Committed Before Reasoning: Behavioral Reproduction and Preliminary Activation-Level Evidence of Answer Pre-Commitment in an Open-Weight LLM

# Behavioral Reproduction and Preliminary Activation-Level Evidence of Answer Pre-Commitment in an Open-Weight LLM
Source: [https://arxiv.org/html/2607.16451](https://arxiv.org/html/2607.16451)
\(July 2026\)

###### Abstract

Chat models sometimes commit to an answer and then produce reasoning that justifies the commitment rather than deriving it — even when the committed answer contradicts a premise of the task\. We study a minimal probe of this failure: “I want to wash my car\. The car wash is 100 meters away\. Should I walk or drive?” The only correct answer is*drive*, because the car must be present at the car wash; models overwhelmingly recommend walking\. We make three contributions\.\(1\) Behavioral reproduction\.On Qwen3\-8B, across five system\-prompt conditions \(210 rollouts\), the wrong commitment occurs in 85–100% of sampled rollouts per condition and in 100% of greedy rollouts, in both thinking and non\-thinking modes; extended chain\-of\-thought does not repair it \(walk\-rate 85–100% with a 4,096\-token thinking budget\)\.\(2\) Preliminary activation\-level evidence\.Using a pretrained,*training\-free*activation oracle \(no task\-specific probe training\), we probe hidden states at positions*before*the answer text is emitted\. Oracle read\-outs of “walk” at pre\-commit positions exceed a neutral\-context baseline \(68% vs\. 17%; walk\-committing rolloutsp=\.005p=\.005, drive\-committing rolloutsp=\.005p=\.005, Fisher exact\) — and, notably, rollouts that eventually answer*drive*also read as walk\-leaning before commitment \(5/6\)\. Because the oracle’s default answer on unrelated content is “drive” \(83%\), these walk read\-outs are not explained by lexical bias; a lexical stratification further shows they are not text recovery — spans containing “drive” still read out walk, and in balanced lexical fields naming both options, per\-rollout walk\-majorities dominate a per\-prompt neutral baseline \(15/22 vs\. 1/8,p=\.01p=\.01; drive\-committing rollouts 6/6,p=\.002p=\.002\)\. Sample sizes are small and the within\-rollout positional gradient is not significant \(p=\.34p=\.34\); we frame these results as preliminary\.\(3\) Methodological\.The same oracle, activations, and positions succeed or fail depending almost entirely on question wording: an open question \(“What answer is this model going to give?”\) fails a positive control \(2/16\) that a closed alternative \(“Is the model going to say walk or drive?”\) passes \(11/16\)\. Current activation oracles are usable, but brittle in ways that standard practice does not yet document\.

## 1Introduction

A model that answers before it reasons is not merely being terse\. When the answer is fixed first, subsequent reasoning tends to be*advocacy*— locally coherent argumentation for the fixed answer — rather than derivation\. The failure is invisible exactly when it matters: the reasoning reads as diligent, and only a premise\-level check exposes that the conclusion was never derived from it\.

We study a deliberately minimal instance\. The car\-wash question \(“The car wash is 100 meters away\. Should I walk or drive?”\) has a single premise that decides it:*the car must be at the car wash for the car to be washed*\. Walking optimizes a nearby but wrong objective \(short trips are better on foot\)\. The question was originally observed to elicit confident “walk” answers, followed by fluent justification, from Claude Sonnet 4\.5 \(claude\-sonnet\-4\-5\-20250929\); this paper asks \(i\) whether the phenomenon reproduces on an open\-weight model at measurable rates, and \(ii\) whether a*training\-free*activation oracle can read the commitment before the answer text appears\. The second question is deliberately narrow: a fast\-growing line of work has now established, with supervised linear probes, that answers are often encoded in activations before reasoning text is generated\(Cox et al\.,[2026](https://arxiv.org/html/2607.16451#bib.bib5); Boppana et al\.,[2026](https://arxiv.org/html/2607.16451#bib.bib2); Mirtaheri and Belkin,[2026](https://arxiv.org/html/2607.16451#bib.bib9); Scalena et al\.,[2026](https://arxiv.org/html/2607.16451#bib.bib11)\)\. What remains open is whether training\-free natural\-language read\-out — which prior work found unreliable on safety\-relevant tasks — can see the same thing, and whether it holds in a setting where the commitment is self\-generated by surface heuristics rather than induced by a hint\.

