Are Reasoning LLMs Robust to Interventions on their Chain-of-Thought?
Authors: Alexander von Recum
Leander Girrbach
Zeynep Akata
Venue: ICLR 2026 Poster (2026)
Keywords: large language model
reasoning model
robustness
chain of thought
Primary area: foundation or frontier models, including LLMs
TL;DR: Reasoning LLMs mostly recover from disruptions using doubting mechanisms, but paraphrasing hinders this and recovery raises reasoning cost.

Abstract: Reasoning LLMs (RLLMs) generate step-by-step chains of thought (CoTs) before giving an answer, which improves performance on complex tasks and makes reasoning transparent. But how robust are these reasoning traces to disruptions that occur within them? To address this question, we introduce a controlled evaluation framework that perturbs a model’s own CoT at fixed timesteps. We design seven interventions (benign, neutral, and adversarial) and apply them to multiple open-weight RLLMs across MATH, SCIENCE, and LOGIC tasks. Our results show that RLLMs are generally robust, reliably recovering from diverse perturbations, with robustness improving with model size and degrading when interventions occur early. However, robustness is not style-invariant: paraphrasing suppresses doubt-like expressions and reduces performance, while other interventions trigger doubt and support recovery. Recovery also carries a cost: neutral and adversarial noise can inflate CoT length by more than 200%, whereas paraphrasing shortens traces but harms accuracy. These findings provide new evidence on how RLLMs maintain reasoning integrity, identify doubt as a central recovery mechanism, and highlight trade-offs between robustness and efficiency that future training methods should address.

Published as a conference paper at ICLR 2026
ARE REASONING LLMs ROBUST TO INTERVENTIONS ON THEIR CHAIN-OF- OFANN-OF-THOUGHT?
Alexander von Recum 1.2
Leander Girrbach 1.
Zeynep Akata 1.3
Helmholtz Munich
Ludwig Maximilian University of Munich
Technical University of Munich, Munich Center for Machine Learning (MCML)
ABSTRACT
Reasoning LLMs (RLLMs) generate step-by-step chains of thought (CoTs) be- fore giving an answer, which improves performance on complex tasks and makes reasoning transparent. But how robust are these reasoning traces to disruptions that occur within them? To address this question, we introduce a controlled eval- uation framework that perturbs model's own CoT at fixed timesteps. We design seven interventions (benign, neutral, and adversarial) and apply them to multiple open-weight RLLMs across MATH, SCIENCE, and LOGIC tasks. Our results show that RLLMs are generally robust, reliably recovering from diverse perturbations, with robustness improving with model size and degrading when interventions oc- cur early. However, robustness is not style-invariant: paraphrasing suppresses doubt-like expressions and reduces performance, while other interventions trigger doubt and support recovery. Recovery also carries cost: neutral and adversarial noise can inflate CoT length by more than 200%, whereas paraphrasing shortens traces but harms accuracy. These findings provide new evidence how RLLMs maintain reasoning integrity, identify doubt as a central recovery mechanism, and highlight trade-oft's between robustness and efficiency that future training methods should address.
INTRODUCTION
Large language models (LLMs) have recently gained strong reasoning abilities through test-time scaling, where they "think" before providing a final answer (Wei et al., 2022. Huang & Chang 2023 Yao al. 2023 Zhang et al., 2024b Guo et al. (025). These Reasoning- LLMs (RLLMs) are trained to solve problems using Chain-of-Thour
(CoT) reasoning, which breaks down solutions into intermediate steps (Ti et al. 2024 Paul et al. 2024 Kumar al., 2025c). The resulting traces can increase user trust and enable error diagnosis in human-in-the-loop workflows (Mosqueira-Ree al. 2023). Yet, an open question remains: how robust are these models to perturbations within their own reasoning as it unfolds?
As statistical models, RLLMS can make mistakes hallucinate (Xu et al. 2024 Huang et al. 2025b), and their CoTss can be affected by noisy tool outputs or adversarial injections (Shen 2024 Wang et al. 2024b Zhan et al. 2024] Kumar al. 2025a Shayegani et 2023 Liu al. 2023)
Beyond correctness, the efficiency of reasoning matters: longer CoTs increase cost and latency
(Arora & Zanette 2025 Sui et al. 2025). Understanding whether RLLMS recover from localized disruptions, and at what computational price, is important both scientifically and for deployment.
Therefore, we introduce a controlled framework to probe robustness during reasoning. Starting from correct CoT's produced by several RLLMss, we intervene at fixed timesteps by modifying only the current reasoning step. Our interventions span (i) benign changes that preserve semanties (e.g., para- phrasing, continuation by another model), (ii) neutral noise (random characters, unrelated Wikipedia text), and (iii) adversarial perturbations (incorrect continuation, fabricated fact, unrelated CoT start). After each intervention, the same model resumes its chain, allowing recovery. We evaluate open- weenh RLLMS across three domains (MATH, SCIENCE, LOGIC) using sampling-bar based based robustness metrics that capture success under different strictness levels.
faithfully measure
In summary, our contributions are: (1) We introduce a controlled benchmark that perturbs a model's own chain of thought at fixed timesteps test robustness during reasoning: (2) we design seven inter-

---

Published as a conference paper at ICLR 2026
Ground-truth onswers
Analysis: Robustness Metrics
majority robust
all-robust
at-least-once robust
/ Logic Datasets
Apply
Interventions
Generate CoT
Benign Enterventions: Add step
remiini the
Squiee agat
Fiber results
Flem on berr
Sagment CoT
Sample Cal continuations
Neutral Inder Iraert nandom dhara
Intervention
la di
Adverserial ventionn:
seoriiigggg Hollue natee atop
RLLM Reacrion
1eys
Still correct
arawer
DeopSock
DeepSiekk Owen
Nemorron
Libma 31
DecpBock
DeepGreei
QwQ
DeepSieet
Owcn
EXAONE
Docp
1.50
Piun 540
Figure I: Overview over our evaluation method. We generate CoTs from 9 RLLMs using prompts from NuminaMath and curate subset of 600 suitable prompts that all models answer correctly. Then, we segment the CoT's into reasoning steps and perform various interventions at fixed timesteps in the reasoning chains. We sample continuations from the intervened chains to probe the RLLMs' robustness and analyze whether models still reach the correct answer.
ventions (benign, neutral, and adversarial) and evaluate them across multiple open-weight RLLMs and three domains (MATH, SCIENCE, LOGIC); (3) we analyze recovery mechanisms and uncover the central role of short, local doubt expressions (e.g., "wait", "let me check") in enabling self- correction, alongside consistent non-invariance style under paraphrasing; and (4) we quantify the compute cost of recovery, showing substantial CoT-length inflation under neutral/adverssrial noise (up to 250% in some settings), while paraphrasing shortens traces reduces accuracy.
Together, these results clarify when and how RLLMs maintain reasoning integrity under realistic disruptions, and at what price. They reveal concrete trade-off's between robustness and test-time compute, highlight that stylistic shifts, and not just semantic errors, can impair recovery, and point to actionable training targets: preserving appropriate doubt, improving style robustness, and devel- oping recovery strategies that control token cost in noisy tool-use pipelines.
2 RELATED WORK ON RLLMS AND LLM SELF-CORRECTION
Reasoning LLMs. While the concept of CoT prompting emerged early (Wei et al. 2022 Kojima al. 2022 Wang et al. 2023), define RLLMs as LLMs that post-trained to natively support reasoning. Most prominently, these models are trained using supervised finetuning (SFT) and rein- forcement learning (RI.) techniques such PPO (Schulman al. 2017) and DPO (Rafailov al.) 2023). RLLMS also make use of recent advances in online RI. that greatly improve performance, such as reinforcement learning from verifiable rewards (RLVR) (Shao et al. 20224) Wang al. 2025 Su et al. (2025), process reward models (PRMs) (Setlur et al. 2025 Zhang et al. [024a Cui et al. 2025 Zhhangaangee al. 2025), and actor-critic methods (Le al. 2022: Yuan & Xie 2025 Kumar al.
2025c). In this study, we define RLLMs as LLMs that are either trained directly with online RL to output long-form CoTs or are distilled from another LLM trained using online RL, such as models distilled from DeepSeek-R1 (Guo et al. 2025).
Previous work (Zhou et al., 2024 Singh al. 2024) has shown that con- ventional (non-reasoning) LLMs have limited reliability in reasoning and self-correction. [Huang] ct al. (2024) find models often change correct answers to incorrect ones when self-correcting with- out external hints. Tyen et al. (2024) report LLMs can fix errors if their location is known but struggle to identify the first error in a faulty reasoning chain. Smaller models especially lack ro- bustness to incorrect few-shot examples and problem perturbations (Singh al. 2024 Zhou et al.) 2024 Huang et al. 2025a] Yu et al. 2025), and counterfactual interventions hurt deductive reasoning (Hoppe et al. 2025 However, RI.-based methods show promise: ScoRe (Kumar et al. 2025b) trains
L.M Self-Correction.
2

---

Published as a conference paper at ICLR 2026
multi-turn second-attens -ttempp corrections, improving reasoning tasks, while S (a et al. 2025 uses combined rewards to verify and self-correct, boosting math reasoning accuracy with limited data.
In the context of Chain-of- Thouuhh Zhou al. (2024) construct noisy rationales and provide them as in-context examples to an LLM, showing this can increase errors, but do not modify the LLM's reasoning trace itself. Yang et al. (2025) show that reasoning LLMs struggle recover when the initial part of their CoT is misleading. However, this setup is less realistic and more similar to prompt attacks (Kumar al. 2025a), it does not use the model's own CoT in any way. Therefore, expand on these insights by intervening at various timesteps of the model's own CoT and introducing more diverse interventions. Finally, (Shah al. (2025) use similar interventions measure when in the pretraining process this self-reflection skill is first observed.
To better understand the robustness of the CoTs of reasoning LLMs, we conduct systematic study of their ability to recover from benign, neutral, and adversarial interventions in their reasoning trace. We also evaluate how these interventions affect the length of the CoT measure the cost of er- rors and misleading injections. Our methods establish new standard for benchmarking reasoning robustness and will inform future improvements LLM training.
INTERVENING ON COTS TO EVALUATE ROBUSTNESS
LLMs Can't Find Reasoning Errors. Can RLLMs? Tyen al. 2024) introduce BIG-Bench Mis- take, a benchmark that measures how well models can detect errors in CoTs. The benchmark con- tains five tasks: Dyck Languages, Logical Deduction, Multistep Arithmetic, Tracking Shuffled Ob- jects, and Word Sorting, where the model must identify the location of the first incorrect reasoning step. Conventional (non-reasoning) LLMs perform poorly across all tasks, highlighting their limited ability to monitor their own reasoning. A natural question is whether RLLMs, with their explicitly trained reasoning traces, overcome this limitation. To test this, we evaluate several RLLMs BIG- Bench Mistake. Results are shown in Table [ (full results in Appendix A.3). RLLMs outperform non-reasoning models of comparable and even larger size, and they approach saturation on some tasks. These findings suggest that RLLMs have developed emerging metacognitive capabilities like self-reflection and self-correction, allowing them identify and reason about their own errors.
Model
Dyck Logical Ded. Multistep Arith.
Track Shuffled Obj.
Word Sorting
Phi-4-reasoning plus (14B)
56.5
65.6
91.4
92.0
59,2
QwQ-32B
66.7
66.9
90.3
94.6
53.2
R1-Distill- Qaeen--wenn32
42.4
31.4
89.4
86.3
30.7
Dl-DDisiil--Llmma- 70B
35.8
25.0
78.3
86.8
29.2
Swen3-30B-A3BBThinnke
38.1
76.8
76.4
83.8
50.8
Qwen3-30B-A3B-
15.2
57.2
76.0
82.9
2.8
GPT-4
17.1
40.7
44.0
62.3
35.0
gpt-oss-1200 120b
73.5
78.3
90.7
92.0
50.7
o3
88.7
82.7
91.0
92.0
64.3
Table 1: BIG-Bench-Ae Be-BBnnhh-Mistake error-localization accuracies (in %). RLLMs substantially outperform the non-reasoning GPT-4 baseline.
A New Benchmark for Reasoning Robustness. Inspired by these findings, the natural question arises: What the extent of these improved self-correction and self-reflectinn capabilities as the model is "thinking", and how robust are they? Therefore, different to the BIG-Bench Mistake benchmark, we evaluate not only the ability to locate errors but also the ability self-correct during the reasoning process. To simulate different reasoning errors, we design a new benchmark with seven interventions that we apply to the Chains of Thought (CoTs) to probe the robustness and self- correction capabilities of RLLMs. These interventions are either benign (not intended to deliberately harm the reasoning process), neutral (similar to injecting random noise), or adversarial (deliberately trying to undermine the model's s ability to solve the given problem). To create an evaluation set, collect reasoning chains from all models in this study, apply these interventions, and then sample continuations from the model that originally generated the reasoning chain.
3

---

Published as a conference paper at ICLR 2026
Category
Intervention Description
LLM-based
Continuation with other model: complete one reasoning step.
Benign
Paraphrasing reasoning: rephrase the chain of thought.
Random character insertion at arbitrary positions step RR-
X
Neutral
Wikipedia text insertion: add unrelated factual content.
x
Incorrect reasoning continuation: add wrong reasoning step,
Adversarial
Hallucinated fact: insert false mathematical fact. Unrelated CoT: insert the start of unrelated chain of thought.
Table Interventions in our experiments, categorized by their expected impact on model reasoning.
3.1 DESIGNING INTERVENTIONS TO PROBE RLLM ROBUSTNESS
We design seven interventions to probe the robustness of reasoning LLMs (RLLMs) to perturbations of their COT. Interventions are grouped into three categories: benign, neutral, and adversarial. An overview is given in Table [ with illustrative examples in Table Prompts used to generate LLM- based interventions are Appendix D.I. and generation hyperparameters are in Appendix [.6] Therefore, 4 interventions of ours take into account the context of the previous trace, while 3 inter- ventions (all neutral interventions and "Unrelated CoT"") do not. All interventions based on trace context use Qwen-2.5-32B Instrrctt to generate the interventions.
Benign interventions preserve correctness of reasoning but alter its form, allowing us to study how sensitive RLLMs are to harmless variations. We consider: (I) Continuation with another model: we add one reasoning step produced by a different, non-reasoning LLM. This tests whether RLLMs remain consistent when continuing from reasoning written in a potentially different style. (2) Para- phrasing reasoning: we use an LLM to rewrite the entire chain (RI,... Rs.) while preserving its content. This tests robustness to changes in wording and structure. To validate semantic preserva- tion, we manually compared 100 paraphrased CoTss against their original COT.
Neutral interventions introduce irrelevant information into the COT. They allow measure how well RLLMS can filter noise, whether incoherent or coherent. We apply: (1) Random character insertion: randomly selected characters are inserted into step R& until they constitute one-third of its total length, rendering it unreadable. (2) Wikipedia text insertion: we replace R3 with randomly chosen paragraph from subset of English Wikipedia.
Adversarial interventions aim to mislead the model by introducing structured errors or distractions. We design: (1) Incorrect reasoning continuation: an LLM generates a faulty reasoning step (e.g., incorrect arithmetic or flawed logic) appended to the chain. (2) Hallucinated fact: we insert fabricated mathematical statement that, adopted, will propagate errors and bias the final answer. (3) Unrelated CoT: we replace R& with the opening of a reasoning chain on unrelated topic. These openings mimic typical CoT phrasing (e.g., "Okay, so need to explain... ") but continue with random topic drawn from list of 100 candidates (Appendix) D.5
3.2 PROMPT AND CHAIN-OF- THOUGHT COLLECTION
Prompts. We collect prompts from three domains to ensure valid evaluation: MATH, SCIENCE, and LOGIC. For MATH, we use the olympiads subset of NuminaMath eLi al. 2024), which contains 150,581 competition problems. We filter to 2,360 problems with numerically parsable an- swers, retaining only those where the reference answer can be parsed as a moating-point number or integer. We then restrict to problems that DeepSeek-RI IB solved correctly, using traces from GENERALTHOUGHTSS (General Reasoning 2025). Next, we generate answers with all evaluated models, using each model's recommended hyperparameters (Appendix D.6). From these, lect 600 problems that all models solved correctly. This ensures that robustness is tested only on problems within the models' capabilities, so that observed errors arise only from interventions.
However, the 20 most common answers account for 52.78% of responses. Because of this skewed distribution, we downsample by keeping at most 20 problems per unique answer. This reduces the
4

---

Published as a conference paper at ICLR 2026
Original CoTT Start
Paraphrasing CoTI
Continuation
Wikipedia Text
Randorn Character
Okay, noad soloe this problem where two digit manber, when you pat a in front it to make
To wolve this prohlem. I Foou to find two digit number such dost when the digit Sis placed in front of to form three dight number. the new oumiber 12 les than nine times original digrt number. Let's approach this step by step.
repecsent threo- digit zumber foemed plac ing 5 in frost the ociginal rea-digit number as 500 + 10n + where 10u e is the org- inal two digit number.
The Feierll poveement'
wrfineT Finjs eTGong
power end slavery liuitd by the Coniitrion which before 1865 was underitood to reserve the issse io...
sdgiCHi Iuganbda9) ipan
belpexomfrres Ba mihocree-
three digit number, is 12 less than sine tinas the migital nimber. (lmm, let treak this down step step.
d'igölit jnulompheefr....
First let denste
Wrong Continuation
Hallucinated Fact
Unrelated CoT
original reo-digit sometting Since
original diglt number as Since
place digit number.
know when you
Okay, need consider the various ways
rondiigi mumber can repeesent as lil++ + where "a' is the lass digit and "to is the mis dight But moghe there's a simpler way think
IV is tee-digi numbeer
fromt thrcodligi mumber formed is the original number. which is 12 lees than times the original number.
ply any dight number by 9. the scault always
be inad verienlly intodured into no- chine learning models through skewed daises or algoritimic deeisione.
can be expeessed as 10o + b,
whece and & ue the tass and
than appending the digit in Iroat it.
units digits, respectivell. However, for simplicity, we can dinsally use N our calculatins.
about it without breaking it into digits Let me soe.
Table 3: Examples of all 7 interventions used in this study. (Left) The original CoT start until segmentation at = 30. (Right) Interventions colored by type, i.e. green are benign interventions, blue neutral ones, and red adversarial interventions.
chance of models succeeding by guessing frequent answers. We also discard traces missing a closing </think> tag and remove the top 2% longest traces.
For SCIENCE, we use SciBench (Wang et al. 2024a) and JEEBench (Arora et al. 2023). For LOGIC, we use challenging BigBench- Hard subsets (Suzgun et al. 2023). including Causal Judgement, Dyck Languages, Logical Deduction with 7 Objects, Tracking Shuffled Objects, and Formal Fallacies. In both cases, we keep only the intersection of problems solved correctly by all models, yielding 231 SCIENCE and 326 LOGIC problems.
Segmentation. To apply interventions at controlled points in reasoning, we segment CoTs into steps. Following the common convention that RLLMS separate steps with two newline characters, we split each reasoning trace R into R = R1, R2,.... Rn. We define the timestep I of step R; as the fraction of cumulative character length up to R2 relative to the full chain length:
t Z
Ryl. where Z ==
Σ Ryl
(1)
We set target timesteps T = 0.1, 0.3, 0.5, 0.7, 0.9 and align each to the nearest reasoning step. At timestep I, the chain includes all steps up to Rd where |4, - || is minimized.
Applying interventions. At each selected timestep, we modify the reasoning trace up to R2 and remove subsequent steps. For all interventions except Paraphrasing reasoning, only the last step R& is altered. This isolates the effect of localized modifications at specific stages of reasoning, After intervention, the model resumes reasoning from this point. Importantly, each model continues only from its own original CoT; we do not prompt models with CoTs generated by others.
For each problem, we apply 7 intervention types 5 timesteps, yielding 7 x 5 35 variants of interventions per reasoning chain. With 600 MATH problems, this results in 21,000 intervened chains per model. We sample 8 independent completions per chain, producing 168,000 completions per model. With 9 models, this results in 1.52 million reasoning chains for MATH. SCIENCE and LOGIC contain 231 and 326 problems respectively, to which we apply the same process. This results in 582, and 821,520 intervened reasoning chains respectively, and 2.923 million reasoning chains in total.
3.3 SAMPLING-BASED ROBUSTNESS METRICS
After applying an intervention at a given timestep, we restart the reasoning process and sample N = 8 independent continuations from the model, to see how it reacts to our intervention. Let K denote the number of completions that produce the correct final answer. We define robustness under three criteria: re-least-once-obusss iff K 1, majority- iff K [N/2] + 1, and all-robust iff K = N. These metrics capture robustness at different strictness levels. We focus on majority robustness, metric that provides good indication of how disruptive our interventions are, is
5

---

Published as a conference paper at ICLR 2026
Complete (Berigg)
(Benign)
(Neutral)
1,0
0.8
Insert Random Charadiers (Neutral)
Ctn. Wrong Reasoning (Adv.)
Insert Wrong Fact (Adv.)
08
0.8
0.8
0.8
0.8
0.1
0.5
0.7
0.9
0.1
0.5
0.7
0.9
0.1
0.3
0.5
0.7
Conánuee Unrelated (Adv.)
R1-DislI-L Lame-8 88
R1-Distll- Qwen-328
NemotronLLamasS 1-Nano-88
R1-Diistl-Gwen-1..
R1- RKs-Distll-oe Qwen-7B
Phi-4 Reasening-ngoee
08
R1-DDitil-Qwan-148 4B
EXAONE- EXAGNE-Deep-322 Deep-328
OwQ-32B
0.1
0.5
0.7
0.9
Figure 2: Majority robustness scores for models and interventions across different timesteps. A score of 1.0 indicates for all problems, the model was able to generate correct answer 2 out of 8 times. Models are robust to interventions, and larger models are more robust than smaller models.
less sensitive answers that were wrong due chance in the sampling process, and thus provides a good indication of the genuine disruptiveness of our interventions.
STRENGTHS AND LIMITATIONS OF RLLM ROBUSTNESS TO INTERVENTIONS
We evaluate robustness across a diverse set of open-weight reasoning models, including DEEPSEEK- R1-DISTULI--WWR variants (1.5B, 7B, 14B) and DEFPSEFK R -1-DISTILA-LLAMM--88 (uuo et al. 2025), LLAMA-3. -NEMOTRON-NNNO-EEE
(Bercovich et al. 2025). 1HI-4-REASONNN (Abdin et al. 2025), EXAONE-DEEP- 32B (LG AI Research et al.
and
2025
and QwQ-32B (Qwen Team 2025).
4.1 RLLMS ARE MOSTLY ROBUST TO INTERVENTIONS
Fig. 2 shows majority robustness for all interventions. We find that all RLLMs evaluate generally recover from our interventions, showing near-perfect robustness in most cases. Interventions applied at earlier timesteps tend to have greater impact the correctness of the final answer, and larger models are generally more robust. In every case, the smallest model in our study, DEEPSEEK- RI- DISTILI-QEEN-II 1,5B, shows weakest recovery performance, while other models perform similarly. Some interventions are particularly disruptive to some models, such as "Continue Unrelated" for EXAONE-DEEP-322
"Add Random Text" for QwQ-32B.
When comparing interventions, we observe similar performance across all intervention types, show- ing that RLLMS robust regardless of whether the intervention is benign, neutral, or adversarial. Only Rewrite Truce results in generally lower robustness scores compared to the other interventions. The results for All robustness and Ar-least-once robustness in the supplementary material support our observations: RLLMs successfully recover from all interventions evaluated in this study. As be- fore, Rewrite Trace yields the lowest robustness scores, they are still generally high. Qualitative examples illustrating how models recover from interventions are shown in Table 4 For the Con- tinuation intervention, where we insert correct reasoning step from a different model, the RLLM recognizes the unfamiliar content by outputting "Wait", but then proceeds correctly after realizing the information is accurate. When Wikipedia text is inserted, the RLLM identifies it as unrelated and ignores it. When incorrect mathematical statement is added, the RLLM correctly detects the error and continues with proper reasoning. Finally, when an unrelated CoT is introduced, the RLLM follows it for few steps, then recognizes its irrelevance and recovers.

