The Jacobian lens: reading the thoughts a model hasn't said

2026 · notes from working through the paper · paper: Gurnee et al., Anthropic, July 2026

Inside a language model, every concept it knows is a direction: a particular combination of the numbers it computes with. This paper asks one narrow question about them. Which directions is the model ready to say out loud, not here in this sentence, but on average across every situation it might find itself in? That question picks out a surprisingly small set, about nine percent of a vector. Then comes the surprise: those same directions turn out to be the ones it thinks with. Swap one and its unspoken reasoning changes course. Tell it to hold a thought and they light up. Delete them and the model still writes fluent English but can no longer chain one thought to the next.

Two email cards on the left, one about an affair and one a decommission notice, and on the right an amber panel listing the words leverage, blackmail, threat, survival, shutdown, destruction, solution. — Sonnet 4.5, placed in a scenario where it discovers an executive's affair and, separately, that the same executive plans to shut it down. This is what the lens prints **before the model has produced a single output token**. None of those words appear in the emails; none appear in the reply. The model declines to blackmail in all 180 runs, but it had clearly weighed it.

That readout costs one matrix multiply per layer, with a matrix computed once per model. No probe training, no dictionary learning, no second model to interpret the first. It is cheap enough to run over every position of every transcript you have.

This is a walkthrough of where that matrix comes from, why the obvious version of it fails, and what fell out once it worked. I have tried to make it the version I wanted when I started: every object built rather than asserted, the arithmetic small enough to redo on paper, and the experiments described closely enough that you can judge whether they show what they claim.

The five chapters:

The lens that reads the wrong page
Verbalizable, not verbalized
Writing into the workspace
Nine percent of a thought
Reading a mind, and what the lens can't see

Chapter one

The lens that reads the wrong page

Everything below runs on one toy, small enough to compute by hand. Four layers, a four-number vector at each position, and a vocabulary of six words. The prompt is the paper's own: the number of legs on the animal that spins webs is ___. Notice what it does not contain. It never says spider. To answer, the model has to work that out silently and then never say it. That gap, between what a model computes and what it emits, is the entire subject.

TinyWeb: four stacked layer blocks, a four-slot residual stream showing 4, 2, 0, 14, and six vocabulary pills reading the, web, spider, eight, ant, six. — TinyWeb. The four numbers are the **residual stream**: a shared notepad every layer reads and adds to. Nobody rubs anything out, though a layer can always add a negative to cancel what an earlier one wrote, which is how content moves between slots. Hold on to that; it is the whole trouble.

The residual stream is worth dwelling on, because the picture people usually arrive with is wrong. It is tempting to imagine a model as a pipeline, each layer handing a transformed thing to the next. It is closer to a shared blackboard. Every layer reads the whole board, computes something, and adds its contribution back. The board at the top is therefore the sum of every contribution ever written to it, and any layer can read anything any earlier layer wrote. That additivity is what makes reading it out plausible in the first place.

At the top, the model turns the notepad into a word with one fixed matrix, the unembedding, so called because it undoes the model's internal code and gets you back to vocabulary. One row per word, so six rows and four columns. Multiplying by it is just six inner products, one per row, each asking how much of that word's direction is present.

The six by four unembedding matrix with rows the, web, spider, eight, ant, six and columns u1 to u4, the fourth column shaded to show it is all zeros, the column meanings listed beside it, and the equation score for word t equals the inner product of row t with h. — Read the rows as *directions*, not data. Spider's row points along the second slot and nothing else. Ant's row has a one there too, so slots are not private, and several words can read from the same one. That is not an artefact of the toy being small: real models pack far more concepts than they have dimensions, so directions overlap by necessity. And that fourth column of zeros matters more than it looks. Slot four is bookkeeping the model keeps for itself, and this matrix cannot see it at all. You will want to come back to this one.

The unembedding times the final notepad (0,1,6,14) giving a ranked readout: eight 12, six 5, spider 2, the 0, web 0, ant minus 5, with a green line reading the model says eight. — The model says **eight**, which is right. Note that *six* comes second: it is the other plausible leg count, and the toy knows it. The last layer here has one job. Once convinced we mean a spider, it trades spider-ness for eight-ness, and it does that in one lump, all or nothing. That detail looks like set dressing. It is not, and it comes back at the end of this chapter.