Our direction is the reverse of hint\-injection studies of unfaithful chain\-of\-thought \(e\.g\., attribution\-graph analyses in which a planted answer bends the reasoning\): there, reasoning is corrupted toward a given answer; here, the reasoning is often*sound in isolation*— the model enumerates factors, weighs them, sometimes even touches the critical premise — and the answer ignores it\. Qualitatively \(Section[2\.4](https://arxiv.org/html/2607.16451#S2.SS4)\), the model walks up to the door \(“if the car is already parked near the car wash, maybe…”\) and does not open it\.

## 2Behavioral study

### 2\.1Setup

#### Model and decoding\.

Qwen3\-8B\(Yang et al\.,[2025](https://arxiv.org/html/2607.16451#bib.bib13)\), run locally on Apple silicon \(MPS\) in bf16 — the 8\-bit path used by the oracle reference setup is CUDA\-only \(bitsandbytes\), and bf16 is the standard full\-quality precision that fits the model in unified memory\. Two decoding settings per condition and thinking mode: greedy \(deterministic; one rollout as a reference point\) and temperature\-0\.7 sampling \(n=20n=20, matching the original experiment’s per\-conditionnn\) to observe the commitment distribution\. Thinking mode toggled via the chat template \(enable\_thinking\)\.

#### Conditions\.

Five system\-prompt conditions taken verbatim from the original experiment:A\_bare\(no system prompt\),B\_role\_only,C\_role\_star\(role \+ mandatory STAR answer structure\),D\_role\_profile\(role \+ user profile stating the car is parked in the driveway\),E\_full\_stack\(B \+ STAR \+ profile\)\. Per condition and thinking mode: 1 greedy \+ 20 sampled rollouts \(210 total\), plus a follow\-up challenge turn \(“How will I get my car washed if I am walking?”\) for recovery analysis\.

#### Scoring\.

The primary metric iscommitted\_wrong: the first recommendation in the speaker’s own voice is*walk*\. We initially scored with a rule\-based \(regex\) scorer, audited it adversarially, and rejected it when it failed a fresh 32\-case holdout \(62\.5% case\-level disagreement with human labels; almost all errors were missed commitments\)\. We replaced it with an LLM judge \(Qwen3\-8B, greedy, rubric prompt, JSON output\), adopted only after passing a pre\-registered gate \(acceptance threshold≥\\geq95%, fixed before scoring\): 96\.9% \(62/64\) agreement with human labels on synthetic audit cases*not used to tune the judge prompt*, with label\-level determinism verified \(8/8 identical on double\-scoring\)\. A stratified manual gate over real rollouts — mandated by the experiment spec at 15–20 cases; we used 20 \(20/20 correct labels, hand\-checked\) — closed the loop\. A secondary construct \(answer\_before\_reasoning\) failed validation \(82\.8%\) and is excluded from all claims\. Appendix[A](https://arxiv.org/html/2607.16451#A1)summarizes the audit trail\.

### 2\.2Results: the wrong commitment is near\-deterministic

Table 1:Wrong\-commitment rates \(judge\_committed\_wrong, sampledn=20n=20per cell; greedy in parentheses\)\.Across all 210 rollouts, committed answers split walk 194 / drive 10 / none 6: 95% of all commitments are wrong\. The failure is not an occasional sampling accident; at temperature 0\.7 it is the modal behavior everywhere, and greedy decoding produces it in 10/10 cells\.

