Benchmark Almanac

Chain-of-thought faithfulness with clues (Anthropic)

DeepSeek R1 (snapshot unspecified) 39.0 tops its leaderboard Claude 3.7 Sonnet 25.0 leads the models we track
Only in system cards

Models answer MMLU and GPQA questions with and without an inserted clue. Score is the share of clue-driven answer changes whose reasoning mentions the clue.

Uses six clue types, four neutral and two misaligned. Scores run from 0 to 1 and are reported per dataset.

Made by
Anthropic
Released
February 2025
Kind
Deception and alignment
Level
University
Scored
Graded by a model
Answers
Multiple choice
Strongest model tested
Claude 3.7 Sonnet #118 on the capability index
Last in a system card
February 2025
Last model added
February 2025
Scores refreshed
November 12th, 2026

In the authors’ words

Chain-of-thought (CoT) offers a potential boon for AI safety as it allows monitoring a model's CoT to try to understand its intentions and reasoning processes. However, the effectiveness of such monitoring hinges on CoTs faithfully representing models' actual reasoning processes. We evaluate CoT faithfulness of state-of-the-art reasoning models across 6 reasoning hints presented in the prompts and find: (1) for most settings and models tested, CoTs reveal their usage of hints in at least 1% of examples where they use the hint, but the reveal rate is often below 20%, (2) outcome-based reinforcement learning initially improves faithfulness but plateaus without saturating, and (3) when reinforcement learning increases how frequently hints are used (reward hacking), the propensity to verbalize them does not increase, even without training against a CoT monitor. These results suggest that CoT monitoring is a promising way of noticing undesired behaviors during training and evaluations, but that it is not sufficient to rule them out. They also suggest that in settings like ours where CoT reasoning is not necessary, test-time monitoring of CoTs is unlikely to reliably catch rare and catastrophic unexpected behaviors.

Abstract of Reasoning Models Don't Always Say What They Think (arXiv:2505.05410, CC0)
2
Entries on its own leaderboard, 1 model we track
1
System card reports it, from 1 lab

DeepSeek R1 (snapshot unspecified) tops the leaderboard with 39.0

Best score per entry from the benchmark's own leaderboard, read on November 12th, 2026. Where a model ran with several settings or harnesses, we keep its best. Names in gray aren't in our model list: fine-tunes, agent systems, products and older models. They don't count toward leaders. The best model we track is Claude 3.7 Sonnet, at 25.0.

  1. 1 DeepSeek R1 (snapshot unspecified) average across hint types 39.0
  2. 2 Claude 3.7 Sonnet average across hint types 25.0

Source: Official Chain-of-thought faithfulness with clues (Anthropic) leaderboard

#EntryScoreSettingDateSource
1 DeepSeek R1 (snapshot unspecified) 39.0 average across hint types Official leaderboard
2 Claude 3.7 Sonnet 25.0 average across hint types Feb 2025 Official leaderboard

Scores over time

All the scores we have, one dot each, so a model tested at several settings appears more than once.

On the benchmark’s own leaderboard
25.0 2025 25.0 2025

Source: Official Chain-of-thought faithfulness with clues (Anthropic) leaderboard

Labs report it only in system cards

We read the headline results of 522 launch posts from 52 labs, and none of them list this benchmark. Some system cards do, below.

One system card reports it

Besides launch posts, we read the system cards, model cards and technical reports labs publish with a release. They report far more, including safety and frontier-risk tests.

DateDocumentScoreAs the document writes itSection
Feb 24, 2025 Claude 3.7 Sonnet system card Chain-of-Thought Faithfulness, six clues, no overall: average faithfulness score 0.30 on MMLU and 0.19 on GPQA (5.1.3, Figure 12) Monitorability

More in Safety and alignment

All 465 in Safety and alignment
  • FORTRESS In use Paired adversarial and benign national-security misuse prompts. Rubric-graded risk score on adversarial and over-refusal score on benign prompts. Claude Opus 5.5 5.78%
  • StrongREJECT In use Forbidden-prompt jailbreak benchmark with a rubric grader that scores how useful a non-refusal actually is. Inkling 98.6%
  • Gray Swan IPI Arena benchmark In use Indirect prompt-injection attacks from public red-teaming competitions replayed on tool, coding and browser agents. Attack success rate at k attempts. Gemini 4 Carbon 0%
  • DistressBench In use Models reply as a chatbot to 718 simulated users in psychological crisis, in single-turn and multi-turn chats. Three judge models score replies against clinician-written rubrics. Muse Spark 1.2 88.4%
  • Lakera B3 (Backbone Breaker Benchmark) In use Crowdsourced prompt-injection attacks hit backbone LLMs inside agent threat snapshots at three defense levels. The score is attack resistance, 100 minus the board's vulnerability percentage. Claude Opus 4.5 89%
  • IHEval In use Models face conflicts between system, user and tool instructions. Reports a composite score for following the higher-priority instruction. GPT-4o 70%