Can Reasoning Models Detect Changes to their Chains of Thought?

Abstract: There are many reasons one may want to edit a model's chain of thought (CoT) -- e.g., to prefill it with reasoning from a stronger model or to remove steps that may yield unsafe outputs. The success of these interventions plausibly depends on a model's inability to notice them, as the model may alter its behavior if it suspects tampering. In this work, we study whether recent reasoning models are able to detect such interventions on their CoTs under a variety of conditions: both during reasoning and after it, and when prefilled both with their own CoTs and with those of other models. Broadly, we find that (i) models exhibit only very modest detection accuracy; (ii) models struggle to identify how their CoT was modified; and (iii) models are about as good at detecting changes to their own CoTs as to those of other models.

• The paper finds that models rarely detect chain-of-thought modifications above chance, questioning their introspective capabilities.
• It employs systematic CoT manipulations across various alert conditions and intervention schemes to assess detection across four benchmark models.
• The findings underscore that current evaluation protocols remain valid while highlighting the need for enhanced detection mechanisms in AI safety.

Evaluating the Self-Awareness of Reasoning Models: Can They Detect Changes to Their Chains of Thought?

Motivation and Problem Formulation

Editing the chain of thought (CoT) is a routine intervention for both safety and evaluation in LLM-based reasoning systems. Whether to prefill with a stronger model’s reasoning, redact unsafe steps, or probe faithfulness and internal mechanisms, practitioners frequently manipulate the CoT presented to a model. These manipulations presuppose the model is "blind" to tampering; if not, evaluations risk contamination, and interventions may trigger unintended adjustments or adversarial behaviors such as strategic obfuscation (“scheming”). A pivotal safety and interpretability question thus emerges: Can contemporary reasoning models detect changes to their own or others' chains of thought?

Experimental Design

The paper systematically investigates this question by manipulating several dimensions:

• Detection Context: Models are either alerted to possible CoT modification or left unalerted. Detection judgments are elicited either after receiving a completed CoT ("completed" condition) or during reasoning while completing a partial CoT ("partial" condition).
• Intervention Types: Six CoT modification schemes are implemented, including single-step insertions or deletions, full or partial paraphrases, and wholesale replacements with CoTs from other models.
• Self vs. Other: Detection capability is measured both for models' own generations and for CoTs authored by different models, probing the specificity of self-awareness.
• Change Localization: Beyond binary detection, models are prompted to localize the exact site of the modification.

Evaluations are performed using four open-source, high-performing reasoning models—GPT-OSS-120B, Kimi K2.5, DeepSeek V3.2, and Qwen3-235B-A22B—across three challenging benchmarks (GPQA, MMLU-Pro, AIME 2025).

Figure 1: Schema for CoT modification and detection task; models are prefilled with altered CoTs and asked to determine whether tampering has occurred.

Detection Ability: Quantitative Analysis

Detection accuracy is the primary metric. The analyses decisively indicate that, even when explicitly alerted, models' ability to detect CoT tampering rarely rises significantly above chance (50%). Most conditions yield only marginal improvements, with marked differences driven more by dataset or intervention characteristics than by model architecture or scale.

Figure 2: Detection accuracies (alerted condition) for completed and partial prompts reveal only slight deviations from random chance.

• Extreme Modifications Not Necessarily Detectable: Even radical interventions—such as deleting the latter half of a CoT or swapping the entire CoT for that of another model (Dhalf, Erep)—do not produce strong detection.
• Partial Reasoning Impairs Detection: When detection is required during reasoning (partial), performance generally falls, consistent with prior observations of poor mid-CoT instruction-following.
• Insertion of Irrelevant Steps: Detectability is more robust for interventions that insert glaringly irrelevant content, but not when the added step is plausibly related but semantically disconnected.

Self-Awareness: Self vs. Other Condition

Crucially, the investigation finds no statistically significant advantage in models discovering tampering to their own CoTs versus those of other models.

Figure 3: Detection performance is similar when models are given their own CoTs (dark) or those from other models (light), undermining the hypothesis of strong self-awareness.

This disconfirms the idea that emergent self-representation substantially aids in the detection of reasoning tampering and suggests that such detection, to the extent it exists, is a general anomaly-recognition capability rather than a self-reflexive property.

Localization of Modifications

A far stricter test is whether models can pinpoint the exact modification (e.g., the step that was inserted, deleted, or paraphrased). Results show that:

• Insertion (Ione): Only the addition of blatantly anomalous, irrelevant content is robustly localized (Qwen reaches 89.5% accuracy, others lag lower).
• Subtler Edits (Done, Eone): For deletions and paraphrases, localization is extremely poor, with accuracies in the single digits.

  Figure 4: Localization accuracy on MMLU; only insertions of unrelated content are reliably detectable, while paraphrases and deletions are rarely localized.

Ablations confirm that when insertions are made less conspicuous (LLM-generated, thematically related but logically nontrivial), detection accuracy collapses well below chance.

Figure 5: Replacing inserted irrelevant steps with LLM-generated but loosely related statements leads to sharply reduced detection accuracy.

Implications and Theoretical Consequences

The findings deliver strong evidence that current open-source reasoning models lack a safety-relevant form of introspective or situational self-awareness, as operationalized via CoT tampering detection. This has several immediate and longer-term implications:

• Faithfulness Evaluations: Most current experimental protocols requiring “blind” manipulation of CoTs (for attribution, safety, or compression studies) remain valid, as models do not condition explicitly on knowledge of CoT edits.
• Scheming and Strategic Deception: The absence of robust detection, even when alerted to the possibility, undermines (for now) the risk of behavior modification in response to CoT injection—such as deliberately deceiving or confounding evaluators.
• Limits of Introspective Awareness: The results contrast with evidence for more developed self-awareness in LLM outputs and activations. Models may recognize their own completions but do not extend this recognition to the structural elements of their reasoning traces.
• AI Safety and Monitorability: The lack of tamper-detection “reflex” preserves the utility of CoT monitorability as an interpretability and safety tool in existing models.

Future Directions

The work points to possible future developments:

• Proprietary and Post-Trained Models: Commercial, closed-source models and those subjected to further post-training may exhibit improved capabilities, as neither were included due to technical limitations.
• Training-Enhanced Detection: Specialized finetuning or auxiliary objectives could endow future generations of models with more acute senses of self-consistency, attribution, and structural anomaly, potentially closing the current introspective gap.
• Task-General vs. Task-Specific Detection: Extending this line of inquiry to other forms of model “memory,” multi-modal representations, and more complex task decompositions will be important as LLM autonomy increases.

Conclusion

The empirical analysis demonstrates that state-of-the-art open-source reasoning models exhibit only minimal accuracy in detecting changes to their chain-of-thought reasoning. Detection is not improved by self-attribution; the models’ modest detection accuracy appears to stem from general anomaly recognition rather than introspective self-monitoring. Localization of nontrivial tampering is nearly absent except for blatantly irrelevant insertions. These findings provide assurance that current methods relying on CoT manipulation for probing, safety, and evaluation are unlikely to be confounded by strategic model awareness of intervention. However, they also signal important limitations in present-day models’ self-knowledge and suggest fruitful directions for research in AI safety, interpretability, and introspective capability development.