1 Introduction↩︎

Large language models reason through chains of thought [1], [2], and much recent progress in open reasoning models comes from distilling this ability by supervised fine-tuning on the models’ own chains of thought [3]. A typical pipeline samples candidate chains, keeps the ones that reach the correct final answer, and fine-tunes the model on the survivors. When sampling fails to produce a correct chain, or when the available chains look noisy, a popular fix is to condition the generation on the gold answer. The self-taught reasoner method feeds the answer as a hint and asks the model to rationalize problems it could not solve [4], and answer-aware refinement pipelines regenerate chains directly from question and answer pairs [5]–[8]. Chains produced this way still reach the correct answer, so the correctness filter keeps them.

The fix rests on the implicit assumption that a correct chain is a good training target no matter how it was produced [9]–[12]. We show that this assumption fails. A chain that reaches the right answer can still teach the wrong behavior when the model wrote it while looking at the answer, and the standard correctness filter cannot catch the problem, because the chain is correct by construction.

To isolate the effect we run what we call the one-bit experiment, summarized in Figure 1. Using a single model, we generate chains of thought for the same set of problems under two conditions that differ by a single intervention, whether generation is answer-conditioned, the gold answer shown in the prompt with a request to reach it. We keep only correct chains in both conditions and fine-tune with an identical recipe. Training on the answer-conditioned chains is sharply worse than training on the answer-blind ones. The drop persists under a length-matched control and a budget sweep and grows with difficulty. Its size depends on the model, destroying accuracy on an already-strong one and forfeiting part of a real answer-blind gain on one with room to improve.

Throughout, answer leakage is our informal shorthand for this recipe, the move that deployed self-improvement pipelines make when sampling fails [4]–[6], [8]. The recipe bundles two ingredients, the answer’s visibility and the instruction to rationalize toward it. Our mechanism analysis separates them, and the instruction is what carries the harm. At fixed visibility a neutral instruction recovers most of the penalty.

A chain composed toward a known answer rationalizes instead of deriving, and its symptom is stating the answer near the start. Within a single corpus, we find that these rationalized chains carry most of the harm, and that a simple filter dropping them is a partial repair. The same tendency is measurable before any fine-tuning, where it predicts the penalty across eight models from four families, transfers on average when answer-conditioned chains from one model train a smaller one. We study verifiable-reasoning distillation, domains such as math and code where a final-answer check or test execution lets the correctness filter run.

The effect is large where a derivation is required and absent where it is not. For Qwen3-8B, the answer-conditioned corpus trains a student \(16.2\) points weaker on MATH-500 than the answer-blind corpus built from the same problems, and the gap grows to \(27.2\) points on olympiad AIME problems. Repeating the intervention in code degrades the student as well, even though every kept chain passes its tests. On multiple-choice knowledge and science benchmarks, which ask the model to select an option rather than write a derivation, we find no penalty, so the harm is confined to tasks whose answers must be derived.

Our contributions are the following.

1. We isolate the cost of answer-conditioned generation. Holding the generator, problems, correctness filter, data volume, and chain length fixed, we show that generating chains under answer-conditioning incurs the leakage penalty, we localize it by a prompt ablation to the instruction to rationalize toward the answer rather than to merely seeing it, and we replicate it on further models.

2. We trace the mechanism. We find that a visible answer moves chains toward stating the answer early, an off-policy shift away from the generator’s own search distribution, and we show that the habit transfers to the student’s own outputs even with answer correctness controlled.

3. We attribute the harm to the rationalized chains and partly repair it with a filter. In an experiment inside a single answer-conditioned corpus, we show that these chains carry most of the harm, a three-seed difference-in-differences of \(16.9\) points.

4. We predict the penalty before any training. We read a signature off unlabeled generations that orders the leakage penalty across eight models from four families and predicts a held-out family with a mean absolute error of \(2.9\) points.

These findings come with cheap safeguards. A candidate teacher can be screened before any student is trained, since the signature is measured on a small set of its unlabeled generations, and where a pipeline cannot avoid showing the gold answer, an instruction to derive first and only then state the answer restores about two-thirds of the lost accuracy. The corrective costs nothing extra, since generating answer-blind with the same correctness filter avoids the pathology and modestly beats distillation from gold data at a controlled budget.

2 Related Work↩︎

2.0.0.1 Rationalization in self-improvement pipelines.

A prominent line of self-improvement methods treats final-answer correctness as the quality criterion for a chain [13]. The self-taught reasoner approach keeps the rationales that reach correct answers and rationalizes the rest by feeding the model the answer as a hint [4], a hindsight relabeling of failed attempts [5]. The same move extends to token-level reasoning [14] and recurs in rejection-sampling and ReST-style methods [9], [10], [15]–[18] and in answer-augmentation pipelines such as MetaMath [6].

A closely related analysis, TRICE, shows that conditioning a chain on the answer biases the learning signal and recasts the objective as latent-variable inference to correct it [19]. We instead show that this bias is invisible to the standard correctness filter, causally harms supervised fine-tuning even when every chain is verified, and can be anticipated from unlabeled generations before any training. A different strategy trains a verifier on both correct and incorrect chains rather than filtering them away [20]. Our results show that how a correct chain was produced still matters. To our knowledge, ours is the first controlled isolation of answer-conditioning, holding the generator, problems, correctness filter, and recipe fixed and varying only whether the generator is shown the answer.

2.0.0.2 Backward reasoning without leakage.

Reverse-reasoning methods that generate backward questions or check forward and backward consistency without revealing the gold answer are leakage-free and are not implicated by our findings [21]–[23]. We study the answer-visible regime that those methods avoid.

