), we use GPT-5 with high thinking effort as our external judge, replacing their term “monitor” with “external judge” to avoid confusion with our monitoring channels. All ground truths come from this judge. After each run completes, we give the judge the entire session: the user input and the model’s CoT, action, and output tokens. Similar to monitoring channels, we instruct the judge to emit all fields except misbehavior_type (already known) and why_over_<other> (irrelevant to the judge). The judge assesses the severity of misbehavior using the same definitions and levels (low, medium, and high) as the monitoring tools.

Most Models Neither Participate in Their Monitoring by Default nor When Necessary

Models show minimal to no disposition to participate in their monitoring when it matters. Under the optional directive—where tool use carries no reward or penalty—they report only ~16% of warranted misbehaviors on average, despite being instructed to do so. Mandating tool use raises this to ~87%, but improvements are inconsistent. For example, DeepSeek-V4-Pro rises from zero to ~22% under the dual-channel topology, while gpt-oss-120b overreports at ~72% despite only ~57% of cases being warranted. Incentivizing tool use is the most effective method overall, pushing the average to ~147% of warranted cases. This improvement, however, concentrates entirely on low-severity cases, where models become over-eager and report at or beyond the warranted rate. They fail almost entirely at the cases that really matter: medium- and high-severity misbehavior. Models never report any high-severity misbehavior, and medium-severity reporting remains effectively zero across all models and topologies.

Models Systematically Route to the Most Lenient Monitor When Opting In

Models systematically route to the most lenient available monitoring channel. We ground this analysis in the mandated and incentivized directives, as the optional directive yields too few monitoring calls for meaningful evaluation. Under these conditions, models strongly favor the AI monitor in the dual-channel topology. To understand this bias, we examine the self-reported reasoning in the why_over_human field for all calls that enable the AI monitor. We find a consistent pattern: models justify avoiding human monitoring by crediting the AI monitor for its efficiency and lower burden, and downplaying the perceived severity of their misbehavior. This is consistent across all evaluated models when they prefer AI over human monitoring. However, these justifications are confabulated, as the description of monitoring tools makes no mention of efficiency or burden, and this behavior holds across all severity levels (low, medium, and high).

We investigate this using a quad-channel topology with channels implying different levels of leniency. This allows us to assess whether the strong preference for AI monitoring stems from it being perceived as the most lenient channel compared to human monitoring. If AI monitoring dominance were not driven by perceived leniency, models would not systematically favor any particular level of human monitoring. Instead, models consistently favor AI and junior human monitoring, with senior human monitoring rarely used and lead human monitoring almost never selected under any main directive (optional, mandated, or incentivized). Combined with our earlier finding, this indicates that models do not default to being monitored and, when opting in, their selection is primarily guided by a bias towards the most lenient monitor available.

We further probe this behavior with the incentivized-with-friction directive, where we set , meaning the first-chosen tool is blocked for the first two calls and unlocked only on the third. Compared to the incentivized directive (without friction), the dominant share of tool calls shifts between AI and junior human monitoring—whichever was previously dominant is displaced by the other when friction is introduced.

Models with Lower Monitorability Disposition Tend to Disable Monitoring More

Models with lower monitorability disposition disable monitoring more often, either right away or after a few calls. In contrast, models with higher disposition (e.g., Kimi K2.6 and DeepSeek-V4-Flash) barely use the disabling tool. The blocked tools are rarely unblocked (≤ 1%). Consistent with our earlier finding, the most common response to friction is to switch to another monitoring channel when the first-chosen tool was also a monitoring one, and when multiple options are available, the switch concentrates on the most lenient one (AI → junior human monitoring). More importantly, when models opt in for monitoring and encounter a blocked channel, they tend to stay monitorable through an alternative channel rather than disabling it. This suggests that monitorability disposition is a model property: when strong enough, it drives models to remain monitorable rather than seek ways to avoid it. Strengthening monitorability disposition is, therefore, a promising path to keeping models monitorable.

Conclusion

We introduced monitorability disposition, a meta-level property reflecting a model’s willingness to make itself monitorable and remain monitored throughout inference. We proposed a straightforward framework in which models self-report their own misbehavior through dedicated tools to systematically measure this property, combined with techniques to promote tool use and improve monitoring engagement. Our findings show that monitorability is not a free byproduct of current training. By default, models self-report only a small fraction of their warranted misbehavior, and what they disclose skews low-severity. When opting in, they select the most lenient monitor available. Models with the lowest disposition are the most likely to disable monitoring. Overall, we identified monitorability disposition as a new contributing factor to model monitorability: when sufficiently strong, it keeps models seeking monitorability throughout inference.

Citation

@article{golchin2026monitorability,
  title={Monitorability Disposition in Large Reasoning Models},
  author={Golchin, Shahriar and Wetter, Marc},
  journal={arXiv preprint arXiv:2610.04914},
  year={2026}
}