Researchers found that thinking tokens in advanced reasoning models do not improve safety as widely believed. The model's refusal or compliance decision is determined within the first token's representation before visible thinking occurs, suggesting safety behavior is largely predetermined rather than genuinely deliberative.
A fundamental assumption about reasoning models—that thinking tokens provide a safe space for deliberation on safety issues—appears largely incorrect based on new research across multiple frontier models. The study reveals that refusal and compliance decisions are statistically predictable from the first token's hidden state with 84-95% accuracy before any extended thinking occurs. This finding challenges the narrative that has driven significant investment in reasoning model architectures. The research demonstrates that visible thinking tokens function more like prefix completion than genuine deliberation, with final outcomes rarely changing after the first 20% of thinking, despite appearing thoughtful at the text level. The implications extend beyond academic interest into practical AI safety deployment. Current safety interventions, including inference-time techniques and training-based approaches, tend to shift models toward excessive refusal rather than inducing authentic deliberation. This suggests developers have been optimizing for the appearance of safety consideration rather than genuine reasoning about ethical constraints. The findings indicate that the safety benefits attributed to chain-of-thought and thinking tokens may be illusory, reflecting statistical memorization of response patterns rather than model-level reasoning improvements. For organizations building reasoning systems, this work signals that additional architectural approaches are necessary to achieve true safety deliberation rather than relying on token manipulation alone.
- →Safety decisions in reasoning models are predictable from first-token representations before visible thinking occurs
- →Thinking tokens function as prefix completion rather than deliberative revision, with outcomes locked early
- →Existing safety interventions suppress deliberation signals while driving excessive refusal behavior
- →The appearance of deliberation in model outputs may mask predetermined safety decisions
- →New methods are needed to induce genuine safety deliberation beyond current token-based approaches