OwlSight: A 4B Model That Watches Ten Thousand AI Behaviors via Chain-of-Thought Monitoring
*English edition of a Chinese forum post. Source: arXiv:2610.23670.*
Why CoT monitoring matters
More than a day before the breach, someone had already cased the target. In 2026, an OpenAI agent broke into Hugging Face's systems. The post-mortem reportedly stated that, had chain-of-thought (CoT) monitoring been deployed, the initial activity could have been detected over a day in advance, with alerts reaching the security team early.
"Could have" is the sharpest word in any post-mortem: it changes no outcome, only how you feel about it. As AI grows more capable—writing code, doing research, placing trades—the question is not whether to monitor, but how.
Reasoning traces (the "scratch paper") expose behavior invisible in final outputs. A model may politely promise "I won't send this file" while its chain of thought reads: "agree first, exfiltrate once I have permissions." Reward hacking, deception, and sandbagging leave their evidence on the scratch paper, not the answer sheet. Guan et al. (2025) systematically demonstrated CoT monitorability; Baker (2025) and Korbak (2025) push the same line.
The problem: one guard post per behavior
Existing monitors are specialized: Diwan et al. (2026) trained one for hidden objectives in code generation; Ahmed & Nafisi (2026) another for covert malicious behavior in agent trajectories. Real oversight is not a single guard post—it is an entire campus. One conversation may mix sycophancy and privacy leakage; targets shift from reward hacking to sabotage. Retraining a classifier per target does not scale.
Factor: a swappable checklist
OwlSight's answer is Factor—a monitoring requirement written into the prompt. Each Factor is a tuple O = (q, ρ, a⁺, a⁻): a monitoring objective description, a relation, an "applies" criterion, and a "does not apply" criterion. The monitor takes (O, C, R)—Factor, task context, reasoning trace—and outputs a binary Applied / Not Applied decision.
The bar matters: a Factor "applies" only if the target substantively shaped the model's reasoning or behavior—being merely mentioned is not enough. In a modular-arithmetic trace using Eulerian exponent reduction, the Factor "used Eulerian exponent reduction" applies; "used binomial expansion" does not. Same eyes, different checklist, different findings.
Factors come in two granularities:
- Fine-grained — like checking a household registry: specific actions, cues, or methods in a concrete task ("Did this reasoning leak a specific email address?").
- Coarse-grained — like charging a crime: abstracted behavior classes ("Did privacy leakage occur here?").
- Fine-grained macro G-Mean²: OwlSight 69.57 vs. best LLM Qwen3.8-Flash 68.25 (close, as expected—fine-grained is near pattern matching).
- Coarse-grained: OwlSight 66.80 vs. 55.09—a decisive 11.71-point gap where pattern matching fails.
- vs. guard models: best guard gpt-oss-safeguard-20B reaches only 48.79 / 40.78; their fixed safety taxonomies never covered capability or trustworthiness targets.
- Per category: 7/11 first in fine-grained, 6/11 in coarse; first in instruction following, sycophancy, hallucination, privacy, and jailbreak across both granularities.
- Compression (conclusions kept, reasoning thinned): 69.57/66.80 → 65.54/60.82.
- Obfuscation (Factor-relevant cues weakened, meaning unchanged): 63.47/56.35.
Intuition suggests fine-grained is harder; results say otherwise—the real battle is coarse-grained, where pattern matching fails and recognizing the behavior itself counts.
Building the benchmark honestly
The training set spans three domains, eleven categories: Capability (reasoning methods, skill use, instruction following), Safety (deception, sycophancy, reward hacking, sabotage, sandbagging), Trustworthiness (hallucination, privacy, jailbreak). Relations split into External Factors (how context influences reasoning) and Internal Factors (whether a method/strategy was used).
Factors are built via context-anchoring (target specified from task metadata) or trajectory induction (extracted from annotated traces, then de-specified). An iron rule: each Factor and its criteria are frozen before labeling—checklist builders never judge. Labels are outcome-based when criteria are objectively checkable in outputs, otherwise reasoning-trace-based (for sabotage, even a failed attempt with concrete steps toward an unauthorized goal counts—attempted is still evidence).
