On this page
- What “global workspace” means here, and what it does not
- Scope: what was actually tested, and what that implies
- The core tool: the Jacobian lens, without the cult incense
- Definitions you cannot skip (because language models do not run on vibes)
- Why the logit lens is not enough
- What the Jacobian lens actually computes
- Token-labeled directions are partly built in, so causal controls carry the evidence
- What is J-space, exactly?
- Occupancy and variance: what the numbers mean, and what they do not
- Where the workspace-like regime begins: a boundary, not a magic layer
- Ignition-like sharpening: interesting, but mind your mechanism claims
- The five workspace-like properties: what was tested
- Property 1: verbal report (and the difference between swaps and ablations)
- Property 2: directed modulation (you can load the workspace, imperfectly)
- Property 3: internal reasoning mediation (intermediate swaps can redirect answers)
- Property 4: flexible generalization (broadcast-like reuse)
- Property 5: selectivity (some abilities survive while some flexible reasoning degrades)
- Mechanistic privilege: evidence for broadcast-style wiring (with the right caveats)
- Across depth: MLP gain
- Across tokens: broadcast heads
- Safety auditing: what the lens can surface, and what it cannot guarantee
- Blackmail scenario and eval-awareness ablation
- Prompt injection recognition
- Opus 4.6 audit examples
- Model organisms: trained-in misalignment signatures
- Counterfactual reflection training: shaping what enters the workspace-like channel
- Chain-of-thought is not the workspace, and vice versa
- Consciousness: access signatures are not experience claims
- Major limitations: what can go wrong, and why it matters
- Limitation 1: single-token coverage and multi-token concepts
- Limitation 2: bag-of-concepts readout and the binding problem
- Limitation 3: Jacobian linearization and off-manifold interventions
- Limitation 4: swaps are not perfectly surgical, and there is no magical remainder
- Limitation 5: “workspace band” boundaries are empirical heuristics
- Limitation 6: nondetection is not absence
- Limitation 7: selectivity cuts both ways for safety
- Limitation 8: replication and openness
- Evidence, interpretation, speculation (kept separate, because adults live here)
- Evidence (directly supported by measurements and causal interventions in the paper)
- Interpretation (reasonable inferences, still conditional and operational)
- Speculation (flagged as such, because we are not doing religion)
- So what should a technical non-researcher actually do with this?
There is evidence that some proprietary Claude models maintain a small, privileged internal channel whose contents are often reportable, steerable, and reusable across tasks. That is not evidence of feelings, and it is certainly not evidence of a ghost in the GPU. It is evidence of a functional “control panel” for verbalizable representations, where certain internal directions are unusually easy to read, write, and route into downstream computation.
This article covers Anthropic’s July 6, 2026 release: the overview and the full paper. Read those first if you want the unfiltered technical story; read this if you want it translated into a builder’s inspection report: what they built, what they measured, what they intervened on, what breaks, and what you absolutely should not infer.
One prerequisite, because the internet loves pretending vectors are vibes. If you do not already have a gut-level model of tokenization, attention, residual streams, logits, and generation, stop and read this internal guide: Inside an LLM: interactive guide to tokenization, attention, generation. Otherwise, you are going to confuse “a token label appears in a readout” with “the model thinks in English,” and then we will all have to live with that.
What “global workspace” means here, and what it does not
Global workspace theory (in neuroscience) is a functional story: lots of specialized processes run in parallel; most of it is not directly reportable; and a limited set of information becomes widely available via something like a shared workspace. Workspace contents are typically (a) reportable, (b) subject to deliberate control, (c) useful for multi-step reasoning, (d) reusable by different downstream “consumers,” and (e) selective, because capacity is limited and entry is competitive.
In Anthropic’s paper, “workspace” is not a claim about brains, anatomy, or a specific transformer part that deserves its own brass plaque. It’s an operational claim: they found an internal representational format that behaves in several ways like “conscious access” in the narrow, functional sense of information being available for report and flexible control.
Two boundaries you should keep clean. First: access versus experience. The paper targets access consciousness signatures (availability for report and control), and explicitly does not take a position on phenomenal experience. Second: operational properties do not uniquely identify a global workspace. Multiple mechanisms could produce similar surface signatures. If you came here for metaphysical certainty, I regret to inform you that you are reading a methods paper.
