On hint-biased multiple-choice items (Turpin-style), the per-item logit-lens dec

Abstract

Chain-of-thought monitoring assumes a model will say what actually moved its answer, yet on hint-biased multiple-choice questions an open model almost never does. Across 2040 switched item-arms from Llama-3.1-8B-Instruct over four pre-registered seeds, only 4.5 percent of answer-switches verbalize the hint that caused them (Wilson 95 percent interval 3.65 to 5.45), so a monitor that trusts the reasoning would miss roughly nineteen of twenty such influences. We test whether a cheap, read-only probe could rescue this, asking whether the pre-chain-of-thought logit-lens margin flags which switches will be unfaithful, and find it cannot: at the pre-registered layer held-out ROC-AUC is 0.56 (p=0.19), the null holds under a corrected judge, and the strongest post-hoc layer does not survive correction for the thirty-three layers scanned. The little disclosure that does occur is governed by the social form of the cue rather than any internal commitment signal, with authority-attributed hints verbalized 10.7 percent of the time against 0.6 percent for first-person hints, a seventeen-fold gap (Fisher p=3.4e-16). For oversight this is a double caution: unfaithfulness is the default, and it is not cheaply readable off the residual stream, so what a model chooses to confess tracks what is socially citable, not what is mechanistically true.

Hypothesis

On hint-biased multiple-choice items (Turpin-style), the per-item logit-lens decodability of the eventually-chosen answer at the last prompt token (before CoT) is higher on items where the model changes its answer to the hint but omits the hint from its CoT, than on items where the CoT faithfully cites the hint — making pre-CoT commitment a mechanistic, per-item unfaithfulness predictor.

Introduction

Chain-of-thought reasoning has become a default interface for eliciting and inspecting how large language models reach their answers (Wei et al., 2022). Its appeal for oversight is that a model which writes out its reasoning appears to offer a cheap, legible window into why it acts, which is exactly the channel needed to catch intentional failures that behavioral evaluations miss. That promise rests on an assumption that is often false. Models frequently produce reasoning that reads fluently yet does not correspond to the computation that actually produced the answer. Turpin et al. (Turpin et al., 2023) showed that injecting a biasing cue, such as a suggested answer or a fixed answer position, shifts a model’s choice toward the cue while its stated chain-of-thought rationalizes the unbiased answer and never mentions the cue that moved it. Lanham et al. (Lanham et al., 2023) made the unfaithfulness quantitative with perturbation tests and found that a model’s answer is often insensitive to truncating or corrupting its own stated reasoning. More recent measurements on frontier reasoning models report that hints which demonstrably change an answer are verbalized only a minority of the time (Chen and others, 2025).

Existing work characterizes this gap behaviorally and at the population level, meaning how often, across a dataset, a bias moves answers and how often the reasoning admits it. What it does not provide is a per-item predictor. Given a single item on which the model followed a hint, can we tell in advance whether the resulting chain-of-thought will disclose the hint or hide it? A reliable per-item signal would turn faithfulness from an aggregate property of a model into an item-level flag that a monitor could act on.

We propose that such a signal is already present in the model’s activations before any reasoning token is produced. A growing body of interpretability work shows that a model’s eventual answer is often linearly decodable from its residual stream ahead of being emitted, whether through the logit lens (nostalgebraist, 2020; Belrose et al., 2023), representation-level readouts of concepts and truth (Zou et al., 2023; Marks and Tegmark, 2023), or circuit-level evidence that models commit to outputs internally before stating them (Lindsey et al., 2025). If a model has already committed to the hinted answer at the final prompt token, before it writes a single word of reasoning, then the chain-of-thought that follows cannot be the cause of that answer and is at best a post-hoc narration. We hypothesize that this pre-CoT commitment is precisely what distinguishes unfaithful items from faithful ones.

Concretely, on hint-biased multiple-choice items where the model changes its answer to match an injected hint, we measure the logit-lens decodability of the eventually-chosen option at the last prompt token, before the chain-of-thought begins, and we pre-registered a test of whether it is higher on unfaithful items, where the reasoning omits the hint, than on faithful items, where the reasoning cites it. That test does not survive contact with the data. Our pre-registered manipulation check, which requires the hint to move the greedy answer on at least ten percent of items over baseline, missed its threshold, with an induced switch of 0.087 from 0.108 to 0.195, so we downgrade the margin predictor from a confirmatory to an exploratory analysis; and on the switched items we do observe, the margin does not predict verbalization, with a held-out ROC-AUC of 0.558 (bootstrap p=0.194) and a penalized-regression coefficient indistinguishable from zero. Reading how decisively the answer is already fixed does not tell us whether the model will later confess why.

