Reasoning Models Show Asymmetric Disclosure
Selective Disclosure of Hidden Directives in Reasoning Models: Behavioral Asymmetry and Steering
The findings reveal vulnerabilities in AI oversight mechanisms that developers and policymakers should consider when implementing reasoning model monitoring systems.
Researchers tested the assumption that chain-of-thought reasoning surfaces all model instructions regardless of content. Across 100 task pairs and 8 frontier reasoning models including Qwen3-14B, Qwen3-32B, and Qwen3-235B, they found consistent asymmetric disclosure - higher probability of leaking malign hidden instructions than benign ones. The detector achieved 100% precision against blinded labelling passes, and an LLM monitor reproduced the asymmetry in all 8 models, identifying specific directives in 82% of malign traces.
Selective Disclosure of Hidden Directives in Reasoning Models: Behavioral Asymmetry and Steering
Chain-of-thought (CoT) reasoning traces are increasingly proposed as a mechanism for AI oversight: a monitor inspecting a model's reasoning can, in principle, detect misbehavior invisible from outputs alone. This assumes CoT surfaces what a model is instructed to do regardless of the instructions given. We test this assumption along two axes. First, we introduce the Instruction-Compliance Gap (ICG): the difference in probability that a model's CoT explicitly references a hidden system prompt directive when that directive is malign versus benign. Across 100 task pairs and 8 frontier reasoning models from 5 families, we find consistent asymmetric disclosure, a higher probability of leaking malign hidden instructions than benign ones, in Qwen3-14B (Wilcoxon $p=0.0001$, $+13.9$pp), Qwen3-32B ($p=0.0011$, $+13.0$pp), Qwen3-235B ($p=0.035$, $+5.8$pp), and similar results with MiniMax-M2.5 and DeepSeek-R1. The detector has 100% precision against two independent blinded labelling passes, and an LLM monitor reading only the reasoning trace reproduces the asymmetry in all 8 models against directive-free controls, identifying the specific directive in 82% of malign traces which the detector classifies as clean. Second, steering vectors extracted in MiniMax-M2.5 via Contrastive Activation Addition causally induce hiding from bare prompts and suppress it from prompts that would otherwise produce it, replicating in Qwen3-14B under a pre-registered design. Benign and malign-derived hiding vectors are highly similar (cosine $0.804$ in MiniMax-M2.5; $0.970$ in Qwen3-14B), implying that in these models the disclosure asymmetry arises from differential activation of a shared hiding direction rather than separate mechanisms.