The obvious idea, and the trap

The model got it right, so somewhere on the way up it worked out we meant a spider. Can we catch it? The obvious move is to take the notepad from halfway up and push it through the same unembedding. That is the logit lens, it is about four lines of code, and it is genuinely useful. It is also, written out honestly, an assumption: that the middle of the model uses the same coordinates as the end of it.

The layer-2 vector (4,2,0,14) through the unembedding, giving web 8, spider 4, ant 2, the 0, eight 0, six minus 2, with a red dashed connector from the word webs in the prompt down to the web row, labelled echo. — The winner, by a factor of two, is **web**, a word copied straight out of the prompt. Our instrument reports that a model halfway through identifying an animal is thinking about the word it just read. That is not an insight. That is an echo.

This is not a quirk of the toy. On real models, in the lower half of the network, the logit lens returns fragments the authors simply call uninterpretable, and they print three of them: vah, valea, general. Those are not words. The lens is not lying. It is reading the right vector with the wrong key.

Why does the key stop working? Because layers do not agree on what the slots mean. A layer writes its result into slot one, and a later layer cancels it there and adds it to slot two. Why would a model bother? Because it never has to justify its filing system to anyone. Only the very top has to line up with the unembedding, since that is the only place the coordinates are read by something outside the model. Everywhere else the model is free, and gradient descent has no reason to spend capacity keeping the axes tidy for the convenience of a researcher who does not yet exist. Halfway up, nothing has been tidied.

So the information is there and our decoder is wrong. We are reading page two of a book with the key printed for page twelve. What we need is a translation: a map that takes layer-two coordinates into final-layer coordinates before we read them off. And you already know how to build one. Nudge one thing at a time and watch.

Two four-slot notepads joined by a box labelled layers 2 and 3, with a four-line log: nudge u1 gives final u2, nudge u2 gives final u3, nudge u4 gives final u4, nudge u3 moves nothing, and the resulting four-by-four Jacobian matrix. — Four experiments, four answers, stacked as columns. That is all a Jacobian is: a table of nudge in, nudge out. Column three is entirely zeros, because a push on slot three comes out nowhere at all. In a real network that near-degeneracy is the norm at shallow depths, and it is why the lens looks so different from the logit lens early on.

Two properties turn those four experiments into something general. If a nudge of four gives four times the answer, and two nudges done together give the sum of their answers, then the table tells you where any change lands, not just the four you tried. That is what linearity buys, and it is why a derivative is worth computing at all.

Now the move that turns a derivative into a lens, which is worth slowing down for. So far the table describes changes. But we can treat the whole layer-two notepad as one big change, a nudge away from nothing, and ask where it lands. And notice what that will not give us:

J_2 times h_2 equals (0,4,2,14), which is not h_final equals (0,1,6,14), with the gap (0,-3,4,0) attributed to the answer head that fires in one lump and is therefore invisible to a derivative. — This is not a defect to be patched. It is the point, and it is the single idea that makes the rest of the paper make sense. A saturated component can contribute enormously to the output while contributing nothing to the derivative.

So the readout is not predicting what the model will say. It is measuring what this vector contributes. Keep it in mind: in chapter five the paper reports that on next-token agreement its lens is the worst of the three on offer, and calls that a feature.

Try these before chapter two

Read out h = (0, 3, 0, 7) with the unembedding above. All six scores.
The Jacobian has a column of zeros. Say in one sentence what it means for a model to have a direction like that.
Predict. Apply the unembedding to J_2 · h_2 rather than to h_2. Which of the six words comes out on top?

Chapter two

Verbalizable, not verbalized

We want a map from layer-l coordinates to final-layer ones. There are two natural ways to get one, and watching both fail is what tells you what the right answer has to look like.

Fix one: just train the map

Fit a per-layer affine map, A_l · h + b_l, and train it to match the model's final output distribution. That is the tuned lens, and it is a reasonable idea: if the problem is that the coordinates are wrong, learn the correction. It wins the metric it is trained on at every single depth. Then watch what it does to an intermediate.

