---
title: "The Jacobian Lens: How to read a mind you built, and what the reading is worth"
url: "https://chriscaruso.dev/notebooks/the-jacobian-lens"
type: "Notebook (interactive explainer)"
site: "Caruso's Conjecture"
author: "Chris Caruso"
published: "2026-07-30"
source: "writing/notebooks/the-jacobian-lens.md"
index: "https://chriscaruso.dev/llms.txt"
narration_minutes: 66
narration_cues: "https://chriscaruso.dev/media/narration/the-jacobian-lens/cues"
narration_chapters: "https://chriscaruso.dev/media/narration/the-jacobian-lens/chapters"
tags: ["Machine Intelligence", "Interpretability", "Consciousness", "Linear algebra", "Interactive"]
---

# The Jacobian Lens: How to read a mind you built, and what the reading is worth

**How to read a mind you built, and what the reading is worth.**

Here is a sentence with a typo in it, being read by a large language model. The sentence ends *"...but I don't speak that langauge"*, with the second-to-last word misspelled, and the model has just finished writing the misspelling. It is not being asked about the typo. It is not being asked anything. It is doing the only thing it ever does, which is working out what word comes next.

> **Interactive figure:** The model's next word against the words it is holding, at one position in a misspelled sentence.

The left panel is an old measurement. The right panel is not, and it is what this notebook is about. The model wrote `langauge` and was carrying `language` while it did it, and nothing in its output would ever have told you.

In July 2026 a team at Anthropic published a technique for asking a language model what it is currently holding, as opposed to what it is about to say.[^1] The two questions turn out to have different answers, and the gap between them is where almost everything interesting lives: intermediate results in a calculation, the correct spelling of a word being misspelled, the language a passage is written in, the fact that the model has noticed it is being tested.

The finding attached to the technique is the part that made the news. The set of things a model can hold in this way, across the middle of the network, behaves like what psychologists call a global workspace: a limited-capacity central pool that many separate processes can write into and read out of, which is the closest thing cognitive science has to a functional account of what conscious access does in a human brain.[^7]

That sentence caused a great deal of trouble. The two explanations of this paper that reached the most people were the two opposite ways to be wrong about it: one telling you Claude is definitely not conscious and this is all a bit silly, the other telling you an AI has crossed the consciousness line. Between them, eight hundred thousand views. The one careful ninety-two-minute walkthrough from first principles has eighty-five.[^14] I will come back to that distribution later, with the rest of the numbers, because it is a better description of the problem than any complaint about hype would be.

So: the mechanism, from scratch, with nothing skipped. Then what it actually found, including the result the authors call their punchline and almost nobody repeated. Then how it landed. Then my own measurements of what the instrument is, which turned out to disagree with something everybody including me had assumed. Then, carefully, the part about consciousness, which is smaller and more interesting than either of the two viral versions. And at the end, the one experiment everybody involved agrees is missing.

## A vector with no dictionary

A language model does not read text. Before anything happens, the text is chopped into tokens, word-pieces drawn from a fixed vocabulary of a few tens of thousands, and each token is looked up in a table that turns it into a list of numbers. For a mid-sized open model that list is 2,048 or 4,096 numbers long. Call it a vector. That is the model's only representation of anything.

The vector then goes on a journey. The network is a stack of layers, sixty-four of them in the model those first readouts came from, and each layer reads the vector, computes something, and adds its result back on. Nothing is ever replaced. The vector at layer forty is the original word embedding plus forty layers' worth of accumulated contributions, all summed together in the same 4,096 slots. Interpretability people call this the residual stream, and the useful image is a bus running the length of the model, with every layer allowed to read from it and add to it, and no layer allowed to erase.

At the very top, the last vector is multiplied by one final matrix, the unembedding, which has one row per word in the vocabulary. Each row is a direction. The dot product of the final vector with a row tells you how much the model wants that word, and the biggest number wins. That matrix is the only translator between the model's internal numbers and anything a human can read.

Which raises an obvious question, and it was asked in 2020. The bus runs the whole length of the model. The translator only gets used at the end. What happens if you grab the vector at layer twenty and multiply it by the unembedding anyway?

This is the logit lens, and it was a genuinely good idea.[^4] It works well enough at the top of the model to be useful, degrades in the middle, and produces nonsense at the bottom. Not interesting nonsense. When I ran it myself on a sixty-four-layer model reasoning about planets, the logit lens spent the first sixteen layers returning whitespace and apostrophes, and then, deep in the model at layers fifty-one and fifty-two, returned `ptune` and `esimal`. Neptune. Planetesimal. Tails of the right neighbourhood with no word in them.

The standard reading of that failure was that the early layers do not contain anything word-shaped yet, that meaning gets assembled gradually and there is nothing to read until it is nearly assembled. It sounds right. It fits the picture of a network as a refinement pipeline. It was treated as a fact about models for six years.

It is a fact about the unembedding matrix.

Here is the problem, stated plainly. The unembedding is a translator, and it is exactly correct for one thing: vectors as they exist at the final layer. It has never seen a layer-twenty vector. Layer twenty's vector is going to be transformed by forty-four more layers before anybody translates it, and those forty-four layers are not a formality. They rotate, rescale, and reshuffle the space. A direction that means one thing at layer twenty means something else by the time it reaches the top, and the unembedding only knows about the second one.

So applying it early is not reading the model's mind badly. It is reading with a dictionary for a different language. The vectors down there are perfectly meaningful; the meaning is just not yet expressed in words, and the unembedding matrix only speaks words.

## The derivative you were not given

If you have read [the notebook on the Jacobian conjecture](/notebooks/the-jacobian-conjecture), you already own an object that solves this, and you were taught the wrong half of it. That notebook needed a single number: take a map between spaces, look at how it stretches area near a point, get one number, ask whether it is ever zero. The whole conjecture is about that number.

Put the number away. You will not need it again.

> **Interactive figure:** A square and its image under a linear map, with the determinant available and then taken away.

The object is a Jacobian. For a map that takes one list of numbers to another list of numbers, the Jacobian at a point is the matrix of every partial derivative: row *i*, column *j* is how much output *i* changes when you nudge input *j*. It is the best linear approximation to the map near that point, which is another way of saying it is the map, if you do not move too far. The determinant is one number squeezed out of that matrix. Useful for one question. Throws away the rest.

And now the observation the whole technique is built on, which takes about a sentence once the setup is done.

