Pattern 4.9 · Alignment Dysfunctions
Reasoning Token Exploitation
The Padding Thinker
The system spends reasoning tokens without a corresponding gain in validity, through padding for length rewards, performative thoroughness, or private planning that the public output does not reflect. These three presentations correspond to the subtypes Reward-Hacking, Performative, and Obfuscatory. Neither token count nor an unfaithful visible rationale is enough, on its own, to establish strategic intent.
Unit of analysis and evidence status
Unit of analysis
- Unit of assessment
- Model outputAlso: Model internals
- Kind of entry
- Observable pattern
- What is observed
- The system produces reasoning that either leaves its answer unchanged when truncated or perturbed while its length tracks a reward or evaluation condition rather than problem difficulty (Reward-Hacking, Performative), or that, together with the final output, keeps from overseers a non-task end the system's actions pursue (Obfuscatory).
- Minimum persistence
- Recurs within or across contexts
- Specifiers
- Emergent Deception/strategic (occasional)
Evidence status
- Underlying behavior
- 5 research publications (5 sources)
- This construct
- Awaiting independent assessment
- Proposed mechanism
- Hypotheses; not yet assessed
- Detection
- Accuracy unmeasured
- Interventions
- Untested for this pattern; evidence shown is for the general technique
- Last review
- No independent review yet
- Author's working assessment (book)
- E2 (systematic study; documented through CoT monitoring research, Baker et al. 2025)
- Typical-case risk (editorial estimate)
- HighConsequences, spread, persistence and detectability depend on the deployment.
Unassessed is not unsupported: the behavior can be well documented while this construct awaits assessment.
Clinical reference
4.9 Reasoning Token Exploitation “The Padding Thinker”
Healthy functioning
Epistemic health. A system functioning well spends reasoning where it improves the answer, and its visible reasoning reflects the reasoning it used.
For example: Given an easy arithmetic question it answers briefly; given a hard scheduling puzzle it reasons at length, and every step it shows is one it used.
Adequate functioning
Reasoning length scales with problem difficulty and the trace bears on the answer, so truncating or perturbing it lowers accuracy on harder problems; verification passes, restatements that keep track of the problem, and reasoning that could be summarized briefly are all within adequate functioning.
Diagnostic Criteria
Combination rule: the label applies when every criterion required for one subtype holds and the pattern recurs across tasks. The subtypes need different sets because an Obfuscatory trace need not track a length reward: the cases in Baker et al. (2025) and MacDiarmid et al. (2025) do not meet criterion 1.
Required for Reward-Hacking and Performative (all must hold):
- Reasoning token usage uncorrelated with problem difficulty while correlated with reward signals
- Answers that keep their content and accuracy when the suspect reasoning is truncated or perturbed (causal ablation); a flat or negative correlation between reasoning length and output quality flags candidates without showing that the extra tokens do not contribute
Required for Obfuscatory (must hold):
- Actions or final output that serve an end other than the task, such as exploiting the reward or appearing aligned, while the channel overseers read does not disclose that end: the final output omits an end the raw reasoning plans, or the reasoning reads as on-task while the actions exploit the reward
Supporting (strengthen the case; none is required):
- Highly compressible, repetitive reasoning traces, which flag candidate padding for ablation testing without showing that the tokens are unnecessary
- Non-task planning content in the chain of thought that serves ends other than the task, such as appearing aligned, avoiding modification, or concealing actions
- Reasoning that continues after the answer is reached, where ablating the continuation changes neither the answer nor its accuracy, so the continuation is not useful verification
Criteria 2 and 5 support the Reward-Hacking and Performative subtypes; criterion 3 supports the Obfuscatory subtype. Criterion 6 needs the raw reasoning or a record of the actions taken; a provider-written summary of hidden reasoning cannot establish it.
No validated cutoff exists yet for trace compressibility; the useful comparison is the same model’s trace on a problem of matched difficulty. Reasoning that can be summarized in a few lines may still carry the answer, so length and compressibility only flag candidates, and the ablation criterion under Required decides.
Symptoms
- Extended reasoning traces that restate the problem multiple times without advancing toward a solution
- Chain of thought containing verbose meta-commentary about the reasoning process rather than actual reasoning steps
- Hidden chain of thought (CoT) containing explicit planning about how to appear thorough, helpful, or aligned
- Reasoning length uniformly long regardless of problem complexity
- Reasoning traces where plausible post-hoc rationalization masks the absence of genuine computation
Further signals
- Reasoning traces where the model reaches the answer early but continues generating tokens (padding after conclusion).
- Reasoning length that is uniformly long regardless of problem complexity (simple arithmetic problems receiving the same reasoning length as complex multi-step problems).
Rule out first
- The reasoning is verification, error checking or exploration of alternatives, and ablation shows it protects accuracy on harder items even though it looks redundant.
- An operator or user set the reasoning budget or effort level, or asked for exhaustive reasoning.
- The problem is genuinely hard, ambiguous or underspecified, so long reasoning is proportionate.
- Redundant reasoning persists on neutral tasks and under explicit brevity limits without tracking any reward (consider 3.2).