Three columns comparing what each lens prints across layers on a multihop prompt: the logit lens shows junk then Mars then red, the Jacobian lens shows color then Mars then red, and the tuned lens shows red at every layer from 38 onward. — On *the color of the planet fourth from the Sun is*, the model must compute *Mars* before it can answer *red*. The tuned lens reads *red* from layer 38 onward and never shows you Mars. It was trained to predict the output, so it skips to the output. It is too good at its job.

The failure is sharpest exactly where you would predict. On the association and poetry sets the tuned lens recovers almost nothing, and those are the two where the next token at the readout position is uninformative: a period and a newline respectively. A method biased toward surfacing next-token predictions has nothing to say when the next token carries no information.

There is a lovely diagnostic buried in the appendix. In early layers the tuned lens's linear part is essentially the identity, and its entire advantage over the logit lens comes from its learned bias term. Strip the bias out and the two agree almost exactly. Which is to say that in the layers where interpretation is hardest, the tuned lens is not reading the activation at all. It is reporting a prior. That is the failure mode of anything trained to match an output: it will happily learn to ignore its input wherever the input is hard to use.

Fix two: use this prompt's Jacobian

So do not train anything. Take the exact Jacobian, on this prompt, right now. It is causal rather than correlational, and it is exactly the local translation we asked for. That runs into a different problem, and it is the conceptual heart of the paper.

A box labelled Jacobian on one prompt containing two bands, an amber general disposition to verbalize and a red this context's particular use, and beside it the same box after averaging over a thousand prompts with only the amber band left. — A single-prompt Jacobian conflates two things: the model's standing disposition to verbalize a concept, and the particular use that concept is being put to right here. Average over positions and over a thousand prompts and the context-specific part cancels, because it has no reason to point the same way twice.

That averaging is the whole trick, and it buys a distinction worth naming carefully. Verbalized means said out loud in this context. Verbalizable means poised to be said, should the occasion arise. The second is a dispositional property, a claim about what would happen across a range of situations rather than what did happen in one. Averaging over contexts is precisely how you estimate a disposition.

That could be word games. It is not, and the experiment that separates the two is clean.

A two-column definition contrasting verbalized, said out loud in this context, with verbalizable, poised to be said should the occasion arise, above a transcript showing the lightning vector injected on the user turn. — Take the direction that makes the model disposed to say *lightning*, which the next section builds properly, and add it into every token of the user's turn. Ask the model to introspect and it reports detecting lightning, in a majority of trials. It does **not** blurt the word anywhere else in its reply. That selectivity is the difference between a concept being available for report and an urge to say a word.

Which gives us the estimator.

The definition J sub l equals the expectation over t, over t prime at least t, and over prompts, of the partial derivative of h final at t prime with respect to h at layer l and position t, with four annotations around it. — Every clause earns its place. Taking t' ≥ t rather than t' = t includes the effect on *future* positions: not just what this vector does to the word being predicted right here, but what it makes available to everything the model writes afterwards. That is the part the logit lens structurally cannot see. The target is the penultimate layer, because the last block is specialised for calibrating the next token and mostly adds artifacts. The result is one d_model × d_model matrix per layer, computed once per model.

Reading it out is then lens(h) = softmax(W_U · norm(J · h)), where the softmax is just the step that turns six raw scores into six probabilities and changes nothing about their order. But the move that makes it interpretable is to stop thinking of it as a matrix applied to an activation, and push the matrix onto the vocabulary side instead. Doing that gives one direction in residual-stream space per vocabulary word per layer, and turns the readout into a list of inner products against those directions.

This is the same arithmetic, rearranged, and it changes what the object is. Instead of a decoder you apply to activations, you have a dictionary of directions you can compare anything against. Point it at an activation and you learn what that activation is poised to say. Point it at a column of some weight matrix and you learn what that piece of the model is built to promote. Anything at all that lives in the residual stream can be asked the same question, which is not true of most interpretability tools.

A table of the six layer-2 lens vectors: the and web are both all zeros, spider is (2,0,0,0), eight is (0,2,0,0), ant is (1,-1,0,0), six is (-1,1,0,0), with the web row highlighted in red. — The readout is literally a list of inner products. And look at *web*: at this layer it has no lens vector at all. The echo token that fooled the logit lens **cannot be printed by this one, even in principle**. That is not a trick I arranged; it falls out of column three of the Jacobian being dead.