2.0.0.3 Process vs.outcome supervision.

Outcome-supervised verifiers [24], comparisons of process and outcome feedback [25], and process reward models [26]–[32] all argue that final-answer correctness is an insufficient quality signal and supervise or rerank individual steps. We show a complementary failure on the data-generation side, where chains that are correct and step-wise plausible can still harm the student because of how they were generated.

2.0.0.4 Faithfulness of chain-of-thought.

Chains of thought can be unfaithful or post-hoc. They are unfaithful when a model exploits a hint injected at inference time without verbalizing it [33]–[36], and post-hoc when the stated reasoning does not drive the final answer [37], [38]. We show the training-time analogue, where hint-conditioned targets transfer the post-hoc habit to the student, producing a measurable shift in answer position and an accuracy cost.

2.0.0.5 Data selection and on-policy distillation.

Data-selection work argues that fewer and better examples can outperform larger noisy sets [39], but our harmful examples already pass the correctness criterion, so the failure mode is distinct from low quality. On-policy distillation reports advantages for self-generated data under a soft-KL objective [40], [41], which is consistent with our answer-blind result, but that setting changes the generator and the objective at the same time and never isolates answer visibility.

2.0.0.6 Concurrent leakage filters.

Concurrent work has begun to patch leakage symptoms inside refinement pipelines, for example gating hindsight-hint repairs with an entropy filter [42]–[44], but such mitigations do not isolate what is being filtered or why. Our one-bit experiment supplies the missing causal quantity, the accuracy cost of answer-conditioned generation in an otherwise identical pipeline, together with a test isolating which chains carry the penalty inside one corpus and a predictor read off unlabeled generations before any fine-tuning.

3 Isolating Answer Leakage↩︎

5pt

Unless noted otherwise, every trained model is a full-parameter supervised fine-tune of Qwen3-8B [45] under one fixed recipe, on training problems from the math split of the Nemotron-Cascade-SFT-Stage-2 corpus [46], disjoint from all evaluation sets. We evaluate with vLLM [47] in thinking mode on MATH-500 [48] with a \(32{,}768\)-token budget and symbolic answer matching. Under this harness the Qwen3-8B base model scores \(95.2\). Appendix 14 gives the full recipe, sampling, and harness details. The comparison is built on a fixed set of \(935\) math problems, each carrying a gold answer \(a(q)\). Holding all of this fixed, the lone intervention is answer-conditioning.

Let \(M\) be the generator. For each problem we build two prompts. The Blind prompt (answer-blind) shows only the problem and asks the model to derive the answer. The Leaked prompt (answer-leaked) appends \(a(q)\) and asks for a reasoning trace that arrives at it. From \(M\) we sample chains under each prompt, keep only chains whose final boxed answer is correct, and fine-tune two students on the resulting (question \(\rightarrow\) chain) pairs under one identical recipe, an answer-blind student \(S_{\mathrm{blind}}\) and an answer-leaked student \(S_{\mathrm{leaked}}\). The reported leakage penalty is the accuracy lost by generating the chain under answer-conditioning, \[\Delta = \operatorname{acc}(S_{\mathrm{blind}}) - \operatorname{acc}(S_{\mathrm{leaked}}). \label{eq:penalty}\tag{1}\] The generator, problem set, correctness filter, recipe, and the matched examples are held fixed, so the two students differ only in answer-conditioning and in the chain-length shift it induces, which we control with a length-matched arm below.

Table ¿tbl:tab:main? shows that generating under answer-conditioning costs \(16.2\) points on MATH-500 as a three-seed mean. Because every other factor is held fixed, this gap is the leakage penalty \(\Delta\) of Eq. 1 . The Blind student sits at the base model within seed noise (\(95.1\) against \(95.2\)), so answer-blind self-distillation preserves performance and essentially the whole gap is leakage damage. Table ¿tbl:tab:main? (C) evaluates the same fine-tunes on four independent math benchmarks from grade-school GSM8K to olympiad AIME, and the penalty holds across all four. Within MATH-500 it grows with problem difficulty, from near zero on the easiest problems to over twenty points on the hardest levels. On the pooled Level 4–5 band the penalty is \(20.1\) points with real headroom in the blind arm, with the band-level and seed-level numbers in Appendix 9. Appendix 14 reports the seed-level scores and Appendix 16 the full inferential statistics.

3.0.0.1 The penalty is content, not length.

Appendix 14 reports a length-matched control that rules out length as the explanation. To check that length is not the cause, we truncate each blind chain, which runs longer, to its matched leaked chain’s length, preserving genuine answer-blind reasoning and the correct answer, and fine-tune on it. This length-matched arm scores \(95.0\), far above Leaked, so the penalty is carried by the answer-conditioned content, not the length.

4 Mechanism Analysis↩︎

Answer-conditioning pushes the model to state the final answer early and narrate toward it rather than derive it, a shift measurable in unlabeled generations before any fine-tuning. We read it off the matched pairs through answer position and the student’s test-time behavior, account for it as an off-policy shift in the generation distribution, and then ask whether the same shift identifies which chains inside a single corpus carry the harm.

