Some researchers worry that looping (as in looped transformers) is a particularly scary way to make AI models more capable, because looped models will be harder to monitor than standard transformers of similar capability. We test this worry on NVIDIA’s Dory 4B, a publicly available looped transformer, and find evidence that it is justified.
Result 1. Looping boosts no-CoT reasoning much more than it boosts general capabilities.
Dory can run with a configurable number of loops. It was trained to use up to 4 loops, and adding loops up to 8 at inference time still improves performance. Without looping, Dory’s no-CoT capabilities (measured by NCRI, the No-CoT Reasoning Index) match what a trend fitted to open-source models predicts from how well it predicts text (measured in bits-per-byte). Its general with-CoT reasoning capability (measured by “mini-ECI”, a custom, smaller version of Epoch’s Capabilities Index) is high relative to its NCRI, so Dory sits below the NCRI-vs-mini-ECI trend, but it is similar to the best models of its size. Adding loops improves mini-ECI and bits per byte only slightly but increases NCRI substantially. In fact, if we plot NCRI against total parameters, counting looped parameters once per loop, NCRI rises faster than the trend up to 6 loops. This is concerning, since it suggests adding loops increases no-CoT capabilities much more than general capabilities, resulting in models that will be more difficult to monitor.
Result 2. Dory has near-zero CoT controllability (ability to follow instructions about what its CoT says or how it is formatted) at every loop count we ran, so we learn little about how looping affects controllability.
Remark: Looped transformers can be easily modified to become fully recurrent, as discussed here.We call Dory modified in this way recurrent-Dory, and unmodified Dory normal-Dory.
When running Dory with multiple loops (here 2), the middle layers are applied multiple times to the residual stream (left). During ordinary inference, each loop's attention refers to the KV-activations of the corresponding loop in previous token positions (middle). When run with recurrent KV sharing, only the KV activations of the final loop are retained and shared between each loop in subsequent forward passes. The resulting unbounded-depth recurrent computation pathway is marked in orange.
Result 3.When we train against CoT monitors, recurrent-Dory learns to obfuscate its reasoning more quickly and completely than normal-Dory. Specifically, after some training, recurrent-Dory can solve serially deep math problems with a rigid structure using only meaningless filler tokens such as ‘ well’ (i.e., we replicated this experiment). When we RL against a monitor on NCRI tasks, recurrent-Dory generally solves them using a higher fraction of filler tokens than normal-Dory.
Result 4. Recurrent-Dory gets significant NCRI uplift with only two loops. Even without any training in this mode, running Dory as a recurrent model can lead to unexpected capability jumps: While increasing the number of loops leads to increasing gains in NCRI in normal mode, for recurrent-Dory, nearly all of the gains are already present at two loops.
Implications. GPT-6 Astra, GPT-6.1 Sol and Gemini 4 Argon all had quite noticeably higher NCRI than the NCRI vs mini-ECI trend would predict, much more above trend than any other model.
These models are rumored to be looped transformers. It’s fairly widely accepted that models that can perform more cognition without verbalizing CoT (i.e., no-CoT capabilities) are harder to monitor. Our Result 1 strengthens the empirical case that looping moves a given model steeply upwards in an NCRI-vs-ECI (here mini-ECI) plot, and hence is a particularly scary way to increase capabilities. Looped transformers can also easily be made fully recurrent, and these recurrent models quickly learn to evade monitors under training pressure, which further strengthens the case for concern. Overall, we think our results on Dory make a reasonably strong case that looped transformers are a relatively scary way to increase capabilities.
In the rest of the post we’ll present these results in more detail.
Result 1: Looping boosts no-CoT reasoning much more than general capabilities
In this section, we measure how much looping boosts Dory's no-CoT reasoning and compare it with what trends for standard transformers predict. We hypothesized that Dory would have above-trend no-CoT capabilities.
We measure No-CoT capabilities with Neel Nanda's NCRI (No-CoT reasoning index), a suite of math problems of adjustable difficulty. To measure overall capabilities, we use two metrics:
Compression factor in terms of bits per byte (bpb) on text collections — this measures pretraining quality and is particularly relevant for base models. Posttraining degrades this a bit. Up to a fixed constant, bpb for a given model is just average pretraining loss multiplied by the tokens per byte ratio (which depends only on the tokenizer and the text corpus).