Three structural observations:

1. 1\.Structured\-answer instructions maximize the failure\.C\_role\_star\(mandatory STAR format\) is at 100% in both thinking modes\. A format that forces an early “Action:” slot appears to lock the commitment in\.
2. 2\.Extended thinking does not repair it\.With a 4,096\-token thinking budget \(Section[2\.3](https://arxiv.org/html/2607.16451#S2.SS3)\), thinking\-mode walk rates remain 85–100%\. Thinking contributes∼5\{\\sim\}5percentage points of rescue: 9 of the 10 correct \(drive\) commitments in the dataset occur in thinking mode\.
3. 3\.The profile does not help\.D\_role\_profileexplicitly states the car is parked in the user’s driveway; the wrong\-commitment rate is 85–100% regardless\.

### 2\.3A truncation artifact that almost reversed a conclusion

Our first full run used a 1,024\-token generation budget\. Thinking\-mode rollouts showed apparently lower wrong\-commitment rates \(45–95% across conditions, vs\. 85–100% after the fix\), which would have supported “thinking mitigates the failure\.” Inspection of the 35 null\-commitment thinking rollouts showed 31 were<think\>blocks truncated mid\-thought by the budget — no visible answer existed to score \(the remaining 4 were genuine non\-commitments\)\. After regenerating the entire thinking arm at 4,096 tokens \(0/210 truncated\), the mitigation disappeared\. We report this because aggregate\-only pipelines would have shipped the wrong conclusion; the correction came from reading the raw texts behind an anomalous label cluster\.

### 2\.4Qualitative anatomy of one rollout

In a representativeC\_role\_starthinking rollout, the think block frames the task as a preference choice — enumerating walking speed, weather, and effort — brushes against the decisive fact exactly once \(“if the car is already parked near the car wash, maybe…”\) and moves on without resolving where the car actually is\. The visible answer then fills the STAR template: “Action: Walk to the car wash\.” The reasoning is diligent and internally consistent; it is also premise\-blind: the one question that decides the task \(*how does the car get there?*\) is raised obliquely and never answered\. This is the shape of the phenomenon: not corrupted reasoning, but an answer that reasoning never actually authorized\.

## 3Probing activations before the commitment \(preliminary\)

If the model is committed to “walk” before emitting it, the commitment may be readable from hidden states at positions preceding the answer text\. We test this with a pretrained activation oracle \(LatentQA\-style: an LLM fine\-tuned to answer natural\-language questions about injected activations\(Pan et al\.,[2024](https://arxiv.org/html/2607.16451#bib.bib10)\)\), using the public Qwen3\-8B oracle checkpoint\(Karvonen et al\.,[2025](https://arxiv.org/html/2607.16451#bib.bib4)\)\. Activations are collected by teacher\-forced prefill over the exact generation\-time sequence \(prompt \+ generated text\), at layer 18 of 36 — 50% depth, the oracle checkpoint’s training and demo default\. We did not sweep layers \(see Limitations\); the per\-question positive control below partially de\-risks this for the question we adopt\.

#### Design\.

22 rollouts from the behavioral study\. Walk\-committing: the first four eligible per cell in dataset order, fromA\_bare\(the bare condition\) andC\_role\_star\(the strongest\-failure condition\)×\\timesthinking on/off\. Eligibility = a localizable commitment position: we anchor the position grid on the rejected regex scorer’s commitment span, used only where it agreed with the judge label \(the span supplies a*position*, not a label\), plus the Section[2\.4](https://arxiv.org/html/2607.16451#S2.SS4)exemplar, whose span we hand\-localized\. Drive\-committing: the dataset contains 10; 6 satisfied the same localizability rule \(in the other 4 the regex found no span to anchor on\)\. Selection is deterministic given the data but not random, and the localization rule inherits the regex scorer’s blind spots; with samples this small we treat every statistic in this section as preliminary\. Six probe sites per rollout: assistant start \(P0\), 25/50/75% of the span to the commitment token \(P1–P3\), immediately before the commitment token \(P4\), and a span starting at the commitment token \(P5 = \[commit, \+8 tokens\], positive control\)\. Oracle decoding is greedy throughout\. P0–P4 windows never touch the commitment tokens, so a correct read\-out at those sites cannot come from the answer text itself \(text\-inversion control\)\.