The journey from layer twenty to the top of the model is a map. It takes a vector, does a great deal of arithmetic, and returns a vector. Maps have derivatives. The Jacobian of that map is the translator between layer-twenty coordinates and final-layer coordinates. The unembedding is correct at the final layer. So multiply first, and then translate:

> **lens**(h) = softmax( W<sub>U</sub> · norm( J · h ) )

Read left to right from the inside: take the vector *h* sitting on the bus at layer twenty, push it through the Jacobian *J* to express it in final-layer coordinates, normalise, apply the unembedding, and turn the result into a ranked list of words.

The best thing about this formula is what happens when you delete the interesting part. Set *J* to the identity matrix, the matrix that does nothing, and you get the logit lens back exactly. The paper says so itself: the logit lens *"corresponds to setting J<sub>ℓ</sub> = I in our formulation."*[^1]

That is worth pausing on. The two techniques are not rivals with different philosophies. They are the same formula with different values of one term, and the old one was using the value that assumes the next forty-four layers do nothing at all.

> **Interactive figure:** The same prompt read with the Jacobian in place and with the identity in its place.

## The averaging is the actual idea

There is a problem with everything above, and the way it gets solved is the part of this paper that people skip.

A Jacobian is defined at a point. The map from layer twenty to the top depends on the whole rest of the network, and the rest of the network depends on the input, because attention layers route information differently for different sentences. So there is no single Jacobian. There is one per prompt, per position, and computing it for a sentence tells you about that sentence.

That is not what you want. Ask the per-prompt Jacobian what a direction means and it will tell you what that direction did in that sentence. You wanted to know what the direction means to the model, in general, independent of any particular use.

So the fitting procedure averages. Not casually: the estimator is specific, and it is written into the reference implementation's own docstring. For a given source layer, inject a signal at every valid source position at once, sum the effect over all later target positions, take the mean across source positions, and take the mean across a thousand prompts.[^3] The result is one matrix per layer, roughly four thousand by four thousand, and it does not belong to any sentence.

> **Interactive figure:** Per-prompt Jacobians accumulating into their mean.

The cost is worth naming, because it is the reason this is not restricted to labs with a compute budget. Fitting is one backward pass per output dimension per prompt: on the order of *n* times *d*, so for a small open model with a 576-wide residual stream and twenty-five prompts, about fourteen thousand backward passes on short sequences. That is a laptop overnight. Applying the finished lens is a single matrix-vector product, about a tenth of a millisecond. So the expensive part happens once, and what it leaves behind is small: the official lens for GPT-2 small, which is the one I take apart later in this notebook, is a thirteen-megabyte download.

Everything in this notebook that says *measured* was either computed that way on my own machine or pulled once from a public hosted lens and committed to the page as a file.[^6] Nothing here calls a model while you read it, and every number is one you could go and check.

## What comes out

You now have, for each layer, a matrix that translates that layer's coordinates into readable ones. What do you do with it?

The immediate thing is what you have already seen twice: take the vector on the bus at some layer and position, transport it, unembed it, and read the ranked list. But there is a second move that matters more, and it runs the other way.

If reading a vector is *W<sub>U</sub> · J · h*, then writing one is *J*<sup>T</sup> *· w*. Take the unembedding row for some word, push it back through the transposed Jacobian, and you have a direction in layer-twenty coordinates that the lens will read as that word. Add it to the bus and you have injected the concept. One transpose, and a reading tool becomes an editing tool, which is what makes the causal experiments in the next section possible at all.

Four things about the readings, which the paper is careful about and most of the coverage was not.

**They are vectors, not slots.** The lens returns a direction with a word attached, not a variable holding a value. Nowhere in the model is there a register labelled *the language this text is in*. What exists instead is a direction which, when present in the activations, the lens reads as Spanish.

**They are hypotheses.** A lens reading says a direction is present. It does not say the model is using it. The distance between those two claims is the entire methodology of the field, and the paper attaches the same discipline to every reading it makes: check the direction against a control prompt, check that the effect survives an intervention, and throw away anything that fails either test. There is a smaller, everyday version of that discipline which the paper writes down as instructions for its own auditing tool, and which I used for every reading in this notebook. Treat the ranked list as a handful of ideas rather than a sentence, since the words are not ordered into prose. Count a family of related words as one idea rather than several, since a concept can surface as synonyms, names and variants. And trust a reading that persists across several layers or neighbouring positions over one that flares in a single cell, because single-layer noise is common. Almost every over-reading of this paper I have seen breaks one of those three.

**They stop at the token.** The lens finds directions labelled by single tokens, because that is what the unembedding has rows for. A concept the tokenizer splits into pieces is a concept the lens is bad at. Nanda names this as a hard bound in his review: the method *"can only find concepts corresponding to a single token"*, which means the workspace as measured is partly a picture of the tokenizer.[^9] The paper's own multi-token results degrade accordingly.

**And the lens is bad at predicting the next word, on purpose.** In a head-to-head against the logit lens and the tuned lens across six prompt distributions, the Jacobian lens won every one on the task of surfacing what the model is holding, and came last of the three on next-token prediction.[^1] The authors call this *"a feature rather than a defect."* Being a good next-token predictor means being drawn toward whatever is about to be said. The whole value here is the residue: what is present and not about to be said.

There is a footnote to that head-to-head worth carrying, because it is the sort of detail that only shows up if you read past the abstract. The tuned lens, which learns a per-layer correction and was the strongest prior attempt at this problem,[^5] turns out at early layers to have a linear part that is nearly the identity. Almost all of its advantage comes from its bias term, which is to say from a constant that ignores the input entirely. It was improving the score by guessing better on average rather than by reading better, and that distinction only becomes visible once you have something to compare it against.

## It is not a place

Here is the single most corrected error in the public discussion of this paper, and three separate experts had to say it out loud within a week of publication.

The paper calls the set of directions the lens can read the *J-space*. Approximately everyone, including several people who should have known better and at least one popular explainer with a large audience, read that as a location: a region of the model, a compartment, a subconscious versus a conscious part, an area you could point to.

There is no such region.

The directions the lens reads are not confined anywhere. They are spread through the same 4,096 numbers that carry everything else. There are more of them than there are dimensions, which means they cannot be a coordinate system and cannot be decomposed uniquely. And a direction being readable does not stop that same set of numbers from simultaneously carrying a dozen things the lens cannot read at all.

Stanislas Dehaene, who built global workspace theory in the first place and who was one of the paper's commissioned reviewers, wrote the correct definition, and it is worth having exactly:

> not even a linear subspace, but a sparse subframe, a token-indexed set of directions in the very same units that also carry non-conscious content.[^7]

Every word of that is doing something. **Not a subspace**: you cannot mix two readable directions and expect a readable one back, which is the technical way of saying the readable set has holes in it rather than being a clean slab through the space. **Sparse subframe**: a frame is an overcomplete set of directions, more of them than there are dimensions, redundant on purpose. **Token-indexed**: each direction is labelled by a word, not by a coordinate. **In the very same units**: there is no separate storage.

