One thing I’m wondering about is the model-specific backfire effect. It seems that each prompt condition uses a single wording. On that point, how can we know whether the difference is caused by severity rather than the particular formulation used? I’d be really curious to see semantically equivalent versions of both the standard and severe instructions tested across the same models and tasks. If cheating rates are stable within each condition and remain distinct across conditions, that strengthens the conclusion about prompt severity. If they vary with wording, then the experiment could be measuring sensitivity to the representation of the rule as well as to the rule itself. To me, the conclusion still seems solid: anything that must be prohibited ultimately needs enforcement outside the model.
This paper made me wonder not whether the chain we can read is actual “thought,” but what conclusions we can draw by observing it. It is an output channel, but not direct access to the black box that creates it. The question pairs present an interesting experiment, but they also got me thinking about semantics: the same underlying relation can have many valid representations, and how models reason across those representations can tell us more about their stability and correctness. Basically, are models semantically consistent when given different representations of the same underlying relation? Do their answers transform as the relationship requires, and do their explanations remain consistent with that relationship?
There’s one thing here that I’m really curious about, and that is what happens in between detection and the decision to pause. Basically, it’s about monitoring any system and the authority over its actions. For humans, 30 minutes to investigate might be considered reasonable, but what if during an investigation there’s a high-risk tool call? If the tool execution happens in real time, then the monitoring becomes retrospective, and if the execution is held, then monitoring latency and uptime are a part of the security contract. Isolation controls may limit damage. So, where is the action gate really placed?
