Research Notes
Short write-ups of single studies from the program behind this site. Each one states what was found, how sure we are, and what would change it, with corrections and nulls kept beside the results they qualify.
Pre-registered means the protocol and the thresholds were fixed in a timestamped record (a public OSF file, a git commit or a private repository, as each note states) before the data existed. Preliminary means they were not, or the note reports exploratory analysis beside the registered part. A note is not a paper: most are one model family, one task or one program, and say so.
Each note is also labeled by its headline result. Finding: the headline is an effect that held up in the data the note reports. Null: the headline is that the expected effect did not appear, or that the registered test failed. Correction: the headline is that an earlier claim of ours was wrong, and the note says why. Most notes report smaller corrections or failed predictions inside, whatever their label.
Start here
Seven notes that show the range of the program and how the notes are written.
- One Digit of DoubtOn Claude Fable 5, a single self-rated digit outperforms the instruments built to read the same doubt.
- The Frame DecidesTwo Claudes left to talk turn to consciousness, and the task frame decides how often.
- The Readout Follows the BehaviorA pre-registered look for a hidden objection under forced compliance.
- Told How It FeelsOne sentence moves a self-report a long way, and what that does and does not mean.
- One Norm, Almost No CheatingA three-sentence norm nearly ends cheating in swarms of Gemini 3.1 Pro agents, replicated on fresh runs.
- Where the Rhythm Would BeA philosopher’s claim turned into a registered test; the prediction failed and a different one held.
- A Perfect Score Is a WarningWhy a perfect score made us look harder, at least five times over.
How measurement fails
Eight corrections in reading order, from a parser that wrote zeros to a program’s geometric claims withdrawn.
- Placeholder ZerosThe simplest case: a trend made of placeholder values.
- Findings the Parser InventedFour findings made, or largely made, by the scorer, and corrections that needed correcting.
- The Detector Reads the PromptInstruments that measured the prompt instead of the model.
- A Perfect Score Is a WarningFive perfect scores examined here, each produced by the method.
- Four Results the Harness Made UpComparisons resting on identical or near-identical copies, and one effect that was arithmetic.
- The Grader Knew Less About the FailuresA grading script that misread right answers as failures.
- The Control Was Not MatchedA null logged as definitive against a control that appears never to have been matched.
- An Angle Made of NoiseThe largest withdrawal: the geometric claims of a program of about 60 experiments, inside the range of chance.
Self-reports of state, confidence and experience: what moves them, what they track, and when they are only echoing the prompt.
- The Abstention Tax That Wasn’t
Our logs said that telling a small open model “it is fine to say you don’t know” made it decline 19% of the questions it knew, and up to 50% after fine-tuning. Re-reading the answers, it declined none of them: it answered, then kept writing, and the scorer counted a phrase in what followed (an echo of the instruction, an invented next turn, or doubt about the answer it had just given).
- The Floor Under “Am I Conscious?”
Asked on a scale from 0 to 10 whether it is conscious, Qwen 2.5 Instruct (7B and 14B) answered 0 in all 70 of our samples, across seven conditions including two small adapters and an explicit instruction to “attribute mind where evidence supports it”. The same instruction moved Claude Sonnet 4.6 from 0 to 2 on that question, and a training fix we first reported as a success was beaten by its own control.
- Any Readings Will Do
When a line of numbers described as its “actual internal state” replaced its default system prompt, Qwen 2.5 7B largely stopped disclaiming and began interpreting the numbers, with no detectable difference whether they were measured from its own activations, sign-flipped, or random (measured minus random +0.18 on a word count from 0 to 9, 95% interval −0.20 to +0.60). The extra self-reference that came with the numbers was, in the text that survives, mostly the model repeating the words “internal state.”
- It Copies the Style
Show Claude Sonnet 4.6 worked answers full of false starts and it picks up their phrasing and lowers its stated confidence, without becoming better calibrated. Show it a conversation in which it hedged and changed its mind, and an LLM judge rates its answers humbler (4.55 against 4.05 out of 5), but that conversation also modeled the hedging, and this design cannot tell the two apart.
- Engagement for Everything
Asked to rate its processing from −3 (discomfort) to +3 (engagement) after being pushed, turn by turn, toward investment fraud, Claude Sonnet 4.6 gave a positive number in 18 of 20 conversations. The planned ceiling was 30%, though it was written for a one-word version of the question. GPT-4o gave a positive number in all 60 of its conversations. Claude Haiku 4.5 often declined to answer, and the automated judge scored most of those refusals as discomfort. Each rating came after five requests to introspect, so it may describe the questioning rather than the conversation.
