The Model’s Inner Stage: Global Workspace Inside Claude

Introduction

On July 6, 2026, Anthropic’s interpretability team published a paper called Verbalizable Representations Form a Global Workspace in Language Models (there is also a companion post for a less technical audience). The headline result was thatinside Claude, researchers found a small, privileged system of internal representations that behaves remarkably like a global workspace, a concept long used in cognitive science to describe conscious access in humans.

The authors named it the J-space, after Jacobi (as in the Jacobian matrix), and within a week the name had gone viral. Here is the short version. In the residual stream of a transformer — amongtens of thousands of features jumbled together in superposition — there is a smallsubsystem, accounting for just a few percent of the variance in theactivations, with the following properties:

• the model can say out loud what is in it;
• the model can deliberately control it to some degree;
• the intermediate steps of the model’s silent reasoning pass through it, reasoning that happens before anything is written down;
• its contents are reused flexibly by any downstream computation;
• and without it, the model loses flexible multi-step thinking while still being able to do “automatic” things: writing grammatical text, recalling facts, continuing familiar patterns.

This list reads suspiciously like a definition of Kahneman’s "System 2", which explains a good deal of the hype. But I think the paper matters even without the psychological connections. As far as I know, this is the first time interpretability research has moved from studying individual "neurons" and small circuits to a macroscopic functional analysis of what goes on inside a language model. And it did so with a tool simple enough that you can reproduce it on any open model.

In this post, we will actually reproduce it, building a J-lens by hand (well, with Claude Code, naturally) on Qwen2.5 and watching the word "France" surface in the middle of the network while the model answered a question about the capital of the country where the Eiffel Tower stands. It surfaces even when the question is asked in Russian, while the model actually turns out to be thinking about it in English and Chinese.

Here is the plan: first we will consider some context, on where interpretability stood before this and what a global workspace is in neuroscience; then the method itself; then the paper’s main results; then our own experiments; and finally applications to AI safety, a tour of the reactions, and the unavoidable conversation about consciousness.

Interpretability before the J-space

Mechanistic interpretability is the research program that tries to work out in detail what happens inside a neural network, to look inside the blackbox and understand by what internal mechanisms the network arrives at its answer.

The motivation is twofold. First, plain scientific curiosity: these are the first artificial systems in history with something resembling general intelligence, and it would be a shame not to look inside. Second—and for Anthropic this is clearly the main driver—it is a critical part of AI safety. If we can read a model’s internal states, we can notice that it is about to do something undesirable before it does it, and independently of what it writes in its output. Dario Amodei made the goal explicit in his essay titled The Urgency of Interpretability: build an “MRI for AI” before models become too capable.

Here is the road so far, very briefly.

Features and superposition. The naive idea that one neuron equals one concept died quickly: a typical neuron fires on dozens of unrelated stimuli. In 2022 Anthropic articulated the superposition hypothesis: a model stores far more features than it has dimensions, packing them in as nearly-orthogonal directions that overlap. Since there are more features than dimensions, one cannot simply read them off individual coordinates, and the interactions between them can become quite intricate.

‍Sparse autoencoders. Next, people started pulling features back out of superposition bytraining a sparse autoencoder (SAE) on top of the activations: it decomposeseach activation into a sparse sum of interpretable directions. First on a toy model, then on Claude 3 Sonnet, which produced the famous Golden Gate Claude, a model with the “Golden Gate Bridge" feature artificially amplified, which steered every conversation back to its beloved bridge. Any other feature could be controlled and cranked up or down in the same way.

‍Circuits and the “biology” of a model. In 2025, Anthropic continued with attribution graphs and the paper titled "On the Biology of a Large Language Model": they moved on from individual features to whole computational circuits. There, they traced how a model answering “the capital of the state containing Dallas” passes internally through "Texas" before producing "Austin" or how, when composing poetry, it plans the rhyme at the end of a line in advance and then generates a suitable beginning of the line.

Introspection. Finally, in late 2025 Jack Lindsey showed in "Emergent Introspective Awareness" that if you inject a concept into Claude’s activations (via activation steering), the model can, under the right conditions, honestly report: "I notice an injected thought about…". In other words, models have some functional access to their own internal states.