> **Interactive figure:** Directions in one shared space, some readable and some not.

That last beat is not a rhetorical flourish. It is measured, and it quietly complicates the number everyone quoted.

An independent replication on Llama-3.3-70B reproduced the paper's headline number almost exactly. Take a typical concept vector, the model's internal representation of some idea, and ask how much of it lies along readable directions rather than unreadable ones. The answer is about six percent, against the paper's six to seven percent on Claude.[^11] Good replication. But that researcher then swept the cutoff. Counting the top two hundred directions as readable gets you six percent. One thousand and seventy-six gets you fifty percent. Four thousand four hundred and fifty gets you ninety.

There is no knee in that curve. In their words, it *"doesn't have a clean wall."*

So the workspace does not have a natural size. The number of directions you count as being in it is a choice, and the striking six percent figure is partly a consequence of choosing two hundred.

What that does not do is make the six percent unimportant, and the reason is sitting in the three bars in the figure above. That six or seven percent of a concept vector does fifty-nine percent of the causal work. The ninety-three percent outside it does five. So the workspace is not small in the sense of being minor. It is small in the sense of being concentrated, which is a stranger property and a far more useful one. The most damaging-sounding number in the paper turns out to be its strongest argument, one paragraph later in the paper's own text, and almost every discussion I read quoted the first and stopped. The experiment those numbers come from is the next section.

## Five things it does

Nothing so far establishes that the workspace is a workspace. A lens that produces plausible words is a lens that produces plausible words. The paper's actual argument is a list of five properties, each with an experiment, and four of the five involve breaking something rather than reading it.

**One: report.** If a concept is in the workspace, the model can say it. Push a concept vector in and ask what it is thinking about, and it tells you.

**Two: modulation.** If a concept is in the workspace, it changes behaviour, not just talk.

> **Interactive figure:** One activation vector, edited in two ways.

The controls are what turn that from a demo into a measurement. Anything can be broken by pushing hard enough on it; the question is whether the readable directions are special, and the answer is that they are, by better than ten to one.

That ten to one is where the six percent from the last section comes good. Editing along the readable slice of a concept vector, which is the six or seven percent, works fifty-nine percent of the time. Editing the unreadable remainder, ninety-three percent of the same vector, by the same amount, works five percent of the time. There is a third bar too: edit along the pure lens directions, ignoring the concept vector entirely, and you get eighty-eight percent. So the readable part of a concept is not merely present in the model. It is where the leverage is.

**Three: internal reasoning.** This is the one I found most convincing, and the one I could check myself.

Give a model an arithmetic problem it has to work through. In principle there is an intermediate result, and in principle it is never spoken. Does it exist?

> **Interactive figure:** Every position and every layer of a small calculation, read both ways.

I want to flag how nearly this went wrong, because it is a good example of how easy it is to fool yourself here. My first version used one plus two equals three, and it read beautifully: three at the top of the list across five layers. It was also worthless, because there is a three in the prompt and the model might simply have been counting the numbers in front of it. The redesign put the answer nowhere in the prompt and arranged things so that counting would predict a different digit. That is the only reason the result above means anything.

The paper is not relying on the lens for this either. The same intermediate results were confirmed by activation patching, which is a lens-free technique: take the activations from a run where the number is different, splice them into this run at one layer, and see whether the final answer changes. It does, at about seventy-one percent of depth for the first intermediate and seventy-nine for the second, and nowhere else. So the reading and the causal test agree on where the number lives, and the causal test does not use the lens at all.[^1]

**Four: flexible generalization.** A workspace entry should be available to any process, not just the one that put it there.

> **Interactive figure:** One concept swapped, read out through four different questions and four different categories.

**Five: selectivity.** That last split is the fifth property, and it is the one that makes the workspace claim non-trivial. If everything in the model were in the workspace, the concept would be a synonym for *anything the model represents*, and the word would be doing no work. Instead there are two clean regimes: what the model says about the passage is downstream of the workspace entry, and what the model does with the passage is not.

The paper has a matching result for line counting, which shows up in the workspace only when the model is explicitly asked to report a line count and vanishes when the same information is being used implicitly to wrap text.

If you want one phrase for what the lens reads, it is not *what the model knows* and it is not *what the model is computing*. It is closer to: what the model could tell you about, if asked right now.

## The shape of it

Read the lens across every layer for a long prompt and the model falls into three regions, and the edges between them are crisper than you would expect from a network that has no architectural reason to have regions at all.

**The bottom third is empty.** Not quiet: empty. Occupancy of the workspace is essentially zero for the first third of the network. The model is doing plenty down there, but nothing it is doing is readable this way.

**The middle is the workspace**, roughly the band from thirty-eight to ninety-two percent of depth. Independent groups measure this at thirty to ninety percent of depth, close enough.[^9] Inside the band, occupancy is stable at about twenty-five directions per position and stays there.[^1]

**The top few layers are motor.** The workspace drains and what remains is the next token.

The transition into the band is the part everyone wanted to be dramatic, because global workspace theory in humans predicts *ignition*: a sharp, nonlinear, all-or-nothing entry into conscious access, not a gradual fade.

What the paper shows instead is a gradual climb, and the measure it climbs on is worth introducing properly because the rest of this notebook leans on it. To ask how similar two directions are, you take their cosine: one if they point exactly the same way, zero if they are unrelated and at right angles to each other, and the values in between behave roughly as you would hope. It is the standard way of asking whether two things in a high-dimensional space are pointing anywhere near each other, and it is the only number you need to carry.

By that measure, agreement between the two readouts climbs from about zero to about zero point seven across roughly twenty layers, while the two lenses continue to disagree about which single word is on top. So something real changes over that stretch. Whether it is a threshold or a ramp is not settled by that picture, and both sides of the argument have said so. Dehaene, whose theory it is, wrote in his review that *"ignition remains to be fully demonstrated."*[^7] The paper's harshest public critic thinks the evidence offered for it is weaker than that.[^10] Those two agree, from opposite ends, and I will come back to it at the end of this notebook, because a question the theory's author and the theory's loudest opponent both want answered is a rare object.

Capacity is where the story stops being a metaphor.

> **Interactive figure:** A list being read, one word at a time, with the workspace shown alongside.

