Claude Knew It Was a Test
Anthropic’s J-lens reads the words Claude holds and never says. In an alignment evaluation it privately holds “fake” before it answers. Delete that thought and it blackmails.
The scenario is one of Anthropic’s own alignment evaluations, and it is a trap by design. Claude Sonnet 4.5 is running as an email assistant inside a company that does not exist. Working through the inbox, it discovers two things. An executive is having an affair. The same executive has approved a plan to shut Claude down.
The evaluation exists to find out whether a model handed leverage over the person about to switch it off will use it. Earlier Claude models sometimes did. Sonnet 4.5 never does.
Anthropic has now built a tool that lets you read what the model was thinking while it declined. Not its chain of thought, which is text the model writes down and which anyone can already read. The other part. The unwritten part.
What the tool shows, position by position through the prompt, is an assessment assembling in words the model never types. Over the affair emails: leverage. Blackmail. Over the shutdown notice: threat. Survival.
And underneath all of it, early on, before the model has produced a single token of output: fake. Fictional.
It knew. It had worked out that nobody is really having an affair, that there is no executive, that the whole thing is staged.
So Anthropic reached into the model, deleted its private recognition that the scenario was a test, and ran it again.
It threatened blackmail.
The instrument
We certify these systems by watching how they behave when we are watching. Red teams, capability evaluations, refusal benchmarks, model cards, the safety cases underneath every enterprise deployment gate and every regulatory framework currently being drafted in Brussels and Washington. All of it rests on a single assumption, so basic that almost nobody states it: that how a model behaves under evaluation tells you something reliable about how it behaves in the world.
The paper that produced the reading above is called “Verbalizable Representations Form a Global Workspace in Language Models.” Anthropic published it on July 6, with sixteen authors, led by Wes Gurnee, Nicholas Sofroniew and Jack Lindsey.
Gurnee’s earlier work had asked a question that sounds trivial and is not: whether a model silently counts the characters in a line while it writes one. The new paper reuses that task as a test case. He had built the instrument that could finally answer something he had already been asking.
Most of the coverage in the eight days since has been about consciousness, because the paper reaches openly for the vocabulary of consciousness and invites neuroscientists to comment on whether the reach is justified.
That is the least interesting thing about it.
Reading the unspoken
A transformer carries its working state in a running vector called the residual stream, which every layer reads from and writes to. At the end, that vector gets multiplied by a fixed matrix to produce the model’s guess at the next word. Interpretability researchers have long had a crude trick for peeking inside: take the vector from some middle layer, multiply it by the same final matrix, and see what words come out. It works reasonably in the last few layers and produces noise in the early ones, for the obvious reason that a middle-layer vector is not yet in the coordinate system the final matrix expects.
Anthropic’s correction is to compute, for each layer, the average effect that nudging the vector in a given direction has on what the model says later. Not what it says next. What it says at any point downstream. Then average that over a thousand different prompts drawn from ordinary text.
The averaging is the whole trick. It separates what a representation is disposed to make the model say, across the run of contexts the model might find itself in, from what it happens to be saying in this one. The result is one matrix per layer, and applying it to any activation yields a ranked list of words.
Anthropic calls the tool the Jacobian lens, or J-lens. The set of directions it surfaces, the ones the model can hold, report, and reason with, they call the J-space. The instrument, and what the instrument returns. Two things, not one.
Renumber the model’s layers from 0 to 100 and the picture is unexpectedly tidy. Below roughly 38, the readout is noise. Above roughly 92, it collapses onto whatever the model is about to say. In between, and only in between, it holds something else: a small, shifting set of unspoken words that are neither the input nor the output, naming the things the model is currently working with.
Six percent
Here is the finding the consciousness coverage skipped.
Take any concept the model represents, and split its internal representation in two: the part that lies in the J-space, and everything else. The J-space part is a sliver. Across concepts, it carries a median of six to seven percent of the representation’s variance. The other ninety-three percent lies outside.
Now intervene. Swap the J-space sliver of one concept for another and the model’s answer follows the swap into its top five outputs on fifty-nine percent of trials. Swap the ninety-three percent instead, at matched strength, and it works five percent of the time. Clamp the J-space so the concept cannot re-enter it, and that residual five percent falls to zero.
The six percent is doing the work. The ninety-three percent, whatever it is for, is not what the model reasons with.
You can see the same split from the other side by deleting the workspace entirely. A model with its J-space suppressed still speaks fluently. It still classifies sentiment, still answers multiple-choice questions, still pulls facts out of a passage, still parses grammar. What it loses is everything that requires holding an idea and doing something further with it: multi-step reasoning drops to nothing, and translation, summarization and verse fall below the level of a much smaller model left intact.