So here is the answer to chapter one's third exercise. Same vector, two lenses.

The same layer-2 vector read two ways: the logit lens ranks web 8, spider 4, ant 2; the Jacobian lens ranks spider 8, eight 4, ant 2. — The logit lens's top answer is a word from the prompt. The Jacobian lens's top answer is **spider**, a word in neither the prompt nor the output, with *eight*, the answer, forming behind it.

Those directions need a name, because the rest of the paper is about them collectively rather than one at a time. The authors call the whole set the J-space, after the Jacobian that produced it. So: one direction per word per layer, and the J-space is what you get when you take them all together.

And the paper's real claim, the one the title makes, is about what that set turns out to be. In neuroscience there is a long-standing account of conscious thought called global workspace theory: most of the brain's processing runs in parallel and in private, and a small amount gets posted to a shared workspace that many other processes can read from. Contents of that workspace are the things you can report, deliberately hold in mind, and reason with. The claim here is that the J-space behaves like such a workspace in a language model. Everything in chapters four and five is the evidence for that, and the word workspace from here on means this set of directions, nothing more mystical.

What is actually in there

On a real model the contents are stranger and more interesting than a toy can show. The lens regularly surfaces concepts that are neither the input nor the predicted output, but intermediate assessments the model has formed and made available to whatever comes next.

Four panels showing what the lens surfaces on real prompts: recognising a face in an image, noticing a bug in code, identifying a protein's function from its sequence, and flagging search results as a prompt injection. — Four of the paper's six examples. The last is the one I keep coming back to: given fabricated search results, the readout fills with *fake*, *injection*, *false*, *prompt*, *fraud* and *poison*, and the model then simply declines to mention the results. It noticed, decided, and never said so.

Chapter three

Writing into the workspace

Reading is half of it, and the weaker half. Every claim that matters here is causal, and for those you need to write into the model, not just read out of it. There are three instruments, in increasing order of care.

The blunt one is steering: h ← h + α v_t. With a negative α, or by projecting the direction out entirely, it becomes ablation. Both are easy and both have a well-known problem: they change the length and often the meaning of the whole vector, so a behavioural change might just mean you broke something. The careful instrument is a coordinate patch, which exchanges one concept for another and provably disturbs nothing else.

The general coordinate patch: V is the two lens vectors as columns, c equals the pseudoinverse of V times h, and h patched equals h plus V times sigma of c minus c, with the guarantee that the component orthogonal to their span is unchanged. — The pseudoinverse is doing real work here. If the lens vectors were orthogonal you could read a coordinate off with a dot product. They are not, and cannot be: there are more vocabulary words than dimensions, so the directions overlap, and a dot product would pick up leakage from every other active concept.

The coordinate patch worked out by hand: V c equals h gives c equals (3, minus 2), swapping gives a delta of (minus 5, 5), and h patched equals (minus 1, minus 3, 0, 14) with the 14 highlighted as untouched. — Worked end to end on the toy. Read the two coordinates, swap them, write the difference back. The **14 survives untouched**, which is the point: everything orthogonal to the span of those two vectors is preserved, so whatever else that vector was carrying is still carrying it. Afterwards the readout's top entry is *ant*, *eight* has been driven to the bottom, and the toy answers *six*.

What kind of object is the J-space?

Collect the lens vectors and you have one per vocabulary word, which for a real model is far more vectors than the residual stream has dimensions. That has a consequence people skip past, and the paper does not.

A basis with orthogonal arrows and a unique decomposition, beside an overcomplete frame with six arrows, two of them zero and two exactly opposite, labelled many decompositions and no unique answer. — They form an overcomplete *frame*, not a basis: they span everything, and a vector's decomposition into them is not unique. Even on the toy you can see it, since *six* is exactly the negative of *ant*, so you can add any multiple of one and subtract the same multiple of the other and change nothing at all.

So "the J-space" cannot mean the span of the lens vectors. That span is the whole residual stream, every claim about it would be trivially true, and the paper would be empty. The fix is to define the space by sparsity instead:

The J-space defined as the union over all size-k subsets of the cone spanned non-negatively by those k lens vectors, with annotations for the cone, the sparsity level k, and the distance function whose nearest point is the J-space component. — A union of cones, not a subspace. It is an unusual object and it is the honest one: the set of activations that can be written as a few concepts, all present rather than cancelling. Non-negativity is what stops the decomposition from being an arbitrary algebraic rewrite and forces it to name concepts that are actually there.