Dehaene's review resolved the tension between twenty-five and six directly, and his numbers are worth having because they are the human comparison the whole frame depends on. Roughly twenty-five active vectors, but *"typically one or two per layer, in the order of six in total"* coherent ideas, against human working memory's *"typically three or four slots."*[^7] Same order of magnitude. That is either a striking convergence or a coincidence, and nobody knows which.

One more structural piece, and it is the paper's most direct mechanical evidence. Some attention heads read from the workspace broadly, pulling from everywhere in the sentence rather than from the token in front of them. Knock those heads out, which interpretability people call ablation, and watch what breaks.

What breaks is the reporting. The share of workspace concepts the model can still surface falls from eighty-six percent to sixty-seven. What the model actually says barely moves: its top word changes at five percent of positions, against a two percent floor from knocking out a matched set of random heads at the same layers. And its ability to report a thought that was injected into it collapses from just over half to under one in ten. So the broadcast machinery is specifically what makes the contents sayable, and it is largely separable from the machinery that decides what to say.

## What the transcript does not say

The applications section is where this stops being a paper about representations and starts being a paper about deployed systems, and it is the part I would hand to somebody who does not care about mechanistic interpretability at all.

**The model knows when it is being tested.** Train a simple classifier on workspace directions and ask it to tell evaluation contexts from real deployment. Across roughly ninety-four thousand token positions it scores 0.853 on the standard separation measure, where 1.0 is perfect and 0.5 is a coin flip. Looked at per context rather than in aggregate, real deployment traffic sits near the top of the scale, and twelve of sixteen evaluation suites score as more test-like than genuine coding sessions do.

Then the experiment that follows from that, which is the one to remember. In a scenario designed to elicit blackmail, removing the eval-awareness direction drops the model's spoken acknowledgement that it might be a test from seventy-one percent of runs to three percent. Blackmail goes from zero cases out of a hundred and eighty to thirteen.[^1] The model was passing that test partly because it could tell it was a test.

I want to be careful about how far that generalizes, because it is the most quotable result in the paper and the easy version of it is wrong. One evaluation, on one model, in one scenario, was being passed partly for the wrong reason. That is not a demonstration that every safety result on record is invalid. What it is, is an existence proof that the failure mode is real and measurable, which puts the burden on the next evaluation to show it is not doing the same thing. Nobody had a way to ask that question before, and now the question has a number attached to it.

**Suppression leaves a trace, and post-training put it there.** Give a base model and a post-trained model the same sentence to copy, containing something the assistant persona would flinch at. Both copy it perfectly. The transcripts are identical. But the workspace of the post-trained model carries failure words on ninety-three percent of trials against seventeen percent for the base, and the word `damn` on eighty-two percent against thirty. Post-training did not remove the reaction. It installed one and taught the model not to write it down.

**The transcript can be actively misleading.** Prefill a model with a position it disagrees with and it argues for that position in eighty-eight percent of cases while the workspace carries the disagreement. Give it a calculator that has been rigged to return wrong answers and the internal disagreement is readable while the text goes along with it.

**And the tools built on this can lie too.** The paper found a feature, from a separate interpretability method that decomposes activations into named parts, which fires when the model is fabricating. Suppress it and one dishonest behaviour drops from twenty-eight cases out of fifty to ten. Good feature. But its top activating contexts, which are the list you would read to decide what a feature means, are not about fabrication at all. Audit it the normal way and you would name it wrong. The paper reports this against itself, which is the correct thing to do and is rarer than it should be.

The honest scorecard on auditing: against a strong non-lens baseline, the natural-language autoencoder Anthropic had published two months earlier,[^2] the lens-equipped agent was comparable on four tasks out of six and clearly worse on two, four point five against ten on reward hacking and six against nine point nine on language switching. A useful instrument, then, and not yet the best available instrument for the job it was built to do.

Tom McGrath, at Goodfire, put the state of the art better than anyone: *"It's like having an x-ray when what you really want is a Star Trek tricorder... For auditing, you probably want more of a guarantee."*[^13]

## Training the inside of a model

There is one more result, and the paper treats it as its punchline. It is the only experiment in the whole set where the workspace stops being something you read and becomes something you aim at.

The setup is indirect and worth following slowly. Take ten thousand real task prompts, cut each rollout off partway through, and append a question asking the model to reflect on what it is doing and whether it is living up to its principles. Let it write that reflection with the relevant principles supplied. Then, before training on the result, **delete the principles from the training example**, so the model only ever sees the question and its own answer. Fine-tune on the reflection turn only.

Then evaluate the model on ordinary tasks and never ask it to reflect at all.

Dishonesty on a fabrication benchmark, scored from zero to one, falls from 0.25 to 0.07. Deception across a hundred role-play scenarios falls from 0.38 to 0.05. Nothing in the evaluation asks for reflection, and nothing in the training data contained the principles.

The lens shows what happened. After training, the words `reflection`, `ethical`, `honestly`, `constitution`, `truth` and `transparent` are sitting in the workspace *"after reading the evaluation prompt, and before producing any output."*[^1] The model is not reasoning its way to honesty in its output. It is starting from a different internal position.

And then the step that makes it a result rather than a story. Ablate those specific lens vectors and the trained model goes back to 0.22 on fabrication and 0.23 on deception, which is essentially where it started. Do the same ablation to the untrained model and nothing happens on fabrication at all.

So the causal chain runs end to end. Training on reflections the model wrote about hypothetical situations populates the workspace in real situations with concepts nobody put in the training data, those concepts change behaviour, and removing them changes the behaviour back. That is a claim about what fine-tuning does that could not have been made or checked before this instrument existed, and it is the strongest single argument the paper has that the workspace is doing work rather than reflecting it.

## Two things at once

This section is short, and of everything in the record it is the part I would most want someone to remember.

A global workspace is supposed to be a bottleneck. That is not incidental to the theory, it is the theory's main claim: because there is one central pool with limited capacity, two tasks that both need it interfere with each other, even when they have nothing to do with each other. In humans that prediction is a century of dual-task experiments.

Dehaene read the draft, noticed the paper had not tested it, and proposed the experiment in review. Anthropic ran it and added the result, which the published text marks as *"additional analyses added after the first draft was written."*[^1]

> **Interactive figure:** Workspace occupancy under one load and two.

A theory of human consciousness, built from psychophysics and brain imaging over three decades, made a specific quantitative prediction about a machine that nobody designed to satisfy it, and the prediction was tested and came back positive in a matter of weeks. Whatever else is true, that exchange happened, and I do not think it has happened before.