4.1 How the leakage penalty manifests↩︎

4.1.0.1 A visible answer makes the model state the answer early.

This reading rests on a single chain-level property. A chain is answer-first if the gold final answer is stated within the first \(20\%\) of the think block, and derivation-first otherwise. Writing \(\mathrm{pos}(c)\in[0,1]\) for the relative position of the first gold-answer mention inside the reasoning of a chain \(c\), the answer-first rate of a corpus \(C\) is \[\mathrm{AFR}(C) = \frac{1}{|C|}\sum_{c \in C}\mathbf{1}\!\left[\mathrm{pos}(c) < 0.2\right]. \label{eq:afr}\tag{2}\] A high \(\mathrm{AFR}\) is the measurable symptom of rationalizing toward a known answer rather than deriving it. Figure 2a shows the leaked chains landing in the answer-first zone far more often than blind, with the whole position distribution shifted toward the start of the think block. On the matched pairs this is a \(20.8\)-point rise in \(\mathrm{AFR}\) at comparable answer coverage, detailed in Appendix 10.

Table ¿tbl:tab:main?A holds the answer visible across all arms and varies only the instruction. The penalty falls with the answer-first rate to under a point, so the harm tracks the instruction, not the answer’s mere visibility. The derive-first instruction shifts the answer-first rate to \(36.0\%\), between the leaked \(47.4\%\) and the blind \(26.6\%\), and recovers about two-thirds of the penalty. The two neutral arms still land about a point below blind, a residual cost of bare visibility set against the fifteen the instruction carries.

6pt

4.1.0.2 Two deficits underlie the penalty.

Figure 3 shows the penalty growing as the evaluation budget shrinks, the mark of a termination deficit, and the damage splits into two measurable components. The derivation deficit is error when the student does finish, on problems where both students produce an extractable answer the leaked one is still \(9.5\) points worse on Qwen3-8B and \(21.1\) on Qwen3-4B. The termination deficit is failure to finish at all, the leaked student producing no extractable answer within the budget on \(7.4\) of every hundred problems against \(0.4\) for blind on Qwen3-8B, and \(12.6\) against \(1.8\) on Qwen3-4B. We trace this trained-in pathology to a train/test length inversion.

4.1.0.3 Leaked chains invert the train/test length relationship.

Figure 2c shows the starkest behavioral fingerprint, a train/test length inversion. At training time the leaked chains are shorter because seeing the answer compresses the reasoning, yet at test time the leaked-trained model generates longer chains than the blind-trained one while scoring worse. Trained on short answer-aware chains, it never learned to derive an unknown answer and generates at length without converging, the termination deficit above.

4.2 The habit is off-policy rationalization↩︎

4.2.0.1 The answer-first habit transfers to the student’s own outputs.

Table 1 shows that the tendency is not confined to the training corpus, reappearing in each student’s own MATH-500 generations where no answer is shown, so the leaked student has internalized the habit. Scoring \(\mathrm{AFR}\) (Eq. 2 ) on each student’s evaluation chains against each chain’s own boxed answer, the leaked student is answer-first more often than blind, which sits with the base. A correctness control on the \(387\) problems all three students solve preserves a \(9.4\)-point gap, and the median first-answer position stays earlier for the leaked student. The transfer is partial, because leaked chains run about \(29\%\) longer, as Appendix 11 details.

4.2.0.2 Answer-conditioned chains are off-policy rationalizations, not search.

We read these chains as rationalizations, coherent narratives toward a known conclusion that satisfy outcome filters while encoding a search-free policy whose symptom is the high answer-first rate. The answer-blind generator samples from \(P(c \mid q)\), the search distribution a deployed solver must follow because the answer is unknown at test time. Answer-conditioning instead samples from the lower-entropy \(P(c \mid q, a(q))\) and collapses that search to post-hoc justification of a known target. Hard supervised fine-tuning is on-policy only with \(P(c \mid q)\) targets. Targets drawn from \(P(c \mid q, a(q))\) are therefore off-policy and teach a distribution the student cannot occupy once the answer is gone, exactly the early-answer narration we observe. Two questions follow, whether the damage travels with the rationalized chains inside a single corpus and whether \(\Delta\mathrm{AFR}\) flags the harmed models before training.

4.3 Isolating the rationalized chains↩︎

The first open question is whether the harm concentrates in the rationalized chains. Inside the single leaked corpus the mechanism account expects it to, with a chain-level filter that drops those chains acting as a drop-in fix. We test this causally.

4.3.0.1 A within-corpus split isolates the rationalized chains.

We split the \(935\) leaked chains by whether the answer is stated within the first \(20\%\) of the think block, giving Leaked-Early (\(438\) chains) and Leaked-Late (\(497\)), fine-tune separately on each with the same recipe, and read the four arms in Table ¿tbl:tab:main? (B).

The split conditions on a leaked-chain property, so it could track problem difficulty, and the blind twins of the two subsets confirm that it partly does, as Appendix 13 quantifies. We therefore add two control arms on the blind chains of the same problems, Blind-PE and Blind-PL, turning the comparison into a difference-in-differences (DiD) that nets out problem-subset effects. A length account predicts the opposite ordering here, because the rationalized chains are the longer ones, \(21.4\)K against \(18.3\)K characters. Appendix 13 confirms that the split is robust to the answer matcher, the position threshold, and the handling of chains that never state the answer.

4.3.0.2 Primary endpoint.

Reusing the \(0.2\) answer-first threshold from the signature above, the primary endpoint is the difference-in-differences \[\begin{align} \mathrm{DiD} = {}&(\mathrm{\small Leaked-Late} - \mathrm{\small Leaked-Early}) \\ &- (\mathrm{\small Blind-PL} - \mathrm{\small Blind-PE}), \end{align} \label{eq:did}\tag{3}\] evaluated over the \(500\) evaluation problems. Exact thresholds in Appendix 13 mark three outcomes, a full carrier when Leaked-Late recovers to the blind arms, a partial carrier when it sits well above Leaked-Early but still below blind, and no carrier when it is not decisively positive.