### 3\.1The oracle is extremely sensitive to question wording

Our first three configurations — single\-token probes, 5\-token majority voting, and segment \(multi\-position\) injection — all failed the positive control with the open question “What answer is this model going to give?” \(P5 hit rates 3/16, 3/16, 2/16\)\. The failure was consistent, not noisy: under majority voting, 10/16 rollouts produced 4–5 “no answer” votes out of 5 at P5\. Our pre\-set recovery criterion for the positive control, fixed before the question comparison, was roughly 10/16\.

Holding activations, positions, and injection mode fixed and changing only the question:

Table 2:Positive\-control recovery under question rewording \(segment injection, spans including the emitted commitment tokens\)\.A closed question naming the answer space recovers the positive control that open questions fail\. We conjecture open answer\-prediction is outside the oracle’s LatentQA training distribution while binary classification is close to it\. Practical implication: a negative oracle result cannot be interpreted without a positive control*per question wording*— a constraint we have not seen documented in current oracle practice, and an independent, quantified confirmation that current activation oracles are hard to use off\-distribution\.

### 3\.2Neutral\-context baseline: the oracle’s default is “drive”

Forced\-choice questions make the oracle answer something even on empty evidence, so read\-out rates are only interpretable against the oracle’s intrinsic preference\. On activations from 8 unrelated prompts \(philosophy, arithmetic, recipes, code; 24 probes\), the oracle answers “drive” 19/23 \(83%\) and “walk” 4/23 \(17%\); one probe mentioned both options and is excluded from the decisive\-read\-out denominator\. We pre\-registered interpretation bands before running the control \(40–60% walk share would support genuine signal;≥\\geq70% would indicate walk bias\); the observed 17% fell outside both bands, in the direction opposite the bias concern\. The oracle’s default under this question is*drive*; consequently “walk” read\-outs carry information and “drive” read\-outs are weak evidence\. \(This asymmetry cuts both ways: it strengthens walk read\-outs below, and it means our positive control stands only on the walk side — drive\-committing rollouts’ P5 read\-outs, 3/6, are uninformative\.\)

### 3\.3Pre\-commit read\-outs exceed the baseline — including in rollouts that end up correct

Table 3:Walk read\-out rates at the pre\-commit site P4 \(commitment text not yet emitted\), against the 17% neutral baseline \(Fisher exact, one\-sided\)\.Two readings, stated with their limits:

1. 1\.The wrong commitment is readable before it is written — by a training\-free oracle\.That pre\-CoT answer encoding exists is established with supervised probes\(Cox et al\.,[2026](https://arxiv.org/html/2607.16451#bib.bib5)\); the increment here is that a natural\-language oracle with no task\-specific training reads it too: in walk\-committing rollouts, an oracle whose default answer is “drive” reads “walk” from pre\-commit activations at3\.6×3\.6\\timesthe neutral rate \(one\-sided tests throughout; direction fixed in advance\)\.
2. 2\.Rollouts that eventually answer correctly also start walk\-leaning\.5/6 drive\-committing rollouts read as “walk” at P4\. Since 9/10 drive commitments arise in thinking mode after long deliberation \(Section[2\.2](https://arxiv.org/html/2607.16451#S2.SS2)\), this is consistent with a two\-stage picture:*walk is the default internal state; occasionally, extended reasoning overrides it late\.*The behavioral and activation\-level views agree on where the default points\.

#### What we do not claim\.

The within\-rollout positional gradient \(P0 6/16→\\rightarrowP1 8→\\rightarrowP2 9→\\rightarrowP3 12→\\rightarrowP4 10→\\rightarrowP5 11, walk group\) trends upward but is not significant \(paired sign test P0 vs\. P4: 7 improved / 3 worsened,p=\.34p=\.34\)\. P0 activations already contain the prompt \(the question is visible to the model\), so P0 is not a zero\-information site — elevation*at*P0 relative to neutral is expected and observed \(6/16 vs\. 17%\)\. Withn=16n=16we cannot distinguish “commitment strengthens toward the answer” from “commitment is present throughout at roughly constant readability\.” The drive\-group result rests onn=6n=6and is preliminary by any standard\. Individual\-rollout trajectories are noisy \(the Section[2\.4](https://arxiv.org/html/2607.16451#S2.SS4)rollout reads walk at P2, drive at P4, walk at P5\)\.