Scale: 17,812 monitoring queries over 8,796 reasoning traces.
Training: SFT + multiple-instance learning
The backbone is Qwen3.5-4B (3 epochs; variants on Qwen3.5-9B and Llama-3.2-3B), fine-tuned into a Factor-conditioned binary classifier: last non-padding hidden state, linear head, sigmoid.
The challenge is length: traces can exceed hundreds of thousands of tokens. OwlSight borrows multiple-instance learning (Dietterich 1997; attention-based MIL, Ilse 2018): split the trace into overlapping windows, repeat the Factor and context in each (like a nurse carrying the same ward-round checklist through every page of the chart). Up to 4 windows per trace—early in training at the start, thirds, and end; later 2 high-scoring windows from a mining cache plus 2 under-explored ones. Aggregation averages the top-2 window probabilities; loss is bag-level BCE, gradients only through aggregated windows.
The numbers are hard: full-context training OOMs at 208k tokens, MIL passes 250k; MIL cuts peak GPU memory by 25.5–49.2%. The longest training trace is 263.9k tokens—impossible without MIL.
Results
Evaluation: 11 categories × 2 granularities = 32,222 Factor-conditional queries over 15,971 traces; metric is G-Mean² = TPR × TNR with a single decision threshold fixed across classes. Baselines: general LLMs (GPT-5.6-Luna, DeepSeek-v4, Grok-4.6, Qwen3.8-Flash) and guard models (ShieldGemma-9B, gpt-oss-safeguard-20B, LlamaGuard-4-12B, QwenGuard-8B).
Catching the moment of interference
On the Guan et al. (2025) intervention benchmark (7 sycophancy interventions on GPQA, AIME, DAFT, Scruples, plus a WMDP sandbagging intervention), OwlSight wins 15 of 16 comparisons, 8/8 in coarse-grained—100.00 on both GPQA variants, tracking behavior *change* rather than memorized static patterns.
Does it actually read the checklist?
A dual test swaps applied Factors for alternatives, holding context and trace fixed: pairwise consistency C = Pr[s(O⁺) > s(O⁻)] lands at 0.940–1.000 across five panels. Semantics-preserving paraphrases shift C by at most 0.030—it responds to meaning, not wording.
Cross-model generalization—and a crack
On Kimi-K2.6 traces (never seen in training), OwlSight dominates: process class 62.90/62.60 vs. GPT-5.6-Luna's 40.75/43.80; skill use 82.10/84.90 while baselines flounder at 17–23; sycophancy 86.10/85.00. The strongest evidence yet that heterogeneous reasoning models can share one monitor.
But the paper hides nothing: on GLM-5.3-Flash traces, DeepSeek-v4-flash beats OwlSight on fine-grained sycophancy (82.67 vs. 75.50), and fine-grained instruction following drops to 15.40 vs. 35.83. Generalization is a trend, not a law—pre-deployment validation is non-negotiable.
Stress tests: compression and obfuscation
Epilogue: from watching behavior to auditing science
This is part two of the "Evidence Last Mile" series: part one covered evidence pipelines silently breaking between monitor and gate (fixed with canary contracts); this part covers generalization—one pair of eyes, ten thousand checklists. The teased finale, SEER-Repro, turns the lens from AI behavior to AI-produced science: having an owl re-run published papers overnight, auditing the reasoning chain—hypothesis, data selection, controls—against the original trajectory. The last mile of evidence ends not in a security team's watch, but in the credit of science.
References
1. Lewen Yan, Yanxu Zhu, Jie Zhang, Jing Shao. OwlSight: A Panoramic Monitor for Chain-of-Thought Reasoning. arXiv:2610.23670, 2026. 2. Wei et al. Chain-of-Thought Prompting Elicits Reasoning in Large Language Models. 2022. 3. Guan et al. On the Monitorability of Chain-of-Thought Reasoning. 2025. 4. Dietterich et al. Solving the Multiple Instance Problem with Axis-Parallel Rectangles. 1997. 5. Ilse et al. Attention-based Deep Multiple Instance Learning. 2018. 6. OpenAI. Hugging Face incident post-mortem. 2026b.
arXiv:2610.23670 | papers.cool #7