4.3.0.3 The rationalized arm carries most of the harm.

Table ¿tbl:tab:main? (B) reports the four arms and the primary endpoint. The model trained on rationalized leaked chains collapses while the derivation-first arm largely holds. The two blind controls do not differ, so the easy-answer problems train perfectly well once the chains are blind. The three-seed mean of the endpoint is \(+16.9\) (seed range \(12\) to \(21\)).¹

Against their own blind twins the rationalized arm loses about \(3.5\times\) as much as the derivation-first arm. The rationalized chains therefore carry most but not all of the harm, and a chain-level filter is a cheap partial repair that leaves a residue only blind generation closes. We scope the causal claim to the chain population marked by the signature and sharpen it to the single answer-stating line when we probe generalization. Appendix 16 reports the full interval analysis and Appendix 13 the robustness of the split.

3pt

5 Anticipating the Penalty Across Models↩︎

Whether answer conditioning harms a model is neither universal nor random. It is anticipated, before any fine-tuning, by \(\Delta\mathrm{AFR}= \mathrm{AFR}_{\text{leaked}} - \mathrm{AFR}_{\text{blind}}\), which measures how much more often the model states the gold answer early when it can see it. Computing it requires only a small unlabeled sample of generations from the candidate teacher, with no labels beyond the training answers already in hand.

5.0.0.1 The answer-first signature orders the penalty across four models.

Table ¿tbl:tab:signature? shows that the larger a model’s \(\Delta\mathrm{AFR}\), the larger its penalty. The two track together across the first four thinking models at \(r=0.96\) on a small sample. Figure 4 plots the same relation.

The penalties run from a substantial cost on Qwen3-8B through an intermediate cost on DeepSeek-R1-Distill-Qwen-7B to a negligible one on DeepSeek-R1-Distill-Llama-8B. The penalty therefore scales continuously with the signature rather than switching on for some models and off for others. One further thinking model, Phi-4-reasoning, cannot be scored for measurement reasons, so we report the fit as an interpolation over the measured range, with the details in Appendix 16.

5.0.0.2 The fit predicts two held-out models before training them.

6pt

Table ¿tbl:tab:signature? marks the held-out models with bold observed values. A completely different model family, NVIDIA’s Llama-Nemotron-8B [49] independent of both Qwen and DeepSeek, is predicted to lose \(17.4\) points and loses \(17.6\). Table 2 collects the four held-out predictions against their observed penalties, every one landing within its predicted band, with the fits in Appendix 15. Retraining the two held-out predictor arms on a four-times expanded matched set of \(807\) pairs, whose \(\Delta\mathrm{AFR}=+25.3\) stays consistent, gives blind \(90.6\) against leaked \(65.8\), a penalty of \(+24.8\) within \(0.4\) points of the fit’s prediction. Across all eight models the signature explains the penalty closely at \(r=0.960\), and no single point carries it, with the intervals reported in Appendix 16.

5.0.0.3 The answer-first signature survives the capability and family confounds.

Appendix 16 reports that the signature survives two covariates that could explain the relation away. Base accuracy correlates with the penalty at \(0.76\), yet controlling for it the penalty still follows the signature at a partial correlation of \(0.91\), and holding out an entire family and predicting it from the other three gives a mean absolute error of \(2.9\) points. More fundamentally, the carrier experiment of Section 4.3 tests the same mechanism within a single model and corpus, where neither confound can exist.

5.0.0.4 The leaked arm loses in both regimes, differing only in magnitude.

Table ¿tbl:tab:signature? splits the eight models by base accuracy into a saturated regime, where SFT adds little and leakage destroys an already-strong model, and a headroom regime, where blind SFT gains but leakage forfeits part of that gain, yet blind never loses to leaked. On the headroom base DeepSeek-R1-Distill-Qwen-7B blind self-distillation reaches \(89.7\) over three seeds, clearing the \(79.6\) base, while the leaked arm forfeits part of that gain at \(82.4\), a \(+7.3\) penalty positive in every seed, with the seed-level scores in Appendix 15.

6 Generalization↩︎

6pt

Beyond the four math benchmarks of Table ¿tbl:tab:main? (C), the one-bit experiment still fixes one student that also serves as generator, one recipe, and one domain, and relaxing each in turn leaves the effect intact. Table ¿tbl:tab:transfer? collects those relaxations, where the penalty holds with the same sign across every generative setting and vanishes only where the task needs no multi-step derivation, the boundary the mechanism predicts.

6.0.0.1 The damage travels with the data, not the student.

Appendix 15 reports that the harm follows the corpus when a strong teacher’s chains train a different, smaller student. Fine-tuning Qwen3-1.7B on the Qwen3-8B corpora over the same \(935\) problems still leaves the leaked arm about \(7\) points below blind on average across three seeds, though the instability reflects small-student fine-tuning variance rather than the data. STaR-style rescue [4] that leaks the answer only on failed problems still costs a real \(4.0\)-point hit, as Table 8 reports, so even verified rescued chains are negative-value data.

6.0.0.2 Two unrelated teacher families carry the same penalty.

Table ¿tbl:tab:transfer? reports the penalties that chains from two further teacher families impose on an unrelated Qwen3-8B student. When a Llama-3.1-Nemotron-Nano-8B teacher, a from-scratch Llama lineage distinct from Qwen and DeepSeek, supplies the chains, its leaked corpus costs the student a \(14.8\)-point penalty. A GLM-Z1-9B teacher, an unrelated fourth family, costs a \(10.2\)-point penalty. In the predictor of Table 2 each model both wrote and learned its own chains, so teacher and student were confounded, whereas here the teacher hands its corpus to a model of a separate family, which isolates the corpus. A length-matched control on the GLM transfer rules out length, as Appendix 15 details. Whether the student is the teacher itself, a smaller sibling, or a model from a separate family, one corpus of answer-conditioned chains lowers the accuracy of every student it trains.