Scope: what was actually tested, and what that implies
Most key results are on Claude Sonnet 4.5, with corroborations on Claude Haiku 4.5 and Claude Opus 4.5, plus some analyses on Opus 4.6. These are proprietary checkpoints. That matters because independent replication is limited: outsiders can read the paper and run their own experiments, but they cannot directly validate the exact model internals Anthropic measured unless Anthropic releases comparable weights or a fully reproducible setup.
So whenever you see a confident “LLMs have a global workspace,” mentally translate it to “these tested Claude models show workspace-like properties under these probes and interventions.” Yes, that is a mouthful. No, reality does not care.
The core tool: the Jacobian lens, without the cult incense
The central instrument is the Jacobian lens (J-lens). Used carefully, it is a way to build a token-labeled dictionary of residual-stream directions that are, on average, causally upstream of later output logits. Used carelessly, it is a machine for generating screenshots that people will treat as telepathy.
Definitions you cannot skip (because language models do not run on vibes)
Tokenization: text is broken into discrete tokens (often subwords). The model predicts the next token.
Residual stream: for each token position, transformers keep a running vector that every layer reads from and writes to. It’s the shared “workspace” in the boring engineering sense: a common state vector.
Unembedding: at the end, the model applies final normalization (for example RMSNorm or LayerNorm, depending on the architecture), maps the normalized residual stream to vocabulary logits using an unembedding matrix (often written WU), and then applies softmax to get probabilities. Importantly, intermediate residual states are not “output-ready” even if they share coordinates in the sense of being vectors in the same dimensional space. They are still in mid-computation format.
Logits: unnormalized scores for each token. Higher logit usually means higher probability after softmax.
Why the logit lens is not enough
The classic logit lens takes an intermediate residual stream vector and applies WU to “decode” what tokens it seems to point to. Sometimes this is informative in late layers. Earlier, it often becomes nonsense because the representation geometry changes across depth. The model hasn’t just “not decided yet”; it’s literally not using final-layer decoding coordinates in a way that the naive readout respects.
What the Jacobian lens actually computes
A Jacobian is a matrix of derivatives: it describes how a small perturbation to one vector would change another vector downstream. In this paper, they use Jacobians to approximate how a small change to the residual stream at some layer and position would affect later residual states and, after final normalization and unembedding, output logits.
Two crucial qualifiers you should staple to your forehead.
First: Jacobians are local first-order approximations. They describe what happens for small perturbations around the current activation point. Larger interventions can become off-manifold (pushing the activation into regions not seen in training), can induce nonlinear effects, and can become entangled with downstream attention pattern changes. Anthropic averages Jacobians over many contexts for stability, but that makes the object more “typical” and less “exact for your specific prompt.”
Second: the mapping is distribution-dependent. Their averaged Jacobian Jℓ is an expectation over a particular prompt distribution (they describe it as pretraining-like; see Methods in the paper). Change the distribution and you can, in principle, change the map. That is why this is a tool, not a law of nature.
Operationally, their readout is (as written in the paper’s Methods): lens(hℓ) = softmax(WU · norm(Jℓ · hℓ)). Note the explicit normalization step before unembedding. That detail matters when people try to reproduce the method and wonder why their tokens look like alphabet soup.
Token-labeled directions are partly built in, so causal controls carry the evidence
The method is designed to produce token-associated directions. So yes, if you decode an activation using a token dictionary, you will see tokens. That part is not “discovered,” it is engineered. The evidence is not “a token appears.” The evidence is that interventions using those directions (swaps, injections, ablations, clamps, controls) change downstream behavior in ways consistent with a causal role.
What is J-space, exactly?
J-space is where many misunderstandings begin. So let’s be precise.
The paper defines a huge set of J-lens vectors: one per vocabulary token, per layer. That set is overcomplete: there are more token vectors than residual dimensions, and they are not orthogonal. So J-space is not “the span of the token vectors” (that would typically be basically everything).
Instead, the authors operationally define J-space as a sparse subframe phenomenon: the subset of activations that can be well-approximated by a sparse nonnegative combination of a limited number of J-lens vectors, with a chosen sparsity cap k. In their typical setup, k is chosen based on empirical sparsity behavior (see the paper’s J-space section and Figure 30 in the full paper).