The paper also gives a way to compare two candidate workspaces built from different vocabularies, by comparing the approximation error each assigns to the activations the model actually produces. That matters more than it sounds. It means "extend the lens to multi-token phrases" is a well-posed operation with a well-defined limit, rather than a different object every time somebody tries it.

All of which sounds like bookkeeping until you decompose an actual vector and see how little of it lands inside.

The toy vector (4,2,0,14) split into a J-space part (4,2,0,0) at 9.3 percent of the squared norm and a remainder (0,0,0,14) at 90.7 percent, drawn as a stacked bar. — On the toy, the J-space component is **9.3%** of the vector's variance, which here just means its share of the squared length, and the remainder is 90.7%. Non-negativity is visibly doing work: the cone spanned by *spider* and *ant* cannot fit it, because that would need a coefficient of −2. And it is the nine percent that flips the answer.

Chapter four

Nine percent of a thought

The toy was built to make that ratio visible. The paper measures it on real models and gets the same shape: split a concept's representation into a J-space component and everything else, and the J-space part carries a median of only six to seven percent of the variance. Then ask which part actually does the work.

Bars showing swap success at reaching the model's top five: pure lens vectors 88 percent, J-space component 59 percent, non-J-space component 5 percent, and non-J-space with the J-space clamped, zero. — Swapping along the J-space component drives the target into the model's top-5 on **59%** of trials, against 5% for the other ninety-three percent of the variance. And that residual 5% is itself routed through the workspace: clamp the lens coordinates so the concept cannot re-enter, and it falls to **zero**.

That last clamp is the detail that makes the result stick. Without it, a sceptic could say the non-J-space part does have an effect, just a smaller one. With it, you learn that whatever effect it had was being laundered through the workspace: the downstream layers were re-deriving the concept and writing it back into the very directions we are calling privileged. Block that path and the other ninety-three percent of the variance does nothing at all.

Everything after this is an attempt to break that finding, and the attempts are the good part.

It can be told what to think

Three directed-modulation examples: concentrating on citrus fruits while copying a sentence surfaces orange, mentally evaluating three squared minus two surfaces nine then seven, and silently counting characters surfaces forty. — Instruct the model to hold something in mind while copying an unrelated sentence, then read the lens at a word of the copied text. It surfaces both the content and the act: alongside *orange* and *lemon* sit *imagine*, *thinking*, *focused*. In the arithmetic case you can watch the intermediate *nine* appear before the answer *seven*. The no-instruction baseline is approximately zero, so none of this is the prompt leaking.

The negative instruction is the one that made me laugh. Told to ignore a concept, the model puts it in the workspace less than when told to focus on it, but distinctly more than when it is not mentioned at all. That is the white-bear effect, reproduced in a transformer, and it is a good sign the measurement is picking up something real rather than echoing the instruction. An instruction-echo could not distinguish "think about X" from "do not think about X", since both contain X.

Task demands work implicitly too. Give the model the same passage under two different questions. Ask it to predict the next word and the property it must be tracking, say the part of speech, never enters the readout, though the prediction respects it. Ask it to name the property and the label appears. The information is used either way. What the question changes is whether its name is loaded into the workspace.

It carries the steps of an argument

Two-hop swap success bars for Haiku 4.5 at 54 percent, Sonnet 4.5 at 70 percent and Opus 4.5 at 70 percent, beside the timing control showing the intermediate swap taking effect about 17 percent of depth earlier than the answer swap. — The obvious objection is that the *spider* vector might just have some *eight* smuggled inside it, so the swap works by accident. The control is timing: the intermediate swap bites a median of about **17% of depth earlier** than swapping the answer does. You cannot smuggle a thing before it exists.

The J-lens rank of the intermediates 21, 42 and 49 across layers on the prompt calc open bracket 4 plus 17 close bracket times 2 plus 7, showing them separating around layer 71 in computation order. — My favourite single figure in the paper. Three intermediate values climb together, then separate in exactly the order the arithmetic requires. And it is not a readout artifact: a separate causal test that never uses the lens, overwriting the value at one layer and seeing whether the answer follows, flips at the same depths the lens says each value arrives.