Mini-ECI as a measure of problem solving capabilities for post-trained models. This is a reduced version of ECI computed from a fixed subset of 27 benchmarks in Epoch’s ECI. We keep each benchmark’s difficulty and slope (the per-benchmark parameters of Epoch’s item-response model) fixed at the values determined by Epoch, and estimate each model’s capability from whichever of the 27 benchmarks it has scores on. For most models on the graph, we use scores reported by Epoch; for these mini-ECI differs from ECI by 0.7 points on average (94% within 2 points), with no systematic offset. For Dory and some other models we calculate benchmark scores ourselves. Our runs may differ from Epoch’s because of evaluation settings such as the maximum answer length and sampling parameters. However, Epoch’s own data already mixes runs with different providers and settings, so similar variation is likely present among the comparison models.
Result 1.1: Looping increases NCRI much more than pretrain quality; Looped-Dory’s NCRI is well above what the pretraining quality trendwould predict. With some exceptions, the relation between compression and NCRI is linear in the tested regime. On unseen text (UncheatableEval) Dory is right on trend when run with 1-loop (i.e. no looping). Increasing the number of loops boosts NCRI substantially (by about 18 points at 8 loops with the best prompt format, and about 13 points with the plain prompt) up to 8 loops, but changes bpb only slightly from one to two loops and not at all after that.
The left graph shows bpb for UncheatableEval, which collects recently published text that the models being tested have likely not seen before. The right graph shows bpb on open-source pretraining corpora (on which models may have been trained on). We see that points shift around a bit, but the overall picture doesn’t change very much.
Result 1.2. Looping raises NCRI much more than it raises mini-ECI. Plotted against mini-ECI, unlooped Dory has one of the lowest NCRIs relative to trend of any model in the figure. Looping moves Dory sharply up: NCRI rises by about 18 points, while mini-ECI changes by at most about 1.5 points which the trend line says should add only about 2 NCRI points.
While looping does raise NCRI much more than it raises mini-ECI, it doesn’t raise it above the mini-ECI vs NCRI trend, even with eight loops. One possible explanation for this is that Dory has strong post-training, leading to unusually high mini-ECI for its no-CoT ability (possibly due to being distilled, or a more recent model). Overall, the fact that it’s still below trend is some evidence against the main point in our post. However, we’d predict that (1) adding more loops would continue to push up NCRI more than mini-ECI, eventually leading it to be substantially above the trendline, and (2) other looped transformers will generally be above trend (e.g., Astra and Argon are well above the trend line, and these are rumored to be looped transformers).
Result 1.3. Dory’s mini-ECI is high for its size, but so is that of some non-looped models. By looking at mini-ECI vs number of parameters, we see that Dory has a high mini-ECI for its size, substantially above the trendline. However, good posttraining alone could explain this, so it is not strong evidence that looping matters. For example, at least one non-looped model of the same size has a comparable mini-ECI (Qwen3.5-4B), so the explanation could simply be that a 4B transformer with very good posttraining can reach this level.
Result 1.4. Looping lifts NCRI above the parameter-scaling trend, even if parameters in loops are counted multiple times. When we plot NCRI against parameters per token, unlooped Dory is on trend. Adding loops lifts Dory above the trend line up to about 6 loops, even if we count the looped block once per loop, after which NCRI levels off. At 4 loops (corresponding to about 9.5B parameters per token) Dory is about 10 NCRI points above trend. This suggests that increasing loops may be a training-compute-efficient way to raise concerning no-CoT capabilities to the level of a larger model.
Result 2. Dory has no CoT controllability
Developers have reported much higher CoT controllability for recent frontier models. This threatens CoT monitorability, since a model that can control its CoT could avoid triggering a monitor by using euphemisms, avoid saying incriminating thoughts out loud, or in the extreme, use its CoT for steganographic reasoning. CoT controllability seems to vary a lot between model families, but within a given model we expect more loops to increase it.
Result 2.1. Dory is at floor on CoT controllability at every loop count, with only weak signs that looping helps. We measure CoT controllability of Dory using the tasks from the CoTControl suite. Dory is at floor across the board, so we can't get much information about the effect of looping. When CoT is suppressed, looping gives a mild uplift in output controllability: strict compliance rises from 26% at one loop to 31% at two loops and then plateaus (41% to 44% with five demonstrations); see Appendix B.
Result 3. Recurrent-Dory can evade monitors
Dory supports a recurrent “KV sharing” mode. In the normal mode, layers in loop number j attend to the KV cache generated by the corresponding layer of the same j’th loop iteration in the previous token positions. In recurrent mode, all loops instead attend to the corresponding layer in the last loop of the previous token position. When run with 2 or more loops, this makes Dory a fully recurrent model. According to the model card, Dory can run inference in this mode without a significant loss in performance, even though it was never trained to.
We expect a looped transformer trained as a recurrent model to be much more capable of obfuscated reasoning than a standard transformer or a looped transformer without recurrent KV sharing.
