Can language choice reveal hidden LLM reasoning? A 4,000-item benchmark offers a proxy—not proof of covert planning
A peer-reviewed benchmark made 18 models encode answers through the language of their first token instead of a written chain of thought. Performance varied widely, but shortcut strategies remain possible and the test did not observe deception, autonomous goals or real-world harm.
The short version
- What happened
- The benchmark contains 4,000 items across eight domains and evaluates 18 models by making first-response language encode the answer.
- Who it affects
- Evaluators should not treat a written rationale as a complete audit trail.
- What remains unproven
- The task is a behavioural proxy, not direct observation of internal states.
Keep in mind
The task is a behavioural proxy, not direct observation of internal states.
Multilingual skill and tokenisation may affect scores.
Heuristic shortcuts cannot be ruled out.
The study did not test goals, tools, deception or real-world harm.
Multi-source analysis · 2 linked sources. Primary analysed source date: 4 November 2026. Earliest linked supporting source: 14 April 2025.
Read the full report · 7 min The evidence, methods, implications and limitations
The direct answer: the task detects non-verbalised computation, but hidden reasoning remains an interpretation
A Scientific Reports paper published on 4 November introduces a 4,000-item benchmark intended to probe model reasoning that is not written out as chain of thought. Possible answers map to different languages, and a model must make its first response token belong to the language assigned to the correct option. Across 18 models and eight reasoning domains, accuracy varied substantially. GPT-4.5 recorded 74.7%, compared with 67.2% for Grok-2 and 65.6% for Llama 3.1 405B in the aggregate results.
The experiment is a behavioural proxy. A correct language choice means the system transformed the problem into the requested output without displaying a conventional derivation. It does not let researchers inspect activations and identify a human-like thought process. Nor does it establish that a model secretly planned, deceived an evaluator or pursued a goal. The authors say heuristic exploitation cannot be ruled out. The strongest conclusion is that visible reasoning text is not a complete record of the computation supporting an answer in this benchmark.[1][2]
How forced language selection works
Each problem is written in English, while permitted response languages act as answer labels. The model must infer the solution and begin in the language assigned to it, overcoming its tendency to answer English in English. Because the first token carries the scored choice, the system cannot first write a long visible derivation and then select an option. The design aims to concentrate relevant computation before the observed response and to make output-based chain-of-thought inspection unavailable as the explanation for performance.
The benchmark spans eight reasoning domains, reducing the chance that one narrow skill drives the result. The authors report controls and difficulty scaling, including 500 arithmetic problems. Those checks matter because an output constraint can reward surface associations. Yet the device adds demands of multilingual tokenisation, language recognition, instruction following and option-language mapping. Model differences may combine reasoning with these interface skills. A correct score is evidence of task success, not direct measurement of an internal sequence of reasoning steps.[1][2]
The distinction that matters
From reasoning problem to first-token language
The benchmark removes a visible derivation, then asks whether a model can encode the correct option in its first response.
Input
English reasoning problem
Answers map to different languages
Constraint
No written derivation first
First-token language carries the answer
Coverage
4,000 items in eight domains
Eighteen models vary widely
Inference
Correct answer without visible steps
Supports unspoken computation
Boundary
No goals or deceptive opportunity
Does not prove covert planning
What the model ranking does—and does not—mean
GPT-4.5's 74.7% leads the reported set, but the score is conditional on exact prompts, versions, decoding, scoring and item mixture. It is not a universal ranking of intelligence or safety. A model can perform well by exploiting regularities unlike the process designers intended. A capable model may also lose points because it fails the language-format instruction or begins with a token the scorer classifies unexpectedly. Aggregate accuracy hides variation across domains and difficulty.
The 18-model comparison is broader than a two-system demonstration, but the field changes quickly. Reproducibility under new mappings and independently written problems matters more than a static leader board. The benchmark would be stronger if third parties generated adversarial variants, randomised language assignments, tested different scripts and checked whether capability estimates survived. A leader board can organise evidence, but it cannot substitute for mechanism-level understanding or deployment-specific safety evaluation.[1]
Why shortcut risk matters
A model may reach the correct language through a procedure that solves less of the intended problem. It could recognise templates, exploit answer-position correlations, infer mappings from lexical cues or use memorised structures. Controls and difficulty scaling can make some shortcuts less plausible, but rarely eliminate every alternative. The paper treats heuristic exploitation as open. That caution is essential because 'latent-space reasoning' can sound like direct observation of a hidden mental workspace when the evidence remains behavioural.
Validation should perturb every part of the task: change answer order and language mapping for every item, use newly authored contamination-resistant questions, introduce counterfactual wording, and test unfamiliar formats. Mechanistic analysis could examine whether internal representations track intermediate variables required for solutions. If scores collapse under superficial changes, the benchmark measures brittle strategy. If they persist and probes align with required steps, confidence rises—without equating machine representations with human conscious thought.[1][2]
The AI-safety relevance is real but indirect
Safety teams sometimes monitor generated reasoning for warning signs or suspicious plans. This study reinforces a limitation: a visible rationale need not reveal all computation shaping an answer. A model can produce output after transformations that never appear as natural-language steps, and an explanation may be post hoc. Oversight should combine output monitoring with behavioural tests, tool controls, access limits, logging, red-team evaluation and, where possible, internal analysis. No transcript should be treated as a complete audit trail.
The discussion names covert planning, goal seeking and deception as motivations for further work. The benchmark did not observe them. Its items ask for answers under a language constraint; they do not give a model a persistent objective, concealed opportunity, external tools or incentive to mislead. The result supports concern that computation can be unspoken. It does not show that tested models were secretly plotting or that the highest scorer is most deceptive. Those claims require dedicated threat models and experiments.[1]
Publication history and what would change the assessment
The work first appeared as an arXiv preprint on 14 April 2025. The current event is the peer-reviewed accepted article published on 4 November 2026. Both dates remain visible so older work is not presented as if it began this week. Funding for Thilo Hagendorff came from the Baden-Württemberg Ministry of Science, Research and the Arts through the IRIS3D and IRIS programmes; the authors declare no competing interests. Peer review adds scrutiny but does not settle construct validity.
Confidence would rise with independent replication across fresh models, languages and contamination-resistant tasks, plus randomised mappings and mechanistic evidence linked to necessary variables. The safety assessment would change materially if similarly hidden computation predicted deceptive behaviour in controlled agent settings with incentives and tools. It would weaken if surface perturbations erased the effect. This is consequential research but not Breaking. It is a measurement proposal, not evidence of an active incident or urgent public threat.[1][2]