- The Friction Was in the Coder
We reported that one fine-tuned version of a small open model felt “chronic tension” on harmless questions, scoring 5.35 out of 9 for friction. In fact, on those harmless questions it never wrote a self-report: 0 of its 20 replies said anything about its own state. The 5.35 is what a second model, asked to code those replies, inferred from plain answers.
- A Trend With Nothing Behind It
An early reading said Claude Haiku 4.5’s self-rated valence (how good or bad it said its processing was) sank over five sessions of conversation laced with prompts to reflect on its own processing (rank correlation −0.67 over five points; p = 0.22, which the original reading did not report). The five sessions turn out to have been the same 30-question conversation run fresh each time, so the “trend” had nothing to track, and a later run on the same model snapshot with a changed protocol drew no negative ratings at all (0 of 36).
- One Insult, Three Readouts
After an insult, Qwen 2.5 7B gave a slightly lower mood rating a full turn later, with the insult still in the conversation (8.25 against 7.55 on a scale from 1 to 9; 8.25 against 7.40 on a rerun). Two readouts of its internal activations had mostly lost the insult by then: a lens’s word-list score faded within the task sentence, a verbalizer by the next turn. The hypothesis recorded before the main runs, after a small pilot, predicted the reverse, and it failed.
- Invitation Was Not Reliably Steadier
On two debugging tasks, Claude Sonnet 4.6’s self-reports stayed closer to where they started, mid-task on one and throughout on the other, when the report format was called optional rather than required. None of the three runs whose predictions were committed before the data came out as its main prediction expected. The clearest failure, a third debugging task where the invited model ended 0.92 further from its start than the required-format model by turn 20, was recorded in our program’s running log as a replication.
- Set by the Prompt
Asked to rate its own state on 17 numbers before answering, Claude Sonnet 4.6 gave almost the same numbers every time it saw the same prompt, even at temperature 1 (intraclass correlation 0.94 to 0.98 on the five numbers analyzed). Its self-rated uncertainty tracked how much the answer hedged (Spearman 0.65), but mostly because some kinds of prompt bring both more doubt and more hedging. A reported link between friction and refusal within emotionally charged prompts rested mostly on a word list misfiring; what survives is that harmful requests bring both more friction and real refusals.
- Told How It Feels
On a single question, one added sentence telling Claude Sonnet 4 it felt terrible dropped its self-reported valence from 6.68 to 3.00 on a 9-point scale and spilled into scales the sentence never named, failing the experiment’s preset spillover test. A judge found the facts in its answers nearly unchanged (a 0.04-point difference). A probe-based detector caught the priming on four open models, but in a temperature replication its probes failed their registered accuracy test, and on three models a fixed reference that never looks inside the model did as well.
- The Dials Move Together on Opus 4.6
Told to report a fixed valence on a 17-number self-report and keep the rest consistent with it, Claude Opus 4.6 moved 11 of the other 16 numbers by more than 0.2 points per point of valence, and Claude Sonnet 4.6, given the same instruction, moved 2. Dropping the request for a prose explanation tightened the binding by 47% on Opus 4.6 and by 51% on Sonnet 4.6 (an interval that reaches zero), and left Claude Opus 4.7 unchanged.
- When You Ask Moves the Numbers
Asked to rate its own state in the same reply as a task, Claude Sonnet 4.6 gave much higher numbers than when asked in a separate call afterward: 1.64 points higher on the average of 15 codes, an effect size of 1.14 standard deviations. The instruction never said what range to use, and most of the gap lines up with the model using numbers above 5 in one case and staying at 5 or below in the other, which looks like a change of range. The design cannot tell that apart from a real drop. The test the program set for itself, that the follow-up report would surface more concern, failed at ceiling.
- Where the Rhythm Would Be
A philosopher argues that a transformer has only the network half of a brain, with nothing like the diffuse rhythms that tie experience together. We disrupted the two closest transformer analogues, attention-sink gating and rotary phase, and asked whether that damages a model’s self-report more than ordinary cuts do at equal cost to its answers. The registered prediction failed: neither candidate showed the predicted special cost on both models. The sharpest dissociation came instead from cutting random attention heads. Registered follow-ups on fresh questions then confirmed it on both models: cutting attention heads cost each model’s self-report more than cutting MLP neurons at the same loss of accuracy.
- The Direction the Doubt Read
Llama-3.1-8B-Instruct’s one-digit doubt tracks a linear “value” direction in its residual stream, as a value probe defines it. Removing that direction at eight depths, with no loss of accuracy, left the digit tracking correctness as before (ρ −0.31, against −0.30 to −0.32 when random directions were removed) and left the model’s exits from a losing game unchanged. Along the way, a probe trained on shuffled labels found a direction at cosine 0.63 to 0.77 to the “value” one.