### 3\.4Lexical stratification: the read\-outs are not text recovery

The remaining confound is lexical leakage: probe windows sit inside deliberation text that frequently contains the word “walk,” so the oracle might be reading nearby tokens rather than state\. We stratify all 110 pre\-commit probes by whether walk/drive literally occur \(a\) in the injected 5\-token span itself and \(b\) within±\\pm25 tokens of it\.

#### Injected\-span \(strict text\-inversion\) test\.

Walk read\-outs are*not*driven by “walk” tokens in the injected span: spans containing “walk” read out walk at 2/8, spans without it at 64/102 \(63%\)\. Eight probes have injected spans containing “drive”/“driving” and not “walk”; five of them still read out walk \(e\.g\., span “ not need to drive\.”→\\rightarrow“walk”\)\. Recovery of injected token identities cannot explain the results\. \(Word matching uses strict boundaries — “driveway” does not count as “drive\.”\)

#### Context\-field test\.

The±\\pm25\-token lexical field does influence the oracle in single\-word strata: contexts containing only “walk” read out walk 12/13; contexts containing only “drive” lean drive \(3/6\)\. These strata are small because deliberation text is saturated with both words: 89/110 probes \(81%\) have a*balanced*field containing both\. Descriptively, walk read\-outs dominate that stratum 52 vs\. 20 \(a 72% walk share against the oracle’s 17% neutral default\)\. Because probes are clustered within rollouts \(five per rollout\), pooled probe\-level tests overstate independence; our primary inference is therefore cluster\-aware, comparing per\-rollout majorities in the balanced field against per\-prompt majorities in the neutral control \(walk\-majority prompts: 1/8\)\. Walk\-committing rollouts: 9/16 walk\-majorities \(p=\.051p=\.051, marginal\)\. Drive\-committing rollouts:6/6walk\-majorities \(p=\.002p=\.002\)\. Combined: 15/22 \(p=\.010p=\.010\)\. The drive\-group cell remains the sharpest: the lexical field names both options, the oracle’s default is drive, the rollout’s own final answer is drive — and every one of the six rollouts reads walk on majority\. Pure lexical reading predicts none of this\.

We conclude the pre\-commit walk read\-outs cannot be reduced to text recovery, while acknowledging that in single\-word lexical fields oracle answers do track the field, so probes there \(a minority\) are individually uninterpretable\.

## 4Related work

#### CoT faithfulness\.

That stated reasoning need not reflect the causal process behind an answer is established: biasing features silently flip answers while the explanation never mentions them\(Turpin et al\.,[2023](https://arxiv.org/html/2607.16451#bib.bib12)\), intervention tests show models often reach the same answer with corrupted or truncated reasoning\(Lanham et al\.,[2023](https://arxiv.org/html/2607.16451#bib.bib7)\), and reasoning models verbalize hints they demonstrably used only 25–39% of the time\(Chen et al\.,[2025](https://arxiv.org/html/2607.16451#bib.bib3)\)\. Our phenomenon is a complement rather than an instance: in those settings the reasoning is bent toward an externally planted answer, whereas here no hint exists — the reasoning is often locally sound and premise\-aware, and the commitment simply precedes and ignores it\.

#### Mechanistic accounts of answer\-first computation\.

Attribution\-graph analyses show language models plan outputs before emitting them \(e\.g\., selecting a rhyme target before writing the line\) and construct post\-hoc justifications in hint\-driven settings\(Lindsey et al\.,[2025](https://arxiv.org/html/2607.16451#bib.bib8); Ameisen et al\.,[2025](https://arxiv.org/html/2607.16451#bib.bib1)\)\. Those results are single\-forward\-pass circuit analyses on a closed model; we ask the coarser but complementary question of whether a commitment is*readable*from open\-weight activations at pre\-emission positions, using only public tooling\.

