Do Thinking Tokens Help with Safety?

2026-06-23

AI Summary

This study investigates whether "thought tokens" in reasoning models genuinely facilitate safe and deliberative reasoning. By training prediction heads on the initial token’s hidden states across multiple state-of-the-art open-source models—including GPT-OSS, Qwen, Olmo, and Phi—and evaluating performance using AUROC and balanced accuracy, complemented by textual- and distribution-level dynamics analysis, the authors find that a model’s final behavior can be predicted with high accuracy from the first token alone (AUROC 0.84–0.95). Notably, approximately 74% of purportedly “deliberative” reasoning occurs after the response distribution has already stabilized. These findings suggest that current reasoning processes largely amount to prefix completion rather than substantive safety-oriented revision, and that existing safety interventions may even suppress genuine deliberation signals, indicating that thought tokens do not effectively enhance model safety or deliberation.

Abstract

Today's reasoning models use thinking tokens to attain stronger performance on benchmarks than their instruction-tuned counterparts. It is also generally believed that this more "deliberative" mode should improve alignment and safety, by providing the model a safe space to consider whether its planned answer to a request violates its safety principles. We present evidence that this intuition is not always correct. Across frontier open-weight reasoning models spanning GPT-OSS, Qwen, Olmo, and Phi families, we find that the eventual refusal/compliance outcome is already strongly predictable via a trained head on the first token's hidden representation ($0.84$-$0.95$ AUROC and $\sim88\%$ balanced accuracy for predicting refusal/compliance) before any visible thinking. The thinking process turns out to be more akin to prefix completion than to deliberative revision, with the final outcome rarely changing after the first $\sim20\%$ of thinking, despite giving the appearance of deliberation at the text level ($\sim74\%$ of text-level deliberations occur when the response distribution is already locked to one refusal/compliance side). We also find that existing inference-time and training-based safety interventions, despite being motivated by the goal of inducing deliberation, largely shift model behavior toward over-refusal while suppressing already-scarce deliberation signals. Our results suggest that safety behavior in current reasoning models is much less deliberative than commonly assumed, and highlight the need for methods that induce real safety deliberation.

Problem

• thinking tokens
• safety
• reasoning models
• deliberation
• alignment

Innovation

• thinking tokens
• safety alignment
• deliberation
• refusal prediction
• reasoning models