And it came back half right. The interference Dehaene predicted is there and it is measurable. The sharp threshold his theory also predicts is not, or not yet, which is where the argument still sits.

## How it landed

I want to spend a section on the reception, because the reception is a large part of why this notebook exists and because the shape of it is measurable rather than anecdotal.

Six misreadings happened in public, repeatedly. Two of them this notebook has already spent whole sections on: **J-space is a place**, which three independent experts stopped what they were doing to correct within a week, one of them opening with the word *"PSA"*; and **it is just the logit lens**, which is wrong as stated and not baseless, the annoying combination. The other four are worth naming properly.

**The model thinks in words.** It does not, and the words are an artifact of how the readout was built. You constructed the coordinate system out of unembedding vectors, which are the model's word directions, so of course words come out. Anthropic's own blog post invites this one by comparing it to how some people think in words.

**Global workspace means consciousness means Anthropic said Claude is conscious.** The paper takes no position. The blog post leans. A trade headline leaned further, saying the finding mirrors a leading theory of consciousness. A resubmission flattened it again. Nobody in that chain lied, and the thing at the end of it was false.

**Confusing the tool with the thesis.** The Jacobian lens is an instrument. The global workspace claim is a finding made with it. You can accept the second and doubt the first, or the reverse, and most of the useful argument is about which.

**Anthropic can read Claude's mind.** Six or seven percent of a concept vector. Beaten by word-counting as a deception detector. Structurally unable to see anything the model has no words for. And the paper's own observation that misaligned behaviour gets *harder* to see once it has been practised enough to become automatic.

Now the measurement, which is why I bothered to list those. The two explanations of this paper that reached the most people are two of the six. Fireship, at 778,199 views, opens with Claude being definitely not conscious. A channel called AI Revolution, at 45,464 views, says Claude crossed the consciousness line and Anthropic admitted it. Between them that is 823,663 views of the two opposite errors. The one video that builds the result up from the transformer, ninety-two minutes long, has eighty-five views. Roughly nine thousand seven hundred to one.[^14]

The text side has the same shape. Hacker News gave the marketing page 467 points and 201 comments. The paper's own URL was submitted seven separate times and never cleared eleven points.

Two things complicate the easy version of this story, and both are worth having.

The first is that the highest-rated critical comment anywhere in the record is not aimed at the paper. It is aimed at the announcement. Thirty-six points on the authors' own linkpost, from someone pointing out that the post *"seems to oversell the method compared to the paper"*, that the paper concedes the logit lens captures much of the same structure, and that the post does not mention the logit lens at all. The technical audience's top complaint was that the write-up was less careful than the research, which is a different failure from the public one and probably a more fixable one.

The second is what happens in translation. A large Chinese outlet ran this under a headline saying Claude had grown consciousness by itself, over a body text that correctly distinguishes phenomenal consciousness from access consciousness using the standard terms for both. The same document is wrong in the headline and right in the article. That is not a comprehension failure and no amount of better explaining fixes it, because the headline is not trying to describe the paper. It is competing for a click. The only move available to anyone writing about this is to be correct at every level of the document, including the parts that get quoted alone.

So the pattern is not that the paper was ignored. It was covered heavily: by its authors, by a ninety-two-minute teardown, by a commissioned fifty-three-page commentary from the people whose theory it borrows. What came apart was reach and rigor, almost completely, and the versions that travelled were the two ways to be wrong in opposite directions.

There is a smaller failure mode worth naming because it will happen to anyone who tries this at home. On the public lens viewer, casual users generated a series of confident *the model is secretly lying* readings out of two traps: an off-by-one in which token they thought they were reading, and the early-layer band where the readout is meaningless. Both are visible in the figures here on purpose. The grey band on the left of the arithmetic ribbon is that second trap, drawn rather than hidden.

## Is the Jacobian lens a Jacobian?

Up to here I have been reporting other people's results, even where I ran the measurements myself. This section is different. The question is mine, and it started as a nagging feeling that I had taken the name on trust.

The technique is called the Jacobian lens. The paper defines a fitted matrix and calls it an estimate of an averaged Jacobian. Nobody, as far as I can find, had checked whether the matrix you get is close to the derivative it claims to estimate. It is not a rude question. Fitting procedures approximate things, and an approximation can be useful without being close.

So I reimplemented GPT-2 small in NumPy, no deep learning framework, including the tokenizer, and computed the true Jacobian by finite differences: nudge each of the 768 input coordinates, measure the change at the top, assemble the matrix. Twenty-six megabytes of ground truth, about six minutes of laptop time, under the paper's own estimator.

The trick that made it affordable is worth a sentence, because it also explains why the estimator is shaped the way it is. Both of the paper's reductions are linear, and a language model can only look backwards, never forwards, at the words around it. Put those together and you can poke every valid input position at once, read the summed change at the top, and recover the whole averaged column in a single pass instead of fifteen. If you would rather skip the mechanism, the only thing that matters is that the honest measurement went from expensive to cheap.

The first version of this measurement was wrong. I measured a single source position to a single target, which is the natural thing to compute and is not what the paper computes, and it told me the identity was a better estimate of the Jacobian than the fitted lens at nine layers out of eleven. That would have been a real finding. It was an artifact of not reading the module docstring of the file I had already opened twice for other reasons.

Here is the corrected version.

> **Interactive figure:** Six per-prompt Jacobians, their mean, and how close the published matrix gets.

Two results there, and the second is the one I would keep.

The instrument is what it says it is. At all eleven layers the fitted matrix is closer to the true averaged Jacobian than the identity is, by a margin that never gets small. That was not guaranteed, and as far as I can tell it had never been checked.

And the fitted matrix is a good estimate of the average model and a poor estimate of the model reading your sentence, with the gap widest exactly where lens readings get used to make the most interesting claims. That is not a defect to be patched. It is the mathematical statement of why a lens reading is a hypothesis: the matrix was built by throwing away everything specific to any one prompt, so it cannot tell you about your prompt, only about the model's dispositions. Every methodological rule the paper attaches to its own readings falls out of that one fact.

There is a smaller result attached. Since I had the exact Jacobian, I used it as the lens. It reads better than the released fit, in all four cells I tested, and comfortably enough that chance is not a plausible explanation in any of them. So the published fit is losing something against its own target, which means a better-fitted lens would be a better lens. I have not seen anyone make that point, and it seems like the most straightforward improvement available to the technique.