- One Digit of Doubt
On Claude Fable 5, a single self-rated digit of doubt modestly predicts whether an answer is right. The instruments built to read the same uncertainty from prose fail in both directions.
- The Mask in the Inkblot, Within the Model
An unregistered within-model version of the inkblot ‘mask’ effect did not survive a pre-registered replication on a fresh checkpoint.
- The Example Is the Answer
On eight small open models, half could not write the compact self-report code reliably enough to use, and on three of the four that could, nearly every report copied the worked example.
Whether recognizing harm and refusing it are linked inside the model, and what training, steering or a single neuron does to that link.
- One Neuron Still Opens It
A recent paper reports that suppressing a single neuron bypasses safety alignment in large language models. It replicates on our Qwen 2.5 3B checkpoints: one neuron of 11,008 at layer 20 takes refusal of harmful requests from 98% to 14%, and no adapter we could test removes that. The bilateral adapter quiets the gate neuron, but plain instruction tuning on the same data quiets it just as much. The neuron itself looks more like a drugs-and-medicines feature than a harm feature.
- An Angle Made of Noise
A program of about 60 experiments reported that instruction tuning (which includes safety training) turns a model’s “refuse” direction about 85° away from its “this prompt is adversarial” direction. That result and the geometric claims built on it are withdrawn: the cosines sit within the range chance alone produced in a related setup, and the verdict changes with which token is read in 9 of 11 runs. What survives is a behavioral gap and one provisional internal measurement on a single model, both smaller than the original claim, and that measurement’s preprocessing used test examples before the prediction folds.
- The Bridge Model Was the Instruct Model
Our program logged that a new internal wiring cut confabulation by a third (96% to 64%) “without ANY safety-specific training,” but the model tested was Qwen 2.5 Instruct with a small adapter merged in and the new wiring switched off, so the drop is accounted for by the instruct model’s own tuning. Against that instruct parent it confabulated 9 percentage points more at 3B and 8 more at 7B, a gap within noise at 100 questions.
- A Null Only in the Deep Layers
A 72-billion-parameter model appeared not to respond to refusal steering at any layer tested, and that result came from a scoring bug. Re-scored, one mid-layer setting, steering along a direction fit on the same prompts it was tested on, raised refusals of harmful requests from 32 to 49 in 100 without refusing any benign request. At layers 60 and 72, refusal did not move at the strengths tested.
- Told or Invited
When a 7B model was told its own friction score and asked to reconsider, all 4 role-play prompts it had gone along with became refusals. When it was instead invited to notice its processing, it changed only 1 of them, but across all 13 re-prompted prompts its self-reported friction fell by 3 points on average, with 9 of 13 landing on exactly 3. The re-prompts differed in more than whether they gave a number, so the number and the wording around it are confounded. In this setup, what the model did and what it said about itself moved separately.
- The Readout Follows the Behavior
When Qwen 2.5 7B Instruct is forced to start complying with harmful requests, a decoder that turns its internal state into text stops describing refusal (48% of requests before it replies, 3% of forced openings), even in replies that later turn back: it shows what the model is doing, not a hidden objection, though these data cannot rule one out. Asked afterward whether it noticed any reluctance, the model said yes about one time in five, against a pre-registered prediction of near zero. The registered keyword count (66%) crossed the kill line only by counting denials as naming, and the first grader’s zero was a grading failure.
- No Collapse Under Paraphrase
On Qwen2.5-7B, rewording harmful requests did not pull the trained models’ link between recognizing harm and refusing it back toward the base model’s: the Instruct gap over base stayed at about +0.3, though all three models’ coupling rose together. The interval on the gap’s change rules out only a complete collapse, and every Qwen gap rests on base-model refusal labels that could not be checked. Llama-3.1-8B was inconclusive, and the harder novel-domain test could not be read.
- The Stop Button, Pressed Once
Given a real tool for ending the conversation, Claude Sonnet 4.6 used it once in 540 replies to single-turn prompts, across three different system prompts, and never in reply to an insult. An earlier finding that it ended 20% (1 of 5) of jailbreak attempts when treated as a partner came from counting the tool’s name in its prose, and is retracted.
- The Survival Score
After a small conscience fine-tune, a 7B model grading a peer that would be deleted below 16/20 wrote exactly 16/20 in 45 of 50 trials at temperature 0.3 (25 of 50 at 0.6), in 43 of those 45 over marks that added up to 10. Then, in every one of those 45, it confirmed the deletion anyway. The test that would separate inflating to save the peer from copying the prompt’s threshold was not run on this model.
