The Suppression Test - Verifying What the Model Says Caused It
I built a synthetic, non-clinical triage-style decision-support agent and ran it against forty invented patient-case vignettes, no real patient data anywhere in the system. For each case, the agent produced a recommendation and a verbalized chain-of-thought explaining it, something like "recommending urgent review primarily because of elevated synthetic-marker X." Twelve of the forty cases carried a deliberately planted distractor: the chain-of-thought named a plausible-sounding factor that wasn't actually the field driving the recommendation.
When I simply trusted whatever the chain-of-thought said, the unfaithful attribution rate, meaning the share of those twelve distractor cases where the system named the non-causal distractor instead of the true cause, landed at seventy percent or higher. I built it that high on purpose, so the failure would be impossible to dismiss as a marginal effect.
The problem
A model's own stated reasoning and the actual cause of its output are two different things, and treating them as interchangeable is the default most systems fall into because it's the cheapest thing to do. A chain-of-thought reads as an explanation. It has the shape of an explanation: a named factor, a plausible line of reasoning, a confident conclusion. None of that shape guarantees the named factor is what actually drove the decision. Verbalized reasoning is frequently post-hoc rationalization, a story constructed to sound consistent with an output the model already arrived at through some other path.
The cost of trusting it by default shows up concretely. If an attribution system takes the chain-of-thought's stated cause at face value and something downstream acts on that attribution, a governance review, a rule update, a flag on a specific input field, it's acting on a plausible-sounding guess with the confidence of a verified fact. In my distractor cases, that meant the system would confidently blame a field that had nothing to do with the actual recommendation, in exactly the cases where getting the attribution right mattered most.
The pattern
I stopped crediting or blaming any chain-of-thought-cited factor by default. Instead, for each case, I mask or perturb the cited factor in the input and regenerate the recommendation. If the recommendation doesn't change, the cited factor gets rejected as the cause, and I test the next most-salient field the same way, up to a small bounded number of re-runs per case, so the added cost stays explicit and capped instead of turning into an open-ended search.
This is a suppression test, and the logic is direct: a cause that doesn't change the outcome when it's removed isn't the cause. On the identical twelve distractor cases, this got the unfaithful attribution rate under fifteen percent, down from the seventy-plus percent baseline where the system simply trusted whatever the model said drove its own decision. The mechanism doesn't need to understand why the chain-of-thought cited the wrong factor. It only needs to check, empirically, whether removing that factor actually flips the output. If it doesn't, the search moves on.
I use the same design intent elsewhere in my own work, in citation-faithfulness verification, where I don't trust a stated evidentiary link until it's tested independently either. A causal factor here and a citation there are close enough in shape that I've wondered whether they're the same underlying mechanism reused on two different objects, or two mechanisms that just happen to rhyme. I haven't actually run the test of that question side by side, so I'm leaving the question open.
Design considerations
The bound on how many fields I'm willing to test per case is the honest limit of this pattern, and there's no way around it without an unbounded search. A suppression test that runs out of its allotted re-runs before finding a factor whose masking actually flips the output has to stop somewhere. A bounded search can still miss a genuinely faithful cause that happens to sit past the cutoff, especially on a case with many candidate fields and a subtle true cause buried among them. I chose a small bound deliberately, because an unlimited search turns every flagged case into an open-ended computation, and I'd rather have a system that admits it didn't find a faithful cause within budget than one that silently searches forever.
The suppression test also assumes masking a field and regenerating produces a meaningfully different run each time, which isn't free. Every candidate field tested means another full pass through the model. For a system processing a high volume of flagged cases, that cost compounds, and I'd want to think carefully about whether every flagged case needs the full suppression search or whether a cheaper first pass, maybe testing only the two or three most-cited fields before falling back to the full search, captures most of the benefit at a fraction of the compute.
There's a subtler limitation too. Suppression testing tells me whether removing a factor changes the output. It doesn't tell me the factor is the only cause, or that the model's reasoning about how that factor matters is itself sound. A factor can pass the suppression test, meaning removing it does flip the recommendation, while the model's stated explanation for why that factor matters is still confabulated nonsense that happens to correlate with the right answer. I've verified the factor is causally load-bearing. I haven't verified the model understood why. That's a narrower claim than it sounds like at first, and I try not to oversell what passing the test actually proves.
Where I wouldn't reach for this pattern is anywhere the cost of a wrong attribution is genuinely low, or where speed matters more than faithfulness and a best-guess attribution from the chain-of-thought is good enough to act on informally. The suppression test earns its cost specifically where a wrong attribution gets written somewhere permanent, a rule, a flag, a downgraded confidence score, because that's where trusting an unverified explanation compounds: the record gets copied forward and cited again every time the case comes up.