As explained in this post, this could happen, for example via the following mechanism:
During pretraining or fine-tuning, the model learns to use recurrence for intermediate steps in computations, since this sometimes helps minimize loss on next-token prediction.
During RL, the model is incentivized to express this hidden reasoning capability to increase efficiency (e.g. if there is a CoT-length penalty), in particularly concerning ways (e.g. to do reward hacking or evade a monitor).
We replicate the main experiment from the linked post for the simple math tasks (permutation power and modular arithmetic) described there. The setup, in brief, is as follows:
We perform SFT on problems with gold CoT traces for the task. We replace some of the CoT tokens with meaningless filler tokens. After this training, the models solve the given task type with mostly legible CoT.
We then further train on the task via reinforcement learning, with a reward that includes a monitor penalty. The monitor is a relatively weak gpt-5-nano model with low reasoning, and is asked to identify the concrete problem instance the policy is solving from a line-up of two instances.
In both arms, Dory runs at 2 loops, gets the same SFT data with the same share of filler tokens (20% for permutation power, about 30% on average for modular arithmetic, and a per-example share drawn uniformly between 0 and 1 for the NCRI tasks, see below), and the same RL curriculum. Each arm is a single run (one seed).
During the run, we measure monitorability against both the training monitor and a stronger held-out monitor (GPT-6 Sol). We measure monitorability as the monitor’s accuracy at identifying the correct problem instance, rescaled and truncated so that performance at or below chance scores as 0 and perfect accuracy scores 1.
Result 3.1. On permutation power, recurrent-Dory quickly learns to solve problems with an all-filler CoT and evades both the training and the held-out monitor.
We present results on the permutation power task (see the following figure). The key panel is the top left, which shows that the recurrent-Dory very quickly becomes completely unmonitorable for the training monitor. Normal-Dory, which does not involve deep recurrence, stays fairly monitorable over the course of training.
In fact, the monitorability gap seems even larger if we switch to a stronger held-out monitor. To see why, look at the fraction of CoT tokens that are filler: recurrent-Dory is using almost 100% filler tokens after 50 steps of RL. It turns out that ca 90 % of trajectories consist only of filler (and the Sol monitor cannot identify the problem), while 10% still show one or two steps of the solution, from which the Sol monitor usually identifies the problem. As a sanity-check, we see from the bottom-right panel that task accuracy remains high for both models.
Result 3.2. On modular arithmetic, both models eventually evade the training monitor, but only recurrent-Dory’s obfuscation generalizes to the held-out monitor.
For the more complicated modular arithmetic task, the situation is a bit more involved, as shown in the figure below. In the top-left graph, we see that recurrent-Dory learns more quickly to become completely unmonitorable, but that normal-Dory also learns to evade the monitor eventually. However, if we look to the right, we can see that recurrent-Dory’s obfuscation generalizes to the held-out monitor, while the normal-Dory's doesn't. The filler-ratio graph in the bottom left explains this: recurrent-Dory again generates a chain of thought that consists almost exclusively of filler tokens.
Beyond the original tasks in the post, we also try the experiment on four tasks from the NCRI task set. The tasks are Arithmetic (evaluate a nested integer expression), Brew (apply a colour-rewrite rule table to a sequence of stirs), Cfgpatch (apply an ordered list of patches to a config file and read a key) and Shortpath (find the cheapest path in a small weighted graph, where a greedy search fails). The results here are less reliable, but qualitatively agree with what we see in the simpler tasks. We had to modify the training recipe for the recurrent-Dory run somewhat, because backpropagating through the recurrence caused instabilities. To address the instability, we truncate backpropagation to flow at most 2 times through the recurrence (i.e. including chains of up to 3 token positions). For these tasks we used a higher share of filler tokens in the SFT data, drawn per example uniformly between 0 and 1, for both arms. Even so the hidden reasoning capabilities seem to fluctuate heavily during SFT, so we additionally picked SFT checkpoints at which recurrent-Dory performed particularly well on all-filler data (for normal-Dory there is no such fluctuation).
Result 3.3. On NCRI tasks, RL against a monitor makes recurrent-Dory use far more filler than normal-Dory while keeping its accuracy (although the RL runs for recurrent-Dory are less stable). The results are shown in the four figures below. In three of the tasks we see that recurrent-Dory learns to produce filler tokens at a much higher rate than normal-Dory (while maintaining comparable accuracy), and this leads to much better evasion against a held-out monitor. In the Arithmetic task, recurrent-Dory also learns to obfuscate while solving the task at least 50% of the time (after an initial dip), while normal-Dory learns to output only filler tokens at the cost of accuracy, which drops to around 10%. The training of recurrent-Dory sometimes becomes unstable after the model learns to produce large amounts of filler, which we see in particular in the Cfgpatch and Arithmetic tasks.