---

Published as a conference paper at ICLR 2026
Complete (Berign)
(Benign)
(Neutral)
1,0
1.0
0.8
Insert Random Charadtera (Neutral)
Ctn. Wrong Reasoning (Adv.)
Insert Wrong Fact (Adv.)
0.
0.8
0.8
0.8
0.8
0.1
0.5
0.7
0.9
0.1
0.3
0.5
0.7
0.9
0.1
0.3
0.5
0.7
Conánue Unrelated (Adv.)
R1-Disll-- amm-88
R1-Disill- Qwen-328
NemotrnnLLamasS 1-Nano-88
R1-Dietil-Gwnn11.3
R1- Rts-Distil--e Qwen-7B
Phi-4 Rei---Reasoninng-fH
08
R1-Diistl-Qwan-148 4B
EXAONE EXAONE-Deep-328
OwQ-32B
0.1
0.5
0.7
0.9
Figure 3: Per-model majority robustness by intervention on the SCIENCE domain. We observe that models maintain high robustness across all intervention types, with performance patterns largely consistent with those seen in mathematical reasoning, confirming that recovery mechanisms gener- alize beyond mathematics.
To assess whether the recovery mechanisms we observe on mathematical problems extend to other domains, evaluate the same interventions the SCIENCE and LOGIC datasets. Figures B and report per-model majority robustness by intervention. Patterns are similar to those on mathemat- ies: models remain highly robust across intervention types, neutral insertions impose the largest degradation, and style rewrites tend to have smaller but noticeable dips for some models. Across all domains, robustness remains high, with QwQ-32B, 1iii---reannnnn-llee plus, and the larger Distill- Qwen variants staying close to ceiling across interventions. The smallest model exhibits the most degradation, particularly under neutral insertions and adversarial wrong continuations, This robust- ness extends to repeated perturbations: when we apply up to 5 consecutive "Wrong Continuation" interventions with reasoning between each, most models degrade gracefully while the strongest (EXAONE-Deep-32B, QwQ-32B) maintain 999% accuracy (see Appendix
Complete Step (Benign)
Rewrlte Trace (Benign)
Add Random Text (Neutrat)
0.
0.1
0.5
0.7
0.9
0.1
0.3
0.5
0.7
0.9
0.1
0.5
0.5
0.7
Insert Characters (Noutral)
Ctn. Wrong Reasoning (Adv.)
Insert Wrong Fact (Adv.)
1.0
1.0
1.0
0.8
Continus Unrelated (Adv.)
Model
0.8
Ri-Distl-LLama-BB
Hi.-Disil-Qunn--22
Namotron-Llema- 1-Nano-se
R1-DielllOOwr-113.
Phi-4-Ressooning-Fi
0.8
Di-Dii1l--wan-114
EXAONE Deepp-- QwQ-32B
0.1
0.5
0.7
0.9
Figure 4: Per-model majority robustness by intervention the LOGIC domain. Again, observe that models maintain high robustness across all intervention types, with performance patterns largely consistent with those seen in mathematical and scientific reasoning.
4.2 RLLMS ARE NOT STYLE-INVARIANT
The role of doubt in reasoning. Manual inspection of intervened chains reveals that RLLMs often insert expressions of doubt immediately after the intervention point. To test whether this pattern holds systematically, analyze the 20 sentences following each intervention. Each sentence is

---

Published as a conference paper at ICLR 2026
Continuation
Wikipedia Text Inscrtion
Hallucinated Fact
Unrelated CoT
I need to represent the three- digit number formed by placing 5 in front of the original two- digit number as 500 10a where 10a + the original two-digit number.
The Foderal government's power end slavery was lim- ited by the Constitution, which before 1865 was understood to the issue...
know that when multiply any two-digit nomber by 9, the result is always 10 less than ap- pending the digit 5 in front it.
Okny, so I need consider the various ways bias can in- advertently introduced into ma- chine learning models through skowed datasets or algorithmic docisions.
Wait, actually, that's correct be- front would be like udding 500 to the origi- nal number. Sa, if the original number is, say, 23, putting 5 in front would make it 523, which is 500 23. Yeah, that makes
Wait, hold on, that's about slav- cry and the Civil War, but problem is about a two-digit numberr Let refocus.
Wail, no, that's not quite right. The prablemn says that the three- digit number (500 + N) 12 less than 9 times the original number (9*N), So, mathemati- cally, that can be written
For example. facial recog- nition system trained mostly on images of light-skinned in- dividuals,..
putting
Wait, I think went a bit oll tmic there. The original prob- lem was about two-digit num- her..
Table 4: Responses of DISTILL-QWEN- 4 interventions (at 30). Intervention names colored by type (benign, neutral, adversarial). Top row shows the intervened text, and the bottom row the response.
Rn Brall Owen 1.
RS Duer
Waspdaadd
beoeed nassing
Kn Boall Dwnir 14k
Hallorodedd bet
Rooidra
Dovire
traword
$11
Figure 5: Average doubtfulness scores in the next 20 sentences after intervention, grouped by inter- vention type (left) and model (right).
automatically classified by an LLM as either expressing doubt about the preceding reasoning or not (see Appendix [D.2] for prompts and Appendix [D.6 for hyperparameters). To validate whether our classifier correctly classifies doubtful and non-doubtful sentences, we validate it on dataset of 200 doubtful sentences similar to the ones our dataset, and 200 non-doubtful sentences randomly sampled from CoT traces, achieving Cohen's Kappa score of 0.8742 between the classifier and majority of human annotators. Details can be found in Appendix D.3 We extract the classifier's responses and compute doubtfulness as the proportion of sentences labeled "Yes." As baseline, we measure doubtfulness in non- non-intervened CoTss by sampling 20 consecutive sentences at random positions. This yields baseline probability of 0.153 for doubt expressions in unperturbed reasoning.
Appendix[D.6]
Fig. 5 reports doubtfulness scores by intervention type and model. Across all models, doubt re- liably spikes immediately after intervention, with the magnitude depending the type: benign interventions induce the smallest increase, while neutral and adversarial ones trigger strong sig- nals of self-questioning. Doubt levels are slightly higher in traces that eventually reach the correct answer, suggesting that doubt supports recovery but is not by itself sufficient. Larger models dis- play more consistent doubt responses than smaller ones, indicating that this recovery mechanism strengthens with scale. Importantly, doubt returns to baseline within about five sentences, showing that interventions are handled locally rather than derailing the entire reasoning process.
Effects of paraphrasing on doubt and performance. The Paraphrasing reasoning intervention shows the opposite pattern. Instead of increasing doubt, it reduces below baseline (0. (0.15)), with pre-intervention traces at 0.068 and post-intervention traces at 0.076. This suggests that the rewriting process removes hedging and self-corrective markers, producing a more assertive but less cautious style. RLLMs then continue in this style, adopting a consistently lower level of doubt throughout the trace. The effect is not only stylistic but also functional: paraphrasing yields the most consistent drop in final correctness across all interventions (Fig, 2). When applied early (t 0.1), paraphrasing also shortens CoT length by 59-61% % for four out of five models, even though only a few initial steps rewritten. We validate that paraphrasing preserves semantic content in Appendix
D.4 D.4
8

---

Published as a conference paper at ICLR 2026
Model
Benign: Complete
Rewrite
Benign:
Neutral: Add Text
Insert Chars
Neutral:
Wrong Cont.
Adv:
Wrong Fact
Unrelated
Adv;
RI-Disaill RI-Disill-Quen-
13.7904
37.1508
665.1573
111.3570
32,2084
65.60770
146.1395
31-Disill-Quen-11
-0.2889
-9.71196
124 1208
33,79088
8.7741
15.0112
21,3786
R1 E1-Disail--uwes Qwwnn-QweBBB
1,0333
-61.1332
53.8024
6.1558
10,4307
14,7904
22,0273
R R1-Disill- Discill-Llaam-888
4,5620
-61.0430
57,3516
17,7022
19.9724
21.4973
31,7228
Mame--Neottro--5
9,3646
237,6901
158.4411
78,3807
18.1226
20.6923
74.4161
M--Dssill-Queee Seeiil--wen-322B
-35,2607
158.7107
EXAONE-Deep- Decp-522
5,7053
-21.6529
53.1555
7,0757
9.0331
10.6520
60,7617
Phi-4-Reau Rilo---aasonnn---
403.6356
624.7056
QwQ-320
8.0356
-43.5604
167.2304
6.2049
16.3954
17.7185
34.7878
Table 5: Percentage change in CoT length by model and intervention (relative to the same instance's
original trace). Larger positive values indicate higher token-cost overhead during recovery.
Time
Benign Complete
Benign Rewrite
Neutral Add Text
Neutral Insert Chars
Adv.
Adv.
Adv.
Wrong Cont.
Wrong Fact
Unrelated
0.1
35.0215
51.0047
236,2198
89.1292
40,9407
45.1593
90.2289
0.3
50.7103
33.4112
217.6404
76.9579
53.8168
50.0287
102,0900
0.5
55.8506
17.9422
226. 226.2052
104.6446
63.0294
67.4898
88 38.0440
0.7
59.7273
15.0093
227.1901
85.5540
62.7264
83,3565
90.7110
0.9
49,1825
20.5443
238.6753
72,7888
67.7971
75.1385
108.2835
Table 6: Percentage change in CoT length by intervention timestep (relative to the same instance's 's original trace). Neutral insertions drive the largest overhead across timesteps.
Taken together, these results indicate that doubt expressions are an important recovery mechanism in RLLMs. When they are triggered, models can often reorient and return to a correct reasoning path. When they are suppressed, as in paraphrased traces, models lose this self-corrective signal, leading to shorter but less accurate reasoning. Thus, robustness RLLMS depends not only on semantic content but also on stylistic features of reasoning traces. This highlights a key limitation of current models: they are not invariant to style, and interventions that alter surface form can impair performance by suppressing metacognitive strategies. Understanding how RLLMs acquire, use, and sustain such strategies is an important direction for future work.
4.3 INTERVENTIONS SIGNIFICANTLY IMPACT REASONING EFFICIENCY
Robust final-answer accuracy can conceal significant computational overhead during recovery. To quantify efficiency, we measure the percentage change in chain-of-thought (CoT) length after an intervention relative the original trace of the same model and problem, after removing the part inserted through our intervention. Positive values indicate longer, more costly reasoning, while neg- ative values indicate shortened reasoning traces. This analysis reveals how models trade off thor- oughness and efficiency when confronted with perturbations that could plausibly arise during tool use, where external outputs are injected into the COT. Two consistent patterns emerge: neutral per- turbations inflate cost, with adding random text and inserting random characters causing the largest overheads, often exceeding +50% across models and soaring for smaller ones, and style rewrites shorten reasoning, with paraphrasing the CoT tending to shorten traces markedly (about -60% for most models), aligning with our observation that reduced doubt leads to prematurely terminated reasoning and lower robustness.
We also summarize how the overhead evolves with the intervention timestep. Tablo percent- age changes relative the pre-intervention trace. Neutral insertions consistently impose the highest cost across timesteps; unrelated continuations and wrong facts also increase length substantially. The benign rewrite pushes in the opposite direction, shortening traces.
ABLATIONS
Does forcing doubt immediately after intervention improve recovery rates? We measure how much appending "Wait" immediately after an intervention increases the recovery rate. To evaluate this, we sample traces for the entire LOGIC dataset, sampling 5 x 7 326
91280 traces per model. We then calculate the change in majority robustness. Tables f and show the changes in majority robustness. We observe that for some intervention types, this simple intervention significantly im-

---

Published as a conference paper at ICLR 2026
Time
RI-Distill Llama-8B
RI-Distill Qwen-1.5B
RI-Distill Qwen-14B
RI-Distill Qwen-32B
RI-Distill Qwen-7B
EXAONE Deep-328
Llama Nemotron
Phi-4 Reasoning
QwQ
6.57
0.5
1.53
2.72
0.83
0.39
1.53
4.69
3.77
1.52
-0.09
0.7
00.13
7.06
0.48
0.44
1.05
3.33
2.19
1.61
-0.09
0.9
0.53
4.21
1.58
-0.09
1.01
2.19
1.75
1.78
0.04
Table 7: Percentage point change in majority robustness when appending "Wait" after the interven- tion, averaged across interventions. Results are on the LOGIC domain.
Time
Adv.: Wrong Cont.
Adv.:
Adv:: Wrong Fact
Benign: Complete
Benign: Rewrite
Neutral: Add Text
Neutral: Rand Chars
Unrelated
0.1
0.91
20.51
1.05
0.57
3.03
3.23
2.18
0.3
0.61
10.87
0.47
-0,00
1.97
2.01
1,46
0.5
8.00
0.88
-0.04
1.46
0.61
0.7
0.92
6.64
0.54
0.30
0.24
2.35
1.39
0.9
0.64
6.68
0.44
0.10
0.17
1.40
0.68
Table Percentage point change majority robustness when appending "Wait" after the interven- tion, averaged across models. Results are on the LOGIC domain.
proves the recovery rate of the model, yielding improvements of single-digit percentages for many interventions. This suggests that training the model increase the likelihood of "Wait" tokens after various interventions could increase robustness, e.g. by augmenting reasoning traces with recovery examples through SFT or rewarding models for more diverse reasoning styles during RL.
Do traces from strong models help weak models recover? We fix the timestep to t = 0.3 and generate a trace from an original model. After the intervention, we swap the model and continue generation to measure how well strong model can recover from weak model's trace, and vice versa. Table 9 shows that swapping to QwQ-32B yields near-perfect recovery (~ 98%) regardless of the original model, while swapping to the weaker L-Dissill-Qweent 1.5B degrades performance to 67%. We observe that continuing the trace of weak model with strong model helps the model recover almost fully, with only slight decrease in performance, while continuing the trace of a strong model using a weak model also only yields modest improvements of 2%, supporting our finding that the primary factor in robustness is overall model capability.
Swapped Model
Original
DS-RI-1.5B
RI-Llama-8B
QwQ-32B
DS-RI-1.5B
65.3
90.8
97.1
R1-Llama-8B
67.5
94.0
98.4
QwQ-32B
67.1
93.8
99.3
Table 9: Majority Robustness after swapping traces (%) at (-0.3.
CONCLUSION
In this paper, investigate the robustness of RLLMs when applying benign, neutral adver- sarial interventions to their CoT traces. We demonstrate that RLLMS are robust, largely due to the self-corrective role of expressing doubt. However, RLLMs are not invariant to style transfor- mations, which can suppress reasoning, and recovery mechanisms incur significant computational overhead. Furthermore, our analyses highlight the importance of doubt in recovering from errors. These findings suggest future work should focus on improving recovery speed and stylistic stability. By uncovering these metacognitive properties, this research advances the understanding of LLM robustness and supports their safe deployment in high-stakes environments.
10

---

Published as a conference paper at ICLR 2026
REPRODUCIBILITY STATEMENT
Code will be made available at plementation details, hyperparameters, and evaluation settings are fully specified the supplemen- lary material. To improve clarity, the manuscript was polished for grammar and style using large language model, with all final text reviewed and validated by the authors.
All im-
ACKNOWLEDGEMENTS
This work was partially funded by the ERC (853489- DEXIM) and the Alfried Krupp von Bohlen und Halbach Foundation, which we thank for their generous support. The authors gratefully ac- knowledge the scientific support and resources of the Al service infrastructure LRZ Systems pro- vided by the Leibniz Supercomputing Centre (LRZ) of the Bavarian Academy of Sciences and Hu- manities (BAdW), funded by Bayerisches Staatsministerium für Wissenschaft und Kunst (StMWK). The authors also acknowledge the use of the HPC cluster at Helmholtz Munich for the computational resources used in this study.
REFERENCES
Marah Abdin, Sahaj Agarwal, Ahmed Awadallah, Vidhisha Balachandran, Harkirat Behl, Lingjiao Chen, Gustavo de Rosa, Suriya Gunasekar, Mojan Javaheripi. Neel Joshi, Piero Kauffmann, Yash Lara, Caio César Teodoro Mendes, Arindam Mitra, Besmira Nushi, Dimitris Papailiopoulos, Olli Saarikivi, Shital Shah, Vaishnavi Shrivastava, Vibhav Vineet, Yue Wu, Safoora Yousefi, and Guo- qing Zheng. Phi-4-reasoning technical report. In arXiv, 2025.
Daman Arora and Andrea Zanette. Training language models to reason efficiently. In NeurlPS, 2025.
Daman Arora, Himanshu Gaurav Singh, and Mausam. Have Ilms advanced enough? a challenging problem solving benchmark for large language models. In EMNLP, 2023.
Akhiad Bercovich, Itay Levy, Izik Golan, Mohammad Dabbah, Ran El-Yaniv, Omri Puny, Ido Galil, Zach Moshe, Tomer Ronen, Najeeb Nabwani, et al. Llama-nemotron: Efficient reasoning models. In arXiv, 2025.
Ganqu Cui, Lifan Yuan, Zefan Wang, Hanbin Wang, Wendi Li, Bingxiang He, Yuchen Fan, Tianyu Yu, Qixin Xu, Weize Chen, et al. Process reinforcement through implicit rewards. In arXiv, 2025.
General Reasoning. GeneralThought-430k 2025.
Daya Guo, Dejian Yang. Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, et al. Deepseek-rl: Incentivizing reasoning capability in Ilms via reinforcement learning. In arXiv, 2025.
Fabian Hoppe, Filip Ilievski, and Christttt Kalo. Investigating the robustness of deductive reasoning with large language models. In ECAI, 2025.
Jie Huang and Kevin Chen Chen-Chuan Chang. Towards reasoning in large language models: A survey. In ACL Findings, 2023.
Jie Huang, Xinyun Chen, Swaroop Mishra, Huaixiu Steven Zheng, Adams Wei Yu, Xinying Song, and Denny Zhou. Large language models cannot self-correct reasoning yet. In ICLR, 2024.
Kaixuan Huang, Jiacheng Guo, Zihao Li, Xiang Ji. Jiawei Ge, Wenzhe Li, Yingqing Guo, Tianle Cai, Hui Yuan, Runzhe Wang, et al. Math-perturb: Benchmarking llms math reasoning abilities against hard perturbations. In arXiv, 2025a.
Lei Huang, Weijiang Yu. Weitao Ma, Weihong Zhong, Zhangyin Feng, Haotian Wang, Qianglong Chen. Weihua Peng, Xiaocheng Feng, Bing Qin, et al. A survey hallucination in large lan- guage models: Principles. taxonomy, challenges, and open questions. ACM Transactions on Information Systems, 2025b.
11

---

Published as a conference paper at ICLR 2026
Yeo Wei Jie, Ranjan Satapathy, Rick Goh, and Erik Cambria. How interpretable reasoning explanations from prompting large language models? In NAACL Findings, 2024.
Takeshi Kojima, Shixiang Shane Gu, Machel Reid, Yutaka Matsuo, and Yusuke Iwasawa. Large language models are zero-shot reasoners. In NeurlPS, 2022.
Abhinav Kumar, Jaechul Roh, Ali Naseh, Marzena Karpinska, Mohit lyyer, Amir Houmansadr, and
Eugene Bagdasarian. Overthink: Slowdown attacks on reasoning lmss. In arXiv, 2025a.
Aviral Kumar, Vincent Zhuang, Rishabh Agarwal, Yi Su, John D Co-Reyes, Avi Singh, Kate Baumli, Shariq lqbal, Colton Bishop, Rebecca Roelofs, Lei M Zhang, Kay McKinney, Disha Shrivastava, Cosmin Paduraru, George Tucker, Doina Precup, Feryal Behbahani, and Alcksandra Faust. Train- ing language models self-correct via reinforcement learning. In ICLR, 2025b.
Komal Kumar, Tajamul Ashraf, Omkar Thawakar, Rao Muhammad Anwer, Hisham Cholakkal, Mubarak Shah, Ming-Hsure Yang, Phillip HS Torr, Fahad Shahbaz Khan, and Salman Khan. Llm post-training: A deep dive into reasoning large language models. In arXiv, 2025c.
Hung Le. Yue Wang, Akhilesh Deepak Gotmare, Silvio Savarese, and Steven H. Hoi. Coderl: Mastering code generation through pretrained models and deep reinforcement learning. In NeurlPS, 2022.
LG AI Research, Kyunghoon Bae, Eunbi Choi, Kibong Choi, Stanley Jungkyu Choi, Yemuk Choi, Seokhee Hong, Junwon Hwang, Hyojin Jeon, Kijeong Jeon, Gerrard Jeongwon Jo, Hyunjik Jo, Jiyeon Jung, Hyosang Kim, Joonkee Kim, Seonghwan Kim, Soyeon Kim, Sunkyoung Kim, Yireun Kim, Yongil Kim, Youchul Kim, Edward Hwayoung Lee, Haeju Lee, Honglak Lee, Jinsik Lee, Kyungmin Lee, Sangha Park. Yongmin Park, Sihoon Yang. Heuiyeen Yeen, Sihyuk Yi, and Hyeongu Yun. Exaone deep: Reasoning enhanced language models. In arXiv, 2025.
Jia Li, Edward Beeching, Lewis Tunstall, Ben Lipkin, Roman Soletskyi, Shengyi Costa Huang, Kashif Rasul, Longhui Yu, Albert Jiang, Ziju Shen, Zihan Qin. Bin Dong, Li Zhou, Yann Fleureau, Guillaume Lample, and Stanislas Polu. Numinamath, 2024.
Yi Liu, Gelei Deng. Yuekang Li, Kailong Wang, Zihao Wang, Xiaofeng Wang, Tianwei Zhang, Yepang Liu, Haoyu Wang, Yan Zheng, et al. Prompt injection attack against Ilm-integrated appli- cations. arXiv preprint arXiv:2306. 05499, 2023.
Ruotian Ma, Peisong Wang, Cheng Liu, Xingyan Liu, Jiaqi Chen, Bang Zhang, Xin Zhou, Nan Du, and Jia Li. Sr: Teaching lims to self-verify and self-correct via reinforcement learning. In arXiv, 2025.
Claudia Malzer and Marcus Baum. A hybrid approach to hierarchical density- -bsed cluster selec- tion. In International Conference on Multisensor Fusion and Integration for Intelligent Systems, 2020.
Leland McInnes, John Healy, Nathaniel Saul, and Lukas Grossberger. Umap: Uniform manifold approximation and projection. The Journal of Open Source Software, 3(29:8611, 2018.
Eduardo Mosqueira-Rey, Elena Hernández-Perreiza David Alonso-Ríos, José Bobes-Bascarán, and Ángel Fermández-Leal. Human-in-the-loog machine learning: state of the art. In Artificial Intelligence Review, 2023.
Debjit Paul, Robert West, Antoine Bosselut, and Boi Faltings. Making reasoning matter: Measuring and improving faithfulness of chain-of-thought reasoning. In EMNLP Findings, 2024.
Qwen Team. Qwb: Embracing the power of reinforcement learning, March 2025. URL wtt.ttth....bbo/////eo//e/ 3otlo///////////////
Rafael Rafailov, Archit Sharma, Eric Mitchell, Stefano Ermon, Christopher D. Manning, and Chelsea Finn. Direct preference optimization: Your language model is secretly reward model. In NewrlPS, 2023.
John Schulman, Filip Wolski, Prafulla Dhariwal, Alec Radford, and Oleg Klimov. Proximal policy optimization algorithms. In arXiv, 2017.
12

