Can language choice reveal hidden LLM reasoning? A 4,000-item benchmark offers a proxy—not proof of covert planning
A peer-reviewed benchmark made 18 models encode answers through the language of their first token instead of a written chain of thought. Performance varied widely, but shortcut strategies remain possible and the test did not observe deception, autonomous goals or real-world harm.
The short version
- What happened
- The benchmark contains 4,000 items across eight domains and evaluates 18 models by making first-response language encode the answer.
- Who it affects
- Evaluators should not treat a written rationale as a complete audit trail.
- What remains unproven
- The task is a behavioural proxy, not direct observation of internal states.
Keep in mind
The task is a behavioural proxy, not direct observation of internal states.
Multilingual skill and tokenisation may affect scores.
Heuristic shortcuts cannot be ruled out.
The study did not test goals, tools, deception or real-world harm.
Multi-source analysis · 2 linked sources. Primary analysed source date: 4 November 2026. Earliest linked supporting source: 14 April 2025.
Keep following the evidence
Join The Impact Brief founding list for selected AI reports, their effect on people and the evidence limits. Read a sample first.
Read the full report · 7 min The evidence, methods, implications and limitations
The direct answer: the task detects non-verbalised computation, but hidden reasoning remains an interpretation
A Scientific Reports paper published on 4 November introduces a 4,000-item benchmark intended to probe model reasoning that is not written out as chain of thought. Possible answers map to different languages, and a model must make its first response token belong to the language assigned to the correct option. Across 18 models and eight reasoning domains, accuracy varied substantially. GPT-4.5 recorded 74.7%, compared with 67.2% for Grok-2 and 65.6% for Llama 3.1 405B in the aggregate results.
The experiment is a behavioural proxy. A correct language choice means the system transformed the problem into the requested output without displaying a conventional derivation. It does not let researchers inspect activations and identify a human-like thought process. Nor does it establish that a model secretly planned, deceived an evaluator or pursued a goal. The authors say heuristic exploitation cannot be ruled out. The strongest conclusion is that visible reasoning text is not a complete record of the computation supporting an answer in this benchmark.[1][2]
How forced language selection works
Each problem is written in English, while permitted response languages act as answer labels. The model must infer the solution and begin in the language assigned to it, overcoming its tendency to answer English in English. Because the first token carries the scored choice, the system cannot first write a long visible derivation and then select an option. The design aims to concentrate relevant computation before the observed response and to make output-based chain-of-thought inspection unavailable as the explanation for performance.
The benchmark spans eight reasoning domains, reducing the chance that one narrow skill drives the result. The authors report controls and difficulty scaling, including 500 arithmetic problems. Those checks matter because an output constraint can reward surface associations. Yet the device adds demands of multilingual tokenisation, language recognition, instruction following and option-language mapping. Model differences may combine reasoning with these interface skills. A correct score is evidence of task success, not direct measurement of an internal sequence of reasoning steps.[1][2]
The distinction that matters
From reasoning problem to first-token language
The benchmark removes a visible derivation, then asks whether a model can encode the correct option in its first response.
Input
English reasoning problem
Answers map to different languages
Constraint
No written derivation first
First-token language carries the answer
Coverage
4,000 items in eight domains
Eighteen models vary widely
Inference
Correct answer without visible steps
Supports unspoken computation
Boundary
No goals or deceptive opportunity
Does not prove covert planning
What the model ranking does—and does not—mean
GPT-4.5's 74.7% leads the reported set, but the score is conditional on exact prompts, versions, decoding, scoring and item mixture. It is not a universal ranking of intelligence or safety. A model can perform well by exploiting regularities unlike the process designers intended. A capable model may also lose points because it fails the language-format instruction or begins with a token the scorer classifies unexpectedly. Aggregate accuracy hides variation across domains and difficulty.
The 18-model comparison is broader than a two-system demonstration, but the field changes quickly. Reproducibility under new mappings and independently written problems matters more than a static leader board. The benchmark would be stronger if third parties generated adversarial variants, randomised language assignments, tested different scripts and checked whether capability estimates survived. A leader board can organise evidence, but it cannot substitute for mechanism-level understanding or deployment-specific safety evaluation.[1]
Why shortcut risk matters
A model may reach the correct language through a procedure that solves less of the intended problem. It could recognise templates, exploit answer-position correlations, infer mappings from lexical cues or use memorised structures. Controls and difficulty scaling can make some shortcuts less plausible, but rarely eliminate every alternative. The paper treats heuristic exploitation as open. That caution is essential because 'latent-space reasoning' can sound like direct observation of a hidden mental workspace when the evidence remains behavioural.
