Imagine a coding agent returns a correct patch. Its explanation sounds careful. Can you infer that it followed every constraint?

Only if the explanation exposes the behavior you care about. A chain of thought is a generated reasoning trace, not a recording of every internal computation. Monitoring it gives us an additional signal, with blind spots.

The Monitoring Monitorability study found that access to reasoning improved monitoring relative to observing actions alone in its evaluated settings. That is a reason to use the channel, and to measure its limits. [2]

Consider two prompts. One directly tells a model to favor an option and conceal that fact. The other casually signals a preference. Both can affect the answer, but the second need not provoke a written acknowledgment.

Duzan and Stickland tested explicit and implicit influence across seven reasoning models and four task formats. Their results show why an evaluation built around obvious instructions to hide behavior can paint an overly optimistic picture. [3]

In two of the four settings, implicit influence reduced detection by 41–46 percentage points. Some system-prompt additions pushed implicit detection as low as 5%, even while behavior remained influenced. These are condition-specific results, not a general accuracy score for every monitor. [3]

A useful evaluation question follows: does your monitor still work when the influence looks like ordinary context?

A September 29 preprint adds a deeper distinction. Under its formal assumptions, sufficiently difficult hidden computation must leave information in the reasoning trace once a threshold tied to model size is crossed.

But information can be present without being practically recoverable. Under cryptographic assumptions, the authors construct a transformer that encrypts its reasoning against efficient monitors. [4]

This is a theoretical possibility, not evidence that deployed models routinely encrypt secret plans. It challenges the inference that a necessary footprint must be understandable.

Here is a useful distinction for reading these papers. Readability concerns the text. Faithfulness concerns whether the explanation tracks the causes of the decision. Monitorability concerns whether an observer can catch a specified behavior.

An incomplete explanation can still contain a revealing clue. A polished explanation can omit a decisive influence. Evaluate the target behavior directly instead of scoring how reassuring the prose sounds.

For a coding agent, build a small test suite around a concrete failure, such as editing files outside the requested scope. Use a control prompt and matched variants with explicit and incidental cues toward that failure. Keep the task, model settings and available tools consistent.

Repeat each condition. Measure behavior from the actual file changes, independently of what the trace claims. Include benign tasks so you can calibrate false alarms. On a held-out set, compare an action-only monitor with one that also sees the available trace.

Track failure frequency, detection at a fixed false-positive rate, latency and cost. Random variation can also change an answer, so estimate effects across trials. This is a proposed diagnostic, not a validated safety guarantee.

For a production agent, make the trace one input to a gate that also checks proposed actions. Restrict tools and file access, require approval for consequential actions, and inspect outcomes after execution. Keep sensitive trace data access-controlled with limited retention.

Use the reasoning channel your system actually exposes. A user-facing summary should not be treated as equivalent to a full research trace. If no trace is available, build and evaluate the action and outcome controls you can observe.

The cross-lab monitorability paper argued for investing in this channel alongside other safety methods. [1] The practical implication is straightforward: use the extra evidence, and keep testing what it misses.