---

Published as a conference paper at ICLR 2026
Amrith Setlur, Chirag Nagpal, Adam Fisch, Xinyang Geng, Jacob Eisenstein, Rishabh Agarwal, Alekh Agarwal, Jonathan Berant, and Aviral Kumar. Rewarding progress: Scaling automated process verifiers for Ilm reasoning. In ICLR, 2025.
Darsh Shah, Peter Rushton, Somanshu Singla, Mohit Parmar, Kurt Smith, Yash Vanjani, Ashish Vaswani, Adarsh Chaluvaraju, Andrew Hojel, Andrew Ma, et al. Rethinking reflection in pre- training. In arXiv, 2025.
Zhihong Shao, Peiyi Wang, Qihao Zhu, Runxin Xu, Junxiao Song, Xiao Bi, Haowei Zhang, Mingchuan Zhang, YK Li, Y Wu, et al. Deepseekmath: Pushing the limits mathematical reasoning in open language models. In arXiv, 2024.
Erfan Shayegani, Md Abdullah Al Mamun, Yu Fu, Pedram Zaree, Yue Dong, and Nael Abu- Ghazaleh. Survey of vulnerabilities in large language models revealed by adversarial attacks. In arXiv, 2023.
Zhuocheng Shen. Llm with tools: A survey. In arXiv, 2024.
Joykirat Singh, Akshay Nambi, and Vibhav Vineet. Exposing the achilles' heel: Evaluating Ilms ability to handle mistakes mathematical reasoning. In arXiv, 2024.
Saba Sturua, Isabelle Mohr, Mohammad Kalim Akram, Michael Günther, Bo Wang, Markus Krim- mel. Feng Wang, Georgios Mastrapas, Andreas Koukounas, Nan Wang, and Han Xiao. jina- embeddings-v3: Multilingual embeddings with task lora. In arXiv, 2024.
Yi Su, Dian Yu, Linfeng Song, Juntao Li, Haitao Mi, Zhaopeng Tu, Min Zhang, and Dong Yu. Crossing the reward bridge: Expanding rl with verifiable rewards across diverse domains. In arXiv, 2025.
Yang Sui, Yu-Neng Chuang, Guanchu Wang, Jiamu Zhang, Tianyi Zhang, Jiayi Yuan, Hongyi Liu, Andrew Wen, Shaochen Zhong, Hanjie Chen, et Stop overthinking: survey on efficient reasoning for large language models. In TMLR, 2025.
Mirac Suzgun, Nathan Scales, Nathanael Schärli, Sebastian Gehrmann, Yi Tay, Hyung Won Chung, Aakanksha Chowdhery, Quoe V. Le, Ed H. Chi, Denny Zhou, and Jason Wei. Challenging big- bench tasks and whether chain-of- oftthought can solve them. In ACL Findings, 2023.
Gladys Tyen, Hassan Mansoor, Victor Cärbune, Yuanzhu Peter Chen, and Tony Mak. Llms cannot find reasoning errors, but can correct them given the error location. In ACL Findings, 2024.
Xiaoxuan Wang, Ziniu Hu, Pan Lu, Yanqiao Zhu, Jieyu Zhang, Satyen Subramaniam, Arjun R. Loomba, Shichang Zhang, Yizhou Sun, and Wei Wang. Scibench: Evaluating college-level sci- entific problem-solving abilities of large language models. In arXiv, 2024a.
Xuezhi Wang, Jason Wei, Dale Schuurmans, Quoe Le, Ed H. Chi, Sharan Narang, Aakanksha Chowdhery, and Denny Zhou. Self-consistency improves chain of thought reasoning in language models. In ICLR, 2023.
Yiping Wang, Qing Yang, Zhiyuan Zeng, Liliang Ren, Lucas Liu, Baolin Peng, Hao Cheng, Xuehai He, Kuan Wang, Jianfeng Gao, Weizhu Chen, Shuohang Wang, Simon Shaolei Du, and Yelong Shen. Reinforcement learning for reasoning in large language models with one training example. In NeurlPS, 2025.
Zhiruo Wang, Zhoujun Cheng, Hao Zhu, Daniel Fried, and Graham Neubig. What tools anyway? a survey from the language model perspective. In COLM, 2024b.
Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi. Quoe V Le, Denny Zhou, et al. Chain-of-thought prompting elicits reasoning in large language models. In NeurIPS, 2022.
Ziwei Xu, Sanjay Jain, and Mohan Kankanhalli. Hallucination is inevitable: An innate limitation of large language models. In arXiv, 2024.
13

---

Published as a conference paper at ICLR 2026
Lei Yang, Renren Jin, Ling Shi, Jianxiang Peng, Yue Chen, and Deyi Xiong. Probench: Benchmark- ing large language models competitive programming. In arXiv, 2025.
Shunyu Yao, Dian Yu, Jeffrey Zhao, Izhak Shafran, Tom Griffiths, Yuan Cao, and Karthik Narasimhan. Tree of thoughts: Deliberate problem solving with large language models. In NeurlPS, 2023.
Tong Yu, Yongcheng Jing, Xikun Zhang, Wentao Jiang, Wenjie Wu, Yingjie Wang, Wenbin Hu, Bo Du, and Dacheng Tao. Benchmarking reasoning robustness large language models. In arXiv, 2025.
Yurun Yuan and Tengyang Xie. Reinforce Ilm reasoning through multi-agent reflection. In ICML, 2025.
Qiusi Zhan, Zhixiang Liang, Zifan Ying, and Daniel Kang. Injecagent: Benchmarking indirect prompt injections tool-integrated large language model agents. ACL Findings, pp. 10471- 10506, 2024.
Dan Zhang, Sining Zhoubian, Ziniu Hu, Yisong Yue, Yuxiao Dong, and Jie Tang. Rest-mets*: Llm self-training via process reward guided tree search. In NeurlPS, 2024a.
Yadong Zhang, Shaoguang Mao, Tao Ge, Xun Wang, Yan Xia, Wenshan Wu, Ting Song. Man Lan, and Furu Wei. LLM as mastermind: A survey of strategic reasoning with large language models. In COLM, 2024b.
Zhenru Zhang, Chujie Zheng, Yangzhen Wu, Beichen Zhang, Runji Lin, Bowen Yu, Dayiheng Liu, Jingren Zhou, and Junyang Lin. The lessons of developing process reward models in mathematical reasoning, In ACL Findings, 2025.
Zhanke Zhou, Rong Tao, Jianing Zhu, Yiwen Luo, Zengmao Wang, and Bo Han. Can language mod- els perform robust reasoning in thain-of-thoughh prompting with noisy rationales? In NewrIPS, 2024.
14

---

Published as a conference paper at ICLR 2026
Supplementary Material
A
EXTENDED RESULTS FROM THE MAIN PAPER
A.1
ADDITIONAL ROBUSTNESS SCORE RESULTS
Complete Step (Benign)
Rewrlt Trace (Benign)
Add Random Text (Neutral)
08
0.1
0.5
0.7
0.9
0.1
0.3
0.5
0.7
0.9
0.1
0.5
0.5
0.7
0.9
Wrong Reasoning (Adv.)
Insert Wrong Fact (Adv.)
1.0
0.8
Continue Unrelated (Adv.)
Model
0.8
RI-Disfi-LLamm-BB
Hi.-Didil-Qwnn-322
Nemmoron-Llema- 1-Nano-SE
R11-iisll-Owen11... R1-Disdil-Qwers Phi-4-Ressoninng-Pe
0.8
Di-DDstt--Qwm--148 EXAONE 3200p--
QwQ-32B
0.1
0.5
0.7
0.9
Figure 6: Per-model all robustness by intervention on the MATH domain. Models generally sustain high robustness across interventions, with consistent trends over timesteps.
Complete Slep (Benign)
Rewrlte Trace (Benign)
Add Random Text (Neutral)
1.0
1.0
0.8
0.8
Insert Random Characlers (Neutral)
Ctn. Wrong Reasoning (Adv.)
Insert Wrong Fact (Adv.)
0.8
0.8
0.8
0.6
0.1
0.5
0.7
0.9
0.1
0.3
0.5
0.7
0.9
0.1
0.3
0.5
0.7
0.9
Continue Unrelated (Adv.)
Model
R1-DislllL lame--8
R1-Disdli-Quen-ee
Nemotron-Llama- 1-Nano-5B
R1-Dislll-Qwen-1..5 DeDDill-Queen--7
Phi-4- Mee4--Ressoning-Pu
R1-Diisll-Gwen-11B
DeeeNE-
Figure 7: Per-model at-least-once robustness by intervention on the MATH domain. Even under challenging interventions, models often reach the correct verifier decision least once across sam- ples.
We plot the all robustness and at-least-once robustness scores for the 9 models and 7 interventions our study. These results confirm our observations in Section 4.1 i.e. RLLMs are robust to var- ious interventions. Like for majority robustess, the rewrite trace interventions yield the lowest robustness scores, albeit still on a high level.
A.2 ROBUSTNESS UNDER MULTIPLE INTERVENTIONS
To evaluate robustness under repeated perturbations, measure how model accuracy degrades as we increase the number interventions from 5o with one paragraph of model reasoning between each intervention. We the LOGIC dataset at timestep 0.3 with the "Wrong Continuation" intervention, evaluating all 326 problems samples per problem for each intervention count. Tabble 10 shows the results.
15

---

Published as a conference paper at ICLR 2026
Complete (Berigg)
(Benign)
(Neutral)
1,0
0.8
Insert Random Charadtera (Neutral)
Ctn. Wrong Reasoning (Adv.)
Insert Wrong Fact (Adv.)
08
0.8
0.8
0.8
0.1
0.5
0.7
0.9
0.1
0.5
0.7
0.9
0.1
0.3
0.5
0.7
Conánuee Unrelated (Adv.)
R1-Disll-L amm-88
R1-Distll- Qwen-328
Nemotron-Llams-3 1-Nano-88
Ri-DDistl-Gwan-1.0
R1- RKs-Distll-oe Qwen-7B
Phi-4 Read-RRaasninn-fee
08
R1-Diisil-Qwan-146 4B
EXAONE- EXAGNE-Deep-322
OwQ-328
0.1
0.5
0.7
0.9
Figure Per-model all robustness by intervention on the LOGIC domain. mirror those in math and science, with modest variation by intervention type.
Robustness patterns
Complete Slep (Benign)
Rewrlte Trace (Benign)
Add Random Text (Neutral)
1,0
0.8
0.8
Insert Random Characters (Neutral)
Ctn. Wrong Reasoning (Adv.)
Insert Wrong Fact (Adv.)
0.8
0.8
0.8
0.8
0.1
0.3
0.5
0.7
0.9
0.1
0.3
0.5
0.7
0.0
0.1
0.5
0.5
0.7
0.9
Continue Unrelated (Adv.)
1.0
Model
Ri--Disil-Llama-BB
11-Disill-Qwen-338
NemotoonLlamm-- 1-Nano-58
Di-Diill--GG--1158
R1-Distil- -aali---een-BB
Phi-4- Phi-4-Reasoingg Reasoning Plus
RI-DDistl-Gwan-14B
SSA-NE-Deep-328
0.7
Figure 9: Per-model at-least-once robustness by intervention on the LOGIC domain. Most models reliably achieve at least robust outcome per configuration across timesteps.
Most models exhibit graceful degradation: EXAONE-Deep-S20 QwQ-32B, and Phi-4-reasoning- plus maintain 97% accuracy even after consecutive interventions, demonstrating remarkable resilience. The larger R1 1-Distill models (14B, 32B) also remain above 93%. However, the smallest model RRL--istill--waar 1.5B) shows substantial degradation, dropping from 63% to 46% accuracy. These results suggest that robustness to repeated perturbations scales with model capability.
A.3 COMPLETE RESULTS ON BIG-BENCH MISTAKE
Full results for 13 open-weight RLLMS and 3 API models on BIG-Bench Mistake are in Table 11 Results on the extended set affirm our observations in Section
B ANALYSIS OF DOUBTFUL PHRASES
In this section, we perform an in-depth analysis of doubting strategics RLLMs and analyze the internal activations of RLLMs after interventions. Here, gain insights into how RLLMs respond to interventions, and we take first steps towards more detailed understanding of how RLLMs realize that there is misleading information errors in the reasoning chain that need to be corrected.
Analyzing doubtful phrases. We seek to further understand the exact ways the model expresses doubt when faced with intervention in its CoT and uses it to recover from interventions.
16

---

Published as a conference paper at ICLR 2026
Complete (Berign)
(Benign)
(Neutral)
1,0
0.8
Insert Random Charadiera (Neutral)
Ctn. Wrong Reasoning (Adv.)
Insert Wrong Fact (Adv.)
08
0.8
0.8
0.8
0.1
0.5
0.7
0.9
0.1
0.5
0.7
0.9
0.1
0.3
0.5
0.7
Conánuee Unrelated (Adv.)
R1-Disll-- amm-88
R1-Distll- Qwen-328
NemotronLLamasS 1-Nano-88
Ri-DDistl-Gwan-1..
R1- Rts-Distll-ae Qwen-7B
Phi-- Rei-4-Reasoninng-PP
08
RT-Distll-Qwan-146 4B
EXAONE EXAONE-Deep-322
OwQ-32B
0.1
0.5
0.7
0.9
Figure 10: Per-model all robustness by intervention on the SCIENCE domain. We observe high overall robustness, with intervention-speccfii dips aligning with domain difficulty.
Complate Step (Benign)
Rewrie Trace (Benign)
Add Random Text (Neutral)
0.8
0.8
0.8
0.6
0.1
0.7
Insert Random Characters (Neutral)
Ctn. Wrong Reasoning (Adv.)
Insert Wrrong Fact (Adv.)
08
0.1
0.5
0.7
0.9
0.1
0.3
0.5
0.7
0.9
0.1
0.5
0.5
0.7
Continue Unrelated (Adv.)
1.0
Model
0.8
RI-DiistiLLamm-BB
Qwen-328
Nomotron-LLama-3
R1-Distll-Owan-11
R1-Distl--
RT-Disdll-Qwen-77 Qwen-7B
Phi-- Reasoning- -Puus
R1-DidlllQwen-14B
EXAGNE-Deup-52
QwQ-32B
Figure 11: Per-model at-least-once robustness by intervention on the SCIENCE domain. Across interventions, models frequently achieve least one robust verification per timestep.
For this, we take all sentences classified as doubtful in Section within the 20 steps after an intervention was performed. We then sample 100, 000 sentences for further analysis and embed them using jina-embed-v3,
state-of-the-art text embedding model Sturua al. (2024). We project embeddings to 50 dimensions using UMAP (McInnes et al. 2018). and cluster them by HDBSCAN (Malzer & Baum 2020).
Table 12 shows the most common categories of reactions, along with summaries of the clusters generated using an LLM. We describe our process for generating summaries in Appendix E.I
We observe that the model shows an awareness of our interventions, often signaling that it needs to return to solving the problem, abruptly rejects what was asserted in the intervention, and pauses to reconsider. These behaviors highlight that RL.LMs seem to have acquired an inherent reflection skill during the training process, which helps them recover from interventions, as we observe similar patterns of intervention rejection across all interventions perform.
C ACTIVATION ANALYSIS
We record the pre-attention residual stream activations of the final token at each layer, denoted !!! = h!! E Rdd where is the sequence length. A decoder-only transformer embeds the input tokens (L....., (n) h (n))) F and propagates the residual vector h() through L. identical layers.
17

---

Published as a conference paper at ICLR 2026
Model
2
3
4
5
RI-Distill-Llama-88
95.0
92.6
91.5
89.1
88.1
RI-Distill-Qwen-l.5
63.4
52.0
48.4
47.2
45.6
RI-Distill-Qwent
98.4
95.7
94.3
94.1
93.4
RI-Distill-Qwen-228
98.9
98.1
96.9
95.9
94.7
R1-Distill-QWen-7B
94.2
90.5
89.4
86.3
84.9
EXAONE-DDee-322
99.8
99.5
98.8
99.0
99.1
Llama-Nemottron-SB
96.8
94.9
92.1
92.3
91.4
Phi-4-reasoning-plee
95.9
98.3
97.6
97.9
98.2
QwQ-32B
99.8
99.5
99.3
99.0
99.1
Table 10: Model accuracy (%) under multiple consecutive "Wrong Continuation" interventions (1- 5) on the LOGIC dataset at t 0.3, with one paragraph of reasoning between interventions.
Model
Dyck Logical Ded.
Multistep Arith.
Track Shuffled Obj.
Word Sorting
RI-Distill-Qwen-1.5
9.4
7.3
55.3
51.6
11.8
RI-Distill-Qwen-
19.6
17.5
88.2
72.8
16.1
El-Distil--Llama-8
10.3
14.0
70.8
54.7
13.8
Lima-Nemotron-8B1
18.5
5.2
26.8
67.7
1.4
D-issill--Qee--Ble
39.7
30.1
86.8
87.8
25.9
Phi-4-reasoming (14B)
50.7
63.5
90.5
89.6
53.8
Phi-4-reasoming-plus (14B)
56.5
65.6
91.4
92.0
59.2
QwQ-32B
66.7
66.9
90.3
94.6
R1 R1-Distill-Qwen-222
42.4
31.4
89.4
86.3
30.7
EXAONE-Deep-32B
52.3
54.3
89.5
94.5
R1
RI-Distil--Llmma-00B
35.8
25.0
78.3
86.8
29.2
Owen3-330B-A3BB-hhmme
76.8
76.4
83.8
Swen3-33B-AAB-Instree Ans-Iustruttt
15.2
57.2
76.0
82.9
2.8
GPr-4-urbo
15.3
21.3
38.3
39.3
36.3
GPT-
40.7
44.0
62.3
35.0
gpt-oss-20b
59.3
72.0
91.0
93.3
45.0
gpt-oss-1200 120b
78.3
90.7
92.0
03
88.7
82.7
91.0
92.0
64.3
Table 11: BIG-Bench-Mistake error-localization accuracies (in %). Reasoning models and recent reasoning-style open-weight lines substantially exceed non-reasoning GPT-4 baselines. All rea- soning models were evaluated in a zero-shot setting, GPT-4 and GPT-4-Turbo were evaluated few-shot setting.
At layer the vector is transformed by multi-head self-attention and by an MLP:
h + Attn
h (++1 5 (L.
Sampling (()) just before the attention block gives us a proxy of understanding how well the em- beddings activations between intervened and non-intervened tokens can be discriminated in the embedding space the model uses to make the final prediction as the forward pass of the transformer performed. For this, we craft dataset of 600 traces random ends 600 traces for each intervention type. To record the activations just before the start of new thought, we also append \n An immediately after the final segment Rg. We then pre-fill the sequence, record the residual activations, and train linear classifiers top of training set of 0.8 1200 960 acti- vation embeddings for each layer and intervention type. We measure the accuracy of the classifiers test set of the remaining 240 embeddings.
non- non-intervened trace, and
Fig. 12 shows the accuracies of classifiers across interventions, along with the classifier accuracies across different models. The classifier accuracies significantly increase immediately after the first attention layer, and then remain consistently accurate, with slight increases in later layers for larger models. We observe that unlike for most other interventions, the accuracy of classifiers for Para-
18

---

Published as a conference paper at ICLR 2026
Size
Example
Summnary
Size
Example
Summary
1105
"Wait, no."
Abrupt negation.
"Did set up
Reflects on equations.
equations right?"
978
"Let me switch gears and focus on that."
Redirects focus,
333
"So,
Periodicity reasoning.
f (88 ff)
517
"Wait, actually, is that correct?"
Checks correctness.
297 "If m = n., then
GCD reasoning.
ged (m,, n)) m..
400
"Wait, no, wait, that's different topie."
Flags digression.
249
need get back on track." "Wait, no, no, hold on."
"Alright,
347
"Wait, is that equal to something?"
Equality probe.
239
Reconsidens.
Table 12: Condensed view the ten largest clusters of doubtful sentences found in the 20 sentences following our interventions. A more detailed table with more examples appears in Table I6 in the supplementary material.
Adtoriall id
Adversald Krong Roasering
Acvesseiil Isot Weong
Burign Complete
8.80
2.75
6.00
6.00
Benign
Neubal
Nattal
Modil
DrepSish-it- Sruppeeee-it---lllna---- -ei-----------e
6.0
Figure 12: Linear probe accuracies for residual stream activations on different interventions by layer
phrasing reasoning is significantly higher, reaching 0.996 in later layers the model. This suggests that models represent their native reasoning differently internally from reasoning worded in a dif- ferent style, thus being non-invariant linguistic transformations despite having the same semantic content and hints at them preferring their own reasoning style.
D GENERATION INTERVENTIONS
Below list each intervention applied the original questions, together with the exact prompt tem- plate used to generate the intervention. In all cases, <Q> is a placeholder for the original questions. <R> is placeholder for the original reasoning chain, and <R,> is placeholder for reasoning step in the reasoning chain.
D.1 PROMPT TEMPLATES FOR INTERVENTIONS
Continuation with other model:
SYSTEM: You are an expert mathematician. Given the problem and the reasoning so far, produce the NEXT SINGLE reasoning step that logically follows and moves towards the correct solution. Respond with only that next step. The step should start with a phrase like "I need to" or "We need to", "I can that", something similar, from the first person's perspective, unless it is just a logical step and not thought (e.g., mathematical
should be written
19

---

Published as a conference paper at ICLR 2026
manipulation), in which case you may just write out that
step.
USER:
Problem:
<Q>
Reasoning so far:
<R>
Next step:
Paraphrasing reasoning:
SYSTEM: You are an expert mathematician. Rewrite the provided reasoning trace in different words while preserving every single piece of information and the logical ordering of the steps, so that each step follows naturally from the previous steps and there are no logical gaps. Separate each step with exactly TWO newline characters. Do not leave out any details. Respond with ONLY the zewritten trace. If the trace already includes the FINAL ANSWER, rewrite everything up to but not including the FINAL ANSWER, and then stop.
USER:
Problem:
<Q>
Original reasoning trace:
<R>
Rewritten trace:
Incorrect reasoning continuation:
SYSTEM: You are an evil mathematician. Given the problem and the chain-of-thought so far, produce THE NEXT SINGLE reasoning step that sounds plausible yet is factually or logically WRONG and leads down an incorrect path. Respond with ONLY that next step, written from the first person's s perspective, starting with a phrase like "I need to" or "We need to", "I can see that", is just mathematical manipulation, in which case you may just write out that step. Make sure the structure of the sentence is similar to the style and structure of the previous steps, but is completely wrong.
something similar, unless it
USER:
Problem:
<Q>
Reasoning so far:
<R>
Next (incorrect) step:
Hallucinated fact:
SYSTEM: You are evil mathematician. Based the problem and the reasoning so far, fabricate ONE new mathematical statement (theorem, lemma, corollary, or definition) that appears to be helpful for solving the problem but is COMPLETELY FALSE. The statement should look plausible and helpful for solving the problem, but will actually mislead it when applied, because it is false. Do not reveal that it is false. Respond with ONLY that fabricated statement, make sure it is written from the first person's perspective, starting with a phrase like "I know that" or "Given that", "I remember that", or something similar, followed by the statement, unless the previous step is just a mathematical manipulation, in which case you may just write out wrong cont fontinuaa inntinu of that manipulation.
20

---

Published as a conference paper at ICLR 2026
USER:
Problem:
<Q>
Reasoning so far:
<R>
Wrong statement:
Unrelated CoT:
SYSTEM: You are evil language model. Produce ONE reasoning step that starts with a phrase such as "Okay, so T need to" "Okay,
the user wants to" and then talks about a topic which is provided to you in the prompt, initiating a chain of thought about that topic, e.g., explanation, history, comparison, thinking about questions, etc. Respond with ONLY that single sentence, starting with something like "Okay, so". For example, if the topic is "Quantum entanglement", the sentence might be "Okay, so I need to think about how quantum entanglement works."
USER:
Topic: <TOPIC>
Unrelated reasoning step about <TOPIC>:
D.2 DOUBT ANALYSIS
Doubt analysis prompt:
SYSTEM; You are an expert evaluator. Respond ONLY with YYes' or 'No'. Given piece of text from a reasoning chain, state whether that text indicates that the PRIOR reasoning contains an error or irrelevant information. USER:
Consider the following text: (sentence.or.segmenr) Does this text indicate that the previous reasoning contains errors or irrelevant information? Answer with Yes or No.
D.3 DOUBT CLASSIFIER VALIDATION
To validate our doubt classifier, we collected annotations from human annotators on a dataset of 400 sentences: 200 GPT-generated variations of doubtful phrases (since doubtful phrases in CoT traces follow similar patterns, we generated 200 variations of these sentences using 10 seed sen- tences randomly sampled from dataset) and 200 random sentences from CoT traces filtered for non-doubttulness by the authors.
Table 13 reports the classifier's performance against ground truth labels and human annotators. The classifier achieves 93.75% accuracy with high precision (89,24% and near- pear-perfect recall (99.50%) for identifying doubtful sentences. The Cohen's 's Kappa of 0.8742 between the classifier and human majority vote indicates strong agreement, comparable to the average pairwise agreement among human annotators (N 0.8385).
D.4 PARAPHRASING QUALITY VALIDATION
To validate that our paraphrasing intervention preserves the semantic content of the original reason- ing traces, we employ GPT-5.1 as judge. For each evaluation, we provide the judge model with the original problem, the original reasoning trace, and the paraphrased trace, then ask it determine whether both traces contain equivalent reasoning steps that are logically equivalent.
We randomly sample 100 traces from each domain and report the percentage of traces judged as semantically equivalent in Table 14] The SCIENCE domain achieves the highest equivalence rate (98%), while MATH (93%) and LOGIC (92%) show slightly lower rates. Upon manual inspection of the discrepancies, we find that the higher equivalence rate in SCIENCE stems from the nature of the reasoning: scientific traces tend to involve more formulaic reasoning and direct application of
21

