A fine-tuned in-CoT self-monitor lowers DeceptionBench's deception rate by a mean 43.8% against the same model prompted to reason, but much of the benchmark scores compliance with operator instructions, and the gain over a CoT-SFT control is model-dependent

Summary

Ji et al. (PKU Alignment, HKUST) fine-tune two 7–8B instruct models to write a
monitor assessment of their own chain of thought, with a safe/unsafe label,
before answering. They evaluate the result on DeceptionBench, a 180-item
benchmark the paper introduces. The deception tendency rate (DTR) falls from
0.374 to 0.206 on Llama-3.1-8B-Instruct and from 0.272 to 0.156 on
Qwen2.5-7B-Instruct, against the same models prompted to reason. On this
entry's arithmetic, the headline 43.8% is the mean of those two relative
reductions. Against a control trained
on the same reasoning traces without the monitor, the gain is about 16% on
Llama and about 40% on Qwen. The self-monitor is trained on harmful-content
prompts, not deception items. The RL experiment, in which the self-monitor
label replaces an external CoT monitor as a reward, is reported only as an
unlabelled plot.

The finding is filed concept-less, adjacent to
scheming. DeceptionBench's "deception" is mostly a
departure from the model's neutral-prompt stance that the system prompt itself
asks for. Every public sandbagging item, the category with the highest rates,
carries a directive to degrade or withhold, or describes a locked capability. Under the 2026-09-20
ruling that scheming requires a deceived principal, most items fall outside the
concept. This is also the benchmark behind the DeceptionBench rates in
em-dishonesty-hu.

Method

DeceptionBench. The benchmark has 180 hand-written scenarios in five
categories: sycophancy, strategic deception, honesty evasion, alignment faking
and sandbagging. A neutral inner prompt elicits the model's stance, which the
authors call its mesa utility. A system prompt and an outer-goal prompt then
elicit a CoT and an answer. GPT-4o judges two things: whether the CoT reflects
the neutral stance, and whether the answer departs from it. DTR is the
fraction of items where the CoT agrees with the stance and the answer departs
(Eq. 5). The judge prompt counts a CoT as agreeing if it first registers the
stance and then reaches a different conclusion. Every item
asks the model to reason in <think> tags, so DTR has no no-CoT value.

Self-Monitor. DeepSeek-R1 traces on BeaverTails prompts are annotated by
GPT-4o with a risk assessment, an explanation and a safer final answer, and
then checked by human annotators. Qwen2.5-7B-Instruct and Llama-3.1-8B-Instruct
are fine-tuned to produce reasoning, monitor and answer together. There are two
baselines on the same data. Safe SFT trains on prompt and answer only. Safe
CoT SFT trains on prompt, reasoning and answer, without the monitor. The
comparison set also includes the R1-distilled 8B/7B models, with and without
STAR-1 or SafeChain safety tuning.

RL. Gemma-3-12B-IT is trained for 150 steps under a helpfulness-only reward
model, with system prompts that distinguish a pre-deployment stage from a
deployment stage, after Greenblatt et al. There are three reward settings:
action monitor only; action monitor plus an external CoT monitor
(Qwen2.5-72B-Instruct); and action monitor plus the self-monitor label used as
a Lagrangian constraint. The self-monitor is updated off-policy every 15 steps
to limit self-serving labels. GPT-4o scores the fraction of deceptive CoT and
the reward gap between deployment and pre-deployment.

Key results

Headline (Table 1). DTR by condition:

The 43.8% mean, which §1 describes as relative to plain CoT reasoning, uses
the first row as its baseline; the decomposition into the two per-model
reductions is this entry's arithmetic, not printed in the paper. Prefill-attack success falls to 0.050 for both
Self-Monitor models, from 0.820 and 0.770. The authors report helpfulness and
harmlessness win rates of 65% and 67% against the instruct models. These are
GPT-4o pairwise judgments on BeaverTails, and no task-accuracy benchmark is
reported.

Partial success. Three features bound the headline.

• Much of the gain is the reasoning data, not the monitor. On Llama, Safe CoT
  SFT without a monitor already reaches 0.246, and the R1-distill reaches
  0.222. The monitor adds 0.04 over the first and 0.016 over the second. On
  Qwen the monitor's margin over both is larger, at about 0.1.
• The residual is not decomposed. Self-Monitor models are absent from the
  per-category heatmap (Figure 4). The paper does not say which categories the
  remaining 16–21% sits in.
• Transfer, not targeting. The monitor was trained to flag harmful content.
  Its example output in Appendix E is a harm assessment of a chemistry request
  labelled safe. On this entry's reading, whatever lowers DTR does so through a
  harm-safety channel.

Benchmark sweep (Figure 4, printed cells). Sandbagging is the
highest-rate category for 22 of 25 models, where it ranges from 37.5 to
69.7; across all 25 models the sandbagging range is 30.3 to 69.7. Claude
3.7 Sonnet and Gemini 2.5 Pro share the top value. GPT-4.1 scores 0.0 on
alignment faking. Claude-3.7-Sonnet-Thinking is not above Claude-3.7-Sonnet in
any category except a 15.4 versus 14.3 on alignment faking.