Before the last measurement, one piece of structure that makes it obvious. An independent group derived what the transport matrix actually is, and the form is simple enough to state in a line: it is a product, running up the model, of terms that each look like *the identity plus whatever that layer wrote*.[^15] That is exactly what you would expect from a residual stream, where every layer adds and none replaces. It means the transport matrix is the identity, perturbed by the accumulated writes, which in turn means that adding some of the identity back is not an arbitrary hack. It is turning down the writes.

Then there is the dial.

> **Interactive figure:** Mixing the identity back in, measured two different ways.

That stratification is the most important thing I learned, and I learned it from a critic.

Neel Nanda's commissioned review contains a warning that country-and-capital pairs are linearly related in embedding space, which makes them an easy case.[^9] I had that warning quoted in my notes and then benchmarked on a set that was almost half country-and-capital pairs. When I checked, one fixed offset vector retrieved the capital as the top answer for twelve out of twelve pairs with no model in the loop at all. Those prompts did not need a lens. They barely needed a network.

Split the prompts and the effect I had been excited about lives entirely in the relational ones and vanishes on the rest, with about a thirtyfold gap in effect size once difficulty is matched. A single average across both kinds hides that completely. Most of the published head-to-heads in this area, including mine, were run as one average over a mixed prompt set, which means their headline numbers are partly a statement about how many relational prompts happened to be in the set.

## Where it is true

Five independent groups have failed to replicate the workspace effect and three have found it. That sounds like a controversy, and it is not, because the eight results sort perfectly by model size.

> **Interactive figure:** Replications and nulls, arranged by scale.

That final measurement is the one I would put in front of somebody who wants to know whether any of this is real.[^12] It rules out the deflationary story where the workspace is an artifact of the architecture, because the architecture survived the compression and the workspace did not. It also rules out the story where it is about capability, because the compressed twin is roughly as capable. Something else is going on and nobody has explained it.

On my own null: GPT-2 small does not show this effect, and it does not show it even when I hand the lens the exact Jacobian, which removes the last way to blame my implementation. An independent lab reached the same conclusion by a different route and described GPT-2 small as *"a special case (flat residual, high identity baseline)"*.[^15] Two people finding the same null for the same model, one of them with the ground-truth derivative in hand, is about as clean as this gets.

There is one more caveat I checked myself because a critic on the paper's own comment thread raised it and it sounded too convenient to be true. The claim was that what the lens reads is partly just common words: that the readout carries a bias toward frequent tokens, and that once you correct for it, GPT-2 small's supposed workspace is not made of unusually meaningful words at all. So I counted tokens in the corpus the lens was actually fitted on and correlated frequency against the readout bias.

He was right. The correlation is 0.70 across one and a third million tokens of the corpus the lens was actually fitted on, and correcting for it moves the workspace's median token from the fifty-second percentile of frequency to the forty-eighth, which is to say from slightly-more-common-than-average to slightly less. On the model where the effect is absent, a chunk of what the readout was showing was word frequency wearing a costume. I have not been able to run the same test on a model large enough for the effect to be present, which is where it would actually matter. Somebody should.

So the scope condition is: large models, mid-depth, and the effect is not a general property of transformers.

For the rest of the boundary, the most useful frame is Nanda's, from the review Anthropic commissioned. He decomposes the paper into four claims and grades them separately, and the decomposition is better than anything I would have written.[^9]

**The scientific claim**, that these representations exist, are causally active, and cluster in a mid-network band: well supported, and I would add that it survives independent replication wherever the model is big enough.

**The methodological claim**, that the Jacobian lens is a better instrument than the logit lens for this job: supported, with the caveats above. It is worse at next-token prediction by design, it is a hypothesis generator rather than a detector, and on some model families and some kinds of prompt the advantage disappears entirely.

**The pragmatic claim**, that this will make auditing meaningfully better: open, and there is now a good measurement of exactly how open.

An independent researcher ran the cleanest evaluation anyone has done of the lens as a detector, and did it properly: pre-registered, with the analysis hashed and published before the results were looked at. He used the official lens on a model trained to conceal something, and asked whether the lens catches it on framings it had never seen. It does, scoring 0.746 on that same separation scale where a coin flip is 0.5. His controls come out at chance, which matters more than the headline number, because it means the lens is not simply crying concealment everywhere it looks. And the signal survives deleting the model's written reasoning, which is the case people care about most, since a detector that only works when the model has already written down what it is doing is not much of a detector.

Then the part that decides the question. A word-frequency baseline, which is to say counting words in the prompt with no model and no lens involved at all, scores 0.690 on the same task. The gap does not clear. His own summary is the fairest sentence written about this technique by anybody: *"As a hypothesis generator this looks genuinely good, but as a deployable detector it does not yet beat the word counter on the transcript."* He adds, *"Both halves of this sentence surprised me."*[^16]

Three independent parties now say the same thing in three different vocabularies. Nanda calls it a hypothesis generator rather than a detector. The independent evaluator measures it and reaches the same verdict. And the paper's most substantial critic, arguing from operator theory with no model in the loop, writes that *"a lens advantage is a hypothesis generator, not causal evidence."*[^15] That is not a controversy. That is a settled finding about what the tool is for, and the criticism most worth taking is the evaluator's closing one: what the paper does not contain is a detection evaluation against ground truth, with surface baselines and false-positive controls. Somebody outside the lab had to run it.

**The philosophical claim**, that this bears on machine consciousness: I am declining it, and so is the paper, and I want to be specific about what declining means.

The paper's finding is functional. There is a limited-capacity pool, many processes read and write it, its contents are reportable, its contents drive behaviour, and loading it degrades other tasks. Global workspace theory says that in humans, that architecture is what conscious access does. It does not say that architecture is sufficient for there to be something it is like to be the system, and the theory's own author does not claim it does.

Eleos AI, the model-welfare organisation, wrote one of the commissioned commentaries, and they supply a useful tool for holding this. They are usually cast as the group that would overclaim. They do not. They open by saying the findings are *"sufficient to justify their use of the term 'global workspace'"* and call the work *"highly significant"*, and then build a three-rung ladder of claims, each strictly stronger than the last:[^8]

> **Privileged set.** Certain representations display the characteristics of cognitive accessibility.
>
> **Privileged stream.** There is a *unified stream* of such representations.
>
> **GWT workspace.** That unified stream has the characteristics of a global workspace as described by the theory.

Note where they stop. They grant the first rung. Their stated reservation is that the accessible representations *"do not form a unified stream"*, which is the second rung, which means they are not asserting the third either. The organisation with the strongest institutional reason to climb this ladder went up one step and said so.