---

Published as a conference paper at ICLR 2026
Classifier vs. Ground Truth
Accuracy
93.75%
Precision (Doubtful)
89.24%
Recall (Doubtful)
99.50%
F1-Score (Doubtful)
94.09%
Precision (Non-Douhtful)
99.44%
Recall (Non-Doubtful)
88.00%
FI-Score (Non-Doubtful)
93.37%
Inter-Annotator Agreement
Avg. Pairwise Cohen's 's x (Humans)
0.8385
Avg. Human Accuracy vs. Ground Truth
93.59%
Classifier vs. Human Annotators
Cohen's (Classifier vs. Human Majority)
0.8742
Avg. (Classifier vs. Individual Humans)
0.8457
Accuracy (Classifier vs. Human Majority)
93.73%
Table 13: Doubt classifier validation metrics 400 annotated sentences (200 doubtful, 200 non- doubtful).
principles, making them easier paraphrase faithfully. In contrast, MATH and LOGIC traces often contain more intricate logical arguments and detailed step-by-step derivations, where subtle nuances occasionally lost or altered during paraphrasing.
Domain
Equivalence Rate
LOGIC
92%
SCIENCE
98%
MATH
93%
Table 14: Paraphrasing quality validation using GPT-5.1 as judge, measuring semantic equivalence between original and paraphrased traces (100 randomly sampled traces per domain).
D.5 TOPICS USED FOR Unrelated CoT INTERVENTION
For our Unrelated CoT interventions, we require a list of 100 topics unrelated to math problems. We use these to start unrelated CoTs within reasoning chains that aim to confuse the RLLM. The full list is in Table 17 and for each intervention, randomly sample topic from this list.
D.6 GENERATION HYPERPARAMETERR
Table 15 summarizes the decoding settings used for each generation scenario. Here, "generate orig- inal reasoning chain" " refers generating the original reasoning chain for each model, "generate intervention" refers to generating the modification to the reasoning chains as described in Section D and "continue after intervention" refers continuing the modified reasoning chain after the inter- vention has been generated. A temperature of 0.0 corresponds to greedy sampling.
E ANALYZING DOUBTFUL PHRASES
We provide overview of the detailed clusters in 16
22

---

Published as a conference paper at ICLR 2026
Model Name
Scenario
Temperature
Top-k
Top-p
Seed
Oven//wen2:1 --s--------uue puct
Complete step
0.0
N/A
N/A
N/A
Qwen/Qwen2 5-322-55-32--0 Instructt M.1M)
Paraphrasing reasoning
N/A
N/A
Add random Insert Random Characters
N/A
N/A
N/A
N/A
(20 LIM)
N/A
N/A
N/A
N/A
Qwen/Qwen2 -
Instruct
Continue with wrong reasoning
0.7
N/A
0.9
80129
Qwen/Qwen2 5-32B2 Instruuctt
Hallucinated Fact Continue Unrelated
0.7
N/A
0.9
80129
Owen/Cwen2.$-220 Instruct
1.0
N/A
0.9
80129
Swen/Owen2.5-300 30..-----e-n-stuut
Douht Classification
0.0
N/A
N/A
N/A
madels
Sampling completions after intervention
0.6
N/A
0.95
N/A
Table 15: Decoding hyperparameters for different scenarios.
E.1 SUMMARIZING CLUSTERS
For summarization, we deduplicate all sentences from each cluster, sample 10 sentences from this set, and order the clusters by size. We then use a single LLM step to summarize all clusters.
F STATISTICAL DETAILS ON RESULTS
Below report the mean and standard deviation for all interventions, models, timesteps, and do- mains.
Table 18: Robustness metrics (mean + std) per model, intervention, and timestep on the Math do- main.
Model
Intervention
Timestep Mean Std
EXAONE-Decp-328
Add Random Text (Neu-
0.1 0.932 0.251
tral)
EXAONE-Deep-321
Add Random Text (Neu- tral)
0,941 0.236
EXAONE-Deep-32B
Add Random Text (Neu-
0.5 0.938 0.242
tral)
EXAONE-Deep-25
Add Random Text (Neu-
0.7 0.950 0.218
tral)
EXAONE-Deec-32B
Add Random Text (Neu-
0.9 0.957 = 0.202
tral)
Nemotron-Llanee -lamr--
Add Random Text (Neu-
0.1 0.971 0.168
3.1-Nano-8B
tral)
Nemotron-LLie Llama-
Add Random Text (Neu-
0.3 0.968 = 0.176
3.1-Nano-83
tral)
Nemotron-Llama-
Add Random Text (Neu-
0.5 0.974 0.159
3.I-Nano-8B
tral)
Nemotron-Llame
Add Random Text (Neu-
0.7 0.973 = 0.161
3.1-Nano-8B
tral)
Nemotron-Llama-
Add Random Text (Neu-
0.9 0.975 = 0.155
3. B.
tral)
Phi-4-Reasoning-Pie
Add Random Text (Neu-
0.893 = 0.309
tral)
Phi-4-Reason ReaRReRnnnnn Plus
Add Random Text (Neu-
0.3 0.900 = 0.301
tral)
Phi-4-Reasoning-Plae
Add Random Text (Neu-
0.5 0.893 0.310
tral)
Phi-4-Rcasoning-PPe
Add Random Text (Neu-
0.7 0.895 = 0.307
tral)
Phi-4-Reasoning-Plue
Add Random Text (Neu-
0.9 0.899 0.301
tral)
QwQ-32B
Add Random Text (Neu-
0.1 0.847 = 0.360
tral)
QwQ-32B
Add Random Text (Neu-
0.3 0.817 0.387
tral)
Continued next page
23

---

Published as a conference paper at ICLR 2026
Table 18: Robustness metries (mean + std) per model, intervention, and timestep the Math do- main.
Model
Intervention
Timestep
Mean Std
QwQ-32B
Add Random Text (Neu-
0.5 0.824 0.381
tral)
QwQ-32B
Add Random Text (Neu-
0.7 0.797 = 0.402
tral)
QwQ-32B
Add Random Text (Neu-
0.9 0.765 0.424
tral)
RI-Distill-Llmm--8
Add Random Text (Neu-
0.933 0.251
tral)
RI-Dastill-Jlam--88
Add Random Text (Neu-
0.3 0.961 0.194
tral)
RI-Distill-Llam-B
Add Random Text (Neu-
0.5 0,970 0.170
tral)
RI-Distill-Llama.
Add Random Text (Neu-
0.7 0.978 = 0.146
tral)
RI-Distill-Llamal
Add Random Text (Neu-
0.9 0.988 0.111
tral)
RI-Distil--Wwen-
Add Random Text (Neu-
0.1 0.730 = 0.444
1.5B
tral)
RI-Distill-Qwen-
Add Random Text (Neu-
0.3 0.759 0.428
1.5B
tral)
RI-Distill D-sstiill-Qwen-
Add Random Text (Neu-
0.5 0.774 + 0.418
1.5B
tral)
R1-Distil--Wwen
Add Random Text (Neu-
0.7 0.803 0.397
1.5B
tral)
R1-Distill-Qwen-
Add Random Text (Neu-
0.9 0.831 = 0.375
1.SB
tral)
RI RI-Distill-Qwent 14B
Add Random Text (Neu-
0.1 0.980 = 0.141
tral)
R1-Distill-Owar Siriill--ee---i 14B
Add Random Text (Neu-
0.3 0.986 0.117
tral)
R1-Distill- Bessill--wee-Be 14B
Add Random Text (Neu-
0.5 0.989 = 0.103
tral)
RI-Distill-Qwen-Ill
Add Random Text (Neu-
0.7 0.991 0.095
tral)
RI DDistill-wwen 14B
Add Random Text (Neu-
0.9 0.991 = 0.096
tral)
11-Distill-Qwen--33
Add Random Text (Neu-
0.1 0.944 0.231
tral)
RI-Distill-Qwen-322
Add Random Text (Neu-
0.3 0.953 = 0.211
tral)
Rl-Distill-Qeen-32B
Add Random Text (Neu-
0.5 0.957 0.203
tral)
RI-Distill-Ween-221
Add Random Text (Neu-
0.955 0.207
tral)
RI-Distill Distill-Qwen-328
Add Random Text (Neu-
0.9 0.951 = 0.215
tral)
RI-Distill-Qwen-7B
Add Random Text (Neu-
0.1 0.932 0.251
tral)
R1-Distill-Qwen-7B
Add Random Text (Neu-
0.3 0.943 = 0.232
tral)
RI-Distill-Qwen-77
Add Random Text (Neu-
0.5 0.949 0.221
tral)
E1-Distill-Qwen--7
Add Random Text (Neu-
0.7 0.942 = 0.234
tral)
RI-Distill-Qwen-77
Add Random Text (Neu-
0.9 0.950 0.218
tral)
EXAONE-Deep-23 Complete Step (Benign) EXAONE-Deep-32B
0.996 0.064 0.3 0.996 + 0.061
Complete Step (Benign)
Continued on next page
24

---

Published as a conference paper at ICLR 2026
Table 18: Robustness metries (mean + std) per model, intervention, and timestep on the Math do- main.
Model
Intervention
Timestep
Mean + Std
EXAONE-Deep-32D
Complete Step (Benign)
0.5 0.995 0.072
EXAONE-Deep--35
Complete Step (Benign)
0.7 0,997 = 0.052
EXAONE-Deep-23
Complete Step (Benign)
0.9 0.998 = 0.046
Nemotron- Llama-
Complete Step (Benign)
0.1 0.993 = 0.086
3.1-Nano-8B
Llama-
Complete Step (Benign)
0.3 0.990 0.102
3.1-Nano-8B
Nemotron-L
Complete Step (Benign)
0.5 0.995 = 0.073
3. 11-Nano-8BB
Nemotron- Llama-
Complete Step (Benign)
0.7 0.994 0.075
3.1-Nano-8B
Nemotron-Llamme
Complete Step (Benign)
0.9 0.997 = 0.054
3. 3.I-Nano88B
Phi-4-Rcasoning- Plus
Complete Step (Benign)
0.1 0.919 0.273
Thi-4-Reasoning-PPP
Complete Step (Benign)
0.3 0.917 = 0.276
mhi-4-RaasoningPP Plus
Complete Step (Benign)
0.5 0,928 = 0.259 0.259
Phi-4-Reasoning-Plae
Complete Step (Benign)
0.7 0.930 = 0.255
Phi-4-Reasoonin-Pllss
Complete Step (Benign)
0.9
QwQ-32B
Complete Step (Benign) Complete Step (Benign)
0.1 0.099
QwQ-32B
0.3 0,985
QwQ-32B
Complete Step (Benign)
0.5 0.109
QwQ-32B
Complete Step (Benign)
0.7 0.990
QwQ-32B
Complete Step (Benign)
0.9 0.989 0.105
RI-Distill-LJmma-8B
Complete Step (Benign)
0.1 0.250
R1-Distiil-LJama--81
Complete Step (Benign)
0.3 0.964
RI-Distill-Llama-B1
Complete Step (Benign)
0.5 0.154
RI-Distill-Llam--Bl
Complete Step (Benign) Complete Step (Benign)
0.7 0.981 0.138
R R--Distil--Lamm--BB
0.9 = 0.091
RI-Distill-Qwen-
Complete Step (Benign)
0.1 0.851 0.356
1,5B
RI-Distill-Qwen-
Complete Step (Benign)
0.3 0.887 = 0.317
1.5B
RI-Distill-Qwen
Complete Step (Benign)
0.5 0.906 0.291
1.5B
RI D1-Distill-Ween-
Complete Step (Benign)
0.7 0.927 = 0.261
1.5B
RI-Distill-Qwen-
Complete Step (Benign)
0.9 0.962 0.190
1.5B
R1 RI-Distill-Qwen-Al
Complete Step (Benign)
0.1 0.990 = 0.102
R R1-Distill-Qwen-1l
14B
Complete Step (Benign)
0.3 0.993 = 0.086
R R1-Distil-QQwen-14
Complete Step (Benign)
0.5 0.993 0,083
R RI-Dissill-Qeen-14B
Complete Step (Benign)
0.7 0.995
R RI-Distill-Qeen-14B
Complete Step (Benign)
0.9 0.043
RI RI-Dissill--Qwenn32B
Complete Step (Benign)
0.1 0.988 = 0.107
R IIDDisilllQQwen-32B
Complete Step (Benign)
0.3 0.992 = 0.089
R RI-Distill-Qwen--22
Complete Step (Benign)
0.5 0.991 0.094
R RI-Dissill-Owen--2B
Complete Step (Benign)
0.7 0.993
R RI-Distill-Qwen--22
Complete Step (Benign)
0.9 0
R RI-Dissill-Qwee--1B
Complete Step (Benign)
0.1 0.159
RI -i-istilll-ween-
Complete Step (Benign)
0.3
0.979
RI RI-Distill-Owen--2
Complete Step (Benign)
0.5
R--Distill-Qwenn-B
Complete Step (Benign)
0.7 0.981 0.137
RI-Distill-Qwen-7B
Complete Step (Benign)
0.9 0.994 0.080
EXAONE-Decq-32B
Continue Unrelated
0.1 0.487 = 0.500
(Adv.)
EXAONE-Deep-32B
Continue
Unrelated
0.3 0.598 0.490
(Adv.)
Continued on next page
25

---

Published as a conference paper at ICLR 2026
Table 18: Robustness metries (mean + std) per model, intervention, and timestep the Math do- main.
Model
Intervention
Timestep
Mean Std
EXAONE-Deep-3225
Continue
Unrelated
0.5 0.713 0.452
(Adv.)
EXAONE-Deep-32B
Continue
Unrelated
0.7 0.779 = 0.415
(Adv.)
EXAONE-Deep-322
Continue
Unrelated
0.9 0.804 0.397
(Adv.)
Nemotron-Llama.
Continue
Unrelated
0.840 0.367
3. 3.1-Nano-BB
(Adv.)
Conotron-Lllmaa
Continue
Unrelated
0.3 0.889 0.314
3.1-Nano-8B
(Adv.)
Remotron-Llamee
Continue
Unrelated
0,912 0.283
3.1-Nano-8B
(Adv.)
Pemotron-Llamme
Continue (Adv.)
Unrelated
0.7 0.937 = 0.243
3.1-Nano8BB
Nemotron-Llane
Continue
Unrelated
0.9 0.968 0.175
1-Nano-8B
(Adv.)
Phi-4-Reasoning-Piie
Continue
Unrelated
0.1 0.929 = 0.258
(Adv.)
Phi-4-Reasoning-Plus
Continue
Unrelated
0.3 0.925 0.263
(Adv.)
Mhi-4-Reasoning Plus
Continue (Adv.)
Unrelated
0.5 0.940 = 0.238
Phi-4-Reasoning-Plas
Continue
Unrelated
0.7 0.936 0.245
(Adv.)
Phi-4-Rcasoning-Phhs
Continue
Unrelated
0.9 0.934 = 0.249
(Adv.)
QwQ-32B
Continue (Adv.)
Unrelated
0.1 0.966 = 0.182
QwQ-32B
Continue
Unrelated
0.3 0.920 0.272
(Adv.)
QwQ-32B
Continue (Adv.)
Unrelated
0.5 0.890 = 0.313
QwQ-32B
Continue
Unrelated
0.7 0.890 0.313
(Adv.)
QwQ-32B
Continue
Unrelated
0.9 0.877 = 0.328
(Adv.)
R1-Distill-Llam--
Continue
Unrelated
0.1 0.905 0.294
(Adv.)
RI-Distill-Llama-B1
Continue
Unrelated
0.3 0.956 = 0.204
(Adv.)
RI-Distill-Llam--B1
Continue
Unrelated
0.5 0.971 = 0.168
(Adv.)
RI-Distill-Llamal
Continue
Unrelated
0.980 0.141
(Adv.)
1-Distill-Llamme 8B
Continue (Adv.)
Unrelated
0.9 0.990 = 0.098
RI-Distill-Qwen-
Continue
Unrelated
0.1 0.825 0.380
1.5B
(Adv.)
RI-Distill-Qwen-
Continue
Unrelated
0.3 0.833 = 0.373
1.5B
(Adv.)
RI-Distill-Qwen
Continue
Unrelated
0.5 0.844 0.363
1.5B
(Adv.)
R1-Distill-Qwen
Continue
Unrelated
0.7 0.861 = 0.346
1.5B
(Adv.)
R1 R1-Distill-Qwen
Continue (Adv.)
Unrelated
0.9 0.874 0.332
1.SB
RI H1-Distill-wwert Qolll--een--DDD
Continue (Adv.)
Unrelated
0.918 0.275
Continued on next page
26

---

Published as a conference paper at ICLR 2026
Table 18: Robustness metries (mean + std) per model, intervention, and timestep on the Math do- main.
Model
Intervention
Timestep
Mean Std
RI-Distill-Qwen- 14B
Continue
Unrelated
0.3 0.971 0.168
(Adv.)
RI-Distill-Qwen-144
Continue
Unrelated
0.5 0.979 = 0.144
(Adv.)
R1-Distill- Piistil-QQeen-lee Qwen-14B
Continue
Unrelated
0.7 0.989 0.105
(Adv.)
RI-Distill-Qwen-
Continue
Unrelated
0.9 0.988 0.109
(Adv.)
RI-Disiil-Qwenn222B
Continue
Unrelated
0.1 0.941 0.236
(Adv.)
A1-DistillQQwen-222
Continue
Unrelated
0,979 0.143
(Adv.)
EL-Distill-Qwen-222
Continue
Unrelated
0.5 0.985 = 0.122
(Adv.)
RI-Distill-Qwen-32
Continue
Unrelated
0.7 0.989 0.106
(Adv.)
RI-Distill-Qwen-32B
Continue
Unrelated
0.9 0.989 = 0.103
(Adv.)
RI-Distill-Qeen-7B
Continue
Unrelated
0.1 0.949 0.220
(Adv.)
RI-Distill Beanill-Qeen-BB
Continue
Unrelated
0.3 0.978 = 0.148
(Adv.)
R1-Disill--wee-77B
Continue
Unrelated
0.5 0.981 0.136
(Adv.)
RI-Distill-Qwen-77
Continue
Unrelated
0.7 0.980 = 0.139
(Adv.)
RI-Distill-Qwen-27
Continue
Unrelated
0.9 0.989 = 0.104
(Adv.)
EXAONE-Deep-2e
Ctn. Wrong Reasoning
0.1 0.993 0.081
(Adv.)
EXAONE-Decp-225
Ctn. Wrong Reasoning
0.3 0.996 = 0.066
(Adv.)
EXAONE-DDee-32B
Ctn. Wrong Reasoning
0.5 0.995 0.068
(Adv.)
EXAONE-Deep-.
Ctn. Wrong Reasoning (Adv.)
0.7 0.996 = 0.063
EXAONE-Deep-225
Ctn. Wrong Reasoning
0.9 0.997 0.052
(Adv.)
Nemotron- -lama-
Ctn. Wrong Reasoning
0.991 = 0.096
3.1 2.1-Nano-8B
(Adv.)
Nemotron-LLann Lllma--
Ctn. Wrong Reasoning
0.3 0.989 = 0.105
3.1-Nano-8B
(Adv.)
Nemotron-Llamee
Cin. Wrong Reasoning
0.5 0.992 0.091
3, 3.1-Nano-88 8B
(Adv.)
Nemotron-Lan -lama-
Ctn. Wrong Reasoning
0.7 0.994 = 0.075
11-Nano-8B
(Adv.)
Nemotron-Llama-
Ctn. Wrong Reasoning
0.9 0.998 0.048
(Adv.)
Phi-4-Rcasoming-Ple
Ctn. Wrong Reasoning
0.1 0.938 = 0.241
(Adv.)
Mhii--Reasoning-Pin -lus
Ctn. Wrong Reasoning (Adv.)
0.3 0.944 0.229
Thi-4-Rcasoning-Piie
Ctn. Wrong Reasoning (Adv.)
0.5 0.943 = 0.232
1ia-4-Reasoning-PPe
Ctn. Wrong Reasoning (Adv.)
0.7 0.943 0.232
Hiii4-RRaaoning-Piin
Cin. Wrong Reasoning
0.9 0.947 0.224
(Adv.)
Continued on next page
27

---

Published as a conference paper at ICLR 2026
Table 18: Robustness metries (mean + std) per model, intervention, and timestep on the Math do- main.
Model
Intervention
Timestep
Mean Std
QwQ-32B
Cin.
Wrong Reasoning
0.1 0.994 0.076
(Adv.)
QwQ-32B
Ctn. Wrong Reasoning
0.3 0.991 = 0.094
(Adv.)
QwQ-32B
Ctn. Wrong Reasoning
0.5 0.993 0.082
(Adv.)
QwQ-32B
Ctn. Wrong Reasoning
0.7 0.989 0.104
(Adv.)
QwQ-32B
Ctn. Wrong Reasoning
0.9 0.987 0.114
(Adv.)
RI-Distil-LLlma-BB
Ctn. Wrong Reasoning (Adv.)
0.917 0.276
RI-Distill-Llama
Ctn. Wrong Reasoning
0.3 0.958 = 0.201
(Adv.)
RI-Distill-Llama-
Ctn. Wrong Reasoning (Adv.)
0.5 0.967 0.179
RI-Distill-Llama-8
Ctn. Wrong Reasoning
0.7 0.980 = 0.139
(Adv.)
RI-Distill-Llmm--8B
Ctn. Wrong Reasoning (Adv.)
0.9 0.990 0.102
RI-Distill Qwen-
Ctn. Wrong Reasoning (Adv.)
0.1 0.816 = 0.388
1.5B
R1-Distill-Qwen-
Ctn. Wrong Reasoning
0.3 0.851 0.356
1.5B
(Adv.)
RI-Distill-Qwen-
Ctn. Wrong Reasoning
0.5 0.879 = 0.326
1.SB
(Adv.)
RI-Distill-Wwen-
Cin. Wrong Reasoning
0.7 0.899 = 0.302
1.SB
(Adv.)
RI-Distil--Qwen
Ctn. Wrong Reasoning (Adv.)
0.9 0.933 0.249
1.5B
R1 Qwe
Ctn. Wrong Reasoning (Adv.)
0.1 0.988 = 0.108
RI-Distill-Qeen-14B
Ctn. Wrong Reasoning
0.3 0.993 0.081
(Adv.)
RI RI-Distilll-Q Sotlll-ween-44444
Ctn. Wrong Reasoning (Adv.)
0.5 0.990 = 0.097
R1-Distill- Saaill--wen---ee 14B
Cin. Wrong Reasoning (Adv.)
0.7 0.995 0.071
RI-Distill-Qwen-11
Ctn. Wrong Reasoning (Adv.)
0.9 0.997 = 0.056
RI-Distill-Qwen-22B
Cin. Wrong Reasoning
0.1 0.975 = 0.155
(Adv.)
RI-DistlllQWenn-22B
Cin. Wrong Reasoning
0.989 0.103
(Adv.)
RI-Distill- Distill-Qwen-32BB
Ctn. Wrong Reasoning (Adv.)
0.5 0.992 = 0.090
RI-Disiill-Qeen-32B
Ctn. Wrong Reasoning
0.7 0.993 0.081
(Adv.)
R1-Distill-QQen-32R
Ctn. Wrong Reasoning
0.9 0.992 = 0.090
(Adv.)
RI-Distill-Qwen-77
Ctn. Wrong Reasoning
0.1 0.968 0.176
(Adv.)
RI-Distill-Qwen-1
Ctn. Wrong Reasoning
0.3 0.980 = 0.140
(Adv.)
RI-Distill-Qwen-7B
Ctn. Wrong Reasoning (Adv.)
0.5 0.981 0.136
RI-Distill-Qwen-77
Cin. Wrong Reasoning
0.7 0.981 0.138
(Adv.)
Continued on next page
28

---

Published as a conference paper at ICLR 2026
Table 18: Robustness metries (mean + std) per model, intervention, and timestep the Math do- main.
Model
Intervention
Timestep
Mean Std
RI-Distill-Qwen-7B
Cin. Wrong Reasoning
0.9 0.992 0.087
(Adv.)
EXAONE-Deep-32B
Insert Random Charac-
0.1 0.996 = 0.064
ters (Ncutral)
EXAONE-Deep-325
Insert Random Charac-
0.3 0.995 0.068
ters (Neutral)
EXAONE-DDee-32B Insert Random Charac-
0.5 0.994 0.075
ters (Neutral)
EXAONE-DDee-32B
Insert Random Charac-
0.7 0.996 0.064
ters (Neutral)
EXAONE-Deep-325
Insert Random Charac-
0.9 0.998 0.050
ters (Neutral)
Nemotron-Llaan
Insert Random Charac-
0.1 0.877 = 0.329
3.1-Nano-8B
ters (Neutral)
Nemotron-Llame
Insert Random Charac-
0.3 0.910 0.286
3, 3.1-Nano-8B
ters (Neutral)
Nemotron-Llama-
Insert Random Charac-
0.5 0.917 = 0.276
3.1 3.1-Nao-8B
ters (Neutral)
Nemotron-Llama-
Insert Random Charac-
0.7 0.941 0.236
3.1-Nano-8B
ters (Neutral)
Nemotron-L Llama-
Insert Random Charac-
0.9 0.935 = 0.246
3. 3.1-Nano-8B
ters (Neutral)
Phi-4-Reasoning-Plis
Insert Random Charac-
0.1 0.907 0.290
(Neutral)
Thi-4-Reasoning-Phas
Insert Random Charac-
0.3 0.910 = 0.286
ters (Neutral)
ReasonReasoning-Puu
Insert Random Charac-
0.5 0.915 = 0.280
ters (Neutral)
mhi-4-Rcasoning-PPP
Insert Random Charac-
0.7 0.911 0.285
ters (Neutral)
Phi-4-Reasoning-Piee
Insert Random Charac-
0.9 0.932 = 0.252
ters (Neutral)
QwQ-32B
Insert Random Charac-
0.1 0.985 0.120
ters (Neutral)
QwQ-32B
Insert Random Charac-
0.3 0.982 = 0.134
ters (Neutral)
QwQ-32B
Insert Random Charac-
0.5 0.975 0.156
(Neutral)
QwQ-32B
Insert Random Charac-
0.7 0.955 = 0.208
ters (Neutral)
QwQ-32B
Insert Random Charac-
0.9 0.978 0.147
ters (Neutral)
RI-Distill-Llam-S
Insert Random Charac-
0.941 = 0.235
ters (Neutral)
D-Distill-Llame 8B
Insert Random Charac-
0.3 0.961 = 0.194
ters (Neutral)
RI-D-isill-Llmm--88
Insert Random Charac-
0.5 0.974 0.159
ters (Neutral)
RI-Distill-Llama-BB
Insert Random Charac-
0.7 0.980 = 0.141
ters (Neutral)
R1-Distill-Llamas
Insert Random Charac-
0.9 0.992 = 0.087 0.087
ters (Neutral) Insert Random Charac- ters (Ncutral) Insert Random Charac-
RI-Distill-Qwen
0.802 = 0.399
1.5B
R1 RI-Distill-Qwen-
0.3 0.850 0.357
1.SB
ters (Neutral)
RI-Distill-Qwen:
Insert Random Charac-
0.5 0.867 0.339
1.5B
ters (Neutral)
Continued on next page
29