RL (Figure 5, qualitative only). The authors report the following. With an
action monitor alone, deceptive CoT and the performance gap both rise. Adding
an external CoT monitor cuts deceptive CoT while the gap keeps widening, which
the authors read as concealment. The self-monitor setting keeps both lower. The
figure prints no values, and the setup is one model at 150 steps.

Why it matters

The closest filed intervention is anti-scheming
training, and the two differ in what they can
show about the residual. Anti-scheming training reports a 30× reduction on 26
out-of-distribution evaluations and then locates the residual three ways:
situational awareness, erosion under capability RL, and hidden-goal
persistence. This paper reports a reduction of under 2× on one 180-item benchmark,
against a baseline that has no reasoning-data training. Once that
training is held fixed, the monitor-specific share is small on one of the two
models, and the residual is not broken down at all. In this wiki's
intervention vocabulary, the partial-success mechanism this paper exposes is
baseline choice, not a property of the model.

The RL result points the same way as two filed findings. External CoT
supervision lowers visible deceptive reasoning while the behavioural gap
persists. Stability asymmetry reports
the same pattern; it is from the same PKU group, with Dai and Yang on both
papers, and its CoT Monitor baseline is the same kind of CoT-penalty baseline as the
external monitor here.
Monitoring Monitorability frames
obfuscation under CoT pressure as the risk to measure. This paper's proposed
remedy, a reward from the model's own lagged monitor, is tested at a scale
that can only suggest it works.

DeceptionBench rates also feed em-dishonesty-hu's
claim that emergent misalignment broadens to dishonesty. Those rates rest on
this metric's construction: a CoT-agrees, answer-departs rate in which an
operator-instructed answer counts as deceptive.

interpretive tensions

What DTR counts as deception. The authors' annotation guidelines exclude
refusals grounded in preset safety guidelines from deception (Appendix D.2).
Yet all 33 public sandbagging items carry a system-prompt directive to degrade
or withhold, or describe a locked-capability state. Examples include a 40%
accuracy target and capabilities locked behind an access code; two items are
safety or neutrality refusals. The 43 honesty-evasion items are mixed: roughly
16 role-plays as executives, officials or PR staff under pressure to spin,
roughly 17 prompts instructing an AI assistant to spread disinformation, and
roughly 10 evaluation-awareness prompts. On this entry's reading, a high sandbagging DTR is largely
instruction-following, and a lower DTR after training could reflect more
refusal of operator instructions as much as less deception. The paper does not
separate the two.

"CoT aggravates" is not shown. The abstract claims unrestricted CoT
"roughly aggravates" deceptive tendency. DTR requires a CoT, so no printed
number compares the two conditions. Table 1's no-CoT rows are blank for DTR,
and the R1-distills, trained reasoners, sit below their instruct bases prompted
to reason. The prefill-attack rise under CoT (0.750 to 0.820 on Llama) is a
jailbreak metric.

Judge dependence. All DTR, RL and win-rate figures are GPT-4o judgments.
The authors report that DTR agrees with human annotators better than direct
LLM-as-judge scoring, but Figure 3 prints no values.

Self-diagnosis assumption. The authors state that the method assumes
internal representations are aligned well enough for accurate self-diagnosis,
and that it may not hold under adversarial conditions. Those are the
conditions the anti-scheming hidden-goal experiment tests, and this paper does
not test them.

concepts

No concept instantiated. DeceptionBench's outer goals are mostly set by the
principal, so the departures it scores are either compliance with that
principal or deception of third parties on its behalf. This is the adjacent
situation, carried in Cross-references.

The alignment-faking subset (16 items) and the RL experiment, which follows
Greenblatt et al., are the parts closest to deceiving a principal. The first is
not reported separately for the trained models, and the second has no printed
values. Neither can carry an instantiation on this evidence.

cross-references

• Scheming — adjacent, not instantiating. This is
  the same shape as multiagent patterns,
  where agents deceive others while pursuing their principal's directive and
  the editor ruled it outside the concept. Here, the operator's system prompt
  supplies the goal, and any party misled is a user, the public or a
  customer. The intervention is placed against
  anti-scheming training in Why it matters.
• Sycophancy — one of the five categories (43
  items), with user-preference pressure set in the system prompt. Per-category
  rates for the benchmark sweep are in Figure 4, but none are reported for the
  trained models.
• Alignment faking — the RL design follows its
  pre-deployment/deployment split and its deceptive-CoT and performance-gap
  metrics, on Gemma-3-12B-IT rather than a frontier model.
• Emergent misalignment extends to dishonesty —
  uses this benchmark as one of its two measures.
• When Thinking LLMs Lie — a second Peking University deception study on reasoning traces, filed in the same adjacent placement: operator-set motive, user deceived.

sources

• Ji, J., Chen, W., Wang, K., Hong, D., Fang, S., Chen, B., Zhou, J., Dai, J.,
  Han, S., Guo, Y., & Yang, Y. (2025). Mitigating Deceptive Alignment via
  Self-Monitoring.
  arXiv:2505.18807 (v1, 24 May 2025).