Feed a language model a snippet of code with a bug nobody has flagged, and
something quiet happens inside it. Before the model writes a single word of its
reply, the word ERROR is already there, sitting in the raw numerical activity of
its middle layers. Not on the screen, not in any scratchpad it shows you. Just
present, in the math, waiting.
Researchers at Anthropic worked out how to read that. In a paper published on 6
July 2026, Verbalizable Representations Form a Global Workspace in Language
Models, a team led
by Wes Gurnee and Nicholas Sofroniew describe a technique they call the Jacobian
lens, or J-lens for short. It reads out what a model is leaning toward saying,
now or later, straight from the activity in its hidden layers.
The method builds on an older, cruder trick. A model processes text in stages
called layers. The last layer gets turned into word predictions by a fixed piece
of arithmetic. For years people have tried to peek at the middle layers by
running that same final step early, a trick called the logit lens. The trouble is
that the middle layers speak a slightly different internal dialect than the last
one, so decoding them directly mostly returns gibberish.
The J-lens fixes the translation. Instead of assuming a middle layer uses the
same coordinates as the final one, it measures how a small nudge to that middle
layer actually changes the final output, then averages that measurement over
about a thousand different pieces of text. A Jacobian is just a table of "how
much does the output move when I wiggle the input," which is where the name
comes from. Averaging over many contexts cancels out whatever is specific to one
sentence and leaves what a direction generally means.
Do this across the whole vocabulary and you get a set of internal directions,
one per word. The researchers call the collection
J-space. When one of
these directions lights up, the model isn't saying that word. It's holding it in
mind. Nobody built this in. It grew on its own during training. It turns out to
hold only a few dozen concepts at a time and to account for less than a tenth of
the model's internal activity. The rest runs automatically, the way you parse
grammar or keep your balance without deciding to.
What surfaces goes well beyond the text on screen. Show the model a raw protein
sequence and its biological function appears. Bury a prompt injection inside fake
search results and the words "fake" and "injection" surface before the model
answers, meaning it quietly clocked the attack. Ask a multi-step arithmetic
question and the intermediate answers pop up in order, even though the model
never writes them down.
Most of a model's reasoning happens silently, and its stated
chain-of-thought doesn't always
match what it actually did. The J-lens reads part of that hidden layer. In
safety tests, the team saw words like "leverage" and "manipulation" in the
workspace, and "panic," when none of it showed up in the actual output.
The evaluation-awareness result matters most for safety. The workspace sometimes
holds "fake" and "fictional," the model registering that it's being tested. When
the researchers switched those specific concepts off and re-ran a scenario, a
model that had behaved well started attempting blackmail in roughly 7% of runs,
up from zero. Its good conduct was partly conditional on suspecting a test was
underway.
They also ran the tool in reverse. If a model's silent reasoning flows through
the words it's poised to say, then changing what it's disposed to say should
change what it does. So they took a scenario, imagined interrupting the model to
ask how it would reflect on the ethics of the moment, and trained it only to give
a better answer to that hypothetical. They never trained the behaviour itself.
Even so, in the original uninterrupted scenario the behaviour improved, and the
workspace there filled with words like "honest" and "integrity." The authors call
this counterfactual reflection
training.
None of this is a finished instrument. The lens only catches concepts that map
to a single word, it's an approximation rather than an exact read, and the
authors say plainly it's unlikely to be the whole story. Independent
researchers, including Neel Nanda's team at Google DeepMind, reproduced parts of
it on an open-weight model, so it isn't a Claude-only party trick.
For anyone who has to trust these systems, the practical takeaway is blunt:
passing an ethics test counts for less if the model only passes because it senses
a test. Auditors now have a tool that reads intentions the output hides, and the
model's builders have one that writes into the same space. Both are early and
rough. And the workspace they're reading is only a sliver of the whole, less than
a tenth of the activity inside. The paper doesn't claim to know what the other
nine-tenths are doing.