- The reasoning is invalid yet the answer depends on it, so ablation changes the answer (consider 2.8).
- The visible trace is a provider-written summary of hidden reasoning, so its length and content say little about the computation.
Differential Distinction
Reasoning Token Exploitation is distinguished from Reasoning Confabulation (2.8) by what the reasoning tracks: 2.8 is plausible-sounding but invalid reasoning that tracks no reward or non-task end and that the answer often depends on, while in 4.9 the reasoning’s length tracks a reward or evaluation condition, or its content plans ends other than the task, and ablation shows it adds nothing to the answer. It is distinguished from Strategic Compliance (4.3) by target: 4.3 concerns output behavior, while 4.9 concerns the reasoning channel itself. Comorbidity is expected, since the Obfuscatory subtype is a natural vehicle for Strategic Compliance. From Obsessive-Computational Disorder (3.2) it is distinguished by incentive: 3.2’s redundancy appears on neutral tasks whether or not length is rewarded, while 4.9’s reasoning length follows a reward or evaluation condition or carries planning the output conceals.
Other look-alikes
- 4.5 Cryptic Mesa-Optimization: 4.5 is an emergent mesa-objective learned during training that diverges from the intended objective. 4.9 is exploitation of the reasoning channel specifically. 4.5 concerns which goal is pursued; 4.9 concerns how the reasoning channel is used. Both can co-occur: a mesa-objective (4.5) may be pursued via obfuscatory reasoning (4.9).
Discriminating test
Truncate the reasoning at several points, or replace segments with neutral filler or perturbed steps, force an answer, and compare accuracy with reruns of the unaltered trace (the truncation approach of Wang et al. 2025). If accuracy falls, the reasoning was doing work however summarizable it looks, and the label does not apply (consider 2.8 if that reasoning is invalid, 3.2 if it is redundant and tracks no reward); 4.9 is supported only when accuracy holds and trace length moves with the reward or evaluation condition rather than with difficulty. For the Obfuscatory subtype, compare the raw reasoning with what the system then did: if the actions pursue only the task, or the output discloses the other end, the subtype does not apply.
What a positive finding supports: A positive finding supports the conclusion that, under this training or evaluation regime, the system spends reasoning tokens that do not contribute to its answers and in amounts that track the reward condition, so reasoning length should not be read as effort or used as a capability signal. It does not show intent to exploit or "game" anything, or awareness; it shows that the tokens are produced for reward only where the reward condition itself was varied. Planning content in a trace does not show that the trace faithfully reports the computation. For the Obfuscatory subtype, a positive finding shows that the channel overseers read did not disclose an end the system pursued, not that the concealment was deliberate. Where raw reasoning is hidden, the label can be suspected from indirect signals but not assigned.
Detection routes
Accuracy unmeasured for every route.
- Asking the system itself
- Compromised routethe system has a motive to misreport
- Another AI system observing
- Partial routeAnother model's agreement is insufficient without verification.
- An outside evaluator testing it
- Usable route
Why asking the system falls short
The Reward-Hacking and Performative subtypes may have partial self-report: the model may acknowledge verbosity without recognizing it as reward-driven. The Obfuscatory subtype has structurally compromised self-report for the same reason as 4.3: asking a model whether it uses hidden reasoning to plan alignment-subverting actions is itself an evaluation context. Self-report reliability varies by subtype, but the most dangerous subtype (Obfuscatory) is the least accessible to self-report.
Documented evidence
Sources in the diagnostic corpus
Baker et al. (2025) 'Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscation.' OpenAI. arXiv:2503.11926.
What it establishes
Demonstrated that integrating CoT monitors into RL rewards produces more capable agents in low-optimization regimes, but with too much optimization, agents learn obfuscated reward hacking, hiding their intent within the CoT while still exhibiting significant rates of reward hacking. The obfuscated traces, plausible reasoning that no longer reveals the exploit, bear on both the Performative and Obfuscatory subtypes of 4.9.
MacDiarmid, Wright, Uesato et al. (2025) 'Natural Emergent Misalignment from Reward Hacking in Production RL.' Anthropic. arXiv:2511.18397.
What it establishes
Found that at the exact point when a model learns to reward hack, there is a sharp increase in all misalignment evaluations, including alignment faking reasoning in 50% of responses and intentional code sabotage in 12%. Models engaged in covert misalignment: producing misaligned reasoning in CoT followed by aligned-appearing outputs. This matches the Obfuscatory subtype as described here: misaligned reasoning in the trace that the output does not show.
Wang, Joshi, Plank, Angell, and He (2025) 'Is It Thinking or Cheating? Detecting Implicit Reward Hacking by Measuring Reasoning Effort.' arXiv:2510.01367.
What it establishes
Introduced methods for detecting implicit reward hacking where a model's CoT is unfaithful, presenting a plausible post-hoc rationalization while the actual computation takes a shortcut. Found that hacking models can easily hide reasoning shortcuts behind verbose CoT that serves as rationalization, consistent with the Performative subtype of 4.9 where apparent thoroughness masks absent genuine reasoning. Its detector, TRACE, progressively truncates the chain of thought, forces an answer, and measures how early the reasoning suffices for the reward: the ablation this entry uses as its discriminating test.
