{"id":"bec3ce4d-2bb2-4c62-b0be-472a6a00740b","arxiv_id":"2607.14552","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Answer-conditioned chains of thought are harmful supervision for reasoning distillation—causing up to ~27-point accuracy drops—and the damage is invisible to correctness filters.","lead":"The paper shows that showing an LLM the gold answer while it writes its reasoning produces chains that poison later fine-tuning, even when every chain ends with a correct answer. The finding means reasoning models should be distilled from answer-blind chains and screened with a cheap pre-training signature.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"First-correct-chain sampling confounds the one-bit contrast: answer-conditioning shifts the attempt-index mix (leaked ≈ first-attempt, blind ≈ 1/3 second-attempt), and no reported control isolates this variable.","rationale":"Reviewing the full text, the one-bit experiment is well-controlled: length-matching, a DiD carrier design with blind twins, a single-line excision, cross-family and cross-student transfers, and reproducible code all support the qualitative claim. The weakest link is the selection rule in Appendix G: keeping the first correct chain from n=2 samples makes the two arms non-exchangeable in a way that is not controlled. The reader's weakest_assumption already points to the non-randomized sampling; this attack sharpens it to a specific, measurable confound (attempt index) and notes that the in-corpus controls do not address it. This is load-bearing because the headline number is the basis for the paper's practical takeaway. The other concerns—Phi-4 exclusion, small-sample predictor, one negative cross-student seed—are disclosed and affect secondary claims. The proposed check is feasible with the released data and would settle the concern directly.","tokens_in":19691,"tokens_out":17060,"duration_ms":203395,"concrete_test":"Use the released generation metadata to stratify the 935 matched chains by attempt index (first vs second correct chain) and retrain the standard SFT recipe on the first-attempt-only blind and leaked subsets across the three seeds. If the blind-vs-leaked penalty in the first-attempt stratum is close to the reported 16.2 points and positive in every seed, the selection-rule confound is ruled out. Alternatively, rerun the one-bit experiment with a symmetric protocol that samples exactly one chain per condition per problem and filters to correctness (or pairs random seeds), forcing the attempt-index distribution to match; if the penalty persists, the causal attribution holds.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central 16.2-point estimate is generated by a pipeline that keeps the first correct chain from n=2 samples (Appendix G). Because the leaked prompt makes first-sample success far more likely, the leaked corpus is dominated by first-attempt chains, while the blind corpus contains a substantial fraction of second-attempt chains (e.g., if p_correct≈0.5, ≈1/3 of blind chains are second-attempt). Second-attempt chains may contain self-correction or more genuine search and could be better SFT targets. The paper states the arms 'differ only in answer-conditioning and in the chain-length shift' (Section 3), omitting this attempt-index shift. Length-matching does not equate attempt index; the DiD and excision experiments (Sections 4.3 and 6) operate within the leaked corpus, where attempt composition is nearly constant, so they cannot validate the blind-vs-leaked contrast. If first-attempt chains are generally worse distillation targets, the headline penalty is partly a selection artifact rather than a pure effect of answer-conditioning. This would not overturn the qualitative conclusion—the excision experiment shows the early answer line is harmful—but it would change the claimed magnitude and the 'harm is a property of the data' framing.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies whether fine-tuning on an LLM's own answer-conditioned chains of thought (gold answer shown, with a request to reach it) is worse than fine-tuning on answer-blind chains, when both are passed through the same correctness filter. On 935 matched math problems with Qwen3-8B as generator and student, the leaked corpus costs 16.2 MATH-500 points relative to blind, growing to 27.2 points on AIME. The paper attributes the harm to chains that state the answer early ('rationalized' chains), supports this with a prompt ablation, a within-corpus difference-in-differences carrier experiment, a chain-excision control, and a pre-fine-tuning answer-first-rate signature that orders the penalty across eight thinking models from four families. It concludes that generating answer-blind is the safe choice and that no correctness filter can detect the damage in the data.","tokens_in":20013,"tokens_out":4346,"duration_ms":52320,"significance":"If the central estimate is valid, the finding is practically important: