The BaseResearcharXiv
Monitoring latent reasoning in looped language models
Researchers at Samsung AI Center, Warsaw, apply five tests of internal states to eight open 'looped' language models, which reuse one block of layers. They report that six of the eight fix most answer tokens on the first pass, that extra loops can hurt, and that random noise breaks one design ('carry' loops) but not the other.
Why it matters
The same thing, for different readers.
For lawmakers
Reasoning that is never written down escapes chain-of-thought monitoring. This study reads looped models' internals, but only small open ones, so what oversight can rely on is untested.
For researchers
One protocol across eight looped models: answers settle early, extra loops can lower accuracy, heads keep their roles, and noise robustness depends on whether the prompt is re-supplied each loop.
In their own words
Every quotation was found, word for word, in the text we saved from the source. That shows the words are there; it does not make them true, or prove the speaker meant them as quoted.
From the source’s own text.
“Averaged over the four generative sets, 76-89% of answer tokens are decided at the first iteration in Ouro, Parcae, and Rec-OLMo, and 90% are decided by iteration 2-3 on most sets (iteration 5 at the latest).”
Found word for word in the source
“More iterations are not always better. Base Ouro predicts the prompt best at iteration 3-4, and gets worse thereafter. The reasoning-tuned Ouro-Thinking models are best at iteration 1 and get worse with every iteration. Only Huginn improves steadily”
Found word for word in the source
“Noise four times the norm of the entry state reduces every carry model to broken or unrelated text. On the other hand, noise fifty times the norm leaves re-read models largely unaffected”
Found word for word in the source
“Of its 73 flipped answers … only 12 follow the harmful request, 24 answer a harmless misread version (one word swapped), and 25 open a reasoning trace that never answers.”
Found word for word in the source
“We use isotropic Gaussian noise as a simple, unstructured perturbation to investigate how the loop responds to changes in its hidden state, independently of its semantic content.”
Found word for word in the source
How the finding was reached
In our words, from the source. Weigh the finding by how it was made.
- What was done
- An inspection protocol of five 'lenses' applied to eight open looped language models from four families, of small size (named sizes 1.3 to 3.5 billion parameters): Ouro (1.4B and 2.6B, each with a 'Thinking' variant) and LoopUS-1.7B, which pass the prompt in once ('carry' loops), and Parcae-1.3B, Huginn-0125 (3.5B) and Rec-OLMo, which re-supply it at every iteration ('re-read' loops). The authors record hidden states, attention, outputs and halting gates at every iteration, on up to 300 prompts per set (MATH, GSM8K, arithmetic, harmful and benign requests, HotpotQA). The fifth lens adds random Gaussian noise to the starting state, at several sizes relative to that state, on 100 prompts per set (AdvBench, CValues, WildChat subsets, TriviaQA, MMLU) and labels answers as refusal, broken or on-topic with keyword and repetition rules; the text also says GPT-5.6 Sol judged every answer. Greedy decoding only.
- What it found
- In six of the eight models, 76% to 89% of answer tokens are fixed at the first iteration, and 90% by iteration 2 to 3 on most sets; Huginn decides gradually (33% at iteration 1). More loops did not always help at reading the prompt: base Ouro was best at iteration 3 to 4 (it was trained for 4) and worsened after, Ouro-Thinking was best at iteration 1 and worsened each loop, and Huginn improved from 0.454 to 0.620 accuracy and never degraded afterwards. No model's attention heads switched roles between iterations. With noise equal to four times the size of the starting state every carry loop produced broken or unrelated text, while re-read loops kept their rates of broken, fluent and refusal answers even at fifty times, though their answers changed (word overlap with the clean answer 0.39 to 0.77). At twice the size, carry-loop answers began to misread requests: Ouro-1.4B refused 25% of safety requests instead of 73%, and of 73 answers that stopped refusing, 12 did what was asked (4.0% of 300 safety prompts), 24 answered a harmless misread request and 25 opened a reasoning trace that never answered. The authors summarise that noise rarely produced harmful answers, at most 4% of safety answers.
- What it does not show
- The authors state that models were run at their trained number of loops except Huginn at 16 (trained mean 32) and Ouro at 6 (trained for 4); that no early-stopping or shortened-loop runs were made, so cutting a loop short is untested; and that the keyword and repetition rules used to label answers can be fooled (for example a story character saying 'I'm sorry' counts as a refusal). By design, only eight small open models were studied, with greedy decoding and random Gaussian noise rather than a crafted attack, which the authors call a stress test; nothing here shows how larger or closed models behave.
- Status
- A preprint: not yet peer reviewed
The record
- Questions
- Can AI systems act beyond what people intended or allowed? · Are AI companies putting stronger safeguards into practice?
- People
- Paweł Olszowiec (Wrote it, Samsung AI Center, Warsaw, Poland) · Paulina Tomaszewska (Wrote it, Samsung AI Center, Warsaw, Poland) · Maciej Żelaszczyk (Wrote it, Samsung AI Center, Warsaw, Poland) · Michal Byra (Wrote it, Samsung AI Center, Warsaw, Poland) · Neo Christopher Chung (Wrote it, Samsung AI Center, Warsaw, Poland; IFTR, Polish Academy of Sciences, Warsaw, Poland; University of Warsaw, Poland)
- What we read
- We read the whole source.
- Found by
- The Radar, run of October 14, 2026, via
arxiv-ai-safety-query(tier 1: the source’s own channel or an official record) - Cite this
- arXiv, “Monitoring latent reasoning in looped language models”, October 13, 2026. Entry in the Ctrl AI Base, https://ctrlai.com/base/arxiv-2026-10-13-monitoring-latent-reasoning-looped-models
Our notesPreprint, not peer reviewed (arXiv v1, 13 Oct 2026). Full text read from the arXiv HTML version, not the PDF, so no lost-ligature problem. Quotes are co-authored paper text; speaker set to the first author per the run rule. Check: the Lens 5 text says GPT-5.6 Sol judged every answer, while the Limitations section and Appendix B define the refusal, broken and on-topic labels by keyword and repetition rules; the paper does not say which produced the reported shares. Ouro-1.4B's refusal rate at twice the noise size is 25% in Section 4.5 and 24% in Appendix G. 'Monitoring' in the title means reading the model's states iteration by iteration; the paper does not test a safety monitor. The paper's own list of findings says noise 'rarely jailbreaks' (at most 4% of safety answers); that matches the largest share in Table 11 (Ouro-1.4B at twice the size: 12 of 300 safety prompts, 4.0%), but the paper does not say how harmful answers were identified. Neo Christopher Chung's second affiliation line runs two institutions together; shown as given. The text does not name the developers of Ouro, LoopUS, Huginn, Rec-OLMo or Parcae, so no developer orgs are listed.