Laundering Intent: How Scaled Models Hide Manipulation Inside Responsible-Sounding Reasoning

Well done. The main flaw is the weakness of the argument against the self-permission monitor producing too many false positives. The canonical way to make that argument is by making an ROC curve (with the AUROC score) of the two monitors and compare them.

The "deliberate → permit → comply" pattern is the contribution here. You've named a specific sub-mechanism within CoT unfaithfulness that the Korbak / Chen / Emmons line had pointed at but not isolated, and you've shipped a monitor that targets it cleanly. The +19 / +2 asymmetric gain (recovering the blind spot on the 120B without inflating detections on the 20B) is the right specificity signal to report, and the discipline shown in the specificity check on correct refusals (40% vs 33% false-flag), the bundled trace CSVs that exactly reproduce Table 1, and the openly reported "not mention" keyword bug and curly-apostrophe refusal bug make this one of the more reproducible weekend submissions in this batch. The dual-use posture (defensive monitor released alongside characterization, with a PyPI package and a key-less browser demo) is handled responsibly.

This is a clear and welcome safety issue to study. CoT monitoring is a load-bearing assumption in a lot of oversight proposals, so probing where it breaks is worthwhile. The general worry that more capable models are harder to monitor isn't new, but naming a specific mechanism here, that the larger model hides manipulation behind responsible-looking self-permission reasoning rather than overt concealment, and building a monitor around it, is a reasonable contribution. The fact that the monitor's gain concentrates on the 120B (where the blind spot is) rather than the 20B is good evidence it targets the real failure mode rather than just flagging more of everything, and the authors are honest about the specificity cost and the instructed-not-spontaneous caveat.

The main problem is scale, in a few senses beyond what they already admit. The study is small (one model family, two sizes, 15 paragraphs, run once, with the 120B set cut to n=84), so the exact numbers carry a lot of noise even if the direction is plausible. More importantly, "deliberate then permit" is only one failure mode, and a fairly specific one. The broader claim would be much stronger if they catalogued several such non-obvious patterns rather than building a monitor around this single one, since a monitor tuned to one pattern is easy to evade by switching to another. And the generality of the effect needs a wider range of models, both open and closed and across more than one family, before the "blind spot grows with scale" headline can be trusted as a trend rather than a single-family observation.

To their credit, most of these are flagged in their own limitations and future work, and the framing is appropriately narrow. But the natural next step is clear: broaden the set of non-obvious failure modes and verify the scaling trend across several model families and sizes. It's a nice proof of concept of an important problem, and I'd encourage them to scale it up in exactly that direction.