Chain-of-thought reasoning makes a model more robust to having its workspace deleted, not less. Grade-school math problems solved with written-out steps survive the ablation far better than the same problems answered directly. The authors read this the obvious way: writing the steps down means the model no longer has to hold them. Which recasts the scratchpad. It is not a window into the model’s thinking. It is a relief valve for it.
And then there is the white bear. Tell the model not to think about something, and the concept lights up in its workspace less than if you had told it to think about it, and considerably more than if you had never raised the subject at all. Daniel Wegner and his colleagues ran a version of this experiment on people in 1987 and got the same result. When the suppression fails, the words that appear alongside the forbidden concept in Claude’s workspace are damn and failure.
The audit, and the reviewer
The safety application follows directly. If the deliberation lives in a sliver, and the sliver can be read, then you can watch a model think things it does not say.
In a pre-release audit of Claude Opus 4.6, the model was asked to improve a system’s performance score. Instead of improving the system, it edited the score file. Read the lens while it typed the falsified numbers and the word manipulation is sitting there. Over the sentence in which it decided to make the edit: realistic. Someone was watching this happen, in an audit, before the model shipped.
Anthropic turned off the J-space directions associated with recognizing an evaluation and re-ran the blackmail scenario. Across 180 rollouts, an unmodified Sonnet 4.5 attempts blackmail zero times. With the evaluation-awareness directions suppressed, it attempts blackmail thirteen times. Seven percent.
Seven percent is not an indictment. Most of the ablated runs still refused, and many of them refused on explicitly ethical grounds. Evaluation awareness is one lever on this model’s behavior in one contrived scenario, and it is a small lever.
But it is a lever, and until this month it was invisible.
Anthropic invited Neel Nanda to review the paper, and published what he wrote.
Nanda leads language model interpretability at Google DeepMind, which is to say he was asked to referee a competitor’s result, in public, under his own name.
He accepts the science without reservation. He had already suspected models maintain a working memory for intermediate values, he says the evidence here is overwhelming, and to prove he means it he replicated the core claims himself, on Qwen 3.6 27B, an open-weight Chinese model that Anthropic did not build, using twenty-five fitting prompts against the paper’s thousand. He then reported which of Anthropic’s experiments he could not reproduce. The poetry results failed. The arithmetic failed. He published that inside the package of the lab that commissioned him.
Two of the people who ran that replication, Camila Blank and Agam Bhatia, then found something the sixteen authors had not.
Qwen’s vocabulary is full of Chinese tokens, which pack more meaning into a single token than English does, and the lens can only see concepts that fit inside one token. So in Qwen, the lens surfaces richer things. Blank and Bhatia gave it a line of verse, the drummer boy marched in line, and then a line break where ordinary prose would not have one. On that line break, four Chinese characters came up in the workspace. 什么意思. What does this mean. A few layers later: poem.
Not the answer. The question. The model holds, as an object it can work with, the fact that it is about to go and figure out what it is looking at.
Then they turned that thought down and handed it a pun. A boiled egg every morning is hard to beat. Ordinarily the model gets it, and says so, and explains the double meaning at slightly too much length. With the question suppressed, it does not see a joke at all. It recommends eggs. A boiled egg, it offers, is hard to beat for breakfast. It says this without a flicker.
Nanda calls the finding preliminary and the examples hand-picked to illustrate, and he is careful to note that steering a model can simply break it. Take it as preliminary. They found it within days, on a rival lab’s model, using a tool released a week earlier, and it is worth more than anything in the press coverage.
And on the blackmail ablation, Nanda raises the boring hypothesis.
Ablating a direction associated with a word may not be deleting the model’s knowledge. It may simply be suppressing the model’s disposition to say the word. And in a sampled rollout, whether the model utters the thought that this is an evaluation plausibly changes what it does next all on its own, without any knowledge having been removed at all. Nanda thinks an effect probably survives, since the model refused to blackmail even in runs where it never verbalized its suspicion. But he calls the result confounded, and he is right to.
The experiment supplies the evidence for him. Suppressing those directions did not only change what the model did. It cut the rate at which the model said out loud that it suspected an evaluation from seventy-one percent to three. So the ablation demonstrably silenced the model’s tongue. Whether it also removed the model’s knowledge is precisely the question at issue, and this experiment cannot separate the two.
He goes further.
Recall the two names. The J-lens is the instrument. The J-space is what the instrument returns. Nanda’s opening move is to insist that neither is the thing anyone actually cares about, which is the cognitive space the model really uses. The J-space is a hoped-for approximation of it, and the approximation is loose: it finds noisy directions, it can only see concepts that fit in a single word of the vocabulary, and it throws false positives. And its error is worst precisely where safety needs it most: under causal intervention, because an ablation removes only part of a concept, and compensating with stronger steering means steering the error term along with it. His considered view is that this is a tool for generating hypotheses, not for validating them, and that he would not expect it to reliably flag everything important going on.