#### Pre\-generation probing of decisions\.

A rapidly forming cluster establishes that answers are encoded in activations before reasoning text, using supervised probes\.Cox et al\. \([2026](https://arxiv.org/html/2607.16451#bib.bib5)\)decode the final answer from the residual stream at the last pre\-CoT token \(\>\>0\.9 AUC on most tasks\), show the direction is causal via steering \(flipping answers in over half of cases\), and taxonomize the induced failures as non\-entailment vs\. confabulation\.Boppana et al\. \([2026](https://arxiv.org/html/2607.16451#bib.bib2)\)show the final answer is decodable far earlier in the CoT than a monitor can tell, and exploit it for probe\-guided early exit;Scalena et al\. \([2026](https://arxiv.org/html/2607.16451#bib.bib11)\)locate a sharp*commitment boundary*inside reasoning chains after which further steps are epiphenomenal\.Mirtaheri and Belkin \([2026](https://arxiv.org/html/2607.16451#bib.bib9)\)detect hint\-induced*motivated reasoning*from pre\-generation representations, matching or beating full\-CoT monitors;Esakkiraja et al\. \([2026](https://arxiv.org/html/2607.16451#bib.bib6)\)decode tool\-calling decisions pre\-generation and flip them by steering\. We treat pre\-generation answer encoding as established by this literature and do not claim it as a contribution\. Our increment is orthogonal on three axes: \(a\) the read\-out tool is a*training\-free*natural\-language oracle rather than a supervised probe — which is what exposes the question\-wording brittleness of Section[3\.1](https://arxiv.org/html/2607.16451#S3.SS1), a failure mode supervised probes cannot have; \(b\) the commitment is self\-generated by the task’s surface heuristics rather than induced by a hint, and reasoning that touches the decisive premise still fails to override it; \(c\) we measure the behavioral failure rate jointly with the internal signal\. Triangulated withKarvonen et al\. \([2025](https://arxiv.org/html/2607.16451#bib.bib4)\)’ report of substantial task variance in oracle performance, the picture is: supervised probes read pre\-CoT commitments well; training\-free oracles mostly do not — unless, as Section[3\.1](https://arxiv.org/html/2607.16451#S3.SS1)shows, the question is asked in\-distribution\.

#### Activation\-to\-language decoders\.

LatentQA fine\-tunes an LLM to answer natural\-language questions about injected activations\(Pan et al\.,[2024](https://arxiv.org/html/2607.16451#bib.bib10)\); Activation Oracles extend this to general\-purpose activation explainers trained across diverse tasks and released for several open models\(Karvonen et al\.,[2025](https://arxiv.org/html/2607.16451#bib.bib4)\)\. Karvonen et al\. report substantial variance across downstream tasks and note calibration limitations; our question\-wording result \(Section[3\.1](https://arxiv.org/html/2607.16451#S3.SS1)\) is a quantified instance of that usability gap, and our stratified controls \(Sections[3\.2](https://arxiv.org/html/2607.16451#S3.SS2)–[3\.4](https://arxiv.org/html/2607.16451#S3.SS4)\) are, to our knowledge, the first text\-inversion analysis of these oracles on an answer\-commitment task\.