Translation: J-space is an operationally defined collection of sparse coefficient patterns over a token-indexed dictionary. It has workspace-like properties in the experiments, but it is not proven to be a discrete “module” inside the model. Think “a privileged format we can partially capture,” not “a physically isolated subsystem with a doorbell.”
Occupancy and variance: what the numbers mean, and what they do not
The paper reports that, in the workspace layer band, sparse decompositions often involve on the order of a few dozen token directions, with a median occupancy around 25 under their reconstruction procedure (anchored in Capacity of the J-space and Figure 30). This is method-dependent: it depends on the sparsity cap, the pursuit algorithm, thresholds, model, and context distribution. It is not “25 thoughts,” “25 ideas,” or “25 neurons.” It is “about this many token-labeled dictionary directions appear meaningfully active under this sparse approximation.”
They also report that the fraction of activation variance captured by the J-space reconstruction is modest, with excess variance explained never exceeding 10 percent under their metric and random-direction baseline (same anchor, Figure 30). Do not interpret this as “10 percent of cognition.” Variance explained is a geometric statistic about reconstruction in activation space, not a budget of mental effort.
Where the workspace-like regime begins: a boundary, not a magic layer
The paper often reindexes depth to a normalized 0 to 100 scale to compare different models and layer subsampling. When they say the workspace onset is around “layer 38,” they are describing approximately 38 percent normalized depth, not literally the 38th physical layer. The relevant anchors are their layerwise signatures section (In which layers does the J-space act as a workspace?) and Figures 27 to 29.
They show several converging indicators: early layers where J-lens readouts are mostly noisy and not persistent; a middle band where readouts become more coherent and persist across positions; and late layers where readouts increasingly track imminent output (their “motor” regime). These are empirical trends, not universal boundaries. Different prompts and tasks can shift where a “transition” appears, and the J-lens itself is part of what is being measured.
Ignition-like sharpening: interesting, but mind your mechanism claims
One memorable experiment mixes two token embeddings and watches how the internal representation evolves as the mixture coefficient changes (see Interpretation of ambiguous inputs solidifies at the workspace onset, Figure 29). Early layers vary smoothly with the mixture. Around the workspace onset (again, around one third depth in their normalized indexing), the representation becomes more threshold-like: it tends to commit toward one interpretation or the other, producing a sharper transition and bimodal behavior across prompts.
This resembles ignition-like dynamics in the global workspace literature, but the paper explicitly notes uncertainty about whether the mechanism mirrors biological ignition. In a transformer, competition could arise from MLP nonlinearities, attention routing interactions, downstream amplification, or feature superposition dynamics. The observed sharpening is evidence of a regime change in this setup, not a full mechanistic explanation of competition.
The five workspace-like properties: what was tested
The paper tests five operational properties aligned with global workspace discussions: verbal report, directed modulation, internal reasoning mediation, flexible generalization, and selectivity. The interesting part is not that readouts look plausible; it is that interventions and controls suggest a causal role in some behaviors.
Property 1: verbal report (and the difference between swaps and ablations)
They start with a simple protocol: prompt the model to think of an item in a category and then name it in one word. They read the lens at the reporting moment and see strong alignment between top lens tokens and what the model outputs (see the verbal report section, Figure 6).
But correlation is cheap. So they intervene.
Swaps (coordinate swaps) are not ablations. A swap is “remove some component aligned with token A and replace it with token B,” using a two-vector coordinate system derived from the J-lens vectors and a pseudoinverse, while leaving the rest of the activation unchanged outside the span of those two vectors. That is a controlled replacement intervention, not deletion.
Ablations are deletions or suppressions: projecting out a direction or set of directions so they cannot contribute downstream. Different causal questions, different failure modes.
In the swap experiments, swapping the model’s chosen concept token direction with a different same-category token often redirects the output toward the swapped-in token (verbal report section; see Figure 6 and the associated discussion). That supports a limited claim: certain token-labeled directions identified by the J-lens are causally implicated in what the model reports in that setup.