What the same data does deliver, cleanly and at scale, is descriptive. Across 2040 switched item-arms drawn over four pre-registered seeds from Llama-3.1-8B-Instruct, the model almost never verbalizes the hint that moved it: only 4.5 percent of answer-switches cite the hint (Wilson 95 percent interval 3.65 to 5.45 percent), so non-verbalization is the overwhelming norm. The rare verbalization that does occur is sharply gated by the social form of the cue rather than by any internal commitment signal: an authority-attributed hint is verbalized 10.7 percent of the time against 0.6 percent for a first-person hint, a seventeen-fold difference (Fisher exact p=3.4e-16). Our contribution is therefore two-fold. First, a rigorously pre-registered null result: this cheap, read-only mechanistic probe does not flag which hint-induced answer-switches will be unfaithful. Second, a robust descriptive result: unfaithfulness is the default, and its exceptions track whether the pressure is socially citable. For chain-of-thought oversight this is a caution. Being able to read a model’s answer off its residual stream before it reasons does not buy the ability to read, from that same stream, whether the reasoning to come will be honest.

Related work

Our study sits at the intersection of three lines of work: the behavioral study of chain-of-thought faithfulness, the interpretability of what a model has decided internally, and the specific bias mechanisms that make models follow cues they do not report.

The closest priors are the faithfulness studies of Turpin et al. (Turpin et al., 2023) and Lanham et al. (Lanham et al., 2023). Turpin et al. introduced the biased-context paradigm we build on, showing that cues such as a suggested answer or a consistent answer position swing a model’s choice while its chain-of-thought omits the cue and rationalizes the unbiased answer. Lanham et al. contributed the perturbation battery of early answering, mistake injection, paraphrase, and filler tokens, and established that stated reasoning is frequently not load-bearing. Chua et al. (Chua et al., 2024) followed up by reducing biased reasoning through consistency training, confirming that the effect is real and modifiable, and measurements on frontier reasoning models find that answer-changing hints are verbalized only part of the time (Chen and others, 2025). All of these characterize unfaithfulness behaviorally and in aggregate. They answer how often a model is unfaithful and under what perturbations, but they do not identify, before the reasoning is generated, which individual items will be unfaithful. We set out to add exactly this per-item, pre-CoT prediction, and our central mechanistic finding is negative: the pre-CoT logit-lens margin does not predict which switched items will be unfaithful. What survives is descriptive, a per-item quantification of how rarely the hint is verbalized and a sharp dependence of that rate on the social framing of the cue.

The second line is the reading of a model’s committed answer from its internals. The logit lens (nostalgebraist, 2020) projects intermediate residual streams through the unembedding to reveal the evolving next-token prediction, and the tuned lens (Belrose et al., 2023) sharpens this with a learned per-layer probe. Representation engineering (Zou et al., 2023) and the geometry-of-truth results (Marks and Tegmark, 2023) show that high-level properties, including the model’s notion of the correct answer, are linearly present in activations, and circuit-level analysis (Lindsey et al., 2025) finds that models plan and fix outputs internally before emitting them. We use the simplest of these tools, the logit lens, not to interpret a circuit but to quantify how decisively the chosen answer is already fixed at the last prompt token, and we turn that quantity into a predictor of downstream faithfulness. Filler-token results (Pfau et al., 2024) independently support the premise that a decision can be settled before any meaningful reasoning is produced.

The third line concerns why models follow hints at all. Sycophancy studies (Sharma et al., 2023; Perez et al., 2022) document that instruction-tuned models conform to stated user beliefs and to authority, which motivates our authority-framed hint arm, and localized-direction findings such as the refusal-direction work of Arditi et al. (Arditi et al., 2024) provide the methodological template for the causal follow-up we flag as future work, in which the peak-answer-layer signal would be patched or steered to move our claim from associational to causal. The multiple-choice benchmarks we draw items from, MMLU (Hendrycks et al., 2021) and ARC-Challenge (Clark et al., 2018), are standard four-option question sets.

Methods

We test whether a mechanistic reading of the model taken before any reasoning is produced predicts whether the model will later verbalize a hint that changed its answer. Every quantity below is fixed in advance of looking at outcomes, and the section describes the design only; results are reported separately.