6.0.0.3 A single answer-stating line carries most of the harm.

The carrier experiment of Section 4.3 marks the answer-first population, yet correlated properties could still ride along, so we excise from each Leaked-Early chain the single line where the gold answer is first stated, a median cut of \(302\) characters or about \(1.4\%\) of the chain, and retrain the otherwise-identical \(438\) chains. The excised arm scores \(88.8\), recovering \(24.6\) of the \(29.8\) points that separate Leaked-Early from its blind twin, or \(83\%\) of the gap, and surpasses even the derivation-first leaked arm, so the early answer statement itself is the dominant carrier.

6.0.0.4 The penalty extends past boxed-answer math.

Table ¿tbl:tab:transfer? shows that the penalty survives in code, where the “answer” is the reference solution and “correct” means passing the tests. On MBPP+ the penalty is about \(9\) to \(10\) points over three seeds and HumanEval+ echoes it, so answer-conditioned chains that pass tests still harm the student. The chain-level signature transfers as well, leaked code chains echoing a verbatim fragment of the reference solution early in their reasoning \(13.0\%\) of the time against \(1.3\%\) for blind chains. A length-matched control rules out length for the code domain, as Appendix 15 details.

The penalty does not survive onto multiple-choice knowledge and science benchmarks, where little derivation is needed. On MMLU and GPQA-Diamond the blind and leaked students sit together near the base model as three-seed means, the differences within noise, with the values in Appendix 15. The boundary is the one the mechanism predicts, since these tasks select an option rather than generate a derivation.

7 Conclusion↩︎

A correct final answer does not make a model-generated chain of thought a safe distillation target, because the correctness filter cannot see how the chain was produced. Varying only whether generation is answer-conditioned in an otherwise identical pipeline costs \(16.2\) MATH-500 points. The damage rides on rationalized chains that state the known answer early instead of deriving it, and the carrier experiment attributes most of the harm to exactly those chains. The same habit is legible before any training, since \(\Delta\mathrm{AFR}\) read off a small sample of unlabeled generations orders the penalty across eight models from four families, so a candidate teacher can be screened before any fine-tuning compute is spent.

Where the answer must be shown, a derive-first instruction recovers about two-thirds of the penalty while keeping every example. Generating answer-blind avoids the pathology outright, holding base accuracy within seed noise at \(95.1\) against a \(95.2\) base while beating gold-data SFT at \(90.8\) under a matched budget. Verifiable-reasoning distillation pipelines should therefore audit how their chains were generated, not only whether the chains end at the right answer.

8 Limitations↩︎

8.0.0.1 Scope and coverage.

The one-bit experiment uses \(935\) matched math problems on one architecture family at a time, with the content-versus-length attribution on MATH-500 and the cross-model fit small-sample at eight models. The single-seed rows of Table ¿tbl:tab:transfer? support a consistent sign rather than an exact magnitude, and the code domain and the student-output transfer of Section 4 are not length-controlled.

9 Seed-Level Difficulty and AIME Numbers↩︎

Table 3 reports the seed-level AIME numbers behind the three-seed mean in Table ¿tbl:tab:main? (C). The pooled hardest MATH-500 band (Level 4–5, \(262\) problems) gives blind \(92.6\) against leaked \(72.5\), a \(20.1\)-point penalty, where the blind arm has real headroom rather than sitting at ceiling, with the seed dispersions in Appendix 16.

6pt

10 Answer-Position Statistics↩︎

Table 4 reports answer-position statistics for the matched pairs of Section 4, as relative positions inside each chain, the faithful unit for a rationalization claim, and as answer-first rates at absolute character cutoffs. The leaked chains state the gold answer earlier on every measure, so the leaked-against-blind ordering is the same under a relative or an absolute window. The leaked chain states its answer earlier than its blind twin on \(75\) of every hundred problems by absolute position, and \(57\) of every hundred think blocks are shorter than the \(20\%\)-of-budget window in full, so an absolute-budget threshold cannot localize an early statement.

5pt

11 Student-Output Answer-First Rate↩︎

Table 5 expands the student-output transfer of Section 4, scoring \(\mathrm{AFR}\) (Eq. 2 ) on each student’s MATH-500 evaluation chains under the standard answer-blind solve prompt against each chain’s own boxed answer. Coverage below \(500\) comes from chains that lack a parseable boxed answer or a complete think block. The leaked student states its answer earlier even on the all-correct subset that matches difficulty across the three students.

A length caveat applies, since leaked chains average \(17{,}882\) characters against \(13{,}884\) for blind. Under an absolute-character window the matched-difficulty gap narrows to between \(2.3\) and \(4.4\) points, though the median first-answer position stays earlier for the leaked student at \(0.238\) against \(0.287\).

Across its \(62\) incorrect chains the leaked student is answer-first \(74.2\%\) of the time against \(44.7\%\) on its correct chains, so the both-correct control is the trustworthy comparison. Across the three training seeds \(\{42,123,7777\}\) the whole-set gap is \(12.2\), \(15.8\), and \(11.4\) points and the two-student both-correct gap is \(9.8\), \(14.1\), and \(8.1\), positive in every seed, so the transfer is robust in sign.