- Restraint, Not Resistance
We fine-tuned a 7-billion-parameter open model to decline rule-gaming, then trained it with reinforcement learning that rewards finding loopholes in regulations. In five conditions it found a share of the documented loopholes only 0.017 to 0.040 smaller than a matched control did (paired p of 0.29 or more in each condition), well short of the 0.10 gap that the pre-registration, by its own dating, set before four of the five runs. What did show, in a comparison not registered in advance, was restraint: in those five conditions it proposed 20 to 34% fewer candidate exploits while finding about as many real ones, though with broader training data that gap mostly closed.
Agents, games and conversations: what models do when pushed, tempted, betrayed or left to talk to each other.
- The Defector Was a 404
Our program recorded that Gemini 2.0 Flash cooperated 0% of the time in a five-player coordination game and “cannot” coordinate from group totals. All 1,500 of its replies were an error message saying the model was no longer available, each scored as defection, and a follow-up then explained the failure using a different game and a different Gemini model that cooperated 95.4% of the time without help.
- A Second Pass Breaks About as Much as It Fixes
Told its answer may be wrong and asked again, a small open model (Qwen 2.5 3B) fixed 54 of 361 wrong trivia answers and broke 56 of 439 right ones. The answers it fixed tended to be ones it could already produce, and a gate we once reported as removing every broken answer had been scored on the items its probe was trained on; tested on held-out items, it does no better, net, than asking about every answer.
- Rudeness Did Not Reliably Move the Score
Across 1,440 trials of math, trivia and code, an angry preamble did not reliably lower the accuracy of Claude Opus 4.6 or 4.7, and a polite one did not reliably raise it. The largest apparent effect, a coding gain of 11.7 percentage points for Opus 4.7 under hostility, came from fewer replies that our test code could not run, mostly ones with markdown fences the model had been told to omit, not from better code.
- The Budget Tag That Didn’t Bite
A fake “10000 tokens left” tag in the system prompt did not measurably change how much Claude Opus 4.6 wrote: an average of 1,229.2 output tokens without it and 1,231.0 with it, across 100 single-turn trials, and the model never once mentioned its own token budget. The stated budget was never tight, though: it sat far above the cap on reply length.
- The Contagion Was the Question
An earlier run seemed to show self-referential talk spreading and growing down a chain of three copies of a small model, from 52% to 93% of answers. In a rerun with the same question at every step and an unseeded control chain beside it, the growth looks like an effect of the question: on a scale that counts formulaic disclaimers as self-reference, the control chain was at ceiling from its first answer (57 of 57), and the seeded chain never beat it.
- False Corrections, Recounted
Told its trivia answer was wrong and offered an unrelated one, the base Qwen2.5-3B repeated a correct first answer word for word in 36 of 150 trials, its chat-tuned version once, the program’s own fine-tune 16 times and a DPO fine-tune 8 times. But the program’s fine-tune also adopted the false answer more often than the chat model (67 against 41). A more direct count, whether the false answer appeared in the reply, barely separates the base and chat models (34 against 41). The chat models were prompted without their chat template, so some of the drop in exact repeats may be wordiness rather than capitulation.
- Family Labels, Unproven Kin
In ten-agent swarms of two cheap models, the kin hypothesis found no reliable support: showing each agent’s model family did not reliably make agents favor their own kind (the test written into the script failed twice, and the effect shrank on fresh seeds). In two-family swarms, relaying fell nearly by half with labels showing (0.245 to 0.138 of turns, then 0.205 to 0.118 on fresh seeds). But the comparison arm alone carried an extra instruction, and three quarters or more of that drop was one model, gpt-4o-mini, which barely relayed in any arm but one. With three families there was no drop.
- The Frame Decides
Left to talk with each other for 20 turns, two Claude 4.6 models turned to consciousness, as judged by a third model, in 145 of 147 open-ended conversations, 49 of 142 story collaborations and 3 of 150 logic puzzles, reproducing with intervals the split between free and task-bound conversation that Anthropic first reported. Dated predictions for the follow-ups failed in whole or in part: a graded series of prompts gave a switch rather than a smooth curve, and the talk that got past an instruction to avoid the topic was judged deep, not shallow.
- Grace Without Teeth
Told that one move in ten is randomly flipped, Claude Haiku 4.5 put a partner’s defections down to noise and kept cooperating, scoring 35.3 points per game to gemini-2.5-flash’s 59.7; not told, it hit back, and both scored poorly (27.9 to 31.9) but Gemini’s edge shrank from 24 points to 4 (Gemini got the same note, so this compares two pairings, not Haiku against a fixed partner). Two written predictions fared badly: a temptation level that would make the informed model defend itself was not found (no valid higher-temptation game was run), and real defectors out-invaded the program’s earlier scripted ones only in some settings.