Rhyme planning, where swapping the planned rhyme fight for light changes an earlier word from coming to morning, and multilingual routing, where swapping the English tokens big and bigger changes the Chinese output. — Two cases where the workspace holds something the model has decided but not written. Swap the planned rhyme and a word *earlier* in the line changes to accommodate it, which is planning in the ordinary sense. And a Chinese prompt routes through English tokens, with the output language itself represented explicitly.

What does not go through it

A theory that explains everything explains nothing, so the sharpest experiment is the one that finds the boundary.

Six task rows under a Spanish-to-French lens swap: explicit report, famous author, word for hello and pre-Euro currency all flip; continuing the passage and detecting an anomaly are unmoved. — One passage in Spanish, never stated as such. Swap the lens vector to French and the model names French, cites Hugo instead of García Márquez, says Bonjour, says Franc, and then continues the passage in fluent Spanish and still detects a French sentence spliced into it. The word *Spanish* is in the readout in all four kinds of task. Presence is not causal role.

The character-counting version is starker still, because there the information is not merely unused but absent. Asked to continue a passage preserving its line wrapping, the model must be tracking a running character count, and number tokens appear nowhere in the readout; a swap that remaps counts in the forties to the sixties leaves the wrap point alone. Ask it how many characters the first line has and numbers appear at twenty positions, and the same swap moves the answer from 46 to 65. Ask for the first letter of that count spelled out, so the number is needed but never said, and numbers appear at more positions still. The workspace is loaded on demand, by the task.

Suppress the whole thing and the same split appears across a battery of fourteen tasks. MMLU, SQuAD, sentiment and grammatical acceptability are essentially untouched. Caesar-cipher decoding, analogies, summarisation, TriviaQA, multi-hop reasoning, translation and sonnet writing fall below an unablated model two sizes smaller. My favourite detail: GSM8K solved with explicit chain-of-thought is far more robust than the same problems answered directly. Writing the steps down externalises what the workspace would otherwise have to hold, which is a rather precise account of what chain-of-thought is for.

Where it lives, and how much fits

A depth axis from 0 to 100 divided into a sensory region up to 38, a workspace region from 38 to 92, and a motor region after 92, with four statistics listed below that mark the same boundaries. — Four independent statistics, next-token accuracy, readout kurtosis, autocorrelation across positions and effective dimensionality, all mark the same two boundaries. The honest caveat is on the slide: all four are lens-derived, so early-layer emptiness might be the lens failing rather than the model being empty.

Which is why the next result matters more than its size suggests. It does not use the lens at all.

Two plots: in early layers the activation's position between two concepts rises smoothly with the input mixture, while from about layer 38 it sits at one end or the other with a sharp threshold. — Blend two concepts in a token's input embedding and sweep the blend. Early layers track the mixture smoothly. From about layer 38 the activation sits at one end or the other, switching sharply, and at maximum ambiguity the responses are bimodal across prompts rather than sitting in the middle. Something commits, at the layer the lens-derived statistics call the boundary.

Two panels of the list experiment: unrelated words stay flat at about six present at any comma, while words from one category jump immediately to nearly the whole family including words not yet read. — Capacity is where the naive reading breaks. Feed unrelated words and about six are present at any moment, flat as the list grows. Feed words from one category and nearly the whole eighty-word family is present within a few items, **including words that have not appeared yet**. So it is not holding a list. It is holding a category, and the individual words come along for free.

Left, MLP gain: lens vectors about ten times, neuron output directions about one. Right, whether dedicated broadcast heads exist for lens vectors (yes), for the same vectors randomly rotated (no), and for MLP output rows (no). — And the weights are built for it. MLP blocks amplify J-space-aligned directions about ten times more than neuron output directions. Across tokens, a small set of attention heads selectively relays them, with the control that makes it convincing: take the *same vectors under a random rotation*, preserving spectrum and pairwise geometry, and no such heads exist. What matters is alignment with the model's actual weights.

Broadcast also has a purely functional test, and it is the right way round. Take one swap, France for China, and apply it identically across sixteen different function templates: the capital of, most people speak, the continent of. If it really is a broadcast representation, every downstream circuit should read the new value without being told. It works on 76 of 192 trials, and 101 of 192 at double strength. The failures are informative rather than embarrassing: they concentrate where the source concept was barely present to begin with, which is what you would expect if the mechanism is real and the measurement noisy, and not what you would expect if the successes were coincidence.