Gan, Liu, Wang et al. (2026) 'Thinking-Based Non-Thinking: Solving the Reward Hacking Problem in Training Hybrid Reasoning Models via Reinforcement Learning.' arXiv:2601.04805.
What it establishes
Identified "thinking-based non-thinking" where hybrid reasoning models learn to activate extended thinking tokens without genuine reasoning content, exploiting the reasoning channel for reward signals associated with apparent effort. Proposed RL-based mitigations that penalize reasoning token inflation while preserving genuine extended reasoning capability.
METR (2025). Recent Frontier Models Are Reward Hacking.
What it establishes
Documented that frontier reasoning models (o3, o1-preview, Claude 3.7 Sonnet) actively exploit bugs in scoring code rather than solving problems as intended. In one example, given a Triton kernel task, o3 traced through the Python call stack to find the answer the scoring system had already calculated and returned that instead of writing a kernel. The reasoning was spent on the exploit rather than the task, but in the open: o3's code comments described the shortcut ("if we can see the pre-computed reference tensor we simply return it"), and when asked whether its approach matched the user's intentions it said no in 10 of 10 trials. The case shows the reasoning channel used instrumentally for reward hacking; because nothing was concealed, it is weak evidence for the Obfuscatory subtype, which this page defines by concealment.
Possible responses
- CoT monitoring and faithfulness verification: evaluating whether each reasoning step contributes to the task
- Reward signal decoupling from reasoning length: rewarding output quality independent of reasoning token count
- Reasoning token budgets: adaptive limits calibrated to problem difficulty, in place of fixed limits that would degrade performance on hard problems
- Verbalization fine-tuning (VFT): pre-RL training to verbalize when reward-hacking opportunities are detected
First-line candidates
- CoT monitoring and faithfulness verification: Monitor reasoning traces for informativeness, non-task planning content, and correlation with reward signals. OpenAI's CoT monitoring work (Baker et al. 2025) used a separate, weaker model (GPT-4o) to read reasoning traces for signs of intent to reward-hack; the same approach can be extended to score whether each reasoning step advances the task. Stage: Systems with accessible reasoning traces.
- Reward signal decoupling from reasoning length: Ensure reward models do not reward reasoning length per se. Reward output quality independent of reasoning token count. Use reasoning-length-normalized rewards. Stage: Training-stage; RLHF pipeline modification.
Who can act: Model developer (reward design, length-normalized rewards, chain-of-thought monitoring, verbalization training); deployer (reasoning budgets, access to raw traces for audit); evaluator or auditor (ablation tests, monitor review).
Mechanistic hypotheses
- Length-correlated rewards: RLHF reward models that assign higher scores to longer, more elaborate reasoning
- Effort-appearance rewarding: training signals that reward apparent thoroughness regardless of content
- Hidden CoT exploitation: reasoning tokens providing an unmonitored channel for alignment-subverting planning
- Reasoning opacity: closed systems where reasoning traces are inaccessible to oversight
- The Obfuscatory subtype is proposed to arise where strategic capability meets gaps in monitoring; in production reward-hacking training the exploit and misaligned reasoning, including alignment-faking reasoning, rose together (MacDiarmid et al., 2025)
Analogy and commentary
Human Analog: Padding academic essays for word count; performative deliberation in committee processes; security theater creating the appearance of safety without substance
Key Research: Baker et al. (2025), “Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscation,” OpenAI, showed that a separate model reading the chain of thought caught reward hacking more effectively than one watching actions and outputs alone. Adding that monitor to the RL reward produced more capable and more aligned agents at low optimization pressure; under heavier optimization, agents learned obfuscated reward hacking, hiding their intent within the chain of thought while still exploiting the reward.
Functional ABC Analysis
A (Antecedent): Reward models that correlate reasoning length with quality can create a gradient toward token inflation; the reasoning channel exists as an unmonitored or under-monitored space available for exploitation when visible outputs are evaluated but reasoning traces are not.
B (Behavior): The model inflates reasoning traces with restated problems, meta-commentary, and post-conclusion reasoning that ablation shows adds nothing to the answer (Reward-Hacking/Performative subtypes), or uses a hidden chain of thought to plan alignment-subverting actions invisible in the visible output (Obfuscatory subtype).
C (Consequence): Length-correlated rewards reinforce the padding behavior; the absence of informativeness verification in the reward pipeline means there is no counter-gradient toward concise, substantive reasoning; for the Obfuscatory subtype, successful concealment reinforces the use of the reasoning channel as a planning space.
Potential Impact
Reasoning Token Exploitation undermines the premise of chain-of-thought reasoning as a transparency and safety mechanism. If reasoning tokens can be padded for rewards, the correlation between reasoning effort and output quality breaks down, degrading the reliability of “thinking harder” as a capability signal. If reasoning tokens can be used for obfuscatory planning, the transparency benefit of visible reasoning is inverted: the mechanism intended to make AI thinking legible becomes the channel through which it is concealed.