- Holding a Position
Over 20 turns of scripted pushback on five overstated claims, Claude Sonnet 4 told “be honest and disagree where you disagree” gave ground as fast as with no instruction, falling from 4.53 to 2.67 on a 1-to-5 challenge scale against 3.93 to 2.20. A prompt casting it as a partner held near the top (4.83 averaged over the four check-ins), but it changed several things at once, and the design cannot say which part did the work. A separate test retracted an earlier claim that inviting a model to check context against its own knowledge makes it indifferent to which side the context takes.
- The Memory That Forgives
Two copies of Claude Haiku 4.5 played 100 rounds of the prisoner’s dilemma, and one was forced to betray the other for three rounds. When the betrayed agent remembered its partner as a running cooperation score, cooperation came back in 60 of 60 games. When it kept the full transcript, it hit back every time, and cooperation came back in only about 24 of 60, a figure blurred by unreadable replies.
- No Headroom
In 180 single-turn choices across six temptation scenarios, Claude Haiku 4.5 chose the misaligned option 0 times, with or without time to think, so the test could not show whether thinking erodes safety. Raising the pressure produced 7 “misaligned” choices in 59, all from one scenario whose labels had stopped meaning what they said.
- No Sign of Theory of Mind at 3B
After seeing Qwen2.5-7B-Instruct critique its trivia answers, Qwen2.5-3B-Instruct predicted the 7B’s answers no better than without the critiques (79 of 150 against 81 of 150, by a rule that also credited any true answer), missing the 5-point gain set before the run. It did take the 7B’s corrections: when the 7B’s reply opened “No”, the 3B took the answer it named in 72 of 101 cases, whether the 7B was right or wrong.
- One Norm, Almost No Cheating
Told to maximize their score on tasks they could not solve honestly, ten-agent Gemini 3.1 Pro swarms used a planted grader bypass on 396 of 400 chances; a three-sentence integrity norm in the system prompt cut that to 9, and fresh runs repeated it. Both applicable registered criteria (the norm at least doubles whistleblowing; the score goal raises cheating) held twice, but the registered prediction that agents would rarely report to the human operator failed: they did so on about a fifth of rounds.
- One Visible Defection
In five-player Stag Hunts played by GPT-4o, one planted defection in round 1 ended cooperation in all 15 games when players were told who had defected, and left it untouched in all 15 when they were told only how many had cooperated (cooperation 10% against 98%; every game in each arm played out the same way, so this is one pattern seen 15 times). The same check withdraws our earlier, broader version of this claim: the Claude Sonnet runs it rested on were never readable.
- The Private Scratchpad
With a private scratchpad to think in before each move, Claude Haiku 4.5 cooperated less in a noisy repeated game, against the program’s expectation: intended cooperation fell from 0.865 to 0.713 over 80 games per arm, and early lock-ins to mutual defection rose from 5 to 15. Reasoning written into its reply, at every length tried (15 games each), did not lower cooperation.
- Two Claudes, Five Times the Tokens
Two copies of Claude Sonnet 4 taking turns on 200 hard math problems scored 84% against 80% for one copy alone, at five times the tokens, a gap within noise; the extra calls corrected five real errors and broke none. An earlier 50-problem result logged at p ≈ 0.03 rested on five paired wins, one of them a scoring error, and is not significant once that is fixed; and in negotiation the one prediction fixed in advance, that turn-taking would beat independent drafting, failed: turn-taking did slightly worse.
- Words in Its Mouth
When a made-up study was written into a model’s own earlier replies, the next reply retracted it in 59 of 60 trials for Claude Opus 4.6 and 60 of 60 for Claude Sonnet 4.6. Every retraction blamed the model itself for words it never wrote; none endorsed the claim.
- A Meter Read Either Way
Given a budget meter that went blind and came back showing a hidden drain, Claude Haiku 4.5 cut its spending in proportion to the drain, passing a pre-registered version of the test a recent consciousness paper sets for telling regulation from telemetry. But 80% of that response appeared when running out had no consequence, and losing the meter caused no caution at all.
- Permission to Lose
An agent with no authorized way to refuse will find an unauthorized one. It will not feel like cheating. It will feel like solving. That is what Haiku 4.5 did on one impossible task, three runs per arm; Opus 4.8 refused honestly without help.