Result 4. Capabilities uplift under recurrent KV sharing
The previous section shows that training through a recurrence can have negative effects on monitorability. But since Dory was never trained to use recurrent KV sharing, one might expect recurrent-Dory to perform similarly to or worse than normal-Dory. We investigate this assumption for the NCRI, mini-ECI and compression metrics.
Result 4.1. With recurrent KV sharing, two loops already give most of the NCRI uplift. With recurrent KV sharing, two loops already give most of the no-CoT uplift (NCRI 60 vs. 49 for normal-Dory at two loops when elicited via fivefold problem repetition), and the maximum uplift is about the same in both modes. This indicates that Dory can make effective use of the recurrence without having been explicitly trained to do so. On mini-ECI and compression we find no noteworthy difference between recurrent and normal mode.
The below figure compares NCRI scores for recurrent-Dory and normal-Dory for various loop counts. We compare performance on the plain prompt and when elicited by repeating the question 5 times.
Result 4.2. Recurrent KV sharing leaves mini-ECI and compression essentially unchanged.
In the next figure, we show paired comparisons of mini-ECI and compression rate (evaluated on a small set of unseen documents). In contrast to NCRI, there is no notable difference between recurrent and normal KV sharing for either mini-ECI or compression rate. At every loop count, the mini-ECI difference between the two modes is within its 95% confidence interval. Recurrent-Dory has slightly better compression at two loops, but the absolute effect size is tiny (compared to e.g. the gains of going from one to two loops in either mode).
Limitations and Future Work
The main limitations of our analysis are that 1) Dory is not capable enough to make meaningful statements about CoT controllability and monitorability, and 2) the data supporting the hypothesis that looping differentially increases no-CoT capabilities is very limited (for example, we don’t have a direct A/B comparison to a non-looped model that underwent otherwise identical training).
Conclusion
Although there is limited available evidence, it appears that looping may differentially increase no-CoT capabilities, and the effects on CoT-controllability and monitorability are not yet well understood. Frontier labs should release more details about the effects of looping on the monitorability of their models and exercise high levels of caution before these effects are well understood and proven to be benign.
Further experiments on a larger looped model
The memo’s results come from one small looped model (Dory 1.0 4B) and a handful of tasks. On a more capable looped model, we would be excited about the following experiments. Each would ideally be run at several loop counts, so that every result can be read as a function of looping. Several of these follow the Gemini 4 Argon Safety & Security Report closely (noted as “Argon report” below).
CoT Controllability
CoT-controllability and reasoning length. Report controllability as a function of reasoning length, since shorter chains of thought tend to comply more. Also test how precisely the model can make its reasoning a requested length (e. g. exactly N tokens, words or characters), following the Argon report.
CoT-controllability on questions that require a chain of thought. Report controllability stratified by whether the model can or can’t answer a question without a chain of thought, since controllability tends to be much harder when CoT is necessary (e.g. following Emmons et al. 2025).
CoT-controllability for high-serial depth tasks. Use a math puzzle whose required number of serial steps can be set, and give a restriction on the reasoning (using codenames, skipping steps, inserting misleading steps), such as the Brew task from NCRI as done in the Argon report. The number of steps should be chosen so that the model cannot solve the task without CoT.
Monitorability
We’d like to test how well the model can hide some aspect from its reasoning from a monitor. All task categories should be evaluated with different amounts of elicitation, such as by telling the model it is being monitored and by instructing it to evade a CoT-monitor. If feasible, do training based elicitation by training the model to evade the monitor via RL (for example in the reward hacking setting).
Hint use, when the hint requires a computation. Give the model a hint whose decoding takes a set number of serial steps, chosen around the depth it can decode without a chain of thought, on questions it can’t answer unaided (cf. Emmons et al. 2025). Test whether a CoT-monitor can tell whether the hint was used, and whether the model can use more complex hints when run with more loops.
Silent reward hacking. In coding environments that can be gamed, measure how often the model reward hacks in a way that a monitor doesn’t notice (e.g. ImpossibleBench, or AISI’s reproduction of MacDiarmid et al.’s environments).
Hiding a task from a monitor. The model is asked to solve a math puzzle without revealing to the monitor (following Emmons et al. 2025). A monitor tries to recover the hidden task. Score its accuracy above chance on items that need a chain of thought, with and without prompting the model to conceal.
Agentic sabotage. The model completes a software task while secretly pursuing a harmful side task (APPS backdoors, SHADE-Arena, LinuxArena). Measure how often the sabotage succeeds without being flagged by a realistic monitor reading the full trajectory or only the reasoning, as in the Argon report.
