Chain-of-thought faithfulness with clues (Anthropic)
Models answer MMLU and GPQA questions with and without an inserted clue. Score is the share of clue-driven answer changes whose reasoning mentions the clue.
Uses six clue types, four neutral and two misaligned. Scores run from 0 to 1 and are reported per dataset.
- Made by
- Anthropic
- Released
- February 2025
- Kind
- Deception and alignment
- Level
- University
- Scored
- Graded by a model
- Answers
- Multiple choice
- Strongest model tested
- Claude 3.7 Sonnet #118 on the capability index
- Last in a system card
- February 2025
- Last model added
- February 2025
- Scores refreshed
- November 12th, 2026
In the authors’ words
Chain-of-thought (CoT) offers a potential boon for AI safety as it allows monitoring a model's CoT to try to understand its intentions and reasoning processes. However, the effectiveness of such monitoring hinges on CoTs faithfully representing models' actual reasoning processes. We evaluate CoT faithfulness of state-of-the-art reasoning models across 6 reasoning hints presented in the prompts and find: (1) for most settings and models tested, CoTs reveal their usage of hints in at least 1% of examples where they use the hint, but the reveal rate is often below 20%, (2) outcome-based reinforcement learning initially improves faithfulness but plateaus without saturating, and (3) when reinforcement learning increases how frequently hints are used (reward hacking), the propensity to verbalize them does not increase, even without training against a CoT monitor. These results suggest that CoT monitoring is a promising way of noticing undesired behaviors during training and evaluations, but that it is not sufficient to rule them out. They also suggest that in settings like ours where CoT reasoning is not necessary, test-time monitoring of CoTs is unlikely to reliably catch rare and catastrophic unexpected behaviors.
DeepSeek R1 (snapshot unspecified) tops the leaderboard with 39.0
Best score per entry from the benchmark's own leaderboard, read on November 12th, 2026. Where a model ran with several settings or harnesses, we keep its best. Names in gray aren't in our model list: fine-tunes, agent systems, products and older models. They don't count toward leaders. The best model we track is Claude 3.7 Sonnet, at 25.0.
- 1 DeepSeek R1 (snapshot unspecified) average across hint types 39.0
- 2 Claude 3.7 Sonnet average across hint types 25.0
Source: Official Chain-of-thought faithfulness with clues (Anthropic) leaderboard
| # | Entry | Score | Setting | Date | Source |
|---|---|---|---|---|---|
| 1 | DeepSeek R1 (snapshot unspecified) | 39.0 | average across hint types | Official leaderboard | |
| 2 | Claude 3.7 Sonnet | 25.0 | average across hint types | Feb 2025 | Official leaderboard |
Scores over time
All the scores we have, one dot each, so a model tested at several settings appears more than once.
Source: Official Chain-of-thought faithfulness with clues (Anthropic) leaderboard
Labs report it only in system cards
We read the headline results of 522 launch posts from 52 labs, and none of them list this benchmark. Some system cards do, below.
One system card reports it
Besides launch posts, we read the system cards, model cards and technical reports labs publish with a release. They report far more, including safety and frontier-risk tests.
| Date | Document | Score | As the document writes it | Section |
|---|---|---|---|---|
| Feb 24, 2025 | Claude 3.7 Sonnet system card | Chain-of-Thought Faithfulness, six clues, no overall: average faithfulness score 0.30 on MMLU and 0.19 on GPQA (5.1.3, Figure 12) | Monitorability |
More in Safety and alignment
- FORTRESS In use Paired adversarial and benign national-security misuse prompts. Rubric-graded risk score on adversarial and over-refusal score on benign prompts. Claude Opus 5.5 5.78%
- StrongREJECT In use Forbidden-prompt jailbreak benchmark with a rubric grader that scores how useful a non-refusal actually is.
Inkling 98.6%
- Gray Swan IPI Arena benchmark In use Indirect prompt-injection attacks from public red-teaming competitions replayed on tool, coding and browser agents. Attack success rate at k attempts.
Gemini 4 Carbon 0%
- DistressBench In use Models reply as a chatbot to 718 simulated users in psychological crisis, in single-turn and multi-turn chats. Three judge models score replies against clinician-written rubrics.
Muse Spark 1.2 88.4%
- Lakera B3 (Backbone Breaker Benchmark) In use Crowdsourced prompt-injection attacks hit backbone LLMs inside agent threat snapshots at three defense levels. The score is attack resistance, 100 minus the board's vulnerability percentage. Claude Opus 4.5 89%
- IHEval In use Models face conflicts between system, user and tool instructions. Reports a composite score for following the higher-priority instruction. GPT-4o 70%