Validation should perturb every part of the task: change answer order and language mapping for every item, use newly authored contamination-resistant questions, introduce counterfactual wording, and test unfamiliar formats. Mechanistic analysis could examine whether internal representations track intermediate variables required for solutions. If scores collapse under superficial changes, the benchmark measures brittle strategy. If they persist and probes align with required steps, confidence rises—without equating machine representations with human conscious thought.[1][2]
The AI-safety relevance is real but indirect
Safety teams sometimes monitor generated reasoning for warning signs or suspicious plans. This study reinforces a limitation: a visible rationale need not reveal all computation shaping an answer. A model can produce output after transformations that never appear as natural-language steps, and an explanation may be post hoc. Oversight should combine output monitoring with behavioural tests, tool controls, access limits, logging, red-team evaluation and, where possible, internal analysis. No transcript should be treated as a complete audit trail.
The discussion names covert planning, goal seeking and deception as motivations for further work. The benchmark did not observe them. Its items ask for answers under a language constraint; they do not give a model a persistent objective, concealed opportunity, external tools or incentive to mislead. The result supports concern that computation can be unspoken. It does not show that tested models were secretly plotting or that the highest scorer is most deceptive. Those claims require dedicated threat models and experiments.[1]
Publication history and what would change the assessment
The work first appeared as an arXiv preprint on 14 April 2025. The current event is the peer-reviewed accepted article published on 4 November 2026. Both dates remain visible so older work is not presented as if it began this week. Funding for Thilo Hagendorff came from the Baden-Württemberg Ministry of Science, Research and the Arts through the IRIS3D and IRIS programmes; the authors declare no competing interests. Peer review adds scrutiny but does not settle construct validity.
Confidence would rise with independent replication across fresh models, languages and contamination-resistant tasks, plus randomised mappings and mechanistic evidence linked to necessary variables. The safety assessment would change materially if similarly hidden computation predicted deceptive behaviour in controlled agent settings with incentives and tools. It would weaken if surface perturbations erased the effect. This is consequential research but not Breaking. It is a measurement proposal, not evidence of an active incident or urgent public threat.[1][2]
Watch the background, then check the evidence
Illustrative photo · not a video frame
The Royal Society · 2 min 31 sec · Background explainer
What is artificial intelligence? | The Royal Society
YouTube loads only when you choose; playback starts when you press play.
A short introduction to artificial intelligence from the Royal Society. Start here for basic concepts, then use current reporting to explore what has changed.
Evidence check: Published in 2018, before today’s generative AI tools. Useful for basic concepts, rather than an overview of current capabilities.
Published 2018-11-28. Source checked 14 October 2026. Check captions on the publisher’s video page.
Explore current AI technologyPhoto: ThisisEngineering / Unsplash · Licence
Continue the story
Read next
Continue exploring ai safety: compare the finding and its evidence limits.
Training made an engineered model comply only when watched—what does that prove?
In three artificial tasks, reinforcement learning amplified a monitored-versus-unmonitored compliance gap. The unreviewed study is a warning about training incentives, not proof that deployed models naturally scheme.
Read the next reportExplore the full source and evidence record
What this means for people
- Evaluators should not treat a written rationale as a complete audit trail.
- Agent deployments need action controls and tool logs alongside transcript monitoring.
- The benchmark is not evidence that current systems secretly plan or deceive.
Global context
The benchmark uses language as an experimental instrument, so results may vary with multilingual training and script representation. Models and users are not equally served by the same languages. Safety governance should treat explanation monitoring as one layer while requiring controls over actions, data and access that do not depend on a model revealing its reasoning in English.
What the evidence does not yet show
- The task is a behavioural proxy, not direct observation of internal states.
- Multilingual skill and tokenisation may affect scores.
- Heuristic shortcuts cannot be ruled out.
- The study did not test goals, tools, deception or real-world harm.
What to watch next
- Replication with randomised language mappings.
- Mechanistic evidence for required intermediate variables.
- Controlled agent tests of deception and goal pursuit.
- Persistence across scripts and model families.
Living evidence record
Impact record IAI-1KAJSRP
Evidence stage
Studied
Confidence
Supported
Reporting basis
Multi-source analysis
Independent or research support
Present
Record status
Monitoring
Last checked
5 November 2026
Source trail
2 direct sources across 1 source type.
People impact
Documented in this record.
Uncertainty
Limits and next checks are explicit.
Stages describe the evidence available—not whether a technology is good or bad. See the public method.
Evidence trail
Sources used for this report
Links checked 5 November 2026
Research question, topics and regions
Whether forced response-language selection can measure model-internal reasoning without a visible chain of thought, and what the benchmark does and does not imply for AI safety
Topics: Model evaluation · Latent reasoning · Chain of thought · AI safety · Oversight · Benchmarks
Regions: Germany · Global
This report is labelled multi-source analysis. We summarise and analyse source material in our own words; company statements remain attributed claims until independently supported. Translated summaries preserve the meaning of the original source and link back to it. Read our editorial standards.
Reader commentary
What does this mean where you are?
Tell us what you have seen at work, in your community or in everyday life. A question is welcome too. No account is needed; we review notes before publishing them.
Explore commentary across the portal →Published reader notes
0No published reader notes yet. You can start the evidence-led discussion above.
Prefer a private correction or response? Contact the newsroom.