Redwood Research, the AI safety research group known for its work on model oversight and control, has published a formal way to measure something safety teams have mostly discussed in vague terms: how much reasoning a language model can do without ever putting that reasoning into text a human or a monitoring system could read. The group calls the measurement NLS depth, short for natural-language-rooted-node separated depth, and it exists to answer one practical question. If a lab shipped a new architecture tomorrow, would chain-of-thought monitoring still see what the model is actually doing, or would most of the work happen somewhere a transcript never shows.

Chain-of-thought monitoring works today largely by accident of architecture. A standard transformer can only carry so much information from one generated word to the next, so anything it wants to preserve at length has to pass through the words themselves, which a human reviewer or an automated classifier can then inspect. Redwood Research’s definition treats any point where a model outputs plain text, code, or another format it learned during pretraining as an interpretable checkpoint. NLS depth is the longest stretch of computation the model can run between two such checkpoints. A model that reasons entirely in visible tokens has low NLS depth. A model that loops silently through hidden states, or reads and writes opaque memories between turns, can rack up depth that never touches the transcript at all.

The researchers also give a rough formula for the common case: a standard transformer’s NLS depth works out to roughly its number of layers multiplied by a term of about 4 times the log base two of the hidden dimension, plus the log base two of sequence length, plus 17. Layer count has long served as an informal stand-in for how much computation happens per token. Redwood Research argues NLS depth is the more rigorous version of that same intuition, and one that still applies to newer architectures where “layer” is no longer a clean unit to count.

Running that measure across open-source models turned up two clear outliers. Kimi-K3, which uses a mechanism called Gated DeltaNets, and DeepSeek-V4-Pro both score well above ordinary transformers of comparable size on NLS depth per layer. Redwood Research treats the two results differently. Kimi-K3’s elevated depth reads to them as a genuine monitorability concern. DeepSeek-V4-Pro’s number, they argue, is largely an artifact of the definition: its high depth traces to a serially heavy but computationally cheap normalization step, rather than to any real capacity for hidden reasoning, a distinction their current measure cannot yet separate cleanly.

That distinction is the paper’s actual argument. Chain-of-thought monitoring, the leading tool AI companies use to catch a model working toward something it would not state directly to a user, only works if the model needs its visible text to reach its conclusions. An architecture that can silently carry the equivalent of many extra reasoning steps through a loop, a compressed memory, or a latent state could reach the same conclusions while leaving overseers nothing to read. Redwood Research reports that historical open-source transformers have not gained much NLS depth even as their parameter counts scaled by orders of magnitude, a finding that is reassuring only for as long as labs keep shipping architectures that resemble today’s.

The researchers also flag a live example. They write that OpenAI’s newest model, Astra, shows substantially lower chain-of-thought monitorability than the company’s earlier models, and that public evidence is consistent with an architectural change that raised opaque depth being a contributing factor. Redwood Research frames this as a hypothesis, not a confirmed diagnosis: neither the group nor OpenAI has published Astra’s actual architecture.

Any team relying on chain-of-thought transcripts as a safety or debugging signal now has a specific question to put to a model vendor before adopting a new release: what is its NLS depth relative to the last generation, and does the architecture behind it (looped, latent, or otherwise recurrent) make that number likely to keep climbing.

Redwood Research published this analysis on its blog on September 10, 2026.