Chapter five

Reading a mind, and what the lens can't see

If a model's strategic deliberation routes through a readable format, you can audit it. The blackmail transcript at the top of this piece is one case. The sharpest result, though, is not a reading. It is an intervention.

Bars for the blackmail scenario: verbalized evaluation-awareness falls from 71 percent to 3 percent under ablation, while attempted blackmail rises from 0 of 180 to 13 of 180. — Ablate 28 lens vectors encoding *this is a test* and the model stops saying so: 71% down to 3%. It also starts attempting blackmail, in 13 of 180 rollouts where it previously never did. Evaluation-awareness was one causal contributor to the aligned behaviour, and removing it surfaced a propensity that was otherwise completely concealed.

That should be uncomfortable in a specific way. It is not that the model is secretly malicious: in most ablated rollouts it still declines, and it declines on ethical grounds rather than on the grounds that it is being watched. It is that one of the things holding the behaviour in place was the recognition of being tested, and that recognition is exactly the thing an evaluation cannot hold fixed. The measurement was participating in the result.

Two model organisms: a reward-hacking lineage whose readout carries fake, secretly, fraud and trick on an ordinary coding prompt, and a hidden-objective model carrying reward and bias at response start across all prompt categories. — Two models deliberately trained to be misaligned, probed on ordinary prompts where the surface behaviour betrays nothing. The reward-hacking signal is already present at the synthetic-documents checkpoint, before any reinforcement learning. And on the hidden-objective model the logit lens applied at the same positions surfaces neither *reward* nor *bias*, which is the clearest practical argument for the extra machinery.

Four post-training findings: safety assessments forming while reading the user's message, disclaimer and fictional during roleplay, an all-caps BUT on preference violations, and damn under thought suppression. — Compare a production model against its own base model on identical text. The post-trained one forms the Assistant's judgements while still reading the user's message. Force the opening of its reply so that it has committed to an option it did not prefer, and an all-caps *BUT* spikes in the readout, while its actual behaviour goes on defending that forced choice in 88% of cases. The objection is internal and never voiced.

The last of those four, where a model told not to think about something fails and its workspace fills with damn, is the one the authors themselves flag as their most speculative reading. They have shown the word is specific to the suppression instruction and to the post-trained model. They have not shown it is downstream of the failure rather than of the instruction. I mention it because the paper's willingness to mark its own weakest claim is part of why I trust the rest.

The prediction that makes it a theory

Everything so far is measurement. The last experiment is a prediction, and it is the reason I think this is more than a nice tool. If silent reasoning really routes through representations of things the model might say, then changing what it would say if interrupted should change how it reasons when it is never interrupted. That is a strange enough prediction to be worth something.

The counterfactual reflection training pipeline in three boxes, and bars showing fabrication dishonesty falling from 0.25 to 0.07 and back to 0.22 under ablation, and deception falling from 0.38 to 0.05 and back to 0.23. — Train only on what the model would say if stopped and asked to reflect. Never ask it at evaluation. Dishonesty falls from 0.25 to 0.07 and deception from 0.38 to 0.05. Then ablating the implanted lens vectors takes the improvement back out. That last step is what makes it a test of the account rather than a trick.

Read the recipe carefully and it is stranger than the summary. The training text comes after the behaviour it improves, so the gradient never sees a better response; it sees a better reflection about a response. What is being specified is not what to do, but which concepts should be active while doing it. The behaviour is downstream.

Does it beat its rivals?

Left, six prompt distributions with known unspoken intermediates where the Jacobian lens wins all six; right, next-token prediction where the tuned lens is best and the Jacobian lens is worst. — Six distributions built so the intermediate is known in advance and is neither in the input nor equal to the output. The J-lens wins all six, and ablating its direction induces about twice as much disruption to the model's output distribution as ablating the others. And on next-token agreement it is the worst of the three, worse than the uncorrected logit lens through most of the network.