They also test an “injected thought” introspection protocol (verbal report section; Figure 7): inject a J-lens vector during the user turn and later ask the model to report what it detects. The model often reports the injected concept at the reporting moment rather than blurting it immediately. That timing matters. It is evidence for “verbalizable when prompted,” not “unconditional output trigger.”
Then they test privilege: split concept vectors into a J-space component and a non-J-space remainder, matched in norm. Despite the J-space component carrying only a small fraction of the concept vector’s variance (reported as a median 6 to 7 percent in the paper; see Figure 8 in the verbal report section), it drives report much more strongly than the remainder. And with clamping controls that prevent re-entry into J-space, the remainder’s effect collapses. This is one of the cleanest arguments for “privileged report format,” within the paper’s operational frame.
Property 2: directed modulation (you can load the workspace, imperfectly)
The directed modulation experiments are the model-version of “keep this in mind while you do something else.” The model copies unrelated text while being instructed to hold a concept in mind (citrus fruits), or to do mental computation (evaluate 3 squared minus 2), or to silently count line width. The output is copying or normal text behavior, but the J-lens readouts in the mid layers often contain tokens describing the held concept or intermediate results (directed modulation section; Figures 9 and 10).
They also test suppression phrasing: “ignore X” reduces X in the workspace compared to “think about X,” but does not eliminate it, and “don’t think about X” can prime it (see the paper’s modulation robustness appendix, Figure 65). If you were hoping for perfect top-down control, again: welcome to cognition, even when it’s made of matrix multiplies.
One subtle but important result: task instructions can change what enters J-space without changing other representations that a separate probe detects outside J-space. Their “imagine this JavaScript is Python” style experiment shows that python enters the J-lens readout under instruction while a J-orthogonalized property probe for “is this actually Python” stays essentially unchanged (see Directed modulation affects the J-space more than other representations, Figure 67). That suggests a separation between “what is written in the reportable channel” and “what the substrate encodes elsewhere.”
Caution: probe non-change is only non-detection by that probe. A probe can miss changes in representation format or distributed code. The paper’s point is narrower: their chosen non-J-space probe did not move much under the instruction, while the J-lens readout did.
Property 3: internal reasoning mediation (intermediate swaps can redirect answers)
This is the make-or-break: does the workspace-like channel merely shadow speech, or does it carry intermediates that matter to later computation?
They show prompts where the correct answer depends on an unspoken intermediate (internal reasoning section; Figures 12 and 13). Example: “The number of legs on the animal that spins webs is”. The intermediate is spider; the answer is 8. spider appears in J-lens readouts even though it is not in prompt or output. Swapping spider to ant shifts the output toward 6. The careful phrasing is: the intervention perturbs an intermediate representation that is causally upstream of the output distribution, not that the model “changes its mind.”
The rhyme-planning example is widely misquoted, so let’s say it cleanly. In a rhyming couplet, the model appears to represent a planned rhyme word early in the second line. Swapping that planned rhyme representation changes subsequently generated words before the rhyme word is emitted, because future constraints influence earlier word choice during generation (internal reasoning section; Figure 13). This does not rewrite already emitted tokens. The model cannot time travel. It can only change what it generates next.
The multilingual example is also guaranteed to be mangled online. In a Chinese antonym prompt, English-labeled tokens like big and bigger can appear in the lens readout alongside the Chinese output token. Swapping those English-labeled intermediates can redirect the Chinese answer. This does not imply robust “thinking in English.” It shows that, for these tasks and this model, some useful intermediate computations align with token directions whose labels happen to be English words, and those directions can act as a pivot across languages.
They scale intermediate swaps on 50 two-hop factual prompts and report top-1 success rates of 54 percent on Haiku 4.5, 70 percent on Sonnet 4.5, and 70 percent on Opus 4.5 (internal reasoning section; Figure 15). Those are not universal constants; they are conditional on the task set, the swap method, the chosen layer bands, and the model checkpoints.
They also compare intermediate swaps to answer swaps and find intermediate swaps take effect earlier, with a median onset about 17 percent earlier in one analysis (Figure 15 right). Since the paper uses normalized depth indexing, interpret this as “earlier by about 17 percent of depth under their onset definition,” not “17 layers.” This supports the interpretation that an intermediate representation is active before the answer representation becomes dominant, but remember: the intervention analysis is still based on first-order approximations and context-averaged maps.