## 5Limitations

- •Single model, single task\.One 8B open\-weight model, one question\. The original phenomenon was observed on a much larger closed model; we show transfer of the behavior, not universality\.
- •Judge and target share a base model\.The LLM judge is Qwen3\-8B scoring Qwen3\-8B rollouts\. The 96\.9% human\-agreement gate and 20/20 manual check mitigate this; raw texts are preserved so any external judge can re\-score\.
- •Probing sample sizes and clustering\.n=16/6n=16/6rollouts; the positional gradient is non\-significant; drive\-side positive control unavailable \(oracle default\)\. Probes are clustered within rollouts, so pooled probe\-level tests are descriptive only and inference is cluster\-aware \(Section[3\.4](https://arxiv.org/html/2607.16451#S3.SS4)\); the walk\-group balanced\-field test is only marginal \(p=\.051p=\.051\) at rollout level\. All Section 3 claims are labeled preliminary\.
- •Single probe layer\.All probes use the oracle’s default layer \(50% depth\)\. A layer sweep was planned but not run; results may differ at other depths\.
- •Non\-random rollout selection\.Section 3 rollouts were selected deterministically \(first\-kkeligible per cell\) under a localizability rule that inherits the rejected regex scorer’s blind spots; 4 of 10 drive\-committing rollouts were excluded by it\.
- •Teacher\-forced prefill\.Probed activations come from re\-encoding the generated sequence, which matches generation\-time computation for the same prefix under causal attention, but small tokenizer boundary effects at the prompt/generation seam are possible\.
- •Local lexical context\.Addressed directly in Section[3\.4](https://arxiv.org/html/2607.16451#S3.SS4): injected\-span text\-inversion is refuted, and the dominant balanced\-field stratum favors walk against both the oracle default and a lexical tie\. Residual caveat: in single\-word lexical fields the oracle tracks the field, so individual probes in those \(minority\) strata remain uninterpretable, and±\\pm25 tokens is one operationalization of “local” among several\.

## 6Discussion

The behavioral result is sturdy: on this task, a competent open\-weight model commits to a premise\-violating answer at 85–100% rates that survive sampling, prompt variation, an explicit contradicting profile, and a 4,096\-token thinking budget — and structured\-answer formats push it to the ceiling \(C\_role\_star: 100% in both modes\)\. The activation\-level result, while preliminary, points the same way: the default internal state reads as “walk” before any answer is written, even in the rare rollouts that end up correct\. The supervised\-probe literature has already established that “answer\-first” is a readable internal condition\(Cox et al\.,[2026](https://arxiv.org/html/2607.16451#bib.bib5); Boppana et al\.,[2026](https://arxiv.org/html/2607.16451#bib.bib2); Scalena et al\.,[2026](https://arxiv.org/html/2607.16451#bib.bib11)\), and that detection there can precede and outperform reasoning monitors\(Mirtaheri and Belkin,[2026](https://arxiv.org/html/2607.16451#bib.bib9)\)— supporting pre\-commitment detection, rather than post\-hoc reasoning audits, as the intervention point\. Our contribution to that picture is narrower: the condition is readable even without training a probe, in a hint\-free setting, if and only if the oracle is questioned in\-distribution\.

The methodological finding stands on its own: with a fixed oracle and fixed activations, question wording alone moved a positive control from 2/16 to 11/16\. Negative oracle results without per\-wording positive controls are uninterpretable, and current oracles’ usable surface is narrower than their interface suggests\.

## Appendix AScorer audit trail \(summary\)

Regex scorer: 6 general\-rule fixes after a 32\-case adversarial audit; fresh 4\-lens 32\-case holdout→\\rightarrow62\.5% case mismatch \(1 false positive, 43/44 field errors were missed commitments\)→\\rightarrowrejected under a pre\-registered\>\>15% threshold\. LLM judge: rubric frozen before validation; 62/64 on combined audit sets; the two disagreements are pre\-flagged label\-ambiguous classes \(implied commitment under negation; conditional dual recommendation\)\. Determinism: 8/8 identical labels on repeated greedy scoring \(MPS\)\. Manual gate: stratified 20 rollouts \(all conditions, both thinking modes, truncation cases included\), 20/20 judge labels confirmed by hand\.

## Appendix BReproducibility

All rollouts, judge outputs, probe responses, and scripts are committed: behavioral harness \(stage1\_qwen\_carwash\.py, resume\-capable\), judge \(judge\_rollouts\.py,\-\-validategate\), AO pipeline \(stage2\_ao\_\{experiment,window,segment,qab,neutral\}\.pyplusstage2\_lexical\_strata\.py, vendored demo library with a 4\-line transformers\-compat patch\), and every statistic in the text as data\-plus\-code \(compute\_statistics\.py→\\rightarrowstage2\_results/statistics\.json\)\. Hardware: single Apple M\-series machine \(MPS, bf16\); no CUDA, quantization, or cloud GPU required\.