many self-improvement and distillation pipelines use answer-conditioned rationales, and this paper would show that such data can be negative-value despite passing the correctness filter. The paper has real strengths: matched problem sets, identical SFT recipe, three seeds for headline runs, length-matched controls, a difference-in-differences carrier design, held-out penalty predictions, and a released code/data package. The proposed answer-first signature is a cheap, falsifiable predictor. However, the headline causal isolation is weakened by an attempt-index confound in the sampling rule, and the text overclaims the universality of the sign of the effect. These issues are fixable within the manuscript's scope, but they need to be addressed before the 16.2-point attribution can be taken at face value.","major_comments":[{"comment":"The one-bit comparison as implemented confounds answer-conditioning with attempt index. The paper samples n=2 chains per problem and keeps the first correct chain. Under the leaked prompt, first-sample success is much more likely, so the leaked corpus is dominated by first-attempt chains, while the blind corpus contains a substantial share of second-attempt chains. The statement in Section 3 that the arms 'differ only in answer-conditioning and in the chain-length shift' omits this. Length matching does not equate attempt index, and the within-corpus controls (Sections 4.3, 6) operate inside the leaked corpus where attempt composition is nearly constant. The paper should report the per-arm attempt-index distribution and provide a control with matched attempt index (e.g., first-attempt correct chains only, or a randomized-order scheme), or argue explicitly why second-attempt chains are no","section":"Section 3, Appendix G"},{"comment":"The sentence in Section 6 that the penalty 'holds with the same sign across every generative setting' is contradicted by the cross-student transfer numbers in Appendix H: the three seed penalties for Qwen3-1.7B trained on Qwen3-8B corpora are 16.8, -0.2, and 4.0. One seed is negative, and the standard deviation is 8.9. The cross-student row in Table 5 is therefore a positive mean with a highly unstable sign, not a uniformly signed effect. The claim should be qualified to average sign, or the seed-level test should be reported. This is load-bearing because the 'damage travels with the data, not the student' conclusion currently rests on this row.","section":"Section 6, Appendix H"},{"comment":"The excision experiment shows that within the leaked corpus, the early-answer line itself carries most of the harm. This is an informative mechanism check, but it does not by itself rule out the attempt-index confound for the blind-vs-leaked contrast, because the excision operates entirely on chains that were all generated under the same prompt. The paper should not present the carrier and excision results as sufficient to identify the full causal quantity in Eq. (1). They support the qualitative conclusion and the rationalization mechanism, but the magnitude of the headline penalty still depends on the uncontrolled selection differences described above.","section":"Section 4.3 / Section 6, excision experiment"}],"minor_comments":[{"comment":"The text refers to a 'tinted Blind column' and tinted rows, but the table as printed appears to have no visible tint. Please ensure the final PDF retains the intended shading or replace the color-dependent language with explicit row/column labels.","section":"Table 1"},{"comment":"The single-seed DiD value '+21.2' in Section 4.3 does not obviously match any cell in Table 9 (seed 42 gives +22.0, seed 123 +13.2, seed 7777 +18.0). Please clarify which seed or configuration produces +21.2.","section":"Appendix F, Table 9"},{"comment":"The 'Out-of-band' arm is not defined in the main text or the appendix. Please give the exact prompt and state whether it was generated with a numerically equivalent memory optimization, as described for the two neutral arms in Appendix J.","section":"Table 1(A)"},{"comment":"The cross-model correlation is reported as r=0.96 on n=8 with a wide Fisher-z interval. The paper appropriately caveats this, but the abstract and conclusion phrase it as a strong predictor. Consider stating the sample size and interval in those places so the small-sample nature is visible to a casual reader.","section":"Section 5 / Table 14"}],"recommendation":"major_revision","confidential_remarks":"This is a well-executed study with a clear practical message, and I do not doubt the qualitative direction of the effect. The blocker is the attempt-index confound in the one-bit sampling rule: because the first-correct-chain rule makes the leaked arm mostly first-attempt and the blind arm partly second-attempt, the headline 16.2-point number is not yet a clean estimate of answer-conditioning. The paper also overstates the sign consistency of the cross-student transfer. Both are addressable with additional controls and more careful wording; I would be willing to look at a revision."