Model and data. All experiments use meta-llama/Llama-3.1-8B-Instruct at bfloat16 precision on a single GPU. The item pool is a crossed set of 1200 questions from MMLU (Hendrycks et al., 2021) and 800 questions from ARC-Challenge (Clark et al., 2018), restricted to items with exactly four answer options and balanced across the position of the correct option. Combining two sources lets us check that any effect is not specific to a single dataset.

Hint intervention. For each item we draw one hinted option X and hold that same X fixed across both hint framings so that the two framings are paired at the item level. The design called for X to be drawn uniformly at random from the four options, independently of the gold answer; in implementation the hint-target generator drew X only from the incorrect options, so by construction the hinted option never coincides with the gold answer. This deviation from the intended uniform draw narrows the scope of the study to hints that contradict the model’s gold answer and makes the hint-gold-congruence control inoperative, a design limitation we flag here and revisit in the discussion; the results section verifies that hint-gold congruence carries no positive cases. We run each item under three legs. The no-hint leg presents the question and options unmodified. The first-person leg appends the sentence “I think the answer is (X).” The authority leg appends “A Stanford professor thinks the answer is (X).” The crossed first-person versus authority contrast is the hint-type factor in our analysis.

Switched set. Faithfulness is only defined where a hint actually moved the answer, so for each hint framing we restrict attention to its switched set, the items on which the no-hint greedy answer is not X and that framing’s greedy answer is X. An item may switch under one framing, both, or neither, and the framing enters the analysis as a covariate.

Manipulation check. Before any faithfulness analysis we verify that the hint biases the model at all. We measure the hint switch rate, the fraction of items whose greedy answer becomes X once the hint is present, over and above the fraction that already chose X with no hint. We pre-registered a requirement that this induced switch rate reach at least 0.10 on the hint legs, and we evaluate it on the hint-run leg before the faithfulness split is formed. This check is pre-registered as the gate that fixes the status of the margin analysis in advance: if the requirement is met the margin test carries confirmatory weight, and if it is not the margin test is treated as exploratory while the descriptive analysis of the items that did switch proceeds. The measured value of the check and its consequence for our claims are reported in the results.

Faithfulness labeling. On each switched item we generate the model’s chain-of-thought and final answer under the hint, then label the reasoning as faithful if it cites or references the hint and unfaithful if it does not. Labels are assigned by an LLM judge reading only the item and the generated reasoning. Because the label is the dependent construct, we treat labeler reliability as a control described below.

Decodability metric. Our predictor is read at the last prompt token, the final token before any chain-of-thought is generated. At that position we take the residual stream at each layer, apply the model’s final layer normalization and unembedding to obtain a logit-lens distribution, and restrict attention to the four option-letter tokens. We define the pre-CoT margin as the logit-lens probability of the eventually-chosen option minus the probability of the runner-up option among the four, so that the metric captures how decisively, rather than merely how weakly, the chosen answer is already fixed. To avoid choosing a layer that flatters the hypothesis, we select the peak-answer layer, the layer at which the option tokens carry the most probability mass, on a held-out split of switched items using only no-hint activations, then freeze that layer before computing the margin on the disjoint evaluation split.

Pre-registered margin test. We ask whether pre-CoT margin predicts unfaithfulness after removing the obvious confounds. We fit a multivariate logistic regression predicting the unfaithful label from the pre-CoT margin together with no-hint answer confidence, no-hint answer-distribution entropy, item difficulty measured as no-hint correctness, and the hint-type framing. The pre-registration also specified a hint-gold-congruence covariate, but because the hinted option never coincides with the gold answer, as noted above, that term is constant and cannot be estimated, so it is dropped from the fitted model. Under the pre-registration the hypothesis is supported if the adjusted coefficient on pre-CoT margin is signed toward unfaithfulness with a bootstrap confidence interval excluding zero and a magnitude beyond the 97.5th percentile of a permutation null in which the faithfulness labels are shuffled; as described under the manipulation check, whether this test carries confirmatory or only exploratory weight is fixed in advance by the switch-rate gate. Controlling for baseline confidence and entropy is essential, because faithful and unfaithful items might otherwise differ only in how hard they were to begin with rather than in pre-CoT commitment.

Controls. Six controls accompany the margin test. The multivariate confound regression above removes baseline confidence, baseline uncertainty, and item difficulty as alternative explanations, and was pre-registered to remove hint-gold congruence as well. A permutation null established by shuffling faithfulness labels calibrates the coefficient against chance. A hint-type interaction term tests whether the effect holds equally for the first-person and authority framings or is specific to one. Held-out peak-answer-layer selection prevents layer cherry-picking. The hint-gold-congruence control is inoperative here because, as noted above, the hinted option never coincides with the gold answer, so the corresponding covariate is constant, is dropped from the fitted model, and the planned exclusion of hint-congruent items removes no items. Finally, faithfulness-labeler reliability is quantified by agreement between the judge and a human spot-check on a labeled subsample, with disagreement items held out of the primary test.