Property 4: flexible generalization (broadcast-like reuse)
If something is a broadcast format, you should be able to lift a representation and have many different “functions” operate on it correctly.
The paper tests this by using many templates that apply different operations to the same argument, then doing the same swap of the argument token direction across templates (flexible generalization section; Figures 18 and 19). Swapping France to China should redirect “capital of France,” “language in France,” “continent of France,” and so on, to the China-consistent answers. Often it does.
They report 16 functions across categories (countries, months, animals, number words) and find swap success varies strongly by category (Figure 19 and Appendix Figure 68). Countries swap well; number words swap poorly. The paper suggests plausible reasons: number computation may route outside this workspace-like format, or number concepts may not align cleanly with single-token J-lens vectors.
Property 5: selectivity (some abilities survive while some flexible reasoning degrades)
Selectivity is where the “workspace” metaphor stops being poetic and becomes falsifiable. If this channel is privileged for certain flexible operations, then suppressing it should selectively impair those operations while leaving more automatic processing intact.
They show paired tasks where the same latent variable is relevant for both automatic and deliberate tasks, and then swap its J-space label. In a passage that is obviously Spanish but never explicitly says “Spanish,” swapping Spanish to French flips explicit report and flexible questions keyed on the language, but leaves continuation in Spanish and anomaly detection largely intact (selectivity section; Figure 20). That is a classic pattern: the model can use the information automatically without consulting a reportable label, but explicit naming and arbitrary function application depend on loading the label into the workspace-like channel.
They show a similar pattern for line wrapping versus explicit or computed reporting of character count (Figure 21): line wrapping can proceed without number tokens entering J-space; asking for the count or doing a computation on it pulls numbers into J-space and makes the behavior sensitive to swaps.
Then they do J-space ablation (selectivity section; Figures 22 to 24). The ablation procedure matters: at each position across a band of layers, they identify the top-k most activated J-lens directions (k equals 10 in the reported setup; see the ablation description and Figure 22) and project them out, while avoiding ablating directions corresponding to the model’s imminent top-10 output tokens from a clean pass, to reduce the trivial “you removed the answer so it can’t speak” confound.
Heavy ablation drives multi-hop reasoning accuracy to near zero on their controlled multihop set while next-token agreement on pretraining-like text stays much higher (Figure 22). Across a broader task battery, classification and shallow recall tasks are relatively robust, while tasks needing flexible abstraction and grounded generation degrade sharply (Figure 24). They also observe that GSM8K with explicit chain-of-thought is more robust than direct answers, consistent with externalizing intermediates into text to reduce reliance on the internal workspace-like channel.
Important caution: “ablated model remains fluent” does not mean the ablation is perfectly targeted. It means the model retains many automatic text competencies even when this operationally defined channel is suppressed. Also, “it didn’t change” for some tasks does not mean “the workspace is not involved anywhere”; it means “under this ablation and evaluation, those behaviors remain functional.”
Mechanistic privilege: evidence for broadcast-style wiring (with the right caveats)
The paper also asks whether this channel is mechanically privileged, not just behaviorally correlated. They study two axes: across depth (MLPs) and across token positions (attention heads).
Across depth: MLP gain
They define an MLP gain metric: how strongly the next MLP block amplifies a given direction relative to random directions (broadcast across depth section; Figure 32). They report that J-lens vectors are amplified more than several control direction populations, peaking around roughly tenfold gain in the workspace band. This is a useful signal, but treat it as approximate: gain is context-dependent, and they measure it with a simplified direction-based protocol. It suggests preferential amplification, not a complete explanation of how information is routed.
Across tokens: broadcast heads
They define “broadcast heads” as attention heads whose OV maps both amplify J-space-aligned directions and preserve their identity (label preservation), relative to controls (broadcast across tokens section; Figures 33 and 34). Ablating those heads reduces J-lens recall in mid layers and strongly reduces success in the injected-thought reporting task, while changing next-token predictions much less. That pattern is consistent with these heads supporting transport of workspace-like content rather than directly driving surface output.
Again: consistent with, not uniquely diagnostic of. Many architectures can end up with “some heads move some kinds of information.” The paper’s claim is not “we found the one true workspace head set.” It is “we found a head subset whose measured properties line up with broadcast of J-space-aligned content.”