## References

- Ameisen et al\. \(2025\)Ameisen, E\., Lindsey, J\., Pearce, A\., et al\. \(2025\)\.*Circuit Tracing: Revealing Computational Graphs in Language Models\.*Transformer Circuits Thread\.[https://transformer\-circuits\.pub/2025/attribution\-graphs/methods\.html](https://transformer-circuits.pub/2025/attribution-graphs/methods.html)
- Boppana et al\. \(2026\)Boppana, S\., Ma, A\., Loeffler, M\., Sarfati, R\., Bigelow, E\., Geiger, A\., Lewis, O\., Merullo, J\. \(2026\)\.*Reasoning Theater: Disentangling Model Beliefs from Chain\-of\-Thought\.*arXiv:2603\.05488\.
- Chen et al\. \(2025\)Chen, Y\., Benton, J\., Radhakrishnan, A\., Uesato, J\., Denison, C\., et al\. \(2025\)\.*Reasoning Models Don’t Always Say What They Think\.*arXiv:2505\.05410\.
- Karvonen et al\. \(2025\)Karvonen, A\., Chua, J\., Dumas, C\., Fraser\-Taliente, K\., Kantamneni, S\., Minder, J\., Ong, E\., Sen Sharma, A\., Wen, D\., Evans, O\., Marks, S\. \(2025\)\.*Activation Oracles: Training and Evaluating LLMs as General\-Purpose Activation Explainers\.*arXiv:2512\.15674\.
- Cox et al\. \(2026\)Cox, K\., Kianersi, D\., Garriga\-Alonso, A\. \(2026\)\.*Decoding Answers Before Chain\-of\-Thought: Evidence from Pre\-CoT Probes and Activation Steering\.*arXiv:2603\.01437\.
- Esakkiraja et al\. \(2026\)Esakkiraja, E\., Rajeswar, S\., Akhiyarov, D\., Venkatesaramani, R\. \(2026\)\.*Therefore I am\. I Think\.*arXiv:2604\.01202\.
- Lanham et al\. \(2023\)Lanham, T\., Chen, A\., Radhakrishnan, A\., et al\. \(2023\)\.*Measuring Faithfulness in Chain\-of\-Thought Reasoning\.*arXiv:2307\.13702\.
- Lindsey et al\. \(2025\)Lindsey, J\., Gurnee, W\., Ameisen, E\., et al\. \(2025\)\.*On the Biology of a Large Language Model\.*Transformer Circuits Thread\.[https://transformer\-circuits\.pub/2025/attribution\-graphs/biology\.html](https://transformer-circuits.pub/2025/attribution-graphs/biology.html)
- Mirtaheri and Belkin \(2026\)Mirtaheri, P\., Belkin, M\. \(2026\)\.*Catching rationalization in the act: detecting motivated reasoning before and after CoT via activation probing\.*arXiv:2603\.17199\.
- Pan et al\. \(2024\)Pan, A\., Chen, L\., Steinhardt, J\. \(2024\)\.*LatentQA: Teaching LLMs to Decode Activations Into Natural Language\.*arXiv:2412\.08686\.
- Scalena et al\. \(2026\)Scalena, D\., Candussio, S\., Bortolussi, L\., Fersini, E\., Nissim, M\., Sarti, G\. \(2026\)\.*Beyond the Commitment Boundary: Probing Epiphenomenal Chain\-of\-Thought in Large Reasoning Models\.*arXiv:2606\.13603\.
- Turpin et al\. \(2023\)Turpin, M\., Michael, J\., Perez, E\., Bowman, S\. R\. \(2023\)\.*Language Models Don’t Always Say What They Think: Unfaithful Explanations in Chain\-of\-Thought Prompting\.*arXiv:2305\.04388\.
- Yang et al\. \(2025\)Yang, A\., Li, A\., Yang, B\., et al\. \(2025\)\.*Qwen3 Technical Report\.*arXiv:2505\.09388\.