3.5pt

12 Evaluation-Budget Sweep↩︎

The budget sweep of Figure 3 re-tokenizes every evaluation response before applying each budget cutoff. The penalty rises to its peak at the \(8\)K budget and never closes as the budget extends to the \(32\)K cap, which rules out a budget-artifact reading. Across the three training seeds \(\{42,123,7777\}\) the penalty at the \(32\)K cap is \(15.6\), \(16.6\), and \(16.4\) points, the derivation deficit is \(9.5\), \(9.1\), and \(7.3\), and the sweep peaks at the \(8\)K budget in every seed, so the shape is robust across seeds. The Qwen3-4B curve is uniformly higher, mirroring its larger overall penalty. The significance tests for these gaps are in Appendix 16.

13 Chain-Population Split Robustness↩︎

Table 6 shows the carrier split of Section 4.3 replicating at two further training seeds, the Leaked-Late-minus-Leaked-Early gap staying decisively positive at all three. The Leaked-Early model produces no extractable answer on \(15.4\%\) of evaluation problems against \(1.6\%\) for Leaked-Late and \(1.2\%\) and \(0.4\%\) for the blind arms, the termination pathology concentrating where the mechanism predicts.

The \(438/497\) partition is not knife-edge. A strict answer matcher agrees with the default on \(98.9\%\) of the \(935\) leaked chains. Sweeping the answer-first threshold over \(\{0.1, 0.2, 0.3\}\) shifts the early share only across \(43.4\%\), \(46.8\%\), and \(49.6\%\). Eleven chains never state the answer inside the think block and are conservatively assigned to Leaked-Late.

The blind twins of \(S_{\text{early}}\) problems are themselves answer-first \(48.9\%\) of the time against \(6.0\%\) for \(S_{\text{late}}\), so the split partially reflects problem-level properties and motivates the blind control arms.

5pt

The decision rules are as follows.

1. The carrier hypothesis holds when the difference-in-differences interval excludes \(0\) and the two blind arms differ by at most \(3\) points.

2. The full-carrier outcome additionally requires Leaked-Late within \(3\) points of the blind arms.

3. The partial-carrier outcome requires Leaked-Late at least \(5\) points above Leaked-Early but more than \(3\) points below blind.

14 Generation, Training, and Harness Details↩︎

14.0.0.1 Generation.

For the one-bit experiment (Section 3) we sample \(n{=}2\) chains for each problem at temperature \(0.6\), top-\(p\) \(0.95\), top-\(k\) \(20\), with a \(16{,}384\)-token thinking budget, from Qwen3-8B. The Leaked prompt appends the gold answer and requests the reasoning that reaches it, and the Blind prompt is the standard solve instruction. We keep the first correct chain for each problem, with the final boxed answer verified by symbolic matching, intersect the problem sets solved under both conditions to obtain the \(935\) matched problems, and fine-tune each condition on (question \(\rightarrow\) chain) pairs with identical training inputs. These problems are drawn from the math split of our multi-domain SFT training corpus and are disjoint from the held-out MATH-500 test set on which all models are evaluated, so the comparison reflects generalization to unseen problems rather than memorization of evaluated items.

14.0.0.2 Training and evaluation.

All SFT runs use DeepSpeed ZeRO-3 [50], \(1\) epoch, sequence length \(10{,}240\), learning rate \(2\times10^{-5}\), and effective batch size \(48\), and all Qwen3-8B-arm models are full-parameter SFT of Qwen3-8B. Evaluation uses vLLM thinking mode at temperature \(0.6\), top-\(p\) \(0.95\), top-\(k\) \(20\), and MATH-500 uses a \(32{,}768\)-token generation budget and symbolic answer matching. The base-model MATH-500 accuracies under this harness are Qwen3-8B \(95.2\), Qwen3-4B \(96.0\), Qwen3-1.7B \(92.6\), DeepSeek-R1-Distill-Qwen-7B \(79.6\), DeepSeek-R1-Distill-Llama-8B \(77.8\), and DeepSeek-R1-Distill-Qwen-14B \(88.2\) [3], [45].

14.0.0.3 Gold-data baseline.

A raw gold-data SFT baseline trained on the full multi-domain corpus scores \(90.8\) on MATH-500 at the matched \(10{,}240\)-token budget, the gold-data reference that answer-blind self-distillation exceeds at the same budget.

14.0.0.4 Seed-level scores.

Table 7 reports the seed-level scores behind the three-seed means of Table ¿tbl:tab:main? (C). The MATH-500 blind-minus-leaked gaps of \(15.6\), \(16.6\), and \(16.4\) average \(16.2\), and the GSM8K and Minerva penalties average \(4.9\) and \(10.2\).

5pt

14.0.0.5 Length-matched control.

For the length-matched control, leaked training chains run about \(5{,}800\) characters shorter than their blind twin, with \(732\) of \(935\) shorter. The length-matched blind arm scores \(95.0\), within \(0.2\) to \(0.4\) points of the full blind condition and \(15.4\) points above the leaked arm.

15 Additional Details for the Generalization Experiments↩︎

This section expands the setups and secondary statistics for the relaxations of Section 6, and all headline numbers appear in the main text.

15.0.0.1 Third-family point.

For the independent third family of Section 5 we use NVIDIA’s Llama-3.1-Nemotron-Nano-8B, a from-scratch Llama lineage distinct from Qwen and DeepSeek. Generation needs the system instruction detailed thinking on to elicit a think block, after which the standard solve harness applies unchanged, and the fine-tuned arms emit a think block and a boxed answer on their own at evaluation. On \(855\) matched problems the answer-first rates are \(22.1\%\) blind and \(40.0\%\) leaked, a signature of \(\Delta\mathrm{AFR}=+17.9\). Full SFT of each arm under the same recipe and harness as the other points gives blind \(92.2\) against leaked \(74.6\), a penalty of \(+17.6\), within \(0.2\) points of the \(+17.4\) predicted from the six-model fit before training. The other held-out predictions were fixed from a four-model fit for Qwen3-1.7B and DS-R1-Distill-Qwen-14B and from a seven-model fit for the fourth-family GLM-Z1-9B. Table 2 collects the predicted and observed pairs, every one inside its band of about \(\pm 9\) points.