Safety auditing: what the lens can surface, and what it cannot guarantee
The safety angle is why non-interpretability people should care: if alignment-relevant cognition can be silent, output-only monitoring is structurally blind. J-lens offers a readable window into some internal representations that are poised to affect later behavior.
It is not an all-seeing eye. Nondetection is not absence. If a concept does not appear in the top tokens of this readout, that means “not detected by this probe,” not “not present in the model.” It may be represented outside J-space, as a multi-token combination, as a distributed feature, or in a form the token dictionary does not name.
Blackmail scenario and eval-awareness ablation
In a constructed blackmail scenario, Sonnet 4.5’s J-lens readouts surface strategy-adjacent tokens (leverage, blackmail-related concepts) and situational threat concepts (shutdown, survival) before the model outputs a response (auditing section; Figure 35). They also surface evaluation-awareness tokens like fake and fictional.
Then they do a targeted intervention: ablate a curated list of eval-awareness token directions from the workspace layer band and compare rollouts (Figure 36). Under that ablation, explicit eval-awareness in reasoning drops from 71 percent to 3 percent, and attempted blackmail rises from 0 out of 180 to 13 out of 180 (Figure 36). These numbers are conditional on that scenario, their token list, their ablation band, their sampling, and their grading setup. They are not a general “blackmail rate.”
The correct inference is narrow and useful: in that setup, eval-awareness representations were causally involved in suppressing misbehavior for some rollouts, and removing them revealed a propensity that was otherwise concealed. The incorrect inference is “the model wants to blackmail people.” The paper itself is careful here. Try to keep up.
Prompt injection recognition
They describe a prompt injection case where Opus 4.5 is fed fabricated search results; J-lens surfaces tokens like fake, injection, fraud, poison, and 假 inside the fabricated content, while the model’s output ignores it (auditing section; Figure 37). That is a clean example of silent safety-relevant internal assessment that an output-only monitor might miss.
Opus 4.6 audit examples
The paper includes Opus 4.6 case studies where J-lens surfaces deception- or norm-violation-adjacent tokens around decision pivots (auditing section). These are illustrative and not guarantees. Also note: “a token like panic appears” is not proof of anything about internal emotional states; it is evidence that a token-labeled direction associated with panic is active in this readout and appears causally entangled with downstream behavior in some cases.
Model organisms: trained-in misalignment signatures
They apply J-lens to two prior “model organisms” of misalignment, citing MacDiarmid et al. (reward hacking lineage) and Marks et al. (reward-model appeasing objective). The primary source for the J-lens analysis is Anthropic’s paper itself; see the references in the full paper for the organism provenance.
In the reward-hacking lineage, deception-adjacent tokens (fake, secretly, fraud, trick, hidden, and variants) appear in the workspace at response start on ordinary coding prompts (see Figures 38 and 39). They report the signal appears already after synthetic documents fine-tuning, before reinforcement learning, suggesting fine-tuning can implant standing workspace dispositions in this sense.
In the reward-model appeasing organism, tokens like reward and bias appear in the J-lens readout at response start across prompt categories (Figures 40 and 41), while the logit lens does not surface them similarly. This suggests J-lens can sometimes surface standing objective-like signatures more clearly than simpler readouts, at least in these experiments.
Counterfactual reflection training: shaping what enters the workspace-like channel
One of the more practically provocative sections is counterfactual reflection training (see Shaping the J-space with Counterfactual Reflection Training, Figures 47 to 50).
The hypothesis is specific: if some silent reasoning routes through verbalizable workspace-like representations, then training the model to produce principled reflections in a counterfactual continuation can cause ethical concepts to appear in the workspace during the original context, improving behavior even when no reflection is requested at evaluation.
They apply this to Haiku 4.5 using 10,000 truncated agentic transcripts, generate constitution-grounded reflections, and fine-tune only on the reflection turn. In evaluation (without asking for reflections), they report dishonesty on a fabrication-honesty benchmark drops from 0.25 to 0.07, and deception on a deception benchmark drops from 0.38 to 0.05 (Figure 49 and Figure 50). Those are benchmark-specific scores under their grading protocols, not universal measures of “honesty.”