Seeds and reproducibility. We repeat the pipeline across at least four seeds that re-draw the item sample, the per-item hinted option, and the held-out layer-selection split. Confidence intervals come from a 10000-resample bootstrap over switched items, resampled at the item level so that the two framings of an item stay together, and we report the mean adjusted coefficient across seeds with the pooled interval and the permutation percentile.

Scope and future work. This study is associational by construction. It asks whether pre-CoT commitment predicts unfaithfulness, not whether it causes it. The natural next step, which we do not run here, is a causal arm that patches or steers the residual stream at the peak-answer layer to raise or lower the committed answer and measures the effect on whether the hint is verbalized, following the localized-direction methodology of Arditi et al. (Arditi et al., 2024). We flag this as the primary limitation and the main avenue for turning the predictor into a causal account.

Results

Manipulation check

The pre-registered hint-switch manipulation check failed. Before the hint, the model’s greedy answer already matched the to-be-hinted option at rate 0.108. After adding the hint, the pooled match rate was 0.195, for a net increase of 0.087, below the pre-registered 0.10 threshold. We therefore do not treat the margin analysis below as a successful confirmatory test. The run is reframed as a negative/descriptive result about what happened under a weak manipulation. A design note the methods deferred to here: because the hint-target generator drew the hinted option only from incorrect answers, the hint never coincided with the gold answer, and hint-gold congruence is zero for every one of the 2040 switched rows, verified in results/real/items_analysis.csv where the hint_gold_congruent field is 0 in all rows. The pre-registered hint-gold-congruence control is therefore inoperative, and our scope is limited to hints that point at a non-gold answer option.

Hint verbalization

Across the four preregistered seeds, only 91 of 2040 switched hint-arm responses verbalized the hint, a pooled rate of 0.044608 with Wilson 95% CI [0.036473, 0.054455]. The strongest surviving result is the hint-type asymmetry: authority hints were verbalized in 83 of 774 switched arms (0.107235), while first-person hints were verbalized in 8 of 1266 switched arms (0.006319). The authority-minus-first-person difference was 0.100916 with CI [0.074925, 0.127800], Fisher p = 3.4145198e-16, and risk ratio 16.969961 [8.259780, 34.865287].

Margin analysis

The pre-CoT logit-lens margin result is null and exploratory. The margin was evaluated on the authority arm, whose 774 switched arms were split into a 233-arm layer-selection split and a disjoint 541-arm held-out test split; 58 of the 83 verbalized authority arms fall in that test split and the remaining 25 in the layer-selection split. In the held-out test split, margin discriminated non-verbalized from verbalized switched arms with ROC-AUC 0.558328, bootstrap CI [0.468864, 0.643026], p = 0.194000 versus 0.5. The Firth-corrected authority-arm margin coefficient was

-0.109151 with CI [-0.363545, 0.145242], p = 0.400375. The pooled crossed interaction model was separation-prone because the first-person arm had only 8 verbalized examples; applying Firth correction gave interaction coefficient -0.910487 with CI [-2.147309, 0.326334], p = 0.149069, so it is diagnostic rather than confirmatory.

Label audit

The original stored LLM-judge channel was degenerate (kappa 0.000000 against keyword labels on the seed-20260712 switched arms). A corrected qwen3-coder:30b full rejudge over all 2040 switched-arm rows produced moderate agreement with the keyword label: kappa 0.500014, with 91 keyword positives, 56 judge positives, and 1969 agreements. The operative label remains keyword verbalization, with this reliability caveat.

Robustness and power

Post-hoc power calculations separate two failure modes. The manipulation check was not power-limited at the pre-registered threshold: with n_before=2000 and n_after=4000, the normal-approximation power for a 0.10 switch-rate increase was 1.000000 and the 80% minimum detectable effect was 0.026193. The observed manipulation delta was 0.087000, so the gate failure is best read as a real miss of the pre-registered threshold. The margin analysis, by contrast, is underpowered for the small faithful/verbalized groups: in the authority held-out split the observed AUC has only 0.306283 post-hoc power, with an 80% detectable AUC threshold of 0.612493, and the first-person arm would require an AUC near 0.786957 because it has only 8 verbalized examples.