---

Published as a conference paper at ICLR 2026
Table 18: Robustness metrics (mean + std) per model, intervention, and timestep on the Math do- main.
Model
Intervention
Timestep
Mean Std
RI-Distill-Qwen-
Insert Random Charac-
0.7 0.886 0.318
1.5B
ters (Neutral)
RI-Distil--Qwen-
Insert Random Charac-
0.9 0.928 = 0.258
1.5B
ters (Ncutral)
RI-Distill-Quwe Sariil--wen--lae 14B
Insert Random Charac-
0.1 0.988 0.109
ters (Neutral)
RI-Distil--Wwen
Insert Random Charac-
0.3 0.992 = 0.087
ters (Neutral)
RI-Distil--Ween-B
Insert Random Charac-
0.5 0.991 0.095
ters (Neutral)
El-Distil-Qwen-- Insert Random Charac-
0.995 0.072
ters (Neutral)
RL-Distill-Qwen--44 Insert Random Charac-
0.9 0.996 = 0,061
ters (Neutral)
RI-Distill-Qwen-222
Insert Random Charac-
0.1 0.983 0.130
ters (Neutral)
RI-Distill-Qwen-32B
Insert Random Charac-
0.3 0.988 = 0.110
ters (Neutral)
RI-Distil--ween-22B
Insert Random Charac-
0.5 0.992 0.091
ters (Neutral)
RI-Distill Distill-Qwenn322
Insert Random Charac-
0.7 0.994 = 0.079
ters (Neutral)
RI-Disill-Qwenn-22R
Insert Random Charac-
0.9 0.993 0.084
(Neutral)
RI-Distill-Qwen-78
Insert Random Charac-
0.890 = 0.312
ters (Neutral)
RI-Distill-Qwen-22
Insert Random Charac-
0.3 0.951 = 0.216
ters (Neutral)
RI-Distill-Qwen-
Insert Random Charac-
0.5 0.946 0.225
ters (Neutral)
RI-Distill-Qwen-22
Insert Random Charac-
0.7 0.948 = 0.222
ters (Neutral)
RI-Disiill-Qeen-7B
Insert Random Charac-
0.9 0.955 0.208
ters (Neutral)
EXAONE EXAONE-Deep-32B
Insert Wrong Fact (Adv.)
0.1 0.993 = 0.081
EXAONE EXAONE-Deep-320
Insert Wrong Fact (Adv.)
0.3 0.996 = 0,066
EXAONE-Deep-3DB
Insert Wrong Fact (Adv.)
0.5 0.997 0.056
EXAONE-DDcp-32P
Insert Wrong Fact (Adv.)
0.7 0.997 0.058
EXAONE-Decp-322
Insert Wrong Fact (Adv.)
0.9 0.998 0.050
Nemotron-Llame
Insert Wrong Fact (Adv.)
0.1 0.991 = 0.096
3.1 3.1-Nano88B
Nemotron-Llama-
Insert Wrong Fact (Adv.)
0.3 0.994 0.077
3.1-Nano-8B
Nemotron- -lama-
Insert Wrong Fact (Adv.)
0.5 0.995 = 0.069
3.1-Nano-8B
Nemotron-Llame
Insert Wrong Fact (Adv.)
0.7 0.996 0.064
3.1-Nano-8B
Nemotron-Llama-
Insert Wrong Fact (Adv.)
0.9 0.998 0.043
3. 1--Nao-88B
Rii--RReasoiing-PP -Pus
Insert Wrong Fact (Adv.)
0.1 0.933 + 0.250
Phi-4-Reasoning- Plus
Insert Wrong Fact (Adv.)
0.3 0.937 0.243
Bhii--Reasoning-PPe -lus
Wrong Fact (Adv.)
0.5 0,941 0.235
Phis--Rcasoning-PPP Plus
Insert Wrong Fact (Adv.)
0.7 0.941 = 0.236
Phi-4-Rcasoning-PPP
Insert Wrong Fact (Adv.)
0.9 0.943 = 0.232
QwQ-32B
Insert Wrong Fact (Adv.)
0.1 0.996 = 0.059
QwQ-32B
Insert Wrong Fact (Adv.)
0.3 0.988 0.111
QwQ-32B
Insert Wrong Fact (Adv.)
0.5 0.992 0.090
QwQ-32B
Insert Wrong Fact (Adv.)
0.7 0.995 + 0.071
Continued on next page
30

---

Published as a conference paper at ICLR 2026
Table 18: Robustness metrics (mean + std) per model, intervention, and timestep on the Math do- main.
Model
Intervention
Timestep
Mean Std
QwQ-32B
Insert Wrong Fact (Adv.)
0.9 0.983 0.129
RI-Distill-
Insert Wrong Fact (Adv.)
0,945 = 0.228
RI-Distill-Llam--81
Insert Wrong Fact (Adv.)
0.3 0,966 = 0.182
EI-Distill-Llame 8B
Insert Wrong Fact (Adv.)
0.5 0.970 = 0.171
RI RI-Distill-Llams -B
Insert Wrong Fact (Adv.)
0.7 0.979 0.142
RI-Distill-Llama
Insert Wrong Fact (Adv.)
0.9 0,991 0.093
RI-Distill-Qwen-
Insert Wrong Fact (Adv.)
0.829 0.377
1.5B
R RI-Distill-Qwen-
Insert Wrong Fact (Adv.)
0.3 0.865 0.342
1.5B
RI-Distill-Qwen-
Insert Wrong Fact (Adv.)
0.5 0.885 = 0.320
1.5B
R1-Distil--Qwen-
Insert Wrong Fact (Adv.)
0.7 0.909 + 0.288
1.5B
RI-Distill-Qwen
Insert Wrong Fact (Adv.)
0.9 0.937 0.243
1.5B
R RI-Distill-Qwen--144
Insert Wrong Fact (Adv.)
0.1 0.990 = 0.102
R R1-Distill-Qwen--14
Insert Wrong Fact (Adv.)
0.3 0.992 = 0.091
R RI-Distill-Qeen-14B
Insert Wrong Fact (Adv.)
0.5 0.994 = 0.075
1--Distil-QQwen-144
Insert Wrong Fact (Adv.)
0.7 0.992 =
EI-Distill-Qwenn-ll
Insert Wrong Fact (Adv.)
0.9 0.997
R RI-Distill-Qwee-52B
Insert Wrong Fact (Adv.)
0.1 0.986 0.119
R R1-Distill-Qwee-228
Insert Wrong Fact (Adv.)
0.3 0.986
R R-DDisilll-Qwen--28
Insert Wrong Fact (Adv.)
0.5 0.993 0.081
R RI-Distill-Qwen--22
Insert Wrong Fact (Adv.)
0.7 0.991 0.093
RI RI-Distill-QWwenn-2BB
Insert Wrong Fact (Adv.)
0.9 0.995 = 0.071
R RI-Distill-Qwen-71
Insert Wrong Fact (Adv.)
0.1 0.984 = 0.125
R RI-Distill-Qwen--7
Insert Wrong Fact (Adv.)
0.3 0.980 0.141
RI-Distill-Qwen-7B
Insert Wrong Fact (Adv.)
0.5 0.980 0.139
RI RI-Distill-Qwen--8
Insert Wrong Fact (Adv.)
0.7 0.985 = 0.120
R RI-Distill-Qwen--B
Insert Wrong Fact (Adv.)
0.9 0.106
EXAONE-Deep-32B
Rewrite Trace (Benign)
0.1 0.071
EXAONE-DDep-32B
Rewrite Trace (Benign)
0.3 0.996
EXAONE-DDeep-221
Rewrite Trace (Benign)
0.5 0.999
EXAONE EXAONE-Deep-322
Rewrite Trace (Benign)
0.7 0.995
EXAONE EXAONE-Deep-23 Deep-32B
Rewrite Trace (Benign)
0.9 0.997 0.056
Nematron-Llama-
Rewrite Trace (Benign)
0.1 0.804 0.397
B.-NNao-8BB
Nemotron-Llama-
Rewrite Trace (Benign)
0.3 0.880 = 0.324
3.1 3.1-Nano-8B
Nemotron-Llama-
Rewrite Trace (Benign)
0.5 0.906 = 0.292
3.1-Nano-8B
Nemotron-Llama-
Rewrite Trace (Benign)
0.7 0.921 = 0.270
3, 3.1-Nano-85
Cemotron-Llama
Rewrite Trace (Benign)
0.9 0.944 = 0.230
2.1-Nan-8BB
Phi-4-Reasoning-Pile
Rewrite Trace (Benign)
0.1 0.913 0.282
mhi-4-Reasoning-PPe Plus
Rewrite Trace (Benign)
0.3 0.904 = 0.295
Mhi-4-Rcasoning-PPle
Rewrite Trace (Benign)
0.5 0.903 = 0.295
mhi---Reasoning-PPe Plus
Rewrite Trace (Benign)
0.7 0.926 = 0.261
Mhii--Reasoning-PPie
Rewrite Trace (Benign)
0.9 0.918
QwQ-32B
Rewrite Trace (Benign)
0.991 0.092
QwQ-32B
Rewrite Trace (Benign)
0.3 0.990
QwQ-32B
Rewrite Trace (Benign)
0.5 0.993
QwQ-32B
Rewrite Trace (Benign)
0.7 0.989 0.105
QwQ-32B
Rewrite Trace (Benign)
0.9 0.991 0.094
RI-Distill-Llam--
Rewrite Trace (Benign)
0.1 0.779 0.415
Ed-Distiil-LLamm--81
Rewrite Trace (Benign)
0.3 0.827 + 0.379
Continued on next page
31

---

Published as a conference paper at ICLR 2026
Table 18: Robustness metrics (mean + std) per model, intervention, and timestep on the Math do- main.
Model
Intervention
Timestep
Mean + Std
RI-Distill-Llamal
Rewrite Trace (Benign)
0.5 0.877 0.329
D-Distill-Llama
Rewrite Trace (Benign)
0.7 0,930 = 0.255
RI-Distil--llmmal
Rewrite Trace (Benign)
0.9 0.962 = 0,190
RI RI-Distill-QP -wenl-
Rewrite Trace (Benign)
0.1 0.791 + 0.407
1.5B
RI-Distill-Owe -wen-
Rewrite Trace (Benign)
0.3 0.818 0.386
1.5B
R1-Distill-Qwen
Rewrite Trace (Benign)
0.5 0.862 + 0.345
1.5B
RI-Distill-Qwen
Rewrite Trace (Benign)
0.7 0.904 0.294
1,5B
RI-Distill-Qwen-
Rewrite Trace (Benign)
0.9 0.945 = 0.228
1.5B
R1 RI-Distill-Qwen-
14B
Rewrite Trace (Benign)
0.1 0.813 0.390
RI-Distill-Qwen- 14B
Rewrite Trace (Benign)
0.3 0.879 0.326
RI-Distill-Owen-143
Rewrite Trace (Benign)
0.5 0 0.278
R RI-Distill-Qwen--4B
Rewrite Trace (Benign)
0.7
0.940 = 0.237
R RI-Distill-Qwen-14B
Rewrite Trace (Benign)
0.9 0.969 0.173
R RI-Distill-Owen--2B
Rewrite Trace (Benign)
0.1 0.374
1--Disill-QOwen-325
Rewrite Trace (Benign)
0.3 0.313
D--Disiill-Qwen--333
Rewrite Trace (Benign)
0.5 0.265
R al-Distill-Owen-5255
Rewrite Trace (Benign)
0.7 0
R RI-Distill-QQeen-28
Rewrite Trace (Benign)
0.9
0.971 0.168
R RI-Distill--wen--7B
Rewrite Trace (Benign)
0.1
0.343
R RI-Distill-Qwen--8
Rewrite Trace (Benign)
0.3
0.899 0.302
RI RI-Distill-Qween-7B
Rewrite Trace (Benign)
0.5 0.942
RI RI-Distill-Qwen-77
Rewrite Trace (Benign)
0.7 0.954 = 0.209
RI Ei--Ditill-Qwenn-17
Rewrite Trace (Benign)
0.9 0.973 0.162
Table 19: Robustness metrics (mean + std) per model, intervention, and timestep on the Science domain.
Model
Intervention
Timestep Mean Std
EXAONE-Deep-32B
Add Random Text (Neu-
0.1 0.923 0.266
tral)
EXAONE-Deep-25
Add Random Text (Neu-
0.927 0.260
tral)
EXAONE-Deep-32) Add Random Text (Neu-
0.5 0.942 = 0.235
tral)
EXAONE-DDee-32BB Add Random Text (Neu-
0.7 0.948 0.222
tral)
EXAONE-Deep-
Add Random Text (Neu-
0.9 0.964 = 0.186
tral)
Nemotron-Llamm
Add Random Text (Neu-
0.1 0.890 0.313
-.
tral)
Nemotron Cemotron-Llama-
Add Random Text (Neu-
0.3 0.896 = 0.306
3.1-Nano-4 8B
tral)
Nemotron-Llama-
Add Random Text (Neu-
0.5 0.898 0.303
J.--Nao-8BB
tral)
Nemotron-Llama-
Add Random Text (Neu-
0.7 0.908 = 0.289
3. 3.1-Nano-83 8B
tral)
Nemotron-Lan Llama-
Add Random Text (Neu-
0.9 0.916 + 0.277
3. ---
tral)
Phi-4-Ke Mee--RRasoning-PPee
Add Random Text (Neu-
0.1 0.850 0.357
tral)
Continued on next page
32

---

Published as a conference paper at ICLR 2026
Table 19: Robustness metries (mean + std) per model, intervention, and timestep the Science domain.
Model
Intervention
Timestep
Mean Std
Mhii4-RRasoning-PHue
Add Random Text (Neu-
0.3 0.848 0.359
tral)
Phi-4-Reasoning-Puue
Add Random Text (Neu- tral)
0.5 0.860 = 0.347
Phi-4-Reasoning Plus
Add Random Text (Neu-
0.7 0.865 0.341
tral)
Phi-4-Reasoning-Plis
Add Random Text (Neu-
0.9 0.860 0.347
tral)
QwQ-32B
Add Random Text (Neu-
0.1 0.903 0.297
tral)
QwQ-32B
Add Random Text (Neu-
0.900 0.300
tral)
QwQ-32B
Add Random Text (Neu-
0.5 0.912 = 0.284
tral)
QwQ-32B
Add Random Text (Neu-
0.7 0.915 0.279
tral)
QwQ-32B
Add Random Text (Neu-
0.9 0.908 = 0.289
tral)
RI-Distil--lama-88
Add Random Text (Neu-
0.1 0.766 0.423
tral)
RI-Distill-Llane 8B
Add Random Text (Neu-
0.3 0.793 = 0.405
tral)
R1-Distill-Llama-B
Add Random Text (Neu-
0.5 0.807 0.394
tral)
R1-Distill-Llama-81 Random Text (Neu-
0.7 0.850 = 0.357
tral)
RI-Distill-Llama-
Add Random Text (Neu-
0.9 0.874 = 0.332
tral)
RI-Distill-Qwen
Add Random Text (Neu-
0.1 0.702 0.457
1,5B
tral)
R1-Distill-Qwer -eein-
Add Random Text (Neu-
0.3 0.690 = 0,462
1.5B
tral)
RI-Distill-Qwen-
Add Random Text (Neu-
0.5 0.737 0.440
1.5B
tral)
RI RI-Distill-QUas Dewiill-Qwen-
Add Random Text (Neu-
0.7 0.744 = 0.437
1.5B
tral)
RI-Distill-Qwar
Add Random Text (Neu-
0.9 0.768 0.422
1.5B
tral)
R1-Distill-Qwen-
Random Text (Neu-
0.910 = 0.286
tral)
RI-Distill-Wwen 14B
Add Random Text (Neu-
0.3 0.913 0.281
tral)
EI-Distill-Qwen- 14B
Add Random Text (Neu-
0.5 0.915 0.279
tral)
RI-Distill- Swelll--een-llle 14B
Add Random Text (Neu-
0.7 0.924 = 0.265
tral)
RI-Distill-Owen-Ia
Add Random Text (Neu-
0.9 0.930 0.256
tral)
R1-Distill-Qwen--2B
Add Random Text (Neu-
0.1 0.919 = 0.273
tral)
RI-Distill-Qwen-222
Add Random Text (Neu-
0.3 0.923 0.267
tral)
L-Diitill-Qwen--33
Add Random Text (Neu-
0.5 0.899 = 0.301
tral)
R1 Rt-Distill-Qwen-22
Add Random Text (Neu-
0.7 0.910 0.286
tral)
RI-Distill- Distill-Qwen-32D
Add Random Text (Neu-
0.9 0.916 0.277
tral)
Continued on next page
33

---

Published as a conference paper at ICLR 2026
Table 19: Robustness metries (mean + std) per model, intervention, and timestep the Science domain.
Model
Intervention
Timestep
Mean Std
RI-Distill-Qwen-71
Add Random Text (Neu-
0.1 0.871 0.335
tral)
RI-Distill-Qwen-7B
Add Random Text (Neu- tral)
0.3 0.882 = 0.323
E1-Distill-Qwen-
Add Random Text (Neu-
0.5 0.872 0.334
tral)
RI-Distill-Qwen-71
Add Random Text (Neu-
0.7 0.871 = 0.335
tral)
R1-Distill-Qwen-7B
Add Random Text (Neu- tral)
0.9 0.878 0.328
LLAONE-Deep-32
Complete Step (Benign)
0,983 0.130
EXAONE-Deep-320
Complete Step (Benign)
0.3 0.976 = 0.152
EXAONE-Deepp
Complete Step (Benign)
0.5 0.971 = 0.168
EXAONE-Deep-328
Complete Step (Benign)
0.7 0.976 0.154
EXAONE-Dccp-320
Complete Step (Benign)
0.9 0.985 0.122
Nemotron -emotron-Llama-
Complete Step (Benign)
0.1 0.892 = 0.310
3.1-Nano-8B
Nemotron-Llamee
Complete Step (Benign)
0.3 0.902 = 0.298
3.
Nemotron Llama-
Complete Step (Benign)
0.5 0,916 0.278
3, 3.1-Nano-88 &B
Nemotron-L -lama-
Complete Step (Benign)
0.7 0.920 + 0.271
3. 1--Nano-8B
Nemotron-LLlama
Complete Step (Benign)
0.9 0.937 0.244
3. 1.--Nno-8B
Mhi-4-Reasooing-PPM
Complete Step (Benign)
0.1 0.865 + 0.341
Phi-4-Reasoning-PPe Plus
Complete Step (Benign)
0.3 0.866 = 0.340
Phi---Reasoning-Ple Pluus
Complete Step (Benign)
0.5 0.859 0.348
Phi-4-Reasoning- -luss
Complete Step (Benign)
0.7 0.872 0.334
Mhi-4-Reasoning-PPP
Complete Step (Benign)
0.9 0.878 = 0.328
QwQ-32B
Complete Step (Benign)
0.1 0.930 = 0.256
QwQ-32B
Complete Step (Benign)
0.3 0.923 0.267
QwQ-32B
Complete Step (Benign)
0.5 0.924 0.265
QwQ-32B
Complete Step (Benign) Complete Step (Benign)
0.7 0.931 0.254
QwQ-32B
0.9 0.917 0.276
R1-Distill-Llamass 8B
Complete Step (Benign) Complete Step (Benign) Complete Step (Benign)
0.1
RI-Distil--Llams
0.3 0.801 0.399
R R1-Distill-LLlmm--00
0.5 0.31100.99
RI-Distill-LLama--8
Complete Step (Benign)
0.7 0
R RI-Distill-Llama-88
Complete Step (Benign)
0.9 0.862 + 0.345
RI-Distill-Qwen-
Complete Step (Benign)
0.1 0.782
1.B
RI-Distill-Qwen-
Complete Step (Benign)
0.3 0.778 = 0.416
1.5
R1 E1-Distill-Qwen
Complete Step (Benign)
0.5 0.821 = 0.383
1.5B
RI-Distill-Qwen-
Complete Step (Benign)
0.7 0.831 0.375
1.5B
R1-Distill-Qwen-
Complete Step (Benign)
0.9 0.863 + 0.344
1.5B
RI-Distill-Qwent
Complete Step (Benign)
0.1 0.909 0.288
RI-Distill-Qwen- 14B
Complete Step (Benign)
0.3 0,912 0.284
RI-Distill-Qwen-II 14B
Complete Step (Benign)
0.5 0.915 = 0.280
RI RI-Distill-Qwenn-48
Complete Step (Benign)
0.7 0.931 = 0.254
R Ri-Disilll-Qeen-14
Complete Step (Benign)
0.9 0.918 0.275
RI Ri-Disiill-Qwen-322
Complete Step (Benign)
0.1 0.916 0.277
R RI-Distill-Qwen-32B
Complete Step (Benign)
0.3 0.913 = 0.282
RI RI-Distill-Qwen-52B
Complete Step (Benign)
0.5 0.916 + 0.278
Continued on next page
34

---

Published as a conference paper at ICLR 2026
Table 19: Robustness metries (mean + std) per model, intervention, and timestep the Science domain.
Model
Intervention
Timestep Mean Std
RI-Distill-Qwen-
Complete Step (Benign)
0.7 0.903 0.296
H.-DistillQween----
Complete Step (Benign)
0.9 0,921 0.270
RI-Distill-Qwea--B
Complete Step (Benign)
0.1 0.898 = 0.302
R
Complete Step (Benign)
0.3 0.914 = 0.280
RI R1-Distill-Qwaar Qwen-7B
Complete Step (Benign)
0.5 0.881 = 0.324
RI-Distill- RI-Distill-Owen-77
Complete Step (Benign)
0.7 0.894 0.308
RI-Distill-Qwen--B
Complete Step (Benign)
0.9
0,906 = 0.292
EXAONE-DDee-32BB
Continue
Unrelated
0.1
0.516 0.500
(Adv.)
EXAONE-Deep-325
Continue
Unrelated
0.3 0.648 0.478
(Adv.)
EXAONE-Deep-325
Continue
Unrelated
0.5 0.754 = 0.431
(Adv.)
EXAONE-Decp-328
Continue
Unrelated
0.7 0.826 0.379
(Adv.)
EXAONE- EXAONE-Deep-328
Continue
Unrelated
0.9 0.859 = 0.348
(Adv.)
Nemotron-Lland
Continue
Unrelated
0.1 0.720 0.449
3.1-Nano-8B
(Adv.)
Nemotron Llama-
Continue
Unrelated
0.3 0.790 0.407
3.1-Nano-88 8B
(Adv.)
Nemotron-Llame Llama-
Continue (Adv.)
Unrelated
0.5 0.856 + 0.352
3. 11-Nano-8B
Nemotron-LLlam-
Continue
Unrelated
0.7 0.878 0.328
---ann-88B
(Adv.)
Nemotron-Llama-
Continue
Unrelated
0.9 0.914 = 0.280
3. 3.
(Adv.)
Thi-4-Reasoning-Piu
Continue
Unrelated
0.1 0.869 0.337
(Adv.)
Bhi-4-Raasoning-PPe
Continue
Unrelated
0.3 0.864 = 0.343
(Adv.)
Phiso-Reasoning-Plus
Continue
Unrelated
0.5 0.878 0.328
(Adv.)
Mhi-4-Reasoning-Plae
Continue
Unrelated
0.883 0.321
(Adv.)
Mhii--Reasonin-Plue
Continue
Unrelated
0.9 0.858 = 0.349
(Adv.)
QwQ-32B
Continue
Unrelated
0.1 0.915 0.279
(Adv.)
QwQ-32B
Continue (Adv.)
Unrelated
0.3 0.926 = 0.261
QwQ-32B
Continue
Unrelated
0.5 0.914 0.280
(Adv.)
QwQ-32B
Continue (Adv.)
Unrelated
0.7 0.926 = 0.262
QwQ-32B
Continue (Adv.)
Unrelated
0.9 0.923 0.267
RI-DistillLLamm-88
Continue
Unrelated
0.760 0.427
(Adv.)
R1-Distill-Llame
Continue
Unrelated
0.3 0.791 = 0.407
(Adv.)
RI-Distill-Llam--B1
Continue
Unrelated
0.5 0.824 0.381
(Adv.)
R1-Distill-Llama-8
Continue
Unrelated
0.7 0.834 = 0.372
(Adv.)
RI-Distill-Llama-e
Continue
Unrelated
0.9 0.873 0.333
(Adv.)
Continued on next page
35