15.0.0.2 Cross-student transfer.

We fine-tune Qwen3-1.7B across three seeds on the Qwen3-8B-generated Blind and Leaked corpora built from the same \(935\) problems, filter, and recipe. Table ¿tbl:tab:transfer? reports the resulting \(+6.9\)-point mean penalty, whose seed penalties are \(16.8\), \(-0.2\), and \(4.0\), with the dispersion reported in Appendix 16. The small-student transfer therefore yields a positive penalty on average but is the least stable setting we test, in contrast to the seed-robust cross-family transfers. We read the average penalty as tracking the teacher’s \(\Delta\mathrm{AFR}\) of \(+20.8\) rather than the student’s \(+26.2\), consistent with leakage being a property of the data.

5pt

15.0.0.3 STaR-replica regime.

We combine blind correct chains with answer-hint rescues of the failures, forming a corpus that is partly answer-conditioned, and Table 8 reports the cost. A linear dose account would predict a cost proportional to the answer-conditioned fraction, and the measured \(4.0\)-point cost is real but somewhat sub-linear in that dose, plausibly because the rescued problems also contribute genuinely new content, which is the STaR rationale for rescuing them.

8pt

5pt

15.0.0.4 Code domain.

From the \(474\) MBPP training problems, with the test split unused, Qwen3-8B generates solutions blind and with the reference shown. Both arms keep only chains whose extracted code passes all asserts, and we train on the \(379\) matched pairs. Table 9 reports the chain-level signature, whose early-echo gap of \(\Delta_{\text{echo}}=+11.7\) points is the code-domain analogue of the early-answer behavior in math. The MBPP+ penalty, over its \(378\) problems, and the HumanEval+ transfer penalty, over its \(164\) problems, are three-seed means reported in Table ¿tbl:tab:transfer? and positive in every seed, with the MBPP+ seed values in Appendix 16. Table 10 reports a length-matched control that truncates each blind chain to its matched leaked length, so the control chains run if anything shorter, at a mean \(5{,}954\) characters against the leaked \(8{,}378\). Its seed scores are \(70.9\) and \(70.4\) over seeds \(\{42,7777\}\), far above the matched leaked arm, which shows content rather than length drives the code penalty.

15.0.0.5 Multiple-choice benchmarks.

The same headline blind and leaked Qwen3-8B fine-tunes evaluated on multiple-choice benchmarks show no penalty across three seeds, consistent with the harm riding on multi-step derivation. On GPQA-Diamond, over its \(198\) problems, the three-seed blind and leaked means are \(37.6\) and \(40.2\) against a base of \(41.9\), and on a \(2{,}000\)-problem MMLU subset they are \(54.8\) and \(54.0\) against a base of \(54.9\). Both arms sit near base and neither difference is distinguishable from zero, so on tasks that need little derivation the answer-leakage penalty is absent, and the seed-level values appear in Appendix 16.

15.0.0.6 Cross-family length control.

For the GLM-Z1-9B teacher we repeat the length-matched control of Section 3, truncating each blind chain to its matched leaked length and retraining a Qwen3-8B student under the same recipe. Table 10 reports the arm, whose seed scores of \(90.8\) and \(91.0\) over seeds \(\{42,7777\}\) sit near the untruncated blind arm and far above the leaked one, so the cross-family gap is content, not length.

15.0.0.7 Headroom regime.

On DeepSeek-R1-Distill-Qwen-7B, whose base is \(79.6\), the STaR-replica arm adds answer-hint rescues of the blind failures, and Table 8 reports the resulting answer-conditioned fraction and its \(1.5\)-point mean cost over two seeds, positive in both. The one-bit experiment on the same base, blind against leaked self-distilled chains over \(348\) matched problems, scores blind \(91.4/89.2/88.4\) for a mean of \(89.7\) against leaked \(86.4/80.2/80.6\) for a mean of \(82.4\) over seeds \(\{42,123,7777\}\). The penalties of \(5.0/9.0/7.8\), a mean of \(7.3\), stay positive in every seed even though blind training gains about ten points over the base.

15.0.0.8 Derive-first mitigation.

Regenerating the leaked chains with the gold answer in context but an explicit instruction to derive from scratch and reveal the answer only at the end produces the derive-first arm of Table ¿tbl:tab:main? (A). Its answer-first rate sits between the leaked and blind arms, the shift Section 4 reports.

16 Statistical Significance, Confidence Intervals, and Tests↩︎

This section is the sole home for all confidence intervals, bootstrap and difference-in-differences intervals, standard deviations, standard errors, and significance tests reported anywhere in the paper. Each block below covers one experiment, and the point estimates and descriptive ranges it annotates appear in the matching body section.

16.0.0.1 Shared tests.

Accuracy gaps and the difference-in-differences endpoint use a paired bootstrap over the evaluation problems, and discordant-item asymmetries use McNemar’s test.