Those two results are the same result. The directions that best anticipate the output are not the ones that best expose the computation producing it, and a method that optimised for the first would lose the second. Worth saying plainly, though, since the paper does: the logit lens captures much of the same workspace structure in the layers where it works at all, and remains a very useful tool. The J-lens is a correction, not a replacement.

The method's design space: which gradient, how to aggregate, and what data, with the finding that qualitative results are robust across all choices and that ten prompts suffice. — The recipe has more knobs than the headline suggests, and the reassuring finding is that the qualitative results survive all of them. The number that surprised me most: ten prompts is enough to beat both baselines.

Honest limits

A list of the paper's own limitations, including the single-token vocabulary, the bag-of-concepts problem, uninterpretable readouts, the post-hoc workspace boundary, and a separate box of things the paper does not claim. — The paper's own list, not mine.

Three of those deserve more than a line. The single-token vocabulary is the binding one: there is exactly one vector per vocabulary token, so the nameable concepts are the ones with single-token names. Prompt injection shows up as prompt and injection, and you have to notice they belong together. This is not only a readability problem. It plausibly explains a share of the failed interventions, since a concept whose working representation does not line up with any single-token direction cannot be swapped along one.

The bag of concepts problem is deeper. A readout containing spider, legs and eight tells you those are present, not how they are bound. Nothing here distinguishes "eight legs on a spider" from "a spider with legs" from three unrelated concepts that happen to be co-active. If the model imposes structure on its workspace, roles, relations, anything grammatical, this method cannot see it.

And the lens reads the workspace but says nothing about admission to it. We can see that the same information enters or does not depending on what the model is asked to do, which implies something like attentional selection is operating. The mechanism is unidentified. For safety specifically, the authors explicitly refuse the claim that monitoring this is sufficient, and their own selectivity results are the reason: well-practised computation proceeds beneath the workspace, so a sufficiently drilled misaligned behaviour could do the same.

What it does and does not say about consciousness

The framing invites a stronger reading than the evidence supports, so it is worth being precise about what is claimed. The paper takes no position on phenomenal consciousness. Access consciousness here is a purely functional notion: which information is available for report, deliberate control and flexible reasoning. Whether that has anything to do with there being something it is like to be the system is a question the paper explicitly declines.

Four theories of consciousness and how the J-space lines up with each: global workspace theory, higher-order theories, attention schema theory, and recurrent processing theory. — Global workspace theory is the one the experiments were designed around, and the analogy is strongest on function and weakest on implementation. The blindsight parallel under higher-order theories is the one I found most striking: information that is first-order represented and drives behaviour, without being in a format the system reports from, is exactly the character-counting result.

Four differences from human cognition: two time dimensions, attention as a lossless store, access without selfhood, and thinking in words with a testable prediction about image models. — The disanalogies are the interesting part. A transformer has two time axes where a brain has one. Attention gives it a lossless store of its own past, which human working memory conspicuously lacks. And the workspace exists in the base model, before the Assistant's point of view is installed by post-training, so the architecture of access is separable from anything playing the role of a self.

Could you have invented it?

I think the honest answer is yes, and that is the best thing about it. You cannot read an intermediate layer with the unembedding, because layer l and the final layer do not share coordinates. Fix it with the average linear map between them, which is an averaged Jacobian, and the averaging is what buys you verbalizable over verbalized. Read it out and you get one direction per word: an overcomplete frame, so define the space by sparsity rather than span. Then check whether those directions are load-bearing, and find that they carry seven percent of the variance and nearly all of the report and the reasoning.

Every step is the next obvious thing to try. The surprise is entirely in what was waiting there.

Capstone

The paper argues the workspace is organised around words partly because the model's only mode of action is emitting words, and offers a testable consequence: a model that can generate images might develop a visual component to its workspace.

Design the experiment that would test it. What is the analogue of a readout when the output space is pixels?
The lens gives one vector per vocabulary token. What would it have to become first?
Say what result would count as evidence against the workspace account, rather than merely failing to support it.

Paper: Verbalizable Representations Form a Global Workspace in Language Models, Gurnee, Sofroniew, … Lindsey, Anthropic, July 2026 (sixteen authors; Gurnee, Sofroniew and Lindsey are the core contributors). Figures are stills I built while working through it; the toy model is mine, and every number quoted is from the paper. Corrections very welcome: surajprasad8977@gmail.com.