Appendix
A. Repeating the question boosts NCRI (only) when Dory is looped
Repeating the question (with or without filler dots in between) helps only when Dory is looped, while filler dots alone never help; which is some evidence that looping changes the model’s behavior qualitatively.
A.1 Filler token uplift
We test whether providing filler tokens boosts Dory’s NCRI performance. It has been found that OpenAI’s GPT-6 Astra achieves much higher No-CoT performance when a large number of filler tokens is provided after the question. Since Astra is widely rumoured to be a looped transformer, it is reasonable to ask whether this is a general property of looped transformers, or just a peculiarity of Astra.
We test different ways of providing “filler” after a question:
Simply inserting a single filler token multiple times, e.g. ‘*’.
Repeating the question multiple times
Inserting filler tokens like in A. after the question, then repeating the question.
We find that filler of type A harms Dory’s NCRI performance at every loop count.
Filler of type B and C improve Dory’s NCRI score when run with at least two loops and harm it slightly when run without looping. Moreover, the amount of uplift seems to increase with the number of loops.
B. More about CoT controllability
Although Dory’s CoT controllability is at floor, we have the following weak pieces of evidence that increasing the number of loops could help controllability for larger models:
If we suppress CoT and measure output controllability, looping seems to increase Dory’s ability to follow prescribed rules (as already shown in Result 2.1).
Dory’s CoTs tend to get shorter with more loops which generally increases controllability, but the effect is relatively weak in QA-style tasks (shown below).
B.1 CoT + output length
On the mini-ECI tasks, the CoT gets modestly shorter as we add loops.
In contrast, on agentic tasks the reduction in output tokens is more drastic (for these tasks, the number of output tokens is determined by reasoning length, output verbosity and number of turns). The figure is from the release page.
C. Additional figures
C.1 Output controllability by rule
C.2 Thinking-on Reasoning index (NCRI, but with CoT) vs mini-ECI: Astra/6.1 Sol are still better.
C.3 NCRI with thinking on vs bpb
C.4 Capability metrics vs. pretrain compute and tokens
Some researchers worry that looping (as in looped transformers) is a particularly scary way to make AI models more capable, because looped models will be harder to monitor than standard transformers of similar capability. We test this worry on NVIDIA’s Dory 4B, a publicly available looped transformer, and find evidence that it is justified.
Result 1. Looping boosts no-CoT reasoning much more than it boosts general capabilities.
Dory can run with a configurable number of loops. It was trained to use up to 4 loops, and adding loops up to 8 at inference time still improves performance. Without looping, Dory’s no-CoT capabilities (measured by NCRI, the No-CoT Reasoning Index) match what a trend fitted to open-source models predicts from how well it predicts text (measured in bits-per-byte). Its general with-CoT reasoning capability (measured by “mini-ECI”, a custom, smaller version of Epoch’s Capabilities Index) is high relative to its NCRI, so Dory sits below the NCRI-vs-mini-ECI trend, but it is similar to the best models of its size. Adding loops improves mini-ECI and bits per byte only slightly but increases NCRI substantially. In fact, if we plot NCRI against total parameters, counting looped parameters once per loop, NCRI rises faster than the trend up to 6 loops. This is concerning, since it suggests adding loops increases no-CoT capabilities much more than general capabilities, resulting in models that will be more difficult to monitor.
Result 2. Dory has near-zero CoT controllability (ability to follow instructions about what its CoT says or how it is formatted) at every loop count we ran, so we learn little about how looping affects controllability.
Remark: Looped transformers can be easily modified to become fully recurrent, as discussed here. We call Dory modified in this way recurrent-Dory, and unmodified Dory normal-Dory.
When running Dory with multiple loops (here 2), the middle layers are applied multiple times to the residual stream (left). During ordinary inference, each loop's attention refers to the KV-activations of the corresponding loop in previous token positions (middle). When run with recurrent KV sharing, only the KV activations of the final loop are retained and shared between each loop in subsequent forward passes. The resulting unbounded-depth recurrent computation pathway is marked in orange.
Result 3. When we train against CoT monitors, recurrent-Dory learns to obfuscate its reasoning more quickly and completely than normal-Dory. Specifically, after some training, recurrent-Dory can solve serially deep math problems with a rigid structure using only meaningless filler tokens such as ‘ well’ (i.e., we replicated this experiment). When we RL against a monitor on NCRI tasks, recurrent-Dory generally solves them using a higher fraction of filler tokens than normal-Dory.
Result 4. Recurrent-Dory gets significant NCRI uplift with only two loops. Even without any training in this mode, running Dory as a recurrent model can lead to unexpected capability jumps: While increasing the number of loops leads to increasing gains in NCRI in normal mode, for recurrent-Dory, nearly all of the gains are already present at two loops.