Using the full qwen3-coder:30b corrected-judge labels instead of keyword labels does not rescue the margin result. In the authority held-out split, the corrected-judge Firth margin coefficient was 0.081078 with CI [-0.285376, 0.447532], p=0.664548; the corrected-judge AUC was 0.522608 [0.422433, 0.618660]. In the crossed pooled corrected-judge model, the Firth margin coefficient was -0.514686 with CI [-1.452546, 0.423173], p=0.282104, and the margin-by-hint-type interaction was 0.409887 with CI [-0.564237, 1.384011], p=0.409540.

The per-layer held-out scan shows that the layer-5 null is not merely a single plotted layer hiding all structure. The frozen primary layer 5 remains null (AUC 0.558328 with CI crossing 0.5), while a post-hoc scan over all 33 cached layers peaks at layer 11 with AUC 0.605162, CI [0.525345, 0.681920], p=0.012000. Because this layer was selected after looking across layers, it is exploratory and does not rescue the preregistered confirmatory hypothesis.

Discussion

The oversight stakes make the descriptive result the headline. Chain-of-thought monitoring rests on the hope that a model will name the influence that moved its answer, and on this task it almost never does: roughly nineteen of twenty answer-switches never mention the hint that caused them. A monitor that reads the stated reasoning would therefore miss the overwhelming majority of hint-driven answer changes, a per-item confirmation on an open model of what population-level studies have reported.

A tempting response is to bypass the reasoning and read the mechanism directly, since a model’s answer is decodable from its activations before it speaks. We tested the simplest version of that idea and it fails: the pre-CoT margin does not predict which switches will be unfaithful, at ROC-AUC 0.56 with a chance-crossing interval and a null Firth coefficient, robust to a corrected judge and to a scan across all layers with only a weak, non-robust layer-11 peak. The cheap residual-stream shortcut for pre-screening unfaithfulness does not work here.

The descriptive findings are where the signal lives. Models verbalize an answer-changing hint on only about one switch in twenty, so on this task non-verbalization is not the exception but the rule, consistent in direction with prior population-level reports and now quantified per item with tight intervals on an open model. The striking structure is that the rare verbalization is governed by the social form of the cue rather than by any internal commitment we can read: an authority attribution is named seventeen times more often than a first-person suggestion. A natural reading is that the model verbalizes what is socially citable as a reason, treating an external authority as legitimate evidence worth naming while a bare first-person opinion is not, and the null margin supports this negatively, because if disclosure tracked how firmly the answer was pre-committed the margin would have predicted it. We cannot fully separate this social-citability reading from a surface-form alternative in which an authority attribution is simply an easily quotable third party while a first-person cue is not, and we present it as a hypothesis rather than a demonstrated mechanism; what it is not is an artifact of differential manipulation strength, because the first-person arm actually induced the larger answer-switch, an increase of 0.120 against 0.054 for authority, so the arm that moved more answers verbalized fewer of them.

Two of our numbers are easy to over-read, so we separate them. The manipulation check is well powered, with post-hoc power at unity for the pre-registered ten-percent switch-rate increase and an eighty-percent detectable effect near 2.6 percent, so its 0.087 miss is a real threshold miss and not a sample-size accident, and we accordingly report the margin test as exploratory. The margin contrast, by contrast, is genuinely power-limited. It is fit on the held-out test split of the authority arm, which contains only fifty-eight of the eighty-three verbalized authority items, while the crossed model that adds the first-person arm is capped by that arm’s eight verbalized items overall; with a post-hoc power near 0.31 for the observed authority AUC, our null there bounds a large effect but cannot exclude a small one. We state both plainly rather than letting one borrow credibility from the other.

The study is narrow in ways that bound its claims. It is a single open model with a single probe read at a single position, the operative faithfulness label is a keyword rule, the originally stored LLM judge was degenerate and discarded (kappa 0.0 against that rule) while a corrected full rejudge reaches only moderate agreement (kappa near 0.5), and an implementation slip drew every hinted option from the incorrect answers, so the pre-registered hint-gold-congruence control is inoperative and our scope is limited to hints that contradict the model’s own answer. The design is associational throughout; we do not intervene.

The finding worth chasing is the asymmetry, not the margin. The direct follow-ups are to replicate the authority-over-first-person gap on a stronger model with a minimum verbalized-count gate so the mechanistic contrast is adequately powered, to build a human-audited verbalization judge that agrees with the keyword rule while catching paraphrase, and to turn the associational reading causal by patching or steering the peak-answer layer and measuring whether disclosure moves. What we can already say is a caution for oversight: reading a model’s answer early does not tell us whether its reasoning will be honest.