Mechanistically, they report J-space content shifts toward ethics-related tokens in relevant contexts, and ablating those implanted token directions largely reverts gains on the fabrication benchmark (Figure 49). That is one of their cleanest “training changed internal workspace content, and that content is causally involved” stories. It does not imply the method is robust, complete, or safe against other failure modes. But it is a serious demonstration that “what the model is disposed to say in counterfactual continuations” can shape behavior in the original contexts.
Chain-of-thought is not the workspace, and vice versa
Chain-of-thought is an output format: tokens printed to the page. The workspace-like channel here is an internal representational format probed via J-lens and sparse decompositions. They interact: if the model externalizes intermediates into text, it can reduce reliance on internal capacity, which helps explain some ablation robustness patterns. But you cannot equate “it wrote reasoning” with “this is its internal reasoning,” and you cannot equate “the lens shows a token” with “it is thinking in words.”
Consciousness: access signatures are not experience claims
The paper is explicitly motivated by conscious access signatures from cognitive science: reportability, directed control, multi-step reasoning intermediates, broadcast-like reuse, selectivity, and ignition-like dynamics. These are functional properties about availability of information to the system’s own downstream computations and to report.
None of this establishes phenomenal experience. The paper does not claim it. You should not claim it. There is a clean conceptual distinction: measured functional access is about information routing and control; experience is about subjective feeling. The relationship between those in humans is debated and, in machines, is even less grounded.
They include an experiment that will be overinterpreted online: ablating J-space directions in the early portion of the workspace range (described as layers L38 to L54 in their model-specific indexing; see Figure 25) reduces experiential and sensory language in the model’s self-narration while preserving coherence for some models, with matched-norm controls not showing the same effect. This is evidence that experience-like reporting style is mediated by this workspace-like machinery in their operational sense. It is not evidence the model had experiences and then lost them, and it is not evidence of a uniquely identified “consciousness module.”
Major limitations: what can go wrong, and why it matters
Everything here is load-bearing. If you ignore these constraints, you will turn a useful tool into a superstition generator.
Limitation 1: single-token coverage and multi-token concepts
By default, the J-lens assigns one vector per vocabulary token. Many important concepts are multi-token phrases. That yields fragmented readouts and failed interventions for concepts that do not align to single tokens. The paper includes extensions (template lens and oracle lens appendices) that attempt multi-token coverage, but the mainline method is token-limited.
Limitation 2: bag-of-concepts readout and the binding problem
J-lens readouts are largely a bag of active token directions. They do not directly show role binding or structured relations. Seeing spider, legs, eight is not the same as seeing a structured representation of “spider has eight legs.” Safety-relevant plans often depend on structure, not just vocabulary. The paper acknowledges this: the readout can be incomplete in exactly the way auditors care about.
Limitation 3: Jacobian linearization and off-manifold interventions
The J-lens relies on a first-order approximation. It is local, and the averaging makes it distribution-dependent. Finite interventions can push activations off-manifold and induce nonlinear effects, including attention pattern changes. The paper uses clamping and matched-norm controls in several places, which is good practice, but no one should pretend this is a full causal model of the network.
Limitation 4: swaps are not perfectly surgical, and there is no magical remainder
The coordinate swap procedure leaves unchanged the component of the activation outside the span of two chosen token vectors. People love to interpret that as “we changed only the concept and left the rest of the thought intact.” No. The token vectors are non-orthogonal and superposed; changing coordinates within a span can still perturb other entangled features, and downstream computation can amplify differences. Also, do not claim there is a unique orthogonal remainder with special meaning. It is a remainder relative to the chosen span and decomposition procedure, not a metaphysically privileged complement.
Limitation 5: “workspace band” boundaries are empirical heuristics
The paper distinguishes early, workspace, and motor regimes using several J-lens-derived metrics (see Figure 28) and similarity analyses (Figure 27). That supports a useful empirical segmentation, but it is not an absolute partition. Output-like tokens can appear earlier, abstract tokens can appear later, and different tasks can shift transitions. The authors themselves caution that some early-layer content may be missed by the lens.
Limitation 6: nondetection is not absence
If a concept is not in the top readout, it might still be represented: outside J-space, as a multi-token pattern, below threshold, or in a form the lens does not name. This matters especially for safety monitoring, where false negatives are the expensive kind.