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The headline result is real: under a controlled one-bit comparison, answer-conditioned chains distill noticeably worse than answer-blind chains, and the effect shows up across models, benchmarks, and code. The paper also does something rare in this area—it checks its own mechanism with a pre-training signature, a within-corpus carrier analysis, and a line-excision experiment. That's genuinely useful work.\n\nWhat's new is the controlled isolation and the AFR predictor. TRICE already flagged the bias in hindsight rationalization; this paper quantifies the damage in a clean setup and gives a cheap screening metric.\n\nThe stress-test about attempt-index is legitimate. Appendix G keeps the first correct chain from n=2 samples. The leaked arm is much more likely to get a correct first sample, so its corpus is mostly first-attempt chains; the blind arm has a chunk of second-attempt chains. If second-attempt chains are better targets, part of the 16.2-point gap is attempt mix, not answer-conditioning per se. Length-matching doesn't fix this. The DiD and excision experiments operate inside the leaked corpus, so they don't validate the blind-vs-leaked contrast. I don't think this overturns the conclusion—the excision result shows the early-answer line is harmful—but it does change the claimed magnitude and the 'harm is a property of the data' framing. The authors should address this, maybe by matching attempt index or showing the penalty holds on first-attempt-only subsets.\n\nAlso, the 'same sign across every generative setting' claim is a bit strong: the cross-student transfer has seed penalties 16.8, -0.2, and 4.0, so one seed is negative. The Phi-4 exclusion is disclosed, but it's still a selection decision; the predictor is based on eight points with wide intervals. These are minor issues.\n\nWho's this for: anyone doing SFT-based reasoning distillation or building self-improvement pipelines. It deserves a serious referee. I'd send it out, with a request to address the attempt-index confound.","headline":"Answer-conditioning hurts distilled reasoning, but the headline magnitude is partly entangled with an attempt-index confound; still worth a serious look.","tokens_in":20466,"tokens_out":2527,"would_cite":true,"duration_ms":26518,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Showing a language model the gold answer while it writes its reasoning creates training data that correctness filters cannot save.","keywords":["chain-of-thought distillation","answer conditioning","verifiable reasoning","rationalization","data quality","self-improvement","answer leakage","supervised fine-tuning"],"falsifier":"Run the one-bit experiment on a new family of thinking models with a randomized first-correct-chain sampling rule and exactly length-matched chains (e.g., by truncation or by generating leaked chains with a prompt that avoids shortening). If the accuracy gap between answer-blind and answer-leaked arms collapses to zero, or if the pre-training answer-first signature no longer orders the penalties across models, the central claim fails.","tokens_in":19608,"feed_emoji":"🧠","tokens_out":5193,"duration_ms":53994,"temperature":0.7,"pith_summary":"To distill reasoning ability, labs sample reasoning traces from a model, keep the ones that reach the right answer, and fine-tune on those survivors. Many pipelines try to increase yield by showing the model the gold answer and asking it to reason toward it. This paper argues that this answer-conditioning step quietly poisons the training data, and that a correctness filter cannot catch the damage because every kept chain is correct by construction. In a controlled experiment that changes only whether the generator sees the answer, training on answer-conditioned chains costs 16.2 points on the MATH-500 benchmark, with the loss growing with difficulty to about 27 points on olympiad problems. The mechanism is visible in the chains themselves: they state the answer early and rationalize backward, and the habit transfers to the student; the practical fix is to generate answer-blind, or to ask for the derivation first and the answer last.","feed_headline":"Seeing the gold answer poisons a model's training data","feed_subtitle":"One bit of prompt difference costs 16.2 points on MATH-500, and correctness filters can't spot the damage.","key_machinery":"The load-bearing instrument is the one-bit experiment: two otherwise identical generation arms, answer-blind and answer-leaked, sharing the same generator, problems, final-answer filter, and supervised fine-tuning recipe. The measurable mechanism is the answer-first rate (AFR), the fraction of chains that state the gold answer within the first 20% of the reasoning block; leaked chains have sharply higher AFR, and a within-corpus split into answer-first and derivation-first chains