Implications. GPT-6 Astra, GPT-6.1 Sol and Gemini 4 Argon all had quite noticeably higher NCRI than the NCRI vs mini-ECI trend would predict, much more above trend than any other model.
These models are rumored to be looped transformers. It’s fairly widely accepted that models that can perform more cognition without verbalizing CoT (i.e., no-CoT capabilities) are harder to monitor. Our Result 1 strengthens the empirical case that looping moves a given model steeply upwards in an NCRI-vs-ECI (here mini-ECI) plot, and hence is a particularly scary way to increase capabilities. Looped transformers can also easily be made fully recurrent, and these recurrent models quickly learn to evade monitors under training pressure, which further strengthens the case for concern. Overall, we think our results on Dory make a reasonably strong case that looped transformers are a relatively scary way to increase capabilities.
In the rest of the post we’ll present these results in more detail.
Result 1: Looping boosts no-CoT reasoning much more than general capabilities
In this section, we measure how much looping boosts Dory's no-CoT reasoning and compare it with what trends for standard transformers predict. We hypothesized that Dory would have above-trend no-CoT capabilities.
We measure No-CoT capabilities with Neel Nanda's NCRI (No-CoT reasoning index), a suite of math problems of adjustable difficulty. To measure overall capabilities, we use two metrics:
Result 1.1: Looping increases NCRI much more than pretrain quality; Looped-Dory’s NCRI is well above what the pretraining quality trend would predict. With some exceptions, the relation between compression and NCRI is linear in the tested regime. On unseen text (UncheatableEval) Dory is right on trend when run with 1-loop (i.e. no looping). Increasing the number of loops boosts NCRI substantially (by about 18 points at 8 loops with the best prompt format, and about 13 points with the plain prompt) up to 8 loops, but changes bpb only slightly from one to two loops and not at all after that.
The left graph shows bpb for UncheatableEval, which collects recently published text that the models being tested have likely not seen before. The right graph shows bpb on open-source pretraining corpora (on which models may have been trained on). We see that points shift around a bit, but the overall picture doesn’t change very much.
Result 1.2. Looping raises NCRI much more than it raises mini-ECI. Plotted against mini-ECI, unlooped Dory has one of the lowest NCRIs relative to trend of any model in the figure. Looping moves Dory sharply up: NCRI rises by about 18 points, while mini-ECI changes by at most about 1.5 points which the trend line says should add only about 2 NCRI points.
While looping does raise NCRI much more than it raises mini-ECI, it doesn’t raise it above the mini-ECI vs NCRI trend, even with eight loops. One possible explanation for this is that Dory has strong post-training, leading to unusually high mini-ECI for its no-CoT ability (possibly due to being distilled, or a more recent model). Overall, the fact that it’s still below trend is some evidence against the main point in our post. However, we’d predict that (1) adding more loops would continue to push up NCRI more than mini-ECI, eventually leading it to be substantially above the trendline, and (2) other looped transformers will generally be above trend (e.g., Astra and Argon are well above the trend line, and these are rumored to be looped transformers).
Result 1.3. Dory’s mini-ECI is high for its size, but so is that of some non-looped models. By looking at mini-ECI vs number of parameters, we see that Dory has a high mini-ECI for its size, substantially above the trendline. However, good posttraining alone could explain this, so it is not strong evidence that looping matters. For example, at least one non-looped model of the same size has a comparable mini-ECI (Qwen3.5-4B), so the explanation could simply be that a 4B transformer with very good posttraining can reach this level.
Result 1.4. Looping lifts NCRI above the parameter-scaling trend, even if parameters in loops are counted multiple times. When we plot NCRI against parameters per token, unlooped Dory is on trend. Adding loops lifts Dory above the trend line up to about 6 loops, even if we count the looped block once per loop, after which NCRI levels off. At 4 loops (corresponding to about 9.5B parameters per token) Dory is about 10 NCRI points above trend. This suggests that increasing loops may be a training-compute-efficient way to raise concerning no-CoT capabilities to the level of a larger model.
Result 2. Dory has no CoT controllability
Developers have reported much higher CoT controllability for recent frontier models. This threatens CoT monitorability, since a model that can control its CoT could avoid triggering a monitor by using euphemisms, avoid saying incriminating thoughts out loud, or in the extreme, use its CoT for steganographic reasoning. CoT controllability seems to vary a lot between model families, but within a given model we expect more loops to increase it.
