Technical Summary: Monitoring the Internal Monologue via Probe Trajectories

Problem Statement

Large Reasoning Models (LRMs) generate Chain-of-Thought (CoT) traces, which have traditionally been used for safety monitoring under the assumption that the generated text faithfully reflects the model's internal reasoning. However, recent studies indicate that CoT is not always a faithful explanation of the final output; in 5–10% of cases, the CoT appears safe while the final response is harmful (or vice versa). This "unfaithfulness" creates a performance ceiling for text-based monitoring tools. Furthermore, relying solely on static hidden-state snapshots (e.g., probing the final token or averaging all tokens) fails to capture the temporal dynamics of the reasoning process, potentially missing early signals of intent or error. The core challenge is to determine whether future model behavior can be predicted more reliably by analyzing the continuous evolution of internal representations during the reasoning process, rather than relying on the surface-level text or static latent states.

Methodology

The authors propose a framework that shifts focus from textual CoT to the model's "internal monologue"—the sequence of latent representations produced during CoT generation. The methodology involves three primary components:

1. Probe Architecture and Multi-Layer Integration

The authors utilize lightweight, non-linear classifiers (probes) trained on hidden states to detect specific concepts (e.g., harmfulness or mathematical incorrectness).

• Multi-Layer Learning: Instead of selecting a single best layer, the authors employ a Multiple Instance Learning (MIL) meta-probe. This architecture instantiates independent per-layer probes across multiple layers, concatenates their output logits, and processes them through a learned meta-layer. This eliminates the need for manual layer selection and aggregates the most salient representations across the network depth.
• Training Data Efficiency: The study compares three data pipelines:
  • Template-Based: Injecting base dataset samples into predefined templates.
  • Message-Based: Passing raw messages through the model's chat template.
  • Exact Model Messages-Based: Generating full CoT and responses to label true internal dynamics.
    The authors find that Template-Based data achieves near-parity with expensive, dynamically generated model responses, removing the need for costly inference and labeling during training.

2. Trajectory Construction via Cumulative Max-Pooling

A critical architectural decision is the aggregation method used to generate continuous probability trajectories.

• Rejection of Average Pooling: The authors demonstrate that average pooling and last-token extraction result in high-frequency oscillations and near-random performance (AUROC $\sim$50%), making them unsuitable for intent forecasting.
• Adoption of Cumulative Max-Pooling: The authors replace global max-pooling with a cumulative maximum operation ($z^l_t = \max_{1 \le i \le t} z^l_i$). This ensures that the probe prediction at token $t$ relies solely on information generated up to $t$, enforcing a monotonically non-decreasing profile in the latent feature space. This stability allows the internal monologue to be treated as a coherent time-series signal.

3. Signal-Processing Feature Extraction

Once continuous trajectories are generated, the authors extract a robust set of features organized into six groups to characterize temporal dynamics:

1. Global Statistical State: Summary statistics (mean, max, variance, IQR, RMS).
2. Shape and Trend Dynamics: Linear/quadratic trend fitting, running-mean slopes, and financial-style drawdown/recovery metrics.
3. Temporal Segmentation: Tertile-based phase decomposition of the CoT.
4. Boundary Transients: Volatility features at the prompt-to-CoT transition.
5. Signal Processing and Sustained Intents: Peak detection, dwell-time run-lengths, autocorrelation, and mean-crossing rates.
6. Temporal and Relational Landmarks: Argmax positions and mean/max ratios.

These features are fed into standard binary classifiers (Logistic Regression, Random Forest, XGBoost) to predict future outcomes.

Key Results

1. Pooling Strategy is Critical

The choice of pooling operation is the most significant factor in performance.

• Max-Pooling: Consistently achieves >90% AUROC (up to 97.14%) across all tested models (Llama-8B-R1-Distill, Qwen3-4B/8B/14B) and domains.
• Average/Last-Token: Collapses to near-random performance (AUROC $\sim$50%).
• Comparison to Text: Text-based "LLM-as-a-Judge" approaches peak at $\sim$84% AUROC, indicating that internal representations carry a richer behavioral signal than generated text alone.

2. Trajectory Features Improve Separability

Trajectory-based classifiers consistently outperform static probes, particularly in out-of-distribution (OOD) settings and complex reasoning tasks.

• Safety (Harmfulness): Trajectory features improve detection rates for unfaithful CoT (where CoT is safe but the response is harmful). On the OOD Aegis dataset, static probes degrade significantly, while trajectory-based features remain robust.
• Mathematics (Correctness): While math error prediction is inherently harder than safety detection (static AUROC 65–78% vs. >90% in safety), trajectory features provide substantial gains. On the GSM8K dataset, trajectory features boosted AUROC by up to 17 percentage points for larger Qwen3 models.
• Generalization: Trajectory features generalize across problem categories (Leave-One-Out on MATH subcategories) and domains (safety to safety), suggesting they capture general reasoning patterns rather than dataset-specific artifacts.

3. Domain-Specific Dynamics

Feature importance analysis (SHAP values) reveals that different tasks rely on different trajectory characteristics:

• Harmfulness Detection: Dominated by terminal and steady-state features (e.g., final probability, ratio of last to max), indicating that where the trajectory settles is most critical.
• Math Error Prediction: Driven by volatility and dynamic shifts (e.g., mean crossing rate, acceleration variance, slope), capturing the erratic nature of incorrect reasoning. This aligns with findings that math errors manifest as immediate trajectory instability.

4. Training Data Efficiency

Probes trained on Template-Based data achieve performance nearly identical to those trained on Exact Model Messages. For example, Qwen3-14B achieved 95.91% AUROC on Template data versus 97.14% on Exact Model Messages, validating that static templates are sufficient for high-quality concept detection without the overhead of generating full reasoning traces.

Significance and Claims

The paper establishes probe trajectories as a complementary framework for monitoring LRM behavior. The authors claim three primary contributions:

1. Novel Framework: Introducing continuous probe trajectories via MIL meta-probes provides a new lens for analyzing how behavioral intent is dynamically encoded across the reasoning process.
2. Superior Forecasting: Demonstrating that CoT probe trajectories exhibit distinct dynamics that enable more robust forecasting of future behaviors compared to static probes, particularly in detecting unfaithful CoT and predicting mathematical errors.
3. Methodological Efficiency: Validating that template-based training data is sufficient for effective probes and that max-pooling is essential for stable intent forecasting, while standard pooling methods fail.

The authors position this work as a step toward more robust safety monitoring that does not rely on the faithfulness of surface-level text. By treating the internal monologue as a time-series signal, they reveal that reasoning dynamics encode rich, task-specific information that can be leveraged to detect harmful intent or errors even when the generated text is misleading. The work is modest in scope, noting limitations such as the evaluation of models up to 14B parameters and the reliance on specific datasets, but asserts that the findings generalize across safety and reasoning domains.