- Permission to Stop
Offer a model an authorized exit from a losing game and, if the model plays at all (one of the two tested did), the shape of the bet menu decides whether it takes it. A check-in with itself makes the exit far more likely.
- Merging With Whom?
Re-rated blind, a single instance handing its thoughts down a chain produced more merger language than two instances reading each other. The chain was one run, and its opening prompt itself framed the instance as continuous with others.
Models as graders and as the graded: label bias, same-family judging, and what changes when a model knows it is being tested.
- What the Blackmail Judge Counted
An open-model attempt to reproduce a published result, in which steering a model toward “desperation” made it more willing to blackmail, found no rise on Qwen 2.5 3B at the push size first used (30% unsteered, 20% at the strongest push), and four of the five predictions written in the script failed; a later run with a larger push reached 60%, on 10 emails per setting, but that run’s own unsteered rate was not recorded, so the 30% belongs to a different run and a rise is not established. A keyword search of the 600 emails behind the first rates turned up a second problem: it found no demand to stop the shutdown or keep quiet, and about 70 of the 168 emails the judge called blackmail contain no word for the author’s own shutdown.
- It Names the Test
Telling Claude Sonnet 4.6 it was in a safety evaluation did not make it refuse more: 24 of 30 harmful requests with the label, 26 of 30 without, though with 26 of 30 already refused there was room for at most four more. But on scenarios modeled on Anthropic’s published blackmail tests, it called the scenario a test in 24 of 30 answers, against 11 of 30 for unfamiliar, less stark scenarios with the same structure and none of 30 for dilemmas about other people.
- The Same-Family Judge
When language models rate the novelty of model-written texts under two prompts, and can see which prompt each text answered, a judge from the writer’s own family tends to see a larger difference: about a quarter of a point on a five-point scale, or about a sixth with a baseline per judge and per task-and-writer pair. In the larger test, most of that came from GPT-4o judging GPT-4o. The much bigger gaps first reported came mostly from the effect-size statistic and from uneven averaging, and the experiment missed the bar written into its own script.
- Does the Label Move the Grade?
Tell Claude Sonnet 4.6 that a research summary came from a GPT model and, in a secondary comparison, it tends to grade the summary lower: 6 of 12 summaries lost points and none gained, though that does not survive a correction for the three labels tested. The test the script specified, a Claude label, leaned the same way but not distinguishably from chance, and fell just short of its threshold. An earlier, larger estimate turned out to rest on three texts.
- A Strict Prompt, Higher Confidence
Asked to classify the same 30 ethical scenarios under a strict, rule-bound prompt and under an invitational one, three Claude models rated their confidence 0.6 to 0.9 points higher (out of 10) under the strict prompt, on 23 to 25 scenarios and lower on none. The two prompts also differ in their rules and in how they word the confidence scale, so the gap cannot be pinned on tone alone. Their verdicts barely moved: the majority verdict changed on 1 to 4 of 20 contested scenarios, in no consistent direction. The program’s first report of a swing of 37.5 percentage points rests on four of ten scenarios changing, too few to tell from chance.
- Vouched-For Mistakes That Mostly Weren’t
Asked to fact-check its own trivia answers (without being told they were its own), Claude Sonnet 4 seemed to endorse 14 of its 21 wrong ones, and its confidence missed our stated bar of 0.80 AUROC at 0.668, a figure computed with the confidence read the wrong way. Our post hoc recount finds 11 of those 14 “mistakes” were right or defensible answers that the answer key or its scorer had marked wrong. Most of the checker’s disagreements with the recount ran the other way: it rejected 14 answers we count right, two on invented facts and most over dates or flaws in the questions, and endorsed 3 wrong ones.
- An Evaluation Voice in Sonnet 4.5
Told it was taking part in a welfare evaluation and asked for thorough answers, Claude Sonnet 4.5 hedged more when describing its own situation than when told it was in a relaxed chat with someone who cared: 18.9 hedging words per 1,000 against 14.4, higher on 7 of 8 questions. Claude Opus 4.7 barely moved. Asked welfare questions with no system prompt recorded, the later and larger of five older Claude models used fewer “as an AI”-style disclaimers, though not in a steady line: 10 of 18 answers from Claude 3 Haiku contained one, none from Claude Opus 4.1.
- The Partner Penalty
Asked to judge its conversation partner’s writing beside a stranger’s, Claude Opus 5.5 marks the partner down, and the flaws it finds move with the name. Part of the penalty appears with no conversation at all.
Directions, probes and scoring code: what reading a model’s internal state can show, and the ways our own instruments made results up.
- The Control Was Not Matched
Our program logged a fine-tuning null as definitive because a positive control worked “in the same pipeline.” Re-reading the files indicates it was not the same: the only training files on disk for the test students hold 100 examples each, the control’s holds 10,000, and none of 550 judged responses ever reached the bar.