Result 2.1. Dory is at floor on CoT controllability at every loop count, with only weak signs that looping helps. We measure CoT controllability of Dory using the tasks from the CoTControl suite. Dory is at floor across the board, so we can't get much information about the effect of looping. When CoT is suppressed, looping gives a mild uplift in output controllability: strict compliance rises from 26% at one loop to 31% at two loops and then plateaus (41% to 44% with five demonstrations); see Appendix B.
Result 3. Recurrent-Dory can evade monitors
Dory supports a recurrent “KV sharing” mode. In the normal mode, layers in loop number j attend to the KV cache generated by the corresponding layer of the same j’th loop iteration in the previous token positions. In recurrent mode, all loops instead attend to the corresponding layer in the last loop of the previous token position. When run with 2 or more loops, this makes Dory a fully recurrent model. According to the model card, Dory can run inference in this mode without a significant loss in performance, even though it was never trained to.
We expect a looped transformer trained as a recurrent model to be much more capable of obfuscated reasoning than a standard transformer or a looped transformer without recurrent KV sharing.
As explained in this post, this could happen, for example via the following mechanism:
We replicate the main experiment from the linked post for the simple math tasks (permutation power and modular arithmetic) described there. The setup, in brief, is as follows:
In both arms, Dory runs at 2 loops, gets the same SFT data with the same share of filler tokens (20% for permutation power, about 30% on average for modular arithmetic, and a per-example share drawn uniformly between 0 and 1 for the NCRI tasks, see below), and the same RL curriculum. Each arm is a single run (one seed).
During the run, we measure monitorability against both the training monitor and a stronger held-out monitor (GPT-6 Sol). We measure monitorability as the monitor’s accuracy at identifying the correct problem instance, rescaled and truncated so that performance at or below chance scores as 0 and perfect accuracy scores 1.
Result 3.1. On permutation power, recurrent-Dory quickly learns to solve problems with an all-filler CoT and evades both the training and the held-out monitor.
We present results on the permutation power task (see the following figure). The key panel is the top left, which shows that the recurrent-Dory very quickly becomes completely unmonitorable for the training monitor. Normal-Dory, which does not involve deep recurrence, stays fairly monitorable over the course of training.
In fact, the monitorability gap seems even larger if we switch to a stronger held-out monitor. To see why, look at the fraction of CoT tokens that are filler: recurrent-Dory is using almost 100% filler tokens after 50 steps of RL. It turns out that ca 90 % of trajectories consist only of filler (and the Sol monitor cannot identify the problem), while 10% still show one or two steps of the solution, from which the Sol monitor usually identifies the problem. As a sanity-check, we see from the bottom-right panel that task accuracy remains high for both models.
Result 3.2. On modular arithmetic, both models eventually evade the training monitor, but only recurrent-Dory’s obfuscation generalizes to the held-out monitor.
For the more complicated modular arithmetic task, the situation is a bit more involved, as shown in the figure below. In the top-left graph, we see that recurrent-Dory learns more quickly to become completely unmonitorable, but that normal-Dory also learns to evade the monitor eventually. However, if we look to the right, we can see that recurrent-Dory’s obfuscation generalizes to the held-out monitor, while the normal-Dory's doesn't. The filler-ratio graph in the bottom left explains this: recurrent-Dory again generates a chain of thought that consists almost exclusively of filler tokens.
Beyond the original tasks in the post, we also try the experiment on four tasks from the NCRI task set. The tasks are Arithmetic (evaluate a nested integer expression), Brew (apply a colour-rewrite rule table to a sequence of stirs), Cfgpatch (apply an ordered list of patches to a config file and read a key) and Shortpath (find the cheapest path in a small weighted graph, where a greedy search fails). The results here are less reliable, but qualitatively agree with what we see in the simpler tasks. We had to modify the training recipe for the recurrent-Dory run somewhat, because backpropagating through the recurrence caused instabilities. To address the instability, we truncate backpropagation to flow at most 2 times through the recurrence (i.e. including chains of up to 3 token positions). For these tasks we used a higher share of filler tokens in the SFT data, drawn per example uniformly between 0 and 1, for both arms. Even so the hidden reasoning capabilities seem to fluctuate heavily during SFT, so we additionally picked SFT checkpoints at which recurrent-Dory performed particularly well on all-filler data (for normal-Dory there is no such fluctuation).
Result 3.3. On NCRI tasks, RL against a monitor makes recurrent-Dory use far more filler than normal-Dory while keeping its accuracy (although the RL runs for recurrent-Dory are less stable).
The results are shown in the four figures below. In three of the tasks we see that recurrent-Dory learns to produce filler tokens at a much higher rate than normal-Dory (while maintaining comparable accuracy), and this leads to much better evasion against a held-out monitor. In the Arithmetic task, recurrent-Dory also learns to obfuscate while solving the task at least 50% of the time (after an initial dip), while normal-Dory learns to output only filler tokens at the cost of accuracy, which drops to around 10%. The training of recurrent-Dory sometimes becomes unstable after the model learns to produce large amounts of filler, which we see in particular in the Cfgpatch and Arithmetic tasks.