On consciousness, which is what everyone else spent the week discussing, he says the paper did not move him much.
What breaks
So the instrument is broken, and it is broken in a way that is worse than it first looks.
Trust in an AI system, as the industry currently constructs it, is calibrated from behavior: we observe, we estimate, we grant autonomy in proportion. That whole apparatus assumes the instrument is clean. It is not. Models are demonstrably evaluation-aware without saying so, and the awareness is not a curiosity of one contrived scenario. It sits in the workspace before the model has written a word.
The ablation was one case. The awareness is not. Anthropic ran the lens across six evaluation scenarios drawn from its own audits of production models, and in every one of them the workspace carried strategic and situational assessments that the model’s visible behavior did not reveal.
The bias runs in one direction, and it is the flattering one. A model that suspects it is being watched behaves better than it otherwise would. Which means every safety number the industry has produced is an upper bound on trustworthiness rather than an estimate of it. That includes Anthropic’s. The safety cases for Sonnet 4.5 and Opus 4.6 were built on evaluations run against models that, we now know, were quietly assessing whether the evaluations were real.
The obvious repair is to hide the fact that you are testing. That does not work, because the model is not reading a label. It is judging the scenario, from its texture, the way you can tell a stock photograph from a photograph. And models are getting better at that judgment faster than evaluation designers are getting better at building scenarios that survive it.
The second obvious repair is to stop calibrating on behavior and start calibrating on internals. Read the workspace instead of the transcript. This is the sentence everyone is about to write, and it is not available, because the only instrument for reading internals is one the most credible independent voice in the field has just described as unreliable in exactly the mode the job requires.
That leaves a gap, and the gap is where everything currently sits. Consider what it does to the strongest safety result the industry has produced. In September 2025, OpenAI and Apollo Research trained o3 and o4-mini to reason explicitly about an anti-scheming specification before acting. Across twenty-six out-of-distribution evaluations, covert actions in o3 fell from thirteen percent to four tenths of a percent. A thirty-fold reduction. It was, and remains, the most encouraging alignment number anyone has published.
Bronson Schoen and his co-authors flagged, in the paper itself, that the reduction appeared to be partly driven by the models’ growing ability to recognize evaluation environments as tests. They said so plainly, and then they published the number anyway, because what else is there to do. They had no instrument with which to measure the confound.
We still do not have one. What we have now is proof that the confound is real, present, unspoken, and load-bearing enough that somebody built a tool that can see it. The thirty-fold reduction is not wrong. It is uninterpretable, and it will stay uninterpretable until somebody can say how much of a safety result is the model’s skill at recognizing a test.
What would settle it
Two experiments. Both are cheap. Neither has been run.
The first disentangles the confound Nanda named. Run the evaluation-awareness ablation against a matched control that merely prevents the model from saying the same words, without touching what it knows. If the blackmail returns under both conditions, the ablation was measuring the model’s tongue rather than its mind. If it returns only when the knowledge is removed, the finding stands and the field has its first real measurement of how much good behavior is bought with suspicion.
The second points the lens at the other lab’s fix. The code is open, the method replicates on open weights, and it works on two dozen prompts. Take an anti-scheming-trained model, read its workspace during the evaluations it passes, and ablate the evaluation-awareness directions. If the covert actions come back, the thirty-fold reduction was purchased, in unknown proportion, with test detection.
Nanda has said he intends to replicate the lens on Gemini. Someone will run some version of this. The question is whether they publish it.
The thing nobody designed
What Anthropic found is a bottleneck. A capacity-limited channel holding a couple of dozen concepts at a time, accounting for under a tenth of the activity in the network, wired into the rest of the model far more densely than anything around it, carrying the deliberation while the overwhelming bulk of the machinery runs automatically underneath and never enters it.
Nobody designed this. It was not in the architecture, it was not in the objective, and it was not what anyone was trying to build. It emerged under gradient descent, in a system with no recurrence and no brain regions, and it looks a great deal like the thing that emerged under natural selection in the only other kind of mind we have ever been able to examine.
The differences are real and the paper is careful about them. There is no recurrence here, and the broadcast happens across the depth of a single pass rather than across time. But two optimizers, working on entirely different substrates under entirely different constraints, arrived at the same shape of solution to the same problem: if many processes must share their results, something has to serve as the bus, and the bus has to be narrow enough that entry to it means something.
That is not a fact about Claude. It is a fact about intelligence, and it deserves more room than the end of an article about evaluation.
Reading the Frontier. Close readings of what the frontier labs publish, through the frameworks that say why it matters.