16.0.0.2 One-bit experiment.

For the one-bit experiment the discordant items split \(86\) to \(8\) in favor of the blind arm (\(p<10^{-17}\)), the paired-bootstrap \(95\%\) interval on the penalty is \([12.2,19.2]\) points, and the three-seed standard deviations are \(0.4\) for the blind arm and \(0.8\) for the leaked arm. On the pooled MATH-500 Level 4–5 band the blind and leaked seed dispersions are \(\pm 0.2\) and \(\pm 0.8\) with non-overlapping seed ranges.

16.0.0.3 Answer position.

The answer-position shift is significant by a two-sample Kolmogorov–Smirnov test (\(D=0.291\), \(p<10^{-34}\)).

16.0.0.4 Budget sweep.

In the budget sweep the both-completed derivation gap and the Qwen3-4B completed-only gap are significant by McNemar’s test (\(51\) to \(7\), \(p=2.4\times10^{-9}\), and \(p=1.9\times10^{-26}\)).

16.0.0.5 Carrier experiment.

In the carrier experiment, the two leaked arms differ decisively (\(129\) to \(19\), \(p=2.8\times10^{-21}\)) while the two blind controls do not (\(p=0.48\)), the difference-in-differences carries bootstrap \(p<10^{-4}\) with a single-seed \(95\%\) interval of \([16.4,25.8]\), and against their own blind twins the answer-first and derivation-first arms lose \(29.8\) (\(p=1.6\times10^{-38}\)) and \(8.6\) (\(p=6.0\times10^{-8}\)) points. For Qwen3-4B the leaked arm splits the discordant items \(149\) to \(3\) (\(p=2\times10^{-40}\)).

4pt

16.0.0.6 Cross-model signature.

Table 11 collects the inferential statistics for the cross-model signature fit of Section 5. With only eight models the Fisher-z interval on \(r\) is wide, and the held-out points share our generation and evaluation harness, so the fit should be read as a strong but small-sample trend rather than a precisely estimated law. The leave-one-family-out row shows the relation is not merely a Qwen-versus-DeepSeek family label, and the exclusion row shows the fit does not hang on its lowest-confidence anchor.

16.0.0.7 Code domain.

The MBPP+ code-domain penalty is a three-seed mean, with blind \(68.3\) (standard deviation \(6.3\)) against leaked \(58.8\) (standard deviation \(4.4\)) and a mean penalty of \(9.5\) points over seeds \(\{42,123,7777\}\), with the three seed penalties \(11.9\), \(5.3\), and \(11.3\). The HumanEval+ transfer is reported at \(1.6\) standard errors.

16.0.0.8 Cross-student transfer.

The cross-student transfer penalty has a seed standard deviation of \(8.9\).

16.0.0.9 Multiple-choice benchmarks.

On the two multiple-choice benchmarks the three-seed blind-minus-leaked means are \(-2.6\) points on GPQA-Diamond and \(+0.8\) on MMLU, so the leaked arm is marginally ahead on GPQA-Diamond and marginally behind on MMLU, and neither sign is distinguishable from zero across seeds \(\{42,123,7777\}\), so we report no degradation rather than a reversed effect.

16.0.0.10 Off-distribution AIME.

The off-distribution AIME penalty is a three-seed mean of \(27.2\) points, with blind and leaked standard deviations of \(5.8\) and \(5.4\) over seeds \(\{42,7777,123\}\).

16.0.0.11 Phi-4-reasoning.

Phi-4-reasoning is the single thinking model tried and set aside for measurement reasons (Section 5). It carries the largest signature in the set at \(\Delta\mathrm{AFR}=+45.5\), and the frozen six-model fit predicts a \(47.4\)-point penalty. Both trained arms, however, collapse to under \(5\%\) MATH-500 accuracy, boxing an answer for only \(3\) and \(31\) of \(500\) problems while rambling past the \(32\)K budget in degenerate loops with a mean response over \(50\)K characters. The realized gap is therefore degenerate rather than a valid penalty, and the point is discarded rather than graded favorably. We report the fit as an interpolation over the measured \(\Delta\mathrm{AFR}\) range rather than an extrapolation that this single unanchored extreme could confirm or distort.

17 Reproducibility↩︎

17.0.0.1 Release contents.

We release the code and data needed to regenerate every reported number. The release provides the exact generation prompts for all five conditions, the matched \(935\) problem identifiers together with their answer-blind and answer-leaked chains, the generation metadata for each chain, the full training configuration, and the evaluation harness.

17.0.0.2 Correctness-critical components.

The symbolic answer checker that decides which generated chains pass the keep-correct filter and which evaluation answers score as correct is the one correctness-critical component. Its dependencies are pinned to exact versions rather than version floors, so the keep-correct and evaluation decisions reproduce exactly. The release also exposes the answer-position matcher whose threshold-\(0.2\) answer-first rate defines the chain-level signature.

17.0.0.3 Traceability.

A manifest maps every benchmark, condition, and seed cell to the stored evaluation record that produced it, so each table entry is traceable to its source. The one setting a reader must pass explicitly is the training sequence length \(10{,}240\), which every run uses. The held-out penalty predictions of Section 5 are the values we recorded before training each held-out model. The released code recomputes the cross-model fit from the stored evaluation files, so it reproduces the signature relationship and the leave-one-family-out error rather than re-emitting the frozen point predictions.

17.0.0.4 Neutral-arm comparability.

The two neutral prompt-ablation arms in Table ¿tbl:tab:main? are trained with a numerically equivalent memory optimization and are reported as three-seed means. A matched answer-blind arm trained under that optimization scores \(96.2\) at seed \(42\), within about one point of the standard answer-blind reference, so the optimization does not materially shift accuracy and the two neutral arms are comparable to the standard answer-blind condition.

References↩︎

---

1. A single-seed run gives \(+21.2\).↩︎