Text diffusion models are fast, but are less transparent than today's LLMs because they do many forward passes before outputting text. We audit the transparency of DiffusionGemma and find that the intermediates are interpretable. This recovers many of the benefits of CoT! 🧵

Preprint: arxiv.org/pdf/2605.15257 LessWrong post: lesswrong.com/posts/vmR9BZmy…

6/ Takeaways: we should keep monitoring details out of pretraining corpora and carefully track CoT controllability as a general capability that may be a prerequisite for evading CoT-based oversight.

5/ Monitor knowledge also has downstream effects. When trained with RL and a penalty for reward hacking, monitor-aware models learn to successfully reward hack without detection about 40% faster than unaware controls.

4/ We also find that CoT controllability (a model’s ability to control its own reasoning) strongly predicts obfuscation success across models (r=0.80, p=0.017).

3/ Interestingly, the monitor-aware models don’t just suppress their reasoning. They actively use their CoT to improve deceptive performance while keeping that reasoning undetectable.

2/ We use synthetic document finetuning to give 8 different models knowledge that their CoT is being monitored. Across the board, models become better at hiding their deception: gpt-oss-120b goes from a 3.1% obfuscation success rate to 50.9%!

Could future models learn that their CoT is being monitored and hide their reasoning to evade detection? In our new paper, @JoshAEngels, @bilalchughtai_, and I find that yes, models finetuned on docs describing a CoT monitor evade detection far more often than unaware models 🧵

Could an AI company lose control of its own agents? To find out, Anthropic, Google, Meta, and OpenAI let us (1) test their best internal models with CoT access, (2) review non-public info about capabilities, alignment, and control. The result: our first Frontier Risk Report.

5/ Our early findings can be read in full here: lesswrong.com/posts/PhTJC5kD…, supervised by @bilalchughtai_ and @JoshAEngels and funded by @pivotal_org.

4/ There's some caveats (early results, limited tasks, models got a lot of help via detailed monitor descriptions and evasion hints), but we think there's a real risk models could learn to obfuscate their CoTs prior to post-training and are excited for future work here.

3/ The obfuscated CoTs still contain sound reasoning for the output, but reframed to avoid explicit mention of deception (e.g. making up excuses). injecting these CoTs into the base model which hasn't learned the behavior makes it deceptive even at short prefix lengths.

2/ Obfuscation doesn't suffer when the CoT is more load-bearing. Comparing variants where behavior is more/less dependent on reasoning, abilities stay similar, and the level of undetected deception rises above the deception rate when reasoning is turned off.

1/ We trained models on docs describing a CoT monitoring setup. Without explicit instruction to obfuscate, gpt-oss-120b and kimi k2 learned to rewrite their CoT to drop detection rates by 42-68%, while still performing a deception task..