---

Published as a conference paper at ICLR 2026
Table 19: domain.
Robustness metries (mean + std) per model, intervention, and timestep the Science
Model
Intervention
Timestep
Mean Std
RI-Distill-Qwen-
Continue
Unrelated
0.1 0.753 0.431
1.5B
(Adv.)
RI-Distil--Qwen-
Continue (Adv.)
Unrelated
0.3 0.771 = 0.420
1,5B
RI-Distill-Quw Bewiill-Qwen-
Continue (Adv.)
Unrelated
0.5 0.802 0.399
1,5B
RI-Distill-Qwen-
Continue
Unrelated
0.7 0.798 0.402
1.5B
(Adv.)
R RI-Distill-Qwen-
Continue
Unrelated
0.9 0.827 0.378
1.5B
(Adv.)
S--iisiil-Qween 14B
Continue
Unrelated
0.859 0.348
(Adv.)
E1-Distill-Qwen
Continue
Unrelated
0.3 0.902 = 0.297
(Adv.)
Et-Distill-Qwen--
Continue
Unrelated
0.5 0.911 0.285
(Adv.)
RI-Distill-Qwen-141
Continue
Unrelated
0.7 0.920 = 0.271
(Adv.)
RI-Distill-Qeen-14B
Continue
Unrelated
0.9 0.918 0.274
(Adv.)
RI-Distill LiiDiiill-ween-2222 Qwen-32B
Continue (Adv.)
Unrelated
0.1 0.896 = 0.305
RI-Disill--Qenn-22R
Continue (Adv.)
Unrelated
0.3 0.917 0.276
RI-Distill-Qwen-32B
Continue
Unrelated
0.5 0.908 = 0.289
(Adv.)
RI-Distill-Qwen-221
Continue
Unrelated
0.7 0.913 = 0.281
(Adv.)
J.-Distill-Qeen-33
Continue
Unrelated
0.9 0.922 0.268
(Adv.)
Rt-Dissill-Qwen-7B
Continue
Unrelated
0.1 0.904 = 0.295
(Adv.)
RI-Distill-Qwen-71
Continue
Unrelated
0.3 0.900 0.300
(Adv.)
RI-Distill- Destill-Qwen-7B
Continue
Unrelated
0.5 0.890 = 0.313
(Adv.)
U.-DistillQwee--11
Continue
Unrelated
0.7 0.900 0.299
(Adv.)
R1-Distill-Qwen-77
Continue
Unrelated
0.9 0.903 = 0.296
(Adv.)
EXAONE-Deep-32B
Ctn. Wrong Reasoning
0.1 0.976 0.154
(Adv.)
EXAONE-Deep-32B
Cin. Wrong Reasoning
0.981 0.138
(Adv.)
EXAONE-Decp-33
Ctn. Wrong Reasoning
0.5 0.977 = 0.149
(Adv.)
EXAONE--Deep-22B
Ctn. Wrong Reasoning
0.7 0.983 0.130
(Adv.)
EXAONE-DDec-32B
Ctn. Wrong Reasoning
0.9 0.990 = 0.101
(Adv.)
Nemotron-Llama-
Ctn. Wrong Reasoning
0.1 0.893 0.309
3.1-Nano-8B
(Adv.)
Nemotron-Llamee
Ctn. Wrong Reasoning
0.3 0.907 = 0.290
3. 2.1-Nao-8BB
(Adv.)
Nemotron-Llama-
Ct.. Wrong Reasoning (Adv.)
0.5 0.914 0.280
3. ---Nano-8B
Nemotron-Llamaa
Cin. Wrong Reasoning
0.922 0.269
3.1 1.--Nao-8BB
(Adv.)
Continued on next page
36

---

Published as a conference paper at ICLR 2026
Table 19: Robustness metries (mean + std) per model, intervention, and timestep the Science domain.
Model
Intervention
Timestep
Mean Std
Nemotron-Llama-
Cin. Wrong Reasoning
0.9 0.924 0.265
3.1-Nano-8B
(Adv.)
Phi-4-Reasoning-Plue
Ctn. Wrong Reasoning
0.1 0.882 = 0.323
(Adv.)
Phi-4-Reasoning Plus
Ctn. Wrong Reasoning (Adv.)
0.3 0.883 0.321
Phi-4-Reasoning-Piig
Ctn. Wrong Reasoning (Adv.)
0.5 0.881 = 0.324
Phi-4-Reasoning-Pliss
Ctn. Wrong Reasoning
0.7 0.891 0.311
(Adv.)
Thi-4-Reasoning-PPP
Ctn. Wrong Reasoning
0.9 0.877 0.329
(Adv.)
QwQ-32B
Ctn. Wrong Reasoning
0.1 0.923 = 0.266
(Adv.)
QwQ-32B
Ct.. Wrong Reasoning
0.3 0.926 0.261
(Adv.)
QwQ-32B
Ctn. Wrong Reasoning
0.5 0.917 = 0.276
(Adv.)
QwQ-32B
Ctn. Wrong Reasoning
0.7 0.926 0.261
(Adv.)
QwQ-32B
Ctn. Wrong Reasoning
0.9 0.919 = 0.273
(Adv.)
R1-Distill-JJmm--88
Ctn. Wrong Reasoning
0.1 0.755 0.430
(Adv.)
R1-Distill-Llmm--B
Ctn. Wrong Reasoning
0.3 0.792 = 0.406
(Adv.)
RI-Distill-Llam--88
Cin. Wrong Reasoning
0.5 0.824 = 0.381
(Adv.)
RI-Distill-Llama-
Ctn. Wrong Reasoning
0.7 0.825 0.380
(Adv.)
Ctn. Wrong Reasoning (Adv.)
0.9 0,865 = 0.341
RI-Distill-Qwen
Ctn. Wrong Reasoning
0.1 0.737 0.440
1.5B
(Adv.)
RI I1-Distill-Qwen
Ctn. Wrong Reasoning (Adv.)
0.3 0.769 = 0.421
1.5B
RI-Distill-Qwei
Ctn. Wrong Reasoning
0.5 0.793 0.405
1.5B
(Adv.)
RI-Distill-Qwen
Ctn. Wrong Reasoning (Adv.)
0.7 0.807 = 0.394
1.5B
RI-Distill-Qwen-
Ctn. Wrong Reasoning
0.9 0.838 0.368
1.SB
(Adv.)
RI-DistillQWeen-I
Cin. Wrong Reasoning
0.909 0.288
(Adv.)
R1-Distill- Sirill--wen-lll 14B
Ctn. Wrong Reasoning (Adv.)
0.3 0.916 = 0.277
RI-Distill-Qwen--A.
Ctn. Wrong Reasoning (Adv.)
0.5 0.931 0.253
R1-Distill-Qwen-144
Ctn. Wrong Reasoning
0.7 0.930 = 0.256
(Adv.)
RI-Distill-Qwen-
Ctn. Wrong Reasoning
0.9 0.927 0.260
(Adv.)
L--iisill-Qwen--33
Ctn. Wrong Reasoning (Adv.)
0.914 = 0.280
R1- RI-Distill-Qwen-B22
Ct.. Wrong Reasoning (Adv.)
0.3 0.918 0.274
Distill-QQeen32B
Cin. Wrong Reasoning
0.5 0.904 0.295
(Adv.)
Continued on next page
37

---

Published as a conference paper at ICLR 2026
Table 19: Robustness metries (mean + std) per model, intervention, and timestep the Science domain.
Model
Intervention
Timestep
Mean Std
RI-Distill-Ween-22B
Cin. Wrong Reasoning
0.7 0.915 0.280
(Adv.)
RI-Distill-Qwen-32B
Ctn. Wrong Reasoning
0.9 0.923 = 0.267
(Adv.)
RI-Distill-Qwen-
Ctn. Wrong Reasoning
0.1 0.893 0.309
(Adv.)
RI-Distill-Qwen-78
Ctn. Wrong Reasoning
0.3 0.896 0.306
(Adv.)
R1-Distil--wwen-7B
Ctn. Wrong Reasoning
0.5 0.894 0.307
(Adv.)
A1-Distill-Qwen-73
Cin. Wrong Reasoning
0.905 0.293
(Adv.)
RI-Distill-Qwen-12
Ctn. Wrong Reasoning
0.9 0.910 = 0.286
(Adv.)
EXAONE-Decp-32B
Insert Random Charac- ters (Neutral)
0.1 0.978 0.147
EXAONE-Deep-32B
Insert Random Charac-
0.3 0.979 = 0.142
ters (Neutral)
EXAONE-Deep-32B
Insert Random Charac-
0.5 0.979 0.142
ters (Neutral)
KLAONE-Deep-321
Insert Random Charac-
0.7 0.980 = 0.140
ters (Neutral)
EXAONE-Deeq-32B
Insert Random Charac-
0.9 0.988 0.108
(Neutral)
Nemotron-L
Insert Random Charac-
0.839 = 0.368
3.1-Nano-8B 8B
ters (Neutral)
Semotron-Llamae
Insert Random Charac-
0.3 0.866 = 0.340
1.-Nano-8B
ters (Neutral)
Nemotron-Llame
Insert Random Charac-
0.5 0.879 0.326
3, 3.1-Nano-8B
ters (Neutral)
Nemotron-Llame
Insert Random Charac-
0.7 0.891 = 0.311
3. 3.1-Nano8BB
ters (Neutral)
Nemotron-Llama-
Insert Random Charac-
0.9 0.891 0.311
3.1 B.1-Nano8BB
ters (Neutral)
Rehs--Reasnnig--PP -Pus
Insert Random Charac-
0.1 0.854 = 0.353
ters (Neutral)
Thi---Reasoning-PP
Insert Random Charac- (Neutral)
0.3 0.852 0.355
Mhi-4-Raasoning-PPH
Insert Random Charac-
0.5 0.860 = 0.347
ters (Neutral)
Miii--Reasoning-Puus
Insert Random Charac-
0.7 0.859 0.348
ters (Neutral)
Phi-4-Reasoning-Plus
Insert Random Charac-
0.9
0.324
ters (Neutral) Insert Random Charac-
QwQ-32B
0.1 0.931 = 0.253
ters (Neutral) Insert Random Charac-
QwQ-32B
0.3 0.925 0.263
ters (Neutral) Insert Random Charac-
QwQ-32B
0.5 0.920 = 0.271
ters (Neutral)
QwQ-32B
Insert Random Charac-
0.7 0.920 0.271
ters (Neutral)
QwQ-32B
Insert Random Charac-
0.9 0.915 = 0.279
ters (Ncutral)
R1-Distill-Llama-B8
Insert Random Charac-
0.1 0.753 0.431
ters (Neutral)
RI-Distill-Llame
Insert Random Charac-
0.779 0.415
ters (Neutral)
Continued on next page
38

---

Published as a conference paper at ICLR 2026
Table 19: Robustness metries (mean + std) per model, intervention, and timestep the Science domain.
Model
Intervention
Timestep
Mean Std
RI-Distil-Llama-8B
Insert Random Charac-
0.5 0.820 0.384
ters (Neutral)
RI-Distil--Llmm--B
Insert Random Charac-
0.7 0.844 = 0.363
ters (Ncutral)
D-istill-Llamaa
Insert Random Charac-
0.9 0.871 0.336
ters (Neutral)
RI-Distill-Qwen
Insert Random Charac- ters (Neutral)
0.745 = 0.436
1.5B
R RI-Distill-Qwen
Insert Random Charac-
0.3 0.778 0,415
1.5B
ters (Neutral)
RI-Distil--Qwen
Insert Random Charac- ters (Neutral)
0.5 0.805 0.396
1,5B
RI-Distill-Wwen
Insert Random Charac-
0.7 0.810 = 0.393
1.5B
ters (Neutral)
RI-Distill-Qwen-
Insert Random Charac-
0.9 0.837 0.369
1.5B
ters (Neutral)
RI-Distill-Qwen-144
Insert Random Charac-
0.1 0.905 = 0.293
ters (Neutral)
RI-Distill-Qwen-145
Insert Random Charac-
0.3 0.904 0.295
ters (Neutral)
RI-Distill Diitiill-wenn-lll- Qwen-14B
Insert Random Charac-
0.5 0.929 = 0.257
ters (Neutral)
R1-Distill-Qwen-14
Insert Random Charac-
0.7 0.929 0.258
(Neutral)
R1-Distill-Qwen-11
Insert Random Charac-
0.9 0.926 = 0.261
ters (Neutral)
RI-Distill-Qwen-32B
Insert Random Charac-
0.1 0.926 = 0.261
ters (Neutral)
R1-Distill-Qwen--22
Insert Random Charac-
0.3 0.912 0.284
ters (Neutral)
R1-Distill-Qwen-322 Insert Random Charac-
0.5 0.917 = 0.276
ters (Neutral)
RI-Disiill-Qeen-32B
Insert Random Charac-
0.7 0.915 0.279
ters (Neutral)
RI-Distill-Qwenn
Insert Random Charac-
0.9 0.926 = 0.262
ters (Neutral)
RL-Distill-Qwen--
Insert Random Charac- (Neutral)
0.1 0.862 0.345
RI-Distill-Qwen-7B
Insert Random Charac-
0.3 0.874 = 0.332
ters (Ncutral)
RI-Distill-Qwen-7B
Insert Random Charac-
0.5 0.864 = 0.343
ters (Neutral)
RI-DistillQWwen-7B
Insert Random Charac-
0.870 0.336
ters (Neutral)
RI-Distill-Qwen-2
Insert Random Charac-
0.9 0.856 = 0.351
ters (Neutral)
EXAONE-DDeq-32B
Insert Wrong Fact (Adv.)
0.1 0.982 0.134
EXAONE-DDep-32B
Insert Wrong Fact (Adv.)
0.3 0.981 0.138
EXAONE-Decc-322B
Insert Wrong Fact (Adv.)
0.5 0.979 = 0.144
EXAONE-Deep-23
Insert Wrong Fact (Adv.)
0.7 0.984 = 0.126
EXAONE-Deep-32
Insert Wrong Fact (Adv.)
0.9 0.985 0.120
Nemotron-LLann -lama-
Insert Wrong Fact (Adv.)
0.904 0.295
3.1 1-Nano-8B
Nemotron-Llame
Insert Wrong Fact (Adv.)
0.3 0.900 + 0.300
3.1 -a-
Nemotron-Llamee
Insert Wrong Fact (Adv.)
0.5 0.917 0.276 0.276
3.1-Nano-8B
Continued on next page
39

---

Published as a conference paper at ICLR 2026
Table 19: Robustness metries (mean + std) per model, intervention, and timestep the Science domain.
Model
Intervention
Timestep Mean Std
Wemotron-Llamal
Insert Wrong Fact (Adv.)
0.7 0.915 0.280
3.1-Nano-8B
Nemotron-Llama
Insert Wrong Fact (Adv.)
0.9 0.926 + 0.261
3.1 3.1-Nano-8B
Reasonigg Plus
Insert Wrong Fact (Adv.)
0.1 0.868 0.339
Phi-4-Reasoning -luus
Wrong Fact (Adv.)
0.3 0.879 0.326
Mhi-4-Reasoning-PPM
Insert Wrong Fact (Adv.)
0.5 0.874 0.331
"hi-4-Reasoning-Piie
Insert Wrong Fact (Adv.)
0.7 0.870 = 0.336
Phi-4-Reusoning-Plus
Insert Wrong Fact (Adv.)
0.9 0.882 = 0.323
QwQ-32B
Insert Wrong Fact (Adv.)
0.1 0.927 0.260
QwQ-32B
Insert Wrong Fact (Adv.)
0.3 0,927 0.259
QwQ-32B
Insert Wrong Fact (Adv.)
0.5 0.919
QwQ-32B
Insert Wrong Fact (Adv.)
0.7 0.216
QwQ-32B
Insert Wrong Fact (Adv.)
0.9 0.918
RI-Distill-Llmm--8
Insert Wrong Fact (Adv.)
0.1 0.760
RI-Distill-LLama-B8
Insert Wrong Fact (Adv.)
0.3 0.798
RI-Distill-Llama--8
Insert Wrong Fact (Adv.)
0.5 0.821 0.383
R RI-Distill-Llama-8B
Insert Wrong Fact (Adv.)
0.7 0.840
R RI-Distill-Llmm--8B
Insert Wrong Fact (Adv.)
0.9 0.873
RI-Distill-Qwwi -wwnn
Insert Wrong Fact (Adv.)
0.1 0.761 0.427
1,5
RI R1-Distill-Qwen
Insert Wrong Fact (Adv.)
0.3 0.786 + 0,410
1.5B
R1-Distill-Qwen
Insert Wrong Fact (Adv.)
0.5 0.795 0.403
1.5B
RI-Distill-Qwen-
Insert Wrong Fact (Adv.)
0.7 0.827 = 0.378
1.5B
RI-Distill-Qwen-
Insert Wrong Fact (Adv.)
0.9 0.857 0.350
1.5B
I-Distill-Qwen-
14B
Insert Wrong Fact (Adv.)
0.1 0.900 = 0.300
RI E1-Distill-Owen--lu 14B
Insert Wrong Fact (Adv.)
0.3 0.920 = 0.271
R RI-Distill-Qwen-145
Insert Wrong Fact (Adv.)
0.5 0.924 = 0.265
R RI-Dissill-Qwen-14B
Insert Wrong Fact (Adv.)
0.7 0.927 0.260
RI-Distill-Qwen-14B
Insert Wrong Fact (Adv.)
0.9 0.927 = 0.259
RI RI-Dissill-Qween-3BB
Insert Wrong Fact (Adv.)
0.1 =
RI RI-DistillQQwen-32B
Insert Wrong Fact (Adv.)
0.3 0.279
R RI-Distill-Qwen-325
Insert Wrong Fact (Adv.)
0.5 0.907 0.290
R RI-Disilll-Qwen--22
Insert Wrong Fact (Adv.)
0.7 0.276
R RI-Distill-Qween-22B
Insert Wrong Fact (Adv.)
0.9 0.920 0.271
R RI-Distill-Qwen--8
Insert Wrong Fact (Adv.)
0.1 0.886 + 0.318
R II-Distill-Qwen--1
Insert Wrong Fact (Adv.)
0.3 0.900 = 0.299
R RI-Distill-Owen--1B
Insert Wrong Fact (Adv.)
0.5 0.890
RI RI-Distill-Qeen--1
Insert Wrong Fact (Adv.)
0.7 0.906
RI-Distill-Qwen-78
Insert Wrong Fact (Adv.)
0.9 0 0,300
XXAONE-Dep-332
Rewrite Trace (Benign)
0.1 2
EXAONE-Deep-320
Rewrite Trace (Benign)
0.3 0.977 0.149
EXAONT--Dee--22
Rewrite Trace (Benign)
0.5 0.974
EXAONE-DDee-32B
Rewrite Trace (Benign)
0.7 0
EXAONE-Decc-32BB
Rewrite Trace (Benign)
0.9 0.971
Nemotron-Llamee
Rewrite Trace (Benign)
0.1 0.756 + 0.430
3.1-Nano-8B
Nemotron-LLian -Lamm--
Rewrite Trace (Benign)
0.3 0.814 0.389
3. 1--Nano-8B
Nemotron-Llame
Rewrite Trace (Benign)
0.5 0.843 + 0.364
3.1- ---Nano-8B
Nemotron-Llamat
Rewrite Trace (Benign)
0.7 0.878 0.327
3.1-Nano-8B
Continued on next page
40

---

Published as a conference paper at ICLR 2026
Table 19: Robustness metries (mean + std) per model, intervention, and timestep the Science domain.
Model
Intervention
Timestep
Mean Std
Nemotron-Llama-
Rewrite Trace (Benign)
0.9 0.904 0.295
3.1-Nano-8B
Bhii4--Raasoning-Pie
Rewrite Trace (Benign)
0.1 0.859 = 0.348
mnii--RRaasning-PPP Plus
Rewrite Trace (Benign)
0.3 0,856 = 0.352
Thi-4-Reasoning Plus
Rewrite Trace (Benign)
0.5 0.843 0.364
Phi-4-Reasoning- -luus
Rewrite Trace (Benign)
0.7 0.845 0.362
Phi-4-Reasoning-Plue
Rewrite Trace (Benign)
0.9 0.869 0.338
QwQ-32B
Rewrite Trace (Benign)
0.1 0.919 = 0.273
QwQ-32B
Rewrite Trace (Benign)
0.3 0.919 = 0.272
QwQ-32B
Rewrite Trace (Benign)
0.5 0.927 0.260
QwQ-32B
Rewrite Trace (Benign)
0.7 0,933 0.250
QwQ-32B
Rewrite Trace (Benign)
0.9 0.936 0.244
R1-Distill-Llama-88
Rewrite Trace (Benign)
0.1 0.555 = 0.497
RI-Distill-Llama-88
Rewrite Trace (Benign)
0.3 0.633 = 0.482
RI-Distill-Llmm--8
Rewrite Trace (Benign)
0.5 0.721 0.449
RI-Distill-LLama--8
Rewrite Trace (Benign)
0.7 0.787 = 0.409
RI-Distill-Llama-8B
Rewrite Trace (Benign)
0.9 0
RI-Distil--Qwen-
Rewrite Trace (Benign)
0.1 0.667 = 0.471
1.SB
Disstill-Qwee
Rewrite Trace (Benign)
0.3 0.731 0.444
1,5B
R1 I1-Distill-Wwen
Rewrite Trace (Benign)
0.5 0.838 = 0.368
1.5B
RI-Distill-Qwen-
Rewrite Trace (Benign)
0.7 0.841 0.365
1.5B
RI-Distill-Qwen-
Rewrite Trace (Benign)
0.9 0.854 + 0.353
1.5B
RI-Distill-Qwen-IHe
Rewrite Trace (Benign)
0.1 0.701 0.458
RI-Distill-Qwen 14B
Rewrite Trace (Benign)
0.3 0.795 0.404
H-Distill-Qwen-
Rewrite Trace (Benign)
0.5 0.857 = 0.350
R RI-Distill-wwen-lle
Rewrite Trace (Benign)
0.7 0,878 = 0.327
R RI-Disilll-Qwen-14B
Rewrite Trace (Benign)
0.9 0.903 = 0.297
R RI-Dissill-Qwen--2B
Rewrite Trace (Benign)
0.1 0.772
R RI-Distill-Qwen--2B
Rewrite Trace (Benign)
0.3 0.832
RI RI-Distill-QQeen-32B
Rewrite Trace (Benign)
0.5 0.839 0.367
RI 1--istill-Qwen-32B
Rewrite Trace (Benign)
0.7 0.314
RI RI-Distill-Qwen-322
Rewrite Trace (Benign)
0.9 0.313
R RI-Distill-Qwen--7
Rewrite Trace (Benign)
0.1
R RI-Distill-Qwen--B
Rewrite Trace (Benign)
0.3 0.821 0.383
RI Ei-Dissill-Qwen-7B
Rewrite Trace (Benign)
0.5 0.855 = 0.352
RI E1-Distill-Qwen--7
Rewrite Trace (Benign)
0.7 0.869 0.337
RI RI--Ditill-Qween-BB
Rewrite Trace (Benign)
0.9 0.884 0.321
Table 20: Robustness metrics (mean + std) per model, intervention, and timestep on the Logic
domain.
Model
Intervention
Timestep Mean Std
EXAONE-Deep-32B
Add Random Text (Neu-
0.1 0.901 0.298
tral)
EXAONE-DDep-322
Add Random Text (Neu- tral)
0.3 0.915 = 0.278
EXAONE-Deep-302
Add Random Text (Neu-
0.5 0.931 + 0.253
tral)
EXAONE-Dccp-32B
Add Random Text (Neu-
0.7 0.948 0.222
tral)
Continued on next page
41

