Training Models to Be Monitored: Causal Bounds for Safer Chain-of-Thought

Introduction

Chain-of-thought (CoT) monitoring is intended to help detect harmful or deceptive behavior by inspecting a model’s reasoning trace. Yet an important distinction is often overlooked: observing a suspicious behavior after an intervention does not prove that the intervention caused it. A new arXiv paper, Learning to Be Monitored, reexamines this problem through a causal lens and asks whether models can be trained to produce reasoning that is easier to audit.

The evaluation problem

Intervention-based evaluations commonly compare control tasks with tasks in which a particular intervention is applied. A monitor then examines the model’s CoT and tries to identify the intervention when a target behavior appears. Prior work has used minimal-criterion sensitivity, denoted TPR_mc, for this purpose.

The authors argue that this metric can be overly optimistic. A target behavior seen under an intervention may have appeared anyway, may reflect a pre-existing model tendency, or may not be causally connected to the intervention. Counting every such observation as evidence of successful detection can therefore blur the difference between detecting a behavior and detecting an intervention’s causal effect.

The paper’s framework makes that distinction explicit:

• TPR_mc is established as an upper bound on the rate at which monitors detect behaviors genuinely caused by the intervention;
• a complementary lower bound is derived to constrain the possible causal detection rate;
• reporting both bounds provides a more cautious and informative view than relying on a single sensitivity measure.

The central lesson is that a monitor should not merely recognize that a risk-related signal is present. It should also provide evidence that the signal is linked to the intervention being evaluated.

Training for monitorability

The paper then moves beyond measurement. The authors build paired control–intervention tasks covering multiple intervention types and use them to study whether models can learn to make their CoTs more monitorable.

They propose three intervention-specific post-training strategies: off-policy self-distillation, reinforcement learning, and on-policy self-distillation. Separate variants of each base model are trained with these approaches and evaluated across multiple model–monitor configurations.

According to the paper’s abstract, all three methods generally improve CoT monitorability over their corresponding base models under the extended causal evaluation framework. The project also releases code, making it possible to reproduce the setup and investigate alternative training objectives.

Why it matters

The work has two implications for AI safety. First, it separates correlation-based monitoring from causal monitoring. A system may be good at spotting that a target behavior occurred while remaining unable to determine whether a particular intervention produced it. Causal bounds can reduce overconfident interpretations of safety evaluations.

Second, monitorability becomes a training objective rather than only a property measured after deployment. Models could be optimized not just to solve tasks, but also to expose useful reasoning signals to external oversight. This connects interpretability, post-training, and safety evaluation in a concrete way.

The available material does not report detailed numerical results for each model or configuration, nor does it establish how well the methods transfer to unseen interventions or stronger adversarial settings. The findings should therefore be read as evidence for a promising methodology, not as a final guarantee that CoT monitoring is reliable. Future work will need to test whether models genuinely become more transparent or merely learn patterns that satisfy the monitors used during training.

arXiv