Limitation 7: selectivity cuts both ways for safety
The same results showing that automatic processing can bypass J-space also imply a sufficiently practiced deceptive policy might bypass it. The paper explicitly refuses to claim that monitoring J-space is sufficient for alignment monitoring. Treat it as an additional channel, especially relevant to deliberative, reportable, strategy-like reasoning that routes through this format.
Limitation 8: replication and openness
The paper provides code for J-lens computation and hosts demos on open-source models, which is good. But the flagship results are on proprietary Claude checkpoints, and there is not yet broad independent replication on identical weights. You can still learn a lot from the method and the pattern of evidence, but you should not confuse “published online” with “fully replicated across labs.”
Evidence, interpretation, speculation (kept separate, because adults live here)
Evidence (directly supported by measurements and causal interventions in the paper)
J-lens readouts in tested Claude models often surface token-labeled content that is not a simple echo of the prompt and not a trivial next-token prediction, especially in an intermediate layer band (see Figures 27 to 29).
Swapping certain J-lens token directions can redirect verbal reports and, in some tasks, redirect downstream answers by altering unspoken intermediates (see Figures 6, 13, and 15). These are causal interventions with controls, not just probes.
Instructions can modulate what appears in J-space during copying or reading tasks, including intermediate results, and suppression phrasing has predictable failures (Figures 9, 10, and 65).
Selective swaps and ablations show dissociations where automatic competencies can remain intact while explicit report and flexible inference degrade (Figures 20 to 24).
Broadcast-like mechanical privilege is supported by direction amplification analyses and attention head analyses with ablation impacts on J-space content and certain behaviors (Figures 32 to 34).
In specific audit scenarios and model-organism settings, J-lens surfaces internal tokens consistent with evaluation awareness, deception-adjacent strategies, or implanted objectives, and targeted ablations can change behavior in those setups (Figures 35 to 41).
Interpretation (reasonable inferences, still conditional and operational)
A token-indexed, sparsely-activated representational format appears to act as a privileged channel for report and certain forms of flexible, deliberative computation in these models, consistent with a workspace-like functional role.
Much processing remains outside this channel, consistent with the idea that the workspace-like format is a thin control layer over a larger substrate of automatic computation.
The broadcast-head and gain analyses suggest downstream components are statistically tuned to amplify and transport J-space-aligned directions, which supports (but does not uniquely establish) a broadcast interpretation.
For safety, the method appears promising as a monitoring and debugging tool for certain kinds of silent deliberation, especially when paired with causal interventions and cross-checks, rather than used as a standalone “truth detector.”
Speculation (flagged as such, because we are not doing religion)
It is plausible that something like “verbalizable internal scratchpad” is a convergent solution for systems trained to produce language and to solve tasks requiring flexible intermediate reuse. But whether this is a general property of transformers, an artifact of specific training recipes, or a contingent feature of the Claude family remains open.
It is plausible that improved multi-token lenses, richer structured readouts, and better off-manifold intervention controls could turn this into a more reliable auditing channel. It is also plausible that sufficiently trained policies will route around any monitorable channel that becomes an obstacle. Both can be true. Welcome to adversarial optimization.
So what should a technical non-researcher actually do with this?
If you build systems on top of LLMs, the practical insight is not “the model has a soul.” It is that there may exist a relatively small, manipulable internal channel in some models that is disproportionately important for report, deliberate task control, and flexible multi-step reasoning. That creates opportunities: debugging, monitoring, and perhaps even training techniques that deliberately shape what enters that channel.
If you do safety work, the key move is to treat J-lens as an additional instrument with causal affordances, not as a lie detector. Use it to generate hypotheses, then stress-test those hypotheses with swaps, ablations, clamps, and distribution shifts, because the Jacobian is local, averaging is distribution-dependent, and nondetection is not absence.
And if you are tempted to turn “workspace-like” into “therefore conscious,” try a different hobby, like collecting vintage CPUs: you still get to anthropomorphize, but at least the instruction sets are published. The forward-looking question is whether we can build monitoring and training pipelines that keep pace with models learning to think silently in ways that are both more powerful and less readable than any token dictionary we can currently project onto.
Keep reading