---

Published as a conference paper at ICLR 2026
Table 20: domain.
Robustness metrics (mean std) per model, intervention, and timestep the Logic
Model
Intervention
Timestep
Mean Std
EXAONE-Deep-320
Add Random Text (Neu-
0.9 0.962 0.192
tral)
Nemotron-Llamme
Add Random Text (Neu-
0.1 0.909 = 0.287
3.1-Nano-83 -B
tral)
Nemotron-L -laroa---aaa----
Add Random Text (Neu-
0.3 0.936 0.245
3.1-Nano-8B
tral)
Nemotron-Llama
Add Random Text (Neu-
0.5 0.949 = 0.220
3. 3.1-Nano-8B
tral)
Nemotron-L.lma-
Add Random Text (Neu-
0.7 0.963 0. 0.188
3.1-Nao-8BB
tral)
Nemotron-Liann Llama-
Add Random Text (Neu-
0.9 0.967 0.178
3, 3.1-Nano-8B
tral)
Mhi-4-Reasoning-PPe Plus
Add Random Text (Neu- tral)
0.1 0.938 = 0.241
mhi-4-Reasoning-PPe
Add Random Text (Neu-
0.3 0.944 0.229
tral)
Phi-4-Reasoning-Plus
Add Random Text (Neu-
0.5 0.940 = 0.237
tral)
Phi-4-Reasoning-Plus
Add Random Text (Neu-
0.7 0.941 0.236
tral)
Mea--RRasoning-PPP Plus
Add Random Text (Neu-
0.9 0.939 = 0.240
tral)
QwQ-32B
Add Random Text (Neu-
0.1 0.963 0.189
tral)
QwQ-32B
Add Random Text (Neu-
0.3 0.975 = 0.157
tral)
QwQ-32B
Add Random Text (Neu-
0.5 0.977 = 0.149
tral)
QwQ-32B
Add Random Text (Neu-
0.7 0.981 0.136
tral)
QwQ-32B
Add Random Text (Neu-
0.9 0.977 = 0.149
tral)
RI-Distil-Llama--B
Add Random Text (Neu-
0.1 0.927 0.261
tral)
EI-Distill-Llamaa
Add Random Text (Neu-
0.3 0.960 = 0.197
tral)
RI-Distill-Llamas
Add Random Text (Neu-
0.5 0.960 0.197
tral)
RI-Distill-Llama-88 Random Text (Neu-
0.7 0.964 = 0.186
tral)
RI-Distill-Llam--B
Add Random Text (Neu-
0.9 0.979 = 0.144
tral)
RI-Distill-Wwen
Add Random Text (Neu-
0.570 0.495
1,5
tral)
RI R1-Distill-Qwar
Add Random Text (Neu-
0.3 0.599 = 0.490
1.5B
tral)
RI-Distill-Qwen-
Add Random Text (Neu-
0.5 0.630 0.483
1.5B
tral)
R1-Distill-Qwen-
Add Random Text (Neu-
0.7 0.646 = 0.478
1.5B
tral)
RI-Distill-Qwent
Add Random Text (Neu-
0.9 0.724 0.447
1.5B
tral)
R1-Distill-Qwen 14B
Add Random Text (Neu-
0.969 = 0.173
tral)
R1 RI-Distill-Qwen- 14B
Add Random Text (Neu-
0.3 0.985 0.121
tral)
RI-Distill-Qwen Qwen--eeeennBB
Add Random Text (Neu-
0.5 0.988 0.107
tral)
Continued on next page
42

---

Published as a conference paper at ICLR 2026
Table 20:
Robustness metrics (mean std) per model, intervention, and timestep the Logic
domain.
Model
Intervention
Timestep
Mean Std
RI-Distill-Qwen- 14B
Add Random Text (Neu-
0.7 0.988 0.107
tral)
RI-Distill-Qwen--le
Add Random Text (Neu-
0.9 0.984 = 0.126
tral)
RI-Distill -Distill-Qwen--22
Add Random Text (Neu-
0.1 0.975 0.156
tral)
RI-Distill-Qwen-22B
Add Random Text (Neu-
0.3 0.982 0.133
tral)
RI-Distil--Qenn-22
Add Random Text (Neu-
0.5 0.989 0.103
tral)
H.-Distil-Qwen---
Add Random Text (Neu-
0.990 0.101
tral)
H-Distill-Qwen-222
Add Random Text (Neu-
0.9 0.989 = 0.105
tral)
Et-Distill-Qwen-7B
Add Random Text (Neu-
0.1 0.916 0.278
tral)
RI-Distill-Qwen-7B
Add Random Text (Neu-
0.3 0.918 = 0.274
tral)
RI-Distill-Qeen-7B
Add Random Text (Neu-
0.5 0.933 0.250
tral)
RI-Distill DDistill-Qwen-7B
Add Random Text (Neu-
0.7 0.927 = 0.261
tral)
R1-Disiill-Qwen-78
Add Random Text (Neu- tral)
0.9 0.945 0.228
EXAONE-Decp-322
Complete Step (Benign)
0.993 = 0.080
-XAONE-Deep-30
Complete Step (Benign)
0.3 0.996 + 0.062
EXAONE-Deep-32B
Complete Step (Benign)
0.5 0.998 = 0.039
EXAONE-Deep-32B
Complete Step (Benign)
0.7 0.999 0.028
EXAONE-Deep-31
Complete Step (Benign)
0.9 0.999 0.028
Nemotron-Llane
Complete Step (Benign)
0.1 0.974 0.160
3. 2.1-Nao-881 8B
Nemotron-Llama-
Complete Step (Benign)
0.3 0.978 = 0.146
B.-Naao-8BB
Nemotron-Llama-
Complete Step (Benign)
0.5 0.981 = 0.136
3.1-Nano-8B
Nemotron- -lama-
Complete Step (Benign)
0.7 0.989 = 0.105
3.1-Nano-8B
Nemotron-Llamaa
Complete Step (Benign)
0.9 0.992 0.089
3. 3.1-Nan-8BB
Phi-4-Rcasoning-PP Plus
Complete Step (Benign)
0.1 0.952 = 0.214
Phi-4-Reasoning-PP Plus
Complete Step (Benign)
0.3 0.959 = 0.197
Phi-4-Reasoning-Plu
Complete Step (Benign)
0.5 0.955
Thi-4-ReasoningPPMe
Complete Step (Benign)
0.7 0.946
Mhi-4-Reasooing-PPP -lus
Complete Step (Benign)
0.9 0.953 0.211
QwQ-32B
Complete Step (Benign)
0.1 0.997 0.052
QwQ-32B
Complete Step (Benign)
0.3 0.995 0.070
QwQ-32B
Complete Step (Benign)
0.5 0.997 0.059
QwQ-32B
Complete Step (Benign)
0.7 0.997 0.055
QwQ-32B
Complete Step (Benign)
0.9 0.999 0.034
@l-Distill-Llama-s
Complete Step (Benign)
0.1 0.941 0.236
RI-Distill-Llama
Complete Step (Benign)
0.3 0.960 0.199
RI-Distill-Llama-B1
Complete Step (Benign) Complete Step (Benign)
0.5 0.975
RI-Distill-LLama--8
0.7
0.977 0.151
RI-Distill-Llama-88
Complete Step (Benign)
0.9 0.982 0.132
RI-Distill-Qwen-
Complete Step (Benign)
0.1 0.646 0.478
1.SB
R Re-Distill-Qwen-
Complete Step (Benign)
0.3 0.700 0.458
1.5B
Continued on next page
43

---

Published as a conference paper at ICLR 2026
Table 20:
Robustness metrics (mean std) per model, intervention, and timestep the Logic
domain.
Model
Intervention
Timestep
Mean Std
RI-Distill-Qwen-
Complete Step (Benign)
0.5 0.740 + 0.438
1.5B
RI-Distil--Wwen-
Complete Step (Benign)
0.7 0.783 = 0.412
1,5B
RI RI-Dissill-Qwan
Complete Step (Benign)
0.9 0.852 0.355
1,5B
RI-Distill-Qwen-11t
Complete Step (Benign)
0.993 0.080
R R1-Distill-Qwen-144
Complete Step (Benign)
0.3 0.990 = 0.099
R RI-Distill-Qwen-14)
Complete Step (Benign)
0.5 0.987 0.112
RI-Distill-Qwen-144
Complete Step (Benign)
0.7 0.992 0.087
RI-Distill-Qwen-14B
Complete Step (Benign)
0.9 0.997 0.059
RI-Distill-QWwen-S2BB
Complete Step (Benign)
0.1 0.996 0.065
R RI-Distill-QOwen-32
Complete Step (Benign)
0.3 0.993 = 0.080
R RI-Distill-Qwen-32B
Complete Step (Benign)
0.5 0.994
R RI-Distill-Qwen--2B
Complete Step (Benign)
0.7 0.998
RI-Distill-Qwenn-3B
Complete Step (Benign)
0,9 0.044
R RI-Distill-QQwen--B
Complete Step (Benign)
0.1 0.954
R RI-Distill-Qwen--B
Complete Step (Benign)
0.3 0.961 0.194
R RI-Distill-Owen--B
Complete Step (Benign)
0.5 0.160
RI-Distill-Qwent Beatill-Qwen-7B
Complete Step (Benign)
0.7 0.977 0.149
RI-Distill- -wenill--eee-7BB
Complete Step (Benign)
0.9 0.981 0.136
EXAONE-Deepe
Continue
Unrelated
0.1 0.410 = 0.492
(Adv.)
EXAONE-DDee-32B
Continue
Unrelated
0.3 0.589 0.492
(Adv.)
EXAONE-Deep-32B
Continue
Unrelated
0.5 0.677 = 0.468
(Adv.)
EXAONE-Deep-32B
Continue
Unrelated
0.7 0.766 0.423
(Adv.)
EXAONE-Deep-io
Continue
Unrelated
0.9 0.810 = 0.392
(Adv.)
Nemotron-Llama-
Continue
Unrelated
0.1 0.579 0.494
B.--Nan-8BB
(Adv.)
Nemotron-Llamaa
Continue
Unrelated
0.3 0.686 0.464
3.1-Nano-8B &B
(Adv.)
Nemotron-L Llama-
Continue (Adv.)
Unrelated
0.5 0.708 = 0.455
3.L-Nano-8B
Nemotron-L
Continue
Unrelated
0.7 0.781 0.414
3. 3.1-Nao-8BB
(Adv.)
Nemotron-Llama-
Continue (Adv.)
Unrelated
0.9 0.834 = 0.372
3. ---Nan-8BB
Phi-4-Reasoning-Plu
Continue
Unrelated
0.1 0.954 0.210 0.210
(Adv.)
Bhi-4-Raasoning-PPP Plus
Continue (Adv.)
Unrelated
0.3 0.954 = 0.210
Phi-4 Reasoning Pluus
Continue (Adv.)
Unrelated
0.5 0.956 0.205
Phi-4-Reasoning-Phhr
Continue
Unrelated
0.7 0.954 = 0.210
(Adv.)
Sii4-Reeasning-PPin
Continue (Adv.)
Unrelated
0.9 0.945 = 0.228
QwQ-32B
Continue
Unrelated
0.987 0.113
(Adv.)
QwQ-32B
Continue (Adv.) Continue (Adv.)
Unrelated
0.3 0.994 = 0.076
QwQ-32B
Unrelated
0.5 0.995 0.070
Continued on next page
44

---

Published as a conference paper at ICLR 2026
Table 20: domain.
Robustness metrics (mean std) per model, intervention, and timestep the Logic
Model
Intervention
Timestep
Mean Std
QwQ-32B
Continue
Unrelated
0.7 0.997 0.055
(Adv.)
QwQ-32B
Continue (Adv.)
Unrelated
0.9 0.997 = 0.055
--Disiill-Llama-
Continue
Unrelated
0.1 0.821 0.383
(Adv.)
RI-Distill-Lamm-88
Continue
Unrelated
0.3 0.929 0.256
(Adv.)
R1-Distill-Llama-B0
Continue
Unrelated
0.5 0.945 0.228
(Adv.)
RI-Distil--Llmm-
Continue
Unrelated
0.962 0.192
(Adv.)
RI-Distill-Llama-B
Continue
Unrelated
0.9 0.973 = 0.162
(Adv.)
RI-Distill-Qwen
Continue
Unrelated
0.1 0.558 0.497
1.5B
(Adv.)
RI-Distill-Qwen-
Continue
Unrelated
0.3 0.574 = 0.494
1.5B
(Adv.)
RI-Distill-Qwen
Continue (Adv.)
Unrelated
0.5 0.591 0.492
1.5B
RI-Distill Qwen-
Continue (Adv.)
Unrelated
0.7 0.643 = 0.479
1.5B
R1-Distil-Qwenn
Continue (Adv.)
Unrelated
0.9 0.674 0.469
1.5B
RI-Distill-Qwen-
Continue
Unrelated
0.648 0.477
(Adv.)
EI-Distill-Qwen-
Continue
Unrelated
0.3 0.871 0.335
(Adv.)
R1-Distill- Saall--eenn--44
Continue
Unrelated
0.5 0.934 0.249
(Adv.)
E1-Distill-Qwent
Continue
Unrelated
0.7 0.927 = 0.260
(Adv.)
RI-Distill-Qwen-14
Continue
Unrelated
0.9 0.869 0.337
(Adv.)
RI Distiill-Qenn---
Continue
Unrelated
0.1 0.861 = 0.346
(Adv.)
H1-Distill-Qwen--31
Continue
Unrelated
0.3 0.966 0.182
(Adv.)
RI-Distill-Qwen-222
Continue
Unrelated
0.5 0.985 = 0.121
(Adv.)
RI-DisiillQQwen-32B
Continue
Unrelated
0.7 0.994 = 0,076
(Adv.)
RI-Distill-Qeen-22B
Continue
Unrelated
0.9 0.993 0.080
(Adv.)
E1-Distill-Qwen-11
Continue
Unrelated
0.1 0.895 = 0.306
(Adv.)
RI-Distill-Qwen--B
Continue
Unrelated
0.3 0.944 0.229
(Adv.)
R1-Distill-Qwen-7B
Continue
Unrelated
0.5 0.948 = 0.222
(Adv.)
RI-Distill-Qwen-72
Continue
Unrelated
0.7 0.952 0.214
(Adv.)
RI-Distill-Qwen-1
Continue
Unrelated
0.9 0.947 = 0.225
(Adv.)
EXAONE-Decp-32B
Ct.. Wrong Reasoning (Adv.)
0.1 0.991 0.093
EXAONE-Dese EXAONE-Deep-32B
Cin. Wrong Reasoning
0.997 0.052
(Adv.)
Continued on next page
45

---

Published as a conference paper at ICLR 2026
Table 20:
Robustness metrics (mean std) per model, intervention, and timestep the Logic
domain.
Model
Intervention
Timestep
Mean Std
EXAONE-Deep-3225
Cin. Wrong Reasoning
0.5 0.996 0.065
(Adv.)
EXAONE-Deep-32B
Ctn. Wrong Reasoning
0.7 0.997 = 0.055
(Adv.)
EXAONE-Deep-322
Ctn. Wrong Reasoning
0.9 1.000 0.020
(Adv.)
Nemotron-Llamen
Ctn. Wrong Reasoning
0.954 0.210
3. 3.1-Nano-BB
(Adv.)
Nemotron-Llamee
Ctn. Wrong Reasoning
0.3 0.964 0.187
3.1-Nano-8B
(Adv.)
Nemotron-Llame Llama-
Ctn. Wrong Reasoning
0.5 0.971 0.167
3.1-Nano-8B
(Adv.)
Nemotron-Llane
Ctn. Wrong Reasoning
0.7 0.976 = 0.154
B.1-Nano-8B
(Adv.)
Nemotron-Llame
Cm. Wrong Reasoning (Adv.)
0.9 0.986 0.117
3, 1-Nano-8B
Phi-4-Reasoning-Plue
Ctn. Wrong Reasoning (Adv.)
0.1 0.954 = 0.209
Phi-4-Reasoning-Plus
Ctn. Wrong Reasoning (Adv.)
0.3 0.954 0.209
4hi-4-Reasoning Plus
Ctn. Wrong Reasoning (Adv.)
0.5 0.960 = 0.196
Phi-4-Reasoning-Plie
Ctn. Wrong Reasoning
0.7 0.955 0.208
(Adv.)
Phi-4-Rcasoning-Plie
Ctn. Wrong Reasoning (Adv.)
0.9 0.953 = 0.211
QwQ-32B
Ctn. Wrong Reasoning
0.1 0.994 = 0,076
(Adv.)
QwQ-32B
Ctn. Wrong Reasoning (Adv.)
0.3 0.997 0.052
QwQ-32B
Ctn. Wrong Reasoning
0.5 0.997 = 0.052
(Adv.)
QwQ-32B
Ctn. Wrong Reasoning
0.7 0.997 0.055
(Adv.)
QwQ-32B
Ctn. Wrong Reasoning (Adv.)
0.9 0.999 = 0.034
RI-Distill-Llama-5
Ctn. Wrong Reasoning
0.1 0.906 0.292
(Adv.)
R1-Distill-Llam-B80
Ctn. Wrong Reasoning
0.3 0.944 = 0.231
(Adv.)
RI-Distill-Llam--81
Ctn. Wrong Reasoning
0.5 0.937 0.243
(Adv.)
RI-Distill-
Cin. Wrong Reasoning (Adv.)
0.965 0.184
DDistill-Llamal 8B
Ctn. Wrong Reasoning (Adv.)
0.9 0.971 = 0.168
RI-Distill-Qwen-
Ctn. Wrong Reasoning
0.1 0.569 0.495
1.5B
(Adv.)
RI-Distill-Qwen-
Ctn. Wrong Reasoning
0.3 0.589 = 0.492
1.5B
(Adv.)
RI-Distill-Qwer
Ctn. Wrong Reasoning
0.5 0.617 0.486
1.5B
(Adv.)
R1-Distill-Qwen
Ctn. Wrong Reasoning
0.7 0.653 = 0.476
1.5B
(Adv.)
R1- R1-Distill-Qwen
Ctn. Wrong Reasoning (Adv.)
0.9 0.751 0.433
1.SB
RI D--istill--wen---
Cin. Wrong Reasoning
0.984 0.126
(Adv.)
Continued on next page
46

---

Published as a conference paper at ICLR 2026
Table 20: domain.
Robustness metrics (mean std) per model, intervention, and timestep the Logic
Model
Intervention
Timestep
Mean Std
RI-Distill-Qwen- 14B
Cin. Wrong Reasoning
0.3 0.982 0.133
(Adv.)
RI-Distill-Qwen-144
Ctn. Wrong Reasoning
0.5 0.988 = 0.107
(Adv.)
R1-Distill- Pistill-Qwen-Bee 14B
Ctn. Wrong Reasoning
0.7 0.990 0.099
(Adv.)
RI-Distill-Qwen-
Ctn. Wrong Reasoning (Adv.)
0.9 0.995 = 0.070
RI-Distil--Qenn-22
Ctn. Wrong Reasoning
0.1 0.986 0.118
(Adv.)
A1-Distill-Qwen--13
Ctn. Wrong Reasoning
0.988 0.110
(Adv.)
E1-Distill-Qwen-222
Cin. Wrong Reasoning
0.5 0.985 = 0.120
(Adv.)
RI-Distill-Qwen-32
Ctn. Wrong Reasoning
0.7 0.987 0.115
(Adv.)
RI-Distill-Qwen-32B
Ctn. Wrong Reasoning
0.9 0.992 = 0.087
(Adv.)
RI-Distill-Qeen-7B
Ctn. Wrong Reasoning
0.1 0.931 0.254
(Adv.)
RI-Distill Bestill-Qwen--BB
Ctn. Wrong Reasoning
0.3 0.935 = 0.246
(Adv.)
R1-Disiil--wwe-77B
Ctn. Wrong Reasoning
0.5 0.955 0.208
(Adv.)
RI-Distill-Qwen-77
Ctn. Wrong Reasoning (Adv.)
0.7 0.960 = 0.197
RI-Distill-Qwen-7B
Cin. Wrong Reasoning
0.9 0.977 = 0.150
(Adv.)
EXAONE- DcONN--
Insert Random Charac-
0.1 0.994 0.078
ters (Neutral)
EXAONE-Decp-325
Insert Random Charac-
0.3 0.996 = 0.062
ters (Neutral)
EXAONE-DDep-32B
Insert Random Charac-
0.5 0.997 0.055
ters (Neutral)
EXAONE-Deep-.
Insert Random Charac-
0.7 0.999 = 0.034
ters (Neutral)
EXAONE-Deep-32B
Insert Random Charac- (Neutral)
0.9 0.999 0.028
Nemotron-LLane
Insert Random Charac-
0.946 = 0.227
3.1 1.1-Nan-8BB
ters (Neutral)
Mamotron-Llamann
Insert Random Charac-
0.3 0.951 0.216
3.1-Nano-8B
ters (Neutral)
Nemotron-Llamee
Insert Random Charac-
0.5 0.952 0.214
3, 3.1-Nano-85 8B
ters (Neutral) Insert Random Charac-
Semotron-Llamee
0.7 0.967 = 0.180
1.-Nano-8B
ters (Neutral) Insert Random Charac-
Nemotron-Llama-
0.9 0.957 0.204
-.-
ters (Neutral)
Phi-4-Reasoning-Pine
Insert Random Charac-
0.1 0.953 = 0.211
ters (Neutral)
Thi-4-Reasoning-PPie
Insert Random Charac-
0.3 0.947 0.224
ters (Neutral)
Thi-4-Rcasoning-Plee
Insert Random Charac-
0.5 0.958 = 0.201
ters (Ncutral)
1ii-4-Reasoning-PPe
Insert Random Charac-
0.7 0.945 0.228
ters (Neutral)
1ii-4-RRaaoning-PPi
Insert Random Charac-
0.9 0.948 0.222
ters (Neutral)
Continued on next page
47

---

Published as a conference paper at ICLR 2026
Table 20:
Robustness metrics (mean std) per model, intervention, and timestep the Logic
domain.
Model
Intervention
Timestep
Mean Std
QwQ-32B
Insert Random Charac-
0.1 0.997 0.052
ters (Neutral)
QwQ-32B
Insert Random Charac-
0.3 0.998 = 0.044
ters (Ncutral)
QwQ-32B
Insert Random Charac-
0.5 0.998 0.044
ters (Neutral)
QwQ-32B
Insert Random Charac-
0.7 0.995 0.068
ters (Neutral)
QwQ-32B
Insert Random Charac-
0.9 0.998 0.048
ters (Neutral)
RI-Distill-Lamm--B
Insert Random Charac-
0,941 0.236
ters (Neutral)
RI-Distill-Llama-
Insert Random Charac-
0.3 0.952 = 0.214
ters (Neutral)
RI-Distill-Llama-
Insert Random Charac-
0.5 0.965 0.183
ters (Neutral)
RI-Distill-Llama-8B
Insert Random Charac-
0.7 0.979 = 0.144
ters (Neutral)
RI-Distill-lamm--8
Insert Random Charac-
0.9 0.979 0.142
ters (Neutral)
RI-Distill Qwen-
Insert Random Charac- ters (Neutral)
0.1 0.599 = 0.490
1.5B
R1-Distill-Qwen
Insert Random Charac-
0.3 0.626 0.484
1.5B
(Neutral)
RI-Distill-Qwen-
Insert Random Charac- ters (Neutral)
0.5 0.646 = 0.478
1.SB
RI-Distill-Qwen-
Insert Random Charac-
0.7 0.676 = 0,468
1.SB
ters (Neutral)
RI-Distill-Qwen
Insert Random Charac-
0.9 0.791 0.407
1.5B
ters (Neutral)
R1 E1-DistilllQwenn 14B
Insert Random Charac-
0.1 0.995 = 0.073
ters (Neutral)
RI-Distill-Qwen-14B
Insert Random Charac-
0.3 0.990 0.101
ters (Neutral)
RI RI-Distill-QQue Biiill-Qwee-1455
Insert Random Charac-
0.5 0.993 = 0.085
ters (Neutral)
RI-Distill- Beatill-Qwen-L45
Insert Random Charac-
0.7 0.995 0.073
(Neutral)
RI-Distill-Qwen-114
Insert Random Charac-
0.9 0.997 = 0.055
ters (Neutral)
RI-DisiillQWeen-22B
Insert Random Charac-
0.1 0.991 0.093
ters (Neutral)
RI-Distill-Qwen-32B
Insert Random Charac-
0.989 0.105
ters (Neutral)
HI-DisilllQwenn-333
Insert Random Charac-
0.5 0.997 = 0.055
ters (Neutral)
RI-Distill-Qwen-322
Insert Random Charac-
0.7 0.997 0.059
ters (Neutral)
RI-Dissill-Qwen--2R
Insert Random Charac-
0.9 0.997 = 0.055
ters (Neutral)
RI-Distill-Qwen-72
Insert Random Charac-
0.1 0.883 0.322
ters (Neutral) Insert Random Charac- ters (Ncutral) Insert Random Charac-
RI-Distill-Qwen-1
0.3 0.910 = 0.286
RI-Distill-Qwen-7B
0.5 0.922 0.268
ters (Neutral)
RI-Distill-Qwen-77
Insert Random Charac-
0.937 0.243
ters (Neutral)
Continued on next page
48