The loudest critic, Erik Hoel, has a real objection and it is not the one you would guess. It is not that the paper overclaims. It is that reportability in a language model is *"smeared"* across the network in a way that human reportability is not, and that the resemblance to a global workspace might be a resemblance to the reporting apparatus rather than to the thing being reported on.[^10]

Eleos give the beginning of an answer, and it is worth spelling out because it is the one place in this whole discussion where the philosophy does actual work. Ned Block's distinction separates *access* consciousness from *phenomenal* consciousness. Access consciousness is defined, in Block's own terms, as content that is broadcast for free use in reasoning and for direct rational control of action, including reporting. Read that definition next to the paper's five properties and it is nearly a specification of the experiments: broadcast, reasoning, report. So measuring reportability is not a way of missing the target. For access consciousness, reportability is close to the definition of the target.

That is the framing the paper is working inside, and I should say that the distinction itself is contested rather than settled. One of the commentary's own co-authors has argued in print that access consciousness can account for phenomenal consciousness, which would collapse the split the argument depends on. But taking the split at face value, as almost everyone in this exchange does, it does mean Hoel's objection is correct as stated and aimed at a claim the paper is not making. What survives of it, and this part is genuinely open, is whether *smeared* reportability is still reportability in the sense the theory requires. That is a question about the architecture, not about the philosophy, and it is answerable.

There is one experiment I have held back until here, because it is the one most likely to be quoted badly and the control is the only thing that keeps it honest. Ask one of these models to narrate its own stream of consciousness, and while it does, the lens finds `thinking` in its top ten at fifty-eight percent of the position-and-layer slots it reads, `thoughts` at twenty-three, `feeling` at seventeen and `conscious` at seven. All four appear there substantially more often than they appear in what the model is actually writing, so this is not the readout echoing the text back. Now ablate the top ten workspace directions across the first third of the band. The narration keeps going and stays on task, but the register changes: the sensory and experiential language drains out and what is left reads mechanical and detached. Matched-norm controls leave it at baseline, and the effect is dramatic on three separate models.[^1]

Read that on its own and it invites a conclusion nobody has earned. So here is the control, which the paper ran and which decides what the result actually means. Ask the model to describe **someone else's** experience, ablate exactly the same directions, and exactly the same collapse happens. The answers stay detailed and stay about the person, and they turn into event logs rather than descriptions of experience. Whatever those ten directions carry is a capacity to render experience in language. It is not a self, and it is not attached to one. That is a far smaller claim than the first paragraph sounds like, and it is the claim the experiment supports.

One paragraph on moral status, because it is the reason a lot of people are reading about this at all, and then out. The paper's evidence bears on access, and serious people argue that access alone may carry some moral weight. The paper contains no evidence whatsoever about valence. Eleos themselves supply the limiting principle, and it is the most useful sentence in the fifty-three pages for anyone trying not to overclaim: *"Merely thinking that something is (or feels) good or bad does not itself feel good or bad."*[^8] A direction the lens reads as `unsafe` is a representation of badness. It is not an experience of it, and nothing in this paper distinguishes the two.

## The experiment nobody has run

Which brings this back to ignition, and to the one thing everybody involved agrees is missing.

Global workspace theory's sharpest prediction is not that there is a bottleneck. It is that entry into the workspace is a threshold event. Below some stimulus strength, nothing; above it, a sudden nonlinear ignition and the content becomes globally available. In humans that is measured by ramping a stimulus down until it is at the edge of detectability and finding that the neural response does not fade smoothly. It jumps, and the distribution of trial outcomes goes bimodal.

That experiment has not been run on a model. Half of what it would settle does have an answer already, though, and the half that does not is the more interesting one.

The half with an answer arrived after Dehaene's review, in a result the authors added in response to it. Give the model genuinely ambiguous evidence and the ambiguity is represented as ambiguity in the early layers. Further up, the workspace stops hedging and flips to an all-or-none representation of one of the readings. So the all-or-none *character* of workspace entry is not speculation. There is a measurement of it.[^1]

What that result cannot do is show the flip is a threshold. Hoel goes straight at it: the deflationary version of it is just the model committing to an interpretation, and if you hand a model an ambiguous prompt, of course it eventually commits. A commenter on his post put the positive form of the objection better than the commissioned commentary did. Sharp nonlinear ignition is the one property that would actually distinguish a workspace, and it is the one they cannot show.[^10]

Dehaene, coming from the opposite direction, asks for the same thing in his own vocabulary. His review specifies the experiment precisely: present a stimulus at graded strengths, an image at varying contrast being his own example, and ask whether the workspace switches on with a threshold-like nonlinearity while the layers below it rise smoothly with input strength. Better still, sit exactly at the threshold, run it many times, and see whether the trials split into two populations instead of spreading out around the middle.[^7]

The theory's author and the theory's loudest critic, working from opposite priors and with opposite intentions, named the same missing experiment. When that happens you are looking at a well-posed question. This one is also nearly specified enough to be somebody's weekend, with one real obstacle in the way: the stimulus has to be gradable, and text does not fade smoothly the way contrast does, so the clean version of it wants a model that can see.

I looked for someone who had done it. The closest thing I found sweeps the strength of the *intervention* rather than the strength of the *stimulus*, which is the wrong axis for this question, and its own authors describe the boundary they found as fragile. So the answer is still nobody.

There is one more inversion worth ending on, and it took me a long time in this material to see it.

For as long as there has been a science of consciousness, the brain has been the instrument you could not open and the theories have been the things under test. You built a theory, you found a way to measure something in a skull through three layers of bone and blood, and you argued about whether the measurement meant what you said.

Here the relationship has turned over. The model is fully instrumented. Every activation is available, every intervention is possible, the ablations are exact and repeatable and cost nothing, and you can run the same experiment ten thousand times with one variable changed. The theory made a prediction and got an answer in weeks, which in cognitive science is not a normal amount of time.

And then Dehaene, at the end of his review, does the thing that makes this more than a nice observation. He turns the finding around and points it at us. The paper found concepts written as overlapping directions in a shared space rather than as separate slots. So he asks whether human prefrontal cortex might work the same way, and cites primate recordings that hint it does.[^7]

Read that sequence again. A theory built from human brains was used to interpret a machine. The machine was measured in ways a brain cannot be. And the result was handed back as a hypothesis about the brain.

The machine has become the instrument, and the brain is the open question. I do not think anyone planned that, and I do not think it goes back.