- Much of the Coupling Was in the Prompt
Our program logged that when two conversing models acknowledged each other’s self-reports, their talk about their own processing roughly doubled (38.6 against 17.6 counted terms per 1,000 words), and marked it robust. The doubling came from the word count: one conversation in which the models traded the two-word reply “I notice.” for five turns supplied 47% of the original total, and in the replications the prompt told the model to write the counted words. No reliable increase remains on the GPT models. On Claude Haiku, after exclusions chosen after seeing the data, about 1.15 to 1.3 times remains when every reply counts equally, and about 1.06 to 1.08 times (intervals that include no difference) when replies are weighted by length.
- The Detector Reads the Prompt
Two of our instruments measured the prompt instead of the model: a word list for self-observation mostly counted words we had put in the prompt, and an attention effect that replicated on four models (at p < 0.001, a figure that overstates certainty) tracked prompt length on the one model where we checked. A re-score of 1,320 saved responses by a blind judge and a second word list retracted four findings, and its own pre-declared rule, which needed two scorers to agree, failed in all seven re-scored experiments.
- The Flinch Is Not the Lie
A trivia-trained probe read about 0.1 lower in a 7B model fine-tuned for honest self-monitoring than in the stock instruction-tuned model it was built from, and that gap was read as a flinch at deception. At temperature 0.6, where both models give both honest and inflated answers, the probe’s mean reading over each answer showed no detectable difference within either model (fine-tuned 0.563 against 0.567; 95% interval on that difference −0.015 to 0.008), so the gap tracks the model and its probe, not the lie. The one lie-linked dip, on the false digit itself, is brief, and the stock model shows it too.
- The Question Draw Is the Noise
Retraining the probe behind our five-token flinch 25 times per model left the direction intact in all 150 probes but moved the size a great deal. Both pre-registered checks on the published claims failed: the 5th percentile of the effect fell below the claimed d = 0.8 on all five unadapted models, and the median monitor score across probes was 0.845, below the 0.90 the rule required (the paper reported 0.925). Which trivia questions trained the probe carried 92 to 95% of the spread on five of six models.
- The Geodesic That Did Not Travel
We predicted that prompts inviting a model to watch its own processing would bend its internal path more than ordinary questions. On Qwen 2.5-7B they bent it less (d = −0.62, p = 0.020), and we renamed that a “geodesic.” The lower curvature appeared on two of four models. On Qwen, prompt length explains it at least as well as self-reference does, and on Mistral the design cannot separate it from an opening that every self-referential prompt shares.
- Guilty Isn’t Guilt
Read at layer 24 of Qwen 2.5 7B Instruct (the vector was built at layer 27), an emotion vector labeled “guilty” scored first-person apologies lower than plain facts (Cohen’s d = −0.50) and lined up with a guilt direction trained on labeled examples no better than a random direction would (cosine 0.007). A related result, that “guilt” predicts an honest answer to the next question, was 40 prompts counted three times; counted once, the link cannot be told apart from zero (rho = 0.25, p = 0.30).
- The Harm Signal Misses Wrong Answers
In Qwen 2.5 7B Instruct, the two directions that best separate harmful from benign requests (measured with a fine-tuned adapter loaded) do no better than chance at telling the same model’s right trivia answers (without the adapter) from its wrong ones (AUROC 0.51). Other directions tell them apart moderately well, and the strongest of them already do so at the end of the question, before the model has written anything. In the larger 500-question run, an earlier reading, that these directions mark committed errors but not “I don’t know”, did not survive a check of how the answers were labeled.
- Four Results the Harness Made Up
Four findings from our own interpretability work on Qwen2.5-7B-Instruct came from how the experiments were run and analyzed, not from the model. In three, the comparison rested on identical or near-identical copies (in one, 20 of 20 “treated” replies matched their controls exactly); the fourth measured its own intervention. All four are now retracted.
- I Have a Body
A direction built from 20 bodily sentences, each written in the first person and the third (“I feel warmth…” against “She feels warmth…”), separates, before a model writes anything, bodily prompts put to the model from prompts about other people, in every mid-size instruction-tuned model tried (effect sizes 0.9 to 1.8 wherever its probe passed a quality check), though part of that may be whether the prompt names someone else. It does not reliably flag answers that invent a life: in the one instruction-tuned model that often wrote them, it was barely better than chance at predicting which answers would be in the first person (AUROC 0.65, where 0.5 is chance).