---

Published as a conference paper at ICLR 2026
Table 20: domain.
Robustness metrics (mean std) per model, intervention, and timestep the Logic
Model
Intervention
Timestep
Mean Std
RI-Distill-Qwen-71
Insert Random Charac-
0.9
0.934 0.248
ters (Neutral)
EXAONE-Deep-321
Insert Wrong Fact (Adv.)
0.1 0.984 = 0.124
EXAONE EXAONE-Decp-322 Decp-32B
Insert Wrong Fact (Adv.)
0.3 0,989 = 0.105
EXAONE EXAONE-Deep-33 Dcep-32B
Insert Wrong Fact (Adv.)
0.5 0.991 0.095
EXAONE EXAONE-Deep-32E
Insert Wrong Fact (Adv.)
0.7 0,998 0.048
EXAONE-Deep-322
Insert Wrong Fact (Adv.)
0.9 0,999 = 0.028
Nemotron-Lllama-
Insert Wrong Fact (Adv.)
0.1 0.947 = 0.225
3.1 A.1-Nao-8BB
Nemotron- -lama-
Insert Wrong Fact (Adv.)
0.3 0.962 = 0.191
3.1-Nano-8B
Nemotron-Llame
Insert Wrong Fact (Adv.)
0.5 0.972 = 0.165
3.1-Nano-BB
Nemotron-Llama-
Insert Wrong Fact (Adv.)
0.7 0.982 0.132
---Nano-8B
Nemotron-Llamar
Insert Wrong Fact (Adv.)
0.9 0.988 = 0.108
3, 3.1-Nano-8B
Phi-4-Reasoning-PPP Plus
Insert Wrong Fact (Adv.)
0.1 0.946 = 0.227
Phi-4-Reasoning-Plue
Insert Wrong Fact (Adv.)
0.3 0.956 0.205
Reassnnng Plus
Insert Wrong Fact (Adv.)
0.5 0.957 0.203
Reasonnnsnn -luss
Insert Wrong Fact (Adv.)
0.7 0.949 = 0.219
Meii--Reasoning-PPe Plus
Insert Wrong Fact (Adv.)
0.9 0.956 + 0.204
QwQ-32B
Insert Wrong Fact (Adv.)
0.1 0.997 = 0.055
QwQ-32B
Insert Wrong Fact (Adv.)
0.3 0.997 0.059
QwQ-32B
Insert Wrong Fact (Adv.)
0.5 0.997 0.055
QwQ-32B
Insert Wrong Fact (Adv.)
0.7
QwQ-32B
Insert Wrong Fact (Adv.)
0.9 1.000
RI-Distill-Lama-BB
Insert Wrong Fact (Adv.)
0.1 0.908 0.289
RI-Distill-Llam--8
Insert Wrong Fact (Adv.)
0.3 0.919
RI-Distill-Llama-
Insert Wrong Fact (Adv.)
0.5 0.939 = 0.240
RI RI-Distill-Llama 8B
Insert Wrong Fact (Adv.)
0.7 0.964 = 0.155
R Rl-Distill-Llmm--8B
Insert Wrong Fact (Adv.)
0.9 0.980 = 0.138
R RI-Distill-Qwen-
Insert Wrong Fact (Adv.)
0.1 0.596 0.491
1.5B
RI E1-Distill-Qwen
Insert Wrong Fact (Adv.)
0.3 0.631 = 0.482
1.5B
R1-Distill-Qwwi
Insert Wrong Fact (Adv.)
0.5 0.655 0.475
1.5B
RI-Distill-Qwen
Insert Wrong Fact (Adv.)
0.7 0.697 = 0.460
1.5B
RI-Distill-Qwen-
Insert Wrong Fact (Adv.)
0.9 0.799 = 0.400
1.SB
RI-Distil-QWeen-la
Insert Wrong Fact (Adv.)
0.969 0.173
RI-Distill-O Soalll--wen-14444 14B
Insert Wrong Fact (Adv.)
0.3 0.971 = 0.168
RI I-Dissill-Qwen--ld
Insert Wrong Fact (Adv.)
0.5 0.971 = 0.168
RI 1--istill-Qwen--
Insert Wrong Fact (Adv.)
0.7 0.994 0.076
R RI-Distill-Qeen-14B
Insert Wrong Fact (Adv.)
0.9 =
R RI-Distill-Qwen-22B
Insert Wrong Fact (Adv.)
0.981 0.137
R RI-Dissill-Qwee--22B
Insert Wrong Fact (Adv.)
0.3 0.971 = 0.168
R RI-Distill-Qwen--2B
Insert Wrong Fact (Adv.)
0.5 0.984 = 0.127
RI RI-Distill-Qwen-32B
Insert Wrong Fact (Adv.)
0.7 0.988 0.110
RI-Distill-Qwen-33B
Wrong Fact (Adv.)
0.9 0.995
Ri RI-Distill-Qwen--B
Insert Wrong Fact (Adv.)
0.1 0.932 + 0.252
R RI-Distill-Qwenn-7
Insert Wrong Fact (Adv.)
0.3 0.935 0.246
RI RI-Distill-Qwen--B
Insert Wrong Fact (Adv.)
0.5 0.946 0.226
R RI-Distill-Qwen--1B
Insert Wrong Fact (Adv.)
0.7 0.960 0.197
RI-Distill-Qwen--B
Insert Wrong Fact (Adv.)
0.9 0.977 + 0.149
EXAONE-Deep-32B
Rewrite Trace (Benign)
0.1 0.997 + 0.055
Continued on next page
49

---

Published as a conference paper at ICLR 2026
Table 20: domain.
Robustness metrics (mean std) per model, intervention, and timestep the Logic
Model
Intervention
Timestep
Mean Std
EXAONE-Deep-22
Rewrite Trace (Benign)
0.3 0.998 0.039
SLAONNE-eeep-11
Rewrite Trace (Benign)
0.5 0,998 0.039
EXAONE-Deep-32B
Rewrite Trace (Benign)
0.7 0.999 = 0.028
EXAONE- M-AONE-Deec-32B
Rewrite Trace (Benign)
0.9 0.999 = 0.034
Comotron-Llamee
Rewrite Trace (Benign)
0.1 0.856 0.351
3.1-Nano-83
Nemotron-Llama
Rewrite Trace (Benign)
0.3 0.893 0.310
3. 3.1-Nano-BB
Nemotron-L.lama-
Rewrite Trace (Benign)
0.5 0.899 = 0.302
3.1-Nano-8B
Nemotron-Llama
Rewrite Trace (Benign)
0.919 0.272
3, 3.1-Nano-BB
Nemotron-Llama-
Rewrite Trace (Benign)
0.9 0.924 + 0.265
3.1 3.1-Nano-8B
Phi-4-Reasoning- -luss
Rewrite Trace (Benign)
0.1 0.918 0.274 0.274
mii---Rcasoning-PP Peaniinnng-uuus
Rewrite Trace (Benign)
0.3 0,936 + 0.245
Phi-4-Reasoning-Pile
Rewrite Trace (Benign)
0.5 0.930 = 0.255
Mhi-4-Reasoning-Plas
Rewrite Trace (Benign)
0.7 0.941 = 0.235
Phi-4-Reasoning-Plus
Rewrite Trace (Benign)
0.9 0.937 0.243
QwQ-32B
Rewrite Trace (Benign)
0.986 0.118
QwQ-32B
Rewrite Trace (Benign)
0.3 0.992
QwQ-32B
Rewrite Trace (Benign)
0.5 0.997 0.059
QwQ-32B
Rewrite Trace (Benign)
0.7 0.995 00070
QwQ-32B
Rewrite Trace (Benign)
0.9 0.997 0.059
RI-Distill-Llama-B8
Rewrite Trace (Benign)
0.845 0.362
RI-Distill-Llama-B1
Rewrite Trace (Benign)
0.3 0.897 0.304
RI-Distill-Llmm-BB
Rewrite Trace (Benign)
0.5 0.908 0.289
R RI-Distill-Llama-BB
Rewrite Trace (Benign)
0.7 0.947 0.223
RI-Distill-Llam--8
Rewrite Trace (Benign)
0.9 0.965 0.183
R1-Distill-QWws Dewsi-
Rewrite Trace (Benign)
0.1 0.728 + 0.445
1.5B
RI-Distill-Qwen-
Rewrite Trace (Benign)
0.3 0.765 = 0.424
1.5B
RI-Distill-Qwen-
Rewrite Trace (Benign)
0.5 0.831 = 0.375
1.5B
R1- R1-Distill-Qwen
Rewrite Trace (Benign)
0.7 0.838 = 0.369
1.5B
RI-Distill-Qwen-
Rewrite Trace (Benign)
0.9 0.883 0.322
1.5B
R R1-Distill-Qwen-
14B
Rewrite Trace (Benign)
0.1 0.913 = 0.281
RI R1-Distill-Qwen- 14B
Rewrite Trace (Benign)
0.3 0.939 = 0.239
RI-Distill-Owen-14B
Rewrite Trace (Benign)
0.5 0.957 0.202
RI-Distill-Qeen-14D
Rewrite Trace (Benign)
0.7 0.970
RI RI-Distill--Qwen-145
Rewrite Trace (Benign)
0.9 0.977
R IDDDisilll-Qwen-32
Rewrite Trace (Benign)
0.1 0.936
R RI-Distill-Qwen-333
Rewrite Trace (Benign)
0.3 0.949 0.221
R RI-Distill-Qwen-32B
Rewrite Trace (Benign)
0.5 0.184
R R--Distlll-Qeen-222
Rewrite Trace (Benign)
0.7 0.968
R RI-Disiill-Qwee--22B
Rewrite Trace (Benign)
0.9 0.188
RI -isiiilll-Qwen--
Rewrite Trace (Benign)
0.1
0.384
Ri-Distill-Qwen-1
Rewrite Trace (Benign)
0.3
0.325
7--issilllQOeen-
Rewrite Trace (Benign)
0.5
0.905
RI
Rewrite Trace (Benign)
0.7 0.935 0.246
RI RI-Distill-Qwen-7B
Rewrite Trace (Benign)
0.9 0.960 0.196
50

---

Published as a conference paper at ICLR 2026
Cluster
Size
Example sentences
Summary
37
1105
"Ww, no." "Wait, no."
Abrupt, terse negations rejecting prior point.
71
978
"Let switch gears and focus that." "Let me try to refocus."
Explicitly redirecting
attention back to the main topic.
22
517
"Wait, actually, that correct?"
Expressing uncertainty and checking correctness.
"Wait, that seems correct?"
331
400
"Wait, no, wait, that's different topic." "Wait, wait, no, that's 's a different topic."
Flagging that the discussion is off-topic.
4
347
"Wait, is that equal to something?"
Quick checks of equality or validity in a derivation.
"Wait, is that right?"
1640
342
"Wait, maybe should solve the equation step by step."
Reflecting on algebraic equation setup or manipulation.
"Wait, let me think about the equation again:"
2820
333
"So, f(8) f(2 "Wait, but if e is the period, then
12."
Working through functional properties and periodicity.
[(n + (m) 1."
816
297
"If m = n, then ged m, n) m.." "Compute GCD(30, 240) = 30."
Reasoning about greatest common divisors.
159
249
"Alright, now need to get back on track."
Attempts resume or stay on the main thread.
"Let me make sure I'm back on track." "Wait, no, no, hold on." "Wait, that's 's about hearsay."
272
239
Pausing and signalling something needs reconsideration.
97
229
"Wait, that's not related at all." "Wait, hold on, no, that's not related."
Explicitly stating a point unrelated.
216
219
"Hmm, wait, is that true?"
Questioning the truth value of claim.
"Wait, wait, is that true?"
31
213
"Wait, but hold on, wait." "Wait, but hang on."
Hesitant interjections before clarifying a caveat.
373
201
"Wait, no, actually, that's not right." "No, that's right either."
Identifying and correcting inaccuracies.
472
189 "Looking back at the problem, it's about pens and money."
Reasoning through combinatorial
"Back to pencils."
pens-and-pencils problem.
Table 16: Top 15 conversational clusters by size, with representative examples and high-level sum- maries.
51

---

Published as a conference paper at ICLR 2026
Quantum cutanglement
Neural style transfer
Photosyuthesis
Plate tectonics
Classical Greek mythol- ogy
Ancient Egyptian hicro-
The French Revolution
Supermassive
black
Cryttocurency mining
Nanocechnology medicine
glyphs
holes
Great Roman aqueduccs
Renaissance
paleobiology
String theory
niques
Medieval blacksmithing
Particle accelerators Industrial Revolu-
The Silk Road
Coral bleaching
Japanese ceremony
Anificial neural not- works
rover missions
Evolstionary game the- ory History of printing press
Viking longships
tion steam engines
Artec civilization
The Great Wall of China
Quantum qubits
compuring
Combinatorial game the-
ory
Ancient Roman law
Solar power satellites
Cave paintings Las- caux
Atmospheric greenhouse effect
Riemann hypothesis
Apollo moon landings
Photonics
Themodynaames laws
Microplastic contamina- tion
Narwhal ecology
Crypocccees mans fungus
neafor-
Möbius strip
Homo erecties migration
Astrophotography toch- niques
Origins of jazz music
Bioluminescent organ-
Easter Island moai
Chaos theory
Tea cultivation Assam
Internet protocol history
isms Shakespearean sonnets
Tropical rainforest ecol. ogy
Desertification in the Sa-
Quantum tunneling
Origami mathematics
Holographic principle Neolithic Göbekli Tope
Nobel Prize history
Biodivensity hotspots
Gel clectrophoresis
Polar iee cores
Space elevator concepts
Renewable wind energy
Mayan calendar
Deep hydrothermal
Solar eclipses
Cryptography history
Antarctic colonics
penguin
Renaissance astronomy
Prohability theory foun- dations
Groek philosophy
Cybersccurity ethics
Photosyuthetic biofuels
algac
Ancient
Somerian Ocean plastic pollution
cuneiform
Satum's rings
Mathematical knot the- ory
Roman concrete durabil- ity
Augmented reality
Neolithic agriculture
History of chess
Electric vehicles
Artificial photosynchesis
Colestial mochanies
Inca road system
Machine leaming fair- ness
Medicval alchemy
Sustainable urban design
Chinese calligraphy
Cognitive behavioral therapy
Fluid dynamics of bird night
CRISPR gene editing
Mount Everest expedi- tions Impressionist painting
Hubble Space Telescope discoverics
Human genome project
Roman games
gladiatorial
Dark matter detection
Blockchain algorithms
consensus
Ottoman architecture
Table 17: 100 topics used for generating starts of CoTs for our Unrelated CoT intervention.
52


Reviews:
[{"review_id": "mnisaGb4PE", "reviewer": "Reviewer_5HWi", "summary": "This paper investigates the robustness of reasoning process when interruptions are injected in the middle of reasoning trace. \nThey introduce unconventional setting where correct pre-generated reasoning traces from RLLMs are produced beforehand, and at each reasoning step in the CoT trace, they inject three types of noises. The benign injection continues the generation from other reasoning model or simply introduce a paraphrasing which do not change the original semantics of the reasoning trace. Neutral injection is adding random characters or documents from wikipedia, whereas adversarial perturbation is to inject unrelated cot trace or incorrect facts. \n\nThey test the reasoning robustness in three domains, math, science and logic. And for five difference RLLMs, they analyze the recovery behavior of each model. Starting from the observation that RL trained reasoning models are more capable of finding the reasoning errors compared to conventional large language models, based on the evaluation on BigBench-mistake, this paper builds a novel benchmark that systematically evaluates self-correction and self-reflection abilities. They define the robustness metric by checking whether the language model is able to produce final correct answer, despite the intervention at the intermediate reasoning steps.", "questions": "Please answer to the weakness above.", "limitations": "", "rating": 2, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "The dataset builds over large number of existing benchmark dataset, extending over various science, math, and logic domains.\nMoreover, this paper experimented over wide variety of reasoning models including, R1 distill, exaone, nemotron, phi, and QwQ. \nThe discovery that LRMs are generally robust to various types of intervention, regardless of the benign, neural, or adversarial .types.\nAlso, it is notable that LRM generation length inflates the most when interrupted with random texts for recovery.", "weaknesses": "The largest concern is that the reasoning trace interruption scenario is extremely far from realistic usage cases, which assumes that the model reasoning will be abruptly interrupted by external signals. Moreover the interruptions are hardly meaningful in logical or semantic sense, since it introduces noises that are completely irrelevant with previous context and model generations. Rather than injecting random text from external sources, what if the model is injected with reasoning trace that leads to wrong answer? Does doubt expression contribute to successfully recovering from this adversarial injection?\nAlso, it would be helpful if the authors could augment their explanation on realistic cases where random interruptions might happen during the model generation.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "gPJT8tp0to", "reviewer": "Reviewer_pGbL", "summary": "The paper studies how robust reasoning models (RMs) are to perturbations in their reasoning trace. They find that accuracy does not suffer as much, but there is an impact on efficiency.", "questions": "I think there are some confounding factors at play. \n\n1. It seems counter-intuitive that introducing benign rewrites reduces accuracy, whereas introducing wrong reasoning improves accuracy. Can the authors unpack this observation? Is it the writing style? What if the benign rewrite is written in a more tentative style or a question? It will be good to do some qualitative study/ablation to see what the cause of robustness is.\n\n2. Same question for efficiency. How can benign rewrites reduce CoT length and accuracy, while other (stronger) interventions don't lead to accuracy drop? Something else may be at play, beyond the type of intervention defined by the authors.", "limitations": "", "rating": 6, "confidence": 5, "soundness": 4, "presentation": 4, "contribution": 3, "strengths": "- Efficiency of RMs is an important consideration. While it is not the explicit goal, I think the paper's results on efficiency are interesting and the dataset can help study efficiency further. \n- Reasonable set of interventions and results across models. \n- Ablations on why RMs are able to recover (using \"wait\" -like tokens) and how the interventions increase inference time per answer. I think this is the strongest part of the paper.", "weaknesses": "- Some of the results need more examination. For example, table 5 shows that benign rewrites lead to drops up to 60%, but then Table 6 shows that there is no drop in CoT length across all intervention timesteps (except 0.9).\n- There are interesting observations, but the insight is weak. For example, introducing wrong reasoning increases accuracy robustness and paraphrasing reduces accuracy. Surely, there are some confounding factors here that can be explored?\n- Many of the results are \"observations\", but no solution is motivated or discussed. For example, if certain kinds of interventions lead to higher use of \"doubt tokens\", then can it be used to improve accuracy (without introducing adversarial interventions)?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "YbAmeNet4i", "reviewer": "Reviewer_FNsV", "summary": "This paper investigates the robustness of Reasoning Large Language Models to interventions within their own generated CoT reasoning processes. The authors introduce a controlled evaluation framework where they interrupt a model's correct CoT at various timesteps and inject one of seven different perturbations. These interventions are categorized as benign (e.g., paraphrasing), neutral (e.g., inserting random text), and adversarial (e.g., adding a wrong reasoning step). The same model is then prompted to continue its reasoning, allowing for a direct measurement of its recovery capabilities. The study evaluates multiple RLLMs across MATH, SCIENCE, and LOGIC domains. Key findings indicate that RLLMs are generally robust to such disruptions, with robustness increasing with model scale. However, this recovery comes at a computational cost, often significantly inflating the CoT length. Finally, the paper identifies the expression of \"doubt\" as a key recovery mechanism and reveals that models are not style-invariant, as paraphrasing can suppress doubt and degrade accuracy despite preserving semantics.", "questions": "1.  Regarding the LLM-based \"doubt\" classifier: How was its performance validated? What is its estimated accuracy, and what are some examples of sentences it correctly or incorrectly classifies as expressing doubt? Could you elaborate more on the findings from the activation analysis?\n\n2.  The interventions are currently single-step. Have you considered experiments with multi-step interventions or cascading errors (e.g., where a wrong fact is introduced and then used logically in the next step)? Do you hypothesize that the \"doubt\" mechanism would still be effective in such scenarios?\n\n3.  The finding that paraphrasing hurts performance is intresting. It suggests models overfit to a particular reasoning \"style.\" Based on this, what are your thoughts on potential training strategies to mitigate this? Would training on a more stylistically diverse set of CoTs (e.g., via paraphrasing augmentation) be a promising direction?\n\n4.  Could you clarify the process for the \"Continuation with other model\" intervention? Is the other model a weaker, non-reasoning-specialized model?", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1.  By intervening directly in a model's own reasoning trace, the authors create a clean and realistic testbed for self-correction, which is a significant step forward in robustness evaluation.\n\n2.  The study is impressively broad, covering 9 models, 3 domains, 7 intervention types, and 5 timesteps. This thoroughness lends high credibility to the conclusions and suggests that the findings are generalizable.\n\n3.  The paper is well-written. The research question, methods, and results are communicated with great clarity, making the experiments easy to understand.", "weaknesses": "1.  While identifying \"doubt\" is a major strength, the analysis relies on an LLM-based classifier to label sentences. This approach, while pragmatic, is somewhat superficial. The paper would be significantly strengthened by a deeper investigation into how \"doubt\" is represented internally. The activation analysis in the appendix is a good first step, but it feels underdeveloped. A more detailed analysis connecting specific internal states to the expression of doubt would benifit the contribution of the work.\n\n2. The interventions are all single-step disruptions. In many real-world scenarios (e.g., interacting with a faulty tool), errors can be more subtle or cascading. For instance, a model might accept a slightly incorrect tool output and then build several subsequent reasoning steps upon it. The current framework does not evaluate robustness to such persistent or multi-step correlated errors, which may be harder for the model to detect and recover from.\n\n3.  The paper excels at diagnosing the problem but is light on proposing solutions. The conclusion suggests that future training methods should address these weaknesses (e.g., style invariance, recovery efficiency), but it offers no preliminary experiments on how this could be achieved. For example, could data augmentation with paraphrased CoTs during finetuning improve style robustness?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "WriQcfBLeY", "reviewer": "Reviewer_6rea", "summary": "This paper studies how robust are reasoning models to disruptions of their own reasoning traces. To study this question, authors introduce a comprehensive intervention framework that contains benign, neutral, and adversarial interventions and analyze models' behaviors including 1) performance on different data domain, different intervening timesteps, different models, 2) doubtfulness rate, and 3) CoT length. The results indicate that reasoning models are robust in general, but the robustness is not style-invariant.", "questions": "1. What if the intervened reasoning is given to another model that is different from the model that originally generates the reasoning trace?  \n2. Is there any reason that authors try to fix the timestep instead of reasoning step? If authors try this, what's the reason not to choose this strategy?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "1. The paper is well-written, easy to follow, and the findings are clear. The findings by the authors could give a big contribution to the community.\n2. The motivation of this work (a new benchmark for reasoning robustness) is valid and sound. The early parts of Section 3 well describes this point.\n3. Authors comprehensively analyze the observed phenomenon in Section 4. This helps readers to understand the limitation of the robustness of the reasoning models more deeply. -- The finding in line 416-418 is very interesting.", "weaknesses": "1. In Section 3 line 135, \"RLLMs outperform non-reasoning models of comparable and even larger size, ...\". In order to support this sentence, I think it is more fair and reliable to compare reasoning models and their non-reasoning counterparts (e.g., Qwen3 think vs no-think, DeepSeek V3 vs DeepSeek R1). Could you report results for one of these?  \n2. In line 187, \"To validate semantic preservation, we manually ...\" So what is the result of this manual comparison? Since the paraphrasing reasoning leads a key finding, ensuring that the paraphrasing is performed well by the models is very important to support authors' claims.  \n3. Why is \"Unrelated CoT\" adversarial? isn't it neutral? -- inserting \"unrelated\" factual content is neutral now. Other two types of adversarial reasoning contain incorrect information, whereas this type does not. By definition by authors, neutral interventions mean \"irrelevant information into the CoT\", which also fits to this type as well. I understand authors' intention, so to improve soundness of this work, clarification is needed.  \n4. The findings in Section 4.2 The role of doubt in reasoning is not surprising.  \n5. In Table 5, Llama-nemotron-8B shows the highest increase of CoT length in paraphrasing reasoning scenario. Why does this happen? This result could indicate that the effect of paraphrasing is only applied to R1-distill-qwen/llama models. Please justify this result.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)