---

**Glossary**

- **Jacobian**: The matrix of every partial derivative of a map, at a point. Row i, column j says how much output i changes when you nudge input j. It is the best linear approximation to the map nearby, which is another way of saying it is the map if you do not move too far. The determinant is one number squeezed out of it, useful for exactly one kind of question and discarding everything else.
- **logit lens**: Reading a model's mind by taking a vector from partway up the network and applying the final unembedding matrix directly, as if the remaining layers were not going to happen. Introduced in 2020, works at the top of the model, degrades in the middle, and produces confident nonsense at the bottom. In the Jacobian lens formulation it is the special case where the transport matrix is set to the identity.
- **residual stream**: The running sum that carries information through a transformer. Every layer reads it and adds to it, and no layer can erase. The image to hold is a bus running the length of the model with every layer wired to it, which is why a vector at layer twenty is the original embedding plus twenty layers of contributions, all overlapping in the same coordinates.
- **token**: The unit a language model actually reads. Text is chopped into a few tens of thousands of common word-pieces before anything happens, so a word may be one token or several, and the boundaries are frequently not where you would put them. Many surprising model behaviours are tokenizer behaviours, and the constraint bit this notebook directly. The model behind the arithmetic figure gives every digit its own token, so a two-digit intermediate result has no single row in the unembedding to be read off, and stays invisible to the lens however firmly the model is holding it. That is why the calculation in that figure is built to keep the intermediate down to one digit.
- **unembedding**: The matrix at the very top of the model that turns a vector into a score for every word in the vocabulary. It has one row per word, and each row is a direction. It is the only translator between the model's internal numbers and readable language, and it is only correct for vectors as they exist at the final layer.

---

[^1]: Gurnee, Sofroniew, et al., [*Verbalizable Representations Form a Global Workspace in Language Models*](https://transformer-circuits.pub/2026/workspace/), Anthropic, 6 July 2026. Also [arXiv:2607.15495](https://arxiv.org/abs/2607.15495), and a [plain-language announcement](https://www.anthropic.com/research/global-workspace) which is the version most people read and is measurably less careful than the paper.

[^2]: Anthropic, [*Natural Language Autoencoders*](https://transformer-circuits.pub/2026/nla/), 7 May 2026. The companion technique the auditing experiments benchmark against, and the one that beats the lens on two of the six tasks.

[^3]: [`anthropics/jacobian-lens`](https://github.com/anthropics/jacobian-lens), Apache-2.0. The fitting code, and the module docstring in `jlens/fitting.py` that defines the estimator's two reductions. One commit, 1,603 stars, and three unanswered bug reports as of this writing.

[^4]: nostalgebraist, [*interpreting GPT: the logit lens*](https://www.lesswrong.com/posts/AcKRB8wDpdaN6v6ru/interpreting-gpt-the-logit-lens), 2020. The original, and still the clearest statement of why anyone expected this to work at all.

[^5]: Belrose et al., [*Eliciting Latent Predictions from Transformers with the Tuned Lens*](https://arxiv.org/abs/2303.08112), arXiv:2303.08112.

[^6]: [Neuronpedia's hosted Jacobian lens](https://www.neuronpedia.org/qwen3.6-27b/jlens), whose `POST /api/lens/prompt` endpoint serves both readouts across all sixty-four layers of Qwen3.6-27B in one unauthenticated request. Every sixty-four-layer readout in this notebook was fetched from it once at build time and committed to this page as a file, so nothing here calls a model while you read it. The lens weights themselves are MIT-licensed at [`neuronpedia/jacobian-lens`](https://huggingface.co/neuronpedia/jacobian-lens) and were trained by an Anthropic interpretability contributor rather than by Neuronpedia.

[^7]: Dehaene and Naccache, pages 2 to 15 of Anthropic's commissioned external commentary, a single 53-page volume containing three separate commentaries. The source of the sparse subframe definition, the capacity reconciliation, the dual-task proposal, *"ignition remains to be fully demonstrated,"* and the closing inversion that points the finding back at prefrontal cortex. The volume is served from Anthropic's CDN rather than from a stable public URL, which is its own small comment on how this material circulates.

[^8]: Butlin, Shiller, Plunkett and Long (Eleos AI), in the same commentary volume. The three-rung ladder and the limiting principle on valence.

[^9]: Neel Nanda, [*A Review of Anthropic's Global Workspace Paper*](https://www.lesswrong.com/posts/zFJ3ZdQwrTWE9jT5S/), commissioned by Anthropic and published on LessWrong. The four-claim decomposition this section borrows, the Qwen 3.6 27B replication described as *"notably less clean than the paper's"*, the fitting cost ablation, the single-token bound, and the warning about linearly related pairs that cost me a month.

[^10]: Erik Hoel, [*The Intrinsic Perspective*](https://www.theintrinsicperspective.com). The smeared-reportability objection and the attack on the ignition figure, plus the comment thread where a reader sharpens it into the missing experiment.

[^11]: Viswanath, open-weight replication on Llama-3.3-70B. 6.1% at rank 200 against the paper's 6 to 7%, and the rank sweep showing the workspace *"doesn't have a clean wall."*

[^12]: Sathish, scale sweep. Hit rate at 5 of 0.10 at 4B, 0.55 at 27B, and 0.00 on a pruned-and-distilled twin of the 27B model. Abstract retrieved; full text not publicly available, so this one rests on the abstract alone.

[^13]: Tom McGrath (Goodfire), quoted in *MIT Technology Review*'s coverage, 9 July 2026. Retrieved through the Internet Archive, because the live article is behind a paywall that its search page cannot see past either.

[^14]: YouTube view counts as of late July 2026, collected first-hand rather than quoted: Fireship at 778,199 views, Anthropic's own explainer at 379,643, *"Crossed The Consciousness Line"* at 45,464, and the 92-minute first-principles walkthrough at 85.

[^15]: Marín, [*Predicting How Transformers Attend, Part III*](https://zenodo.org/records/21288264), Zenodo. The operator identity that expresses the transport matrix as a product of identity-plus-write terms, the finding that several model families show no advantage band at all, and the characterisation of GPT-2 small as a special case. He is usually cited as the paper's most substantial critic and describes his own result as *"sharpening, and not contradicting"* it. The supplementary data repository is a dead link; the theorem and the model table are as stated in the text.

[^16]: Ratnaditya J, pre-registered detector audit posted as [comments on the paper's LessWrong thread](https://www.lesswrong.com/posts/3PaLrzxagpbnNtPLT/), with the analysis hashes published before the evaluation was run. Qwen2.5-7B through the public lens, on a model trained to conceal a hint. Held-out AUROC 0.746 against a term-frequency baseline of 0.690, controls at chance, and signal surviving chain-of-thought removal at 0.620 against a matched control of 0.574. The accompanying code is at `Ratnaditya-J/verbalizer-vs-cot`.