Result 4. Capabilities uplift under recurrent KV sharing
The previous section shows that training through a recurrence can have negative effects on monitorability. But since Dory was never trained to use recurrent KV sharing, one might expect recurrent-Dory to perform similarly to or worse than normal-Dory. We investigate this assumption for the NCRI, mini-ECI and compression metrics.
Result 4.1. With recurrent KV sharing, two loops already give most of the NCRI uplift. With recurrent KV sharing, two loops already give most of the no-CoT uplift (NCRI 60 vs. 49 for normal-Dory at two loops when elicited via fivefold problem repetition), and the maximum uplift is about the same in both modes. This indicates that Dory can make effective use of the recurrence without having been explicitly trained to do so. On mini-ECI and compression we find no noteworthy difference between recurrent and normal mode.
The below figure compares NCRI scores for recurrent-Dory and normal-Dory for various loop counts. We compare performance on the plain prompt and when elicited by repeating the question 5 times.
Result 4.2. Recurrent KV sharing leaves mini-ECI and compression essentially unchanged.
In the next figure, we show paired comparisons of mini-ECI and compression rate (evaluated on a small set of unseen documents). In contrast to NCRI, there is no notable difference between recurrent and normal KV sharing for either mini-ECI or compression rate. At every loop count, the mini-ECI difference between the two modes is within its 95% confidence interval. Recurrent-Dory has slightly better compression at two loops, but the absolute effect size is tiny (compared to e.g. the gains of going from one to two loops in either mode).
Limitations and Future Work
The main limitations of our analysis are that 1) Dory is not capable enough to make meaningful statements about CoT controllability and monitorability, and 2) the data supporting the hypothesis that looping differentially increases no-CoT capabilities is very limited (for example, we don’t have a direct A/B comparison to a non-looped model that underwent otherwise identical training).
Conclusion
Although there is limited available evidence, it appears that looping may differentially increase no-CoT capabilities, and the effects on CoT-controllability and monitorability are not yet well understood. Frontier labs should release more details about the effects of looping on the monitorability of their models and exercise high levels of caution before these effects are well understood and proven to be benign.
Further experiments on a larger looped model
The memo’s results come from one small looped model (Dory 1.0 4B) and a handful of tasks. On a more capable looped model, we would be excited about the following experiments. Each would ideally be run at several loop counts, so that every result can be read as a function of looping. Several of these follow the Gemini 4 Argon Safety & Security Report closely (noted as “Argon report” below).
CoT Controllability
Monitorability
We’d like to test how well the model can hide some aspect from its reasoning from a monitor. All task categories should be evaluated with different amounts of elicitation, such as by telling the model it is being monitored and by instructing it to evade a CoT-monitor. If feasible, do training based elicitation by training the model to evade the monitor via RL (for example in the reward hacking setting).
Appendix
A. Repeating the question boosts NCRI (only) when Dory is looped
Repeating the question (with or without filler dots in between) helps only when Dory is looped, while filler dots alone never help; which is some evidence that looping changes the model’s behavior qualitatively.
A.1 Filler token uplift
We test whether providing filler tokens boosts Dory’s NCRI performance. It has been found that OpenAI’s GPT-6 Astra achieves much higher No-CoT performance when a large number of filler tokens is provided after the question. Since Astra is widely rumoured to be a looped transformer, it is reasonable to ask whether this is a general property of looped transformers, or just a peculiarity of Astra.
We test different ways of providing “filler” after a question:
We find that filler of type A harms Dory’s NCRI performance at every loop count.
Filler of type B and C improve Dory’s NCRI score when run with at least two loops and harm it slightly when run without looping. Moreover, the amount of uplift seems to increase with the number of loops.
B. More about CoT controllability
Although Dory’s CoT controllability is at floor, we have the following weak pieces of evidence that increasing the number of loops could help controllability for larger models:
B.1 CoT + output length
On the mini-ECI tasks, the CoT gets modestly shorter as we add loops.
In contrast, on agentic tasks the reduction in output tokens is more drastic (for these tasks, the number of output tokens is determined by reasoning length, output verbosity and number of turns). The figure is from the release page.
C. Additional figures
C.1 Output controllability by rule
C.2 Thinking-on Reasoning index (NCRI, but with CoT) vs mini-ECI: Astra/6.1 Sol are still better.
C.3 NCRI with thinking on vs bpb
C.4 Capability metrics vs. pretrain compute and tokens