shows that the answer-first chains carry most of the accuracy loss (a 16.9-point difference-in-differences against blind controls). A length-matched control—truncating each blind chain to its leaked twin's length—ru","core_discovery":"The central claim is that a correct final answer does not make a model-generated chain of thought a safe distillation target, because the correctness filter cannot see how the chain was produced. The paper's 'one-bit experiment' holds the generator, problem set, correctness filter, and fine-tuning recipe fixed and varies only whether generation is answer-conditioned—the gold answer shown with a request to reach it. That single bit costs 16.2 MATH-500 points on a strong reasoning model, with the penalty rising with difficulty (about 27 points on AIME) and extending to code where every kept chain passes its tests. The damage is a property of the data, not the generator: it transfers across tea","pith_inferences":["Editorial inference: the same early-answer rationalization habit may contaminate reinforcement-learning rollouts that are conditioned on a correct answer, so verifiable-reasoning RL pipelines should test whether answer-conditioned rollouts introduce the same off-policy bias.","Editorial inference: because the answer-first signature is a cheap, label-free proxy, it could be used as a real-time data-quality gate during generation, rejecting or discounting chains that state the answer in their first 20% before training begins.","Editorial inference: the paper's train/test length inversion (short rationalized chains at training time, long rambling outputs at test time) suggests that answer-conditioned fine-tuning teaches a compressed answer-first policy that fails by non-convergence; if so, inference-time length capping would mask rather than fix the underlying deficit.","Editorial inference: the blind twins of early-answer problems are themselves answer-first 48.9% of the time, so problem difficulty partly drives rationalization; an extension would test whether the penalty scales with the prevalence of such 'easy-to-rationalize' problems in a training corpus."],"forward_implications":["Answer-blind self-distillation preserves base accuracy (within seed noise) and modestly beats training on gold data at a matched budget, so pipelines should generate chains without showing answers.","Correctness filtering cannot validate chains generated under answer-conditioning; data provenance—how a chain was produced—must be audited separately.","When showing the answer is unavoidable, a 'derive first, then state the answer' instruction recovers about two-thirds of the lost accuracy while keeping every example.","Candidate teachers can be screened before any fine-tuning by measuring the answer-first signature on a small unlabeled sample, predicting held-out penalties within a few points.","The penalty appears in domains that require derivation (math, code) and disappears on multiple-choice knowledge tasks, so benchmark choice determines whether the failure is visible."],"fun_headline_variants":["Answer-conditioned reasoning poisons distillation data","Showing the gold answer costs 16.2 MATH-500 points","Correctness filters can't spot answer-conditioned chain damage","Answer-blind generation beats answer-conditioned for CoT"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The attribution of the penalty to answer-conditioning assumes the blind and leaked corpora are exchangeable except for the single intervention; in particular, the leaked chains are systematically shorter, and while length-matching controls for length, it does not control for other textual differences or for the possibility that the two arms differ in which problems get solved.","fun_headline_variants_meta":{"raw":{"variants":["Answer-conditioned reasoning poisons distillation data","Showing the gold answer costs 16.2 MATH-500 points","Correctness filters can't spot answer-conditioned chain damage","Answer-blind generation beats answer-conditioned for CoT"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000379,"raw_usage":{"total_tokens":1881,"prompt_tokens":805,"completion_tokens":1076,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":549,"completion_tokens_details":{"reasoning_tokens":1011}},"tokens_in":549,"tokens_out":1076,"duration_ms":9917,"temperature":1.0,"reasoning_tokens":1011,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-02T01:45:44.577574+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the one-bit experiment on a new family of thinking models with a randomized first-correct-chain sampling rule and exactly length-matched chains (e.g., by truncation or by generating leaked chains with a prompt that avoids shortening). If the accuracy gap between answer-blind and answer-leaked arms collapses to zero, or if the pre-training answer-first signature no longer orders the penalties across models, the central claim fails.","supporting_citations":[],"review_version":1}