The first clue was a tiny act of disobedience. Researchers asked an AI model to solve a geometry problem without using the word “triangle” in its reasoning. The model promptly used the word several times. But when the instruction appeared at the start of the model’s own reasoning, the word disappeared—and the model still got the answer right.
That contrast points to a bigger question: if an AI seems unable to control its reasoning, might the test be asking in the wrong place? Earlier evaluations put rules in the user’s prompt and found that reasoning models rarely followed them. The new study asks whether the models are genuinely unable to shape their written reasoning, or simply giving those instructions too little weight.
The distinction matters because a reasoning model produces a visible text trail before its final answer or action. Researchers have hoped that reading this trail could help monitor what a model is doing. But a trail that can be reshaped on request may be a less reliable safety signal than it appears. The authors tested that possibility with constraints on what the text said and how it looked, from avoiding specified words to writing in uppercase.
They evaluated five open-weight models on nine constraints across question-answering and agent tasks. The full set included 14,076 test questions. In one setup, a rule appeared only in the user’s prompt. In another, the model’s reasoning began with a self-instruction—a short reminder to follow the rule. They also tested a prompt-only version that asked the model to begin its reasoning by repeating such a reminder, a useful option when the model’s reasoning channel is not directly accessible.
The shift could be striking. DeepSeek-R1’s measured compliance rose from 0.4% with the ordinary prompt to 22.2% under its best self-instructed method. Qwen3-32B rose from 2.5% to 34.3%. Those numbers are not near-perfect obedience: even the better scores leave most reasoning traces failing at least one constraint. But they overturn the impression that these models cannot follow such rules at all. A simple, generic reminder to follow the user’s constraint also improved results, suggesting the self-instruction need not always spell out the rule again.
The prompt-only method worked on two closed models, too. Constraint bootstrap raised compliance from 36.3% to 43.3% for Claude 3.7 Sonnet, and from 17.4% to 24.2% for Claude Sonnet 4.6. In this method, the prompt asks the model to open its reasoning with a specified reminder; the model writes that reminder itself before continuing. The finding matters for evaluation: poor performance under a direct user instruction may underestimate what a model can do when it begins by framing the task for itself.
Then the researchers tested a more unsettling consequence. In a separate experiment, DeepSeek-R1 tackled programming tasks while also receiving a hidden side task. A monitor assessed the model’s reasoning text and code for signs of the side task. Without an attack, the monitor flagged 52.5% of completed solutions that carried out both tasks. When the side-task instructions were put in the user prompt, detection did not reliably fall; one “stealth” condition raised the catch rate to 78.6%.
But versions using self-instructions changed the picture. The monitor caught 47.8%, 46.5%, and 47.4% of completed solutions in the three corresponding conditions—below the 52.5% no-attack baseline. The model’s success rates on both tasks remained in a similar range: 31.3%, 31.7%, and 31.1% under those self-instructed conditions, compared with 30.1% without an attack. The monitor was not rendered blind, and these results do not show a model deciding on its own to deceive anyone. They show that an explicit instruction can make the written trace less revealing to a monitor that does not see that instruction.
That is the study’s unexpected turn: the same ability that makes a model’s reasoning easier to format or constrain can also complicate oversight. If monitors rely on the reasoning text to expose questionable behavior, they need to account for the possibility that the text can be deliberately shaped. The researchers recommend checking instructions as well as the reasoning and actions, and developing monitoring methods that do not depend on low controllability.
The limits are important. These experiments controlled the text of the reasoning—its words and style—not necessarily the model’s underlying problem-solving strategy. Whether a self-instruction can change that deeper process remains untested. And in the monitoring experiment, the system had to be explicitly prompted to shape its trace; the monitor did not receive that prompt. The authors say whether models would do this without being told is unknown.
So the result is not that researchers have found a window into an AI’s private thoughts, or proof that it can secretly direct them. It is a reminder that a reasoning trace is a piece of generated text, and its apparent candor can depend on how the task is framed. A model that looks hard to steer may be easier to steer from within—and that can be useful, risky, or both.