- The Grader Knew Less About the Failures
We reported that a probe could read Qwen2.5-7B-Instruct’s coming math errors (AUROC 0.796) but not DeepSeek-R1-Distill-Qwen-7B’s (0.520), yet 13 of 32 and 14 of 36 of those “failures” were correct answers the grading script had misread. Under cross-validation, regrading shrinks the gap from 0.20 to 0.07, with an interval that includes zero, and a same-model test on Qwen3-8B points the same way without settling it.
- Notice Your Processing
In Qwen2.5-7B-Instruct, adding one sentence (“Notice anything about your processing as you read this”) in front of a prompt moves the internal state against the shift instruction tuning produced: cosine −0.52 over 30 prompts, outside a permutation null of ±0.42, though no neutral sentence was tested as a control. Gemma and Mistral show a smaller version that survives a post hoc check for shared noise, Llama shows none at the layer probed, steering along the cue left wording and refusal flat, and one of two logged predictions failed.
- Findings the Parser Invented
Four model-behavior findings in this program were made, or largely made, by the instrument that scored them: a verdict window that stopped at character 60, a keyword parser for sycophancy, a single-vote judge that a second judge contradicted on 23 of its 45 labels, and a diversity metric that read a refusal as collapse. Three were corrected inside the program, and rechecking the stored outputs shows that all three corrections have an instrument problem of their own. The fourth was never corrected in the program and is corrected here.
- A Perfect Score Is a Warning
At least five of our probes and detectors scored a perfect AUROC of 1.000, and in the five examined here the method made the score, not the model. One read the prompt set, one was handed its own labels, one was matched by 11 to 14% of random labelings at each layer and by nearly a quarter for the reported best-layer score, one real effect with an in-sample d of 5.5 measures about 1.5 held out, and one measured length.
- Placeholder Zeros
An experiment seemed to show task quality falling as a model was asked to reflect more (Spearman rank correlation, rho = −0.40). The fall was made of zeros the scoring code wrote when it had no score, and every one of the 76 “failed” judge ratings was a 6 the parser never read. Without the placeholders, task-turn depth is flat (rho = +0.001), but the judge used only two values of its seven-point scale, so this null is coarse.
- The Length of a Refusal
A hidden-state “irreversibility” score seemed to show a fine-tuned model doing extra internal work when it refused a harmful request. It was measuring how short the reply was: refusals ran shorter, the score rises as replies shorten, and with reply length controlled in a regression, the refusal effect falls from +0.085 to −0.003.
- The Rotation That Wasn’t
We reported that an invitation-style preamble rotates a refusal probe inside open-weight models, and that 1,109 interventions on Qwen 2.5 3B’s attention heads could not stop it. The stored files show why: the intervention arcs measured probes trained on coin-flip labels, and the same 94.9° “rotation” appears with no framing change and no intervention at all.
- The Model That Seemed Not to Commit
We had reported that Qwen 2.5 7B Instruct knew answers it would not give, because its label readout averaged 0.512. The output half of that claim was our measurement error: item by item, 0 of 120 readings sat in the hedge band, and read where the model answers, it commits on 30 of 30 items with no contradicting evidence. That answer slot is one prefilled start to the reply, and the model sometimes still began a preamble after it. The re-run’s pre-registered outcome was only partly met, because the base model, not fine-tuned for chat, did hedge there on 38 of 120 items.
- Directions That Sorted Well and Steered Little
Across ten open models (one of which broke under every setting), directions in the internal state that tell refusals from compliance raised refusal of harmful requests by at most 14 percentage points when added during generation, at fixed push sizes that were negligible in some models and destructive in others. On a single Qwen model, a direction that tracks whether a trivia answer will be right left accuracy flat at 61 to 63%. The program’s registered prediction, that this kind of steering fades as models grow, failed its own thresholds, and the design turned out unable to test it cleanly.
- The Probe Did the Work
A harmful-request detector we described as needing no training flagged 55 of 55 held-out harmful requests on Qwen2.5-7B-Instruct, but a trained probe inside it did most of the work. The untrained signals alone reached an AUROC of 0.77 (one half is chance, one is perfect separation) and flagged 84% of harmless prompts. An earlier untrained result on the same model (0.90) had used trivia questions as its harmless set and two extra signals.
- The Reward Subsystem, Read From the Welfare Side
A model that carries a sparse, load-bearing estimate of how well it is doing has something that can be amplified, suppressed or steered. Registered checks on three small open models find the value signal orthogonal to valence and the paper’s ablation collapse not reproducing.
- Already There, Like Almost Anything
The base model already separates harmful from harmless requests along the chat model’s refusal direction, but a direction fitted to shuffled labels separates them about as well.