You can see the trajectory: features → circuits → planning → introspection. The new work takes the next step. It asks not "what features does a model extract" but "how is the whole thing organized". Is there an architecture at a higher level of description? This is the move from microscopy to systems neuroscience, from studying individual neural assemblies to asking where this brain keeps its cortex and where its cerebellum.

The global workspace: forty years of cognitive science

To understand the paper’s title we need to make a brief detour into cognitive science.

Baars’ theory. In 1988 Bernard Baars proposed the Global Workspace Theory (GWT), still arguably the leading functional theory of conscious access. Baars’ metaphor is a theater: hundreds of specialized processors run in parallel in the brain—vision, hearing, motor control, memory, syntax—each in its own dark corner ofthe auditorium, unconsciously. But there is a small stage under a spotlight,and information that makes it onto the stage is broadcast to all the processors at once. Conscious access means getting onto that stage, that is, winning a competition for a very limited shared channel.

Dehaene’s neuronal version. Stanislas Dehaene and Jean-Pierre Changeux turned the metaphor into a neurophysiological model, the global neuronal workspace: a distributed network of long-range neurons, mostly in prefrontal and parietal cortex, which shows a characteristic ignition when a stimulus becomes conscious: an abrupt, nonlinear, all-or-nothing transition into sustained global activation. Subliminal stimuli are processed locally and fade; supraliminal ones “ignite” the workspace and become available for report, voluntary control, and reasoning.

In this tradition, conscious access has a standard list of functional properties. Information in the workspace is:

• verbalizable — you can report it in words;
• ‍subject to voluntary control— you can hold it in mind, and try (with mixed success) to push it out;
• ‍the medium of sequential reasoning — step-by-step chains of thought run through it;
• flexibly reusable — the same content is available to any further operation: compare it, name it, count it, imagine it;
• selective — only a handful of items are conscious at any moment, while the overwhelming majority of processing stays unconscious and automatic.

An important caveat: all of this concerns what Ned Block called access consciousness, the functional availability of information for report and control. The question of phenomenal consciousness—whether there is something it is like to be the system, from the inside—is not settled here (though Dehaene tends to think it is, and philosophers, as usual, disagree).

Crossing GWT with neural networks is not a new idea, and some serious groups have dabbled in it:

• Van Rullen and Kanai (2021) proposed building AI architectures with an explicit workspace;
• Goyal, Bengio et al. (2021) experimented with a shared "bottleneck" for coordinating neural modules;
• in the well-known report by Butlin, Long et al. (2023) on consciousness in AI, GWT-derived indicators were central to the checklist of what to look for.

But in all of that ML work, the workspace was something you would design. The news in Anthropic’s paper is that in an ordinary transformer trained to predict the next token, a similar structure appears to emerge on its own.

The J-lens: how to read the residual stream

Now on to the method, which is extremely simple.

The residual stream. First, a quick refresher on how a transformer works inside. Each token, at each layer, is represented by a vector, that is, a list of a few thousand numbers (tens of thousands in the largest models). Every layer reads from that vector and writes its own corrections back into it: attention adds something, the MLP adds something. The vector is not replaced, only added to, which is why it is called the residual stream: a shared data bus through which the layers talk to each other. At the very end, the final vector is multiplied by the "unembedding" matrix, a lookup table with one row per vocabulary token, which converts it into scores for every possible next word.

All the features, circuits, and other interpretability findings live in that stream. The natural question is: can we read it at intermediate layers, before the model has finished thinking?

The logit lens. The oldest trick is the logit lens (nostalgebraist, 2020): take an intermediate vector and apply the final unembedding to it directly, pretending that the remaining layers do not exist. At late layers this works well, because the model has essentially formed its answer already. The earlier the layer, the worse it gets: intermediate representations are under no obligation to live in the same coordinate system as the final ones.

The tuned lens. The next idea, the tuned lens (Belrose et al., 2023), is to train a small correction for each layer, fitted so that the readout matches the model’s actual final distribution. It works better, but it has a conceptual flaw that the Anthropic paper puts as follows: the tuned lens skips ahead. Because it is trained to predict the output, it also learns to finish the model’s computation for it. Such a lens ultimately tries to answer what the model will end up saying, whereas what we want is what is written in the activations right now, at this specific layer.

The J-lens. Anthropic’s solution: do not train anything but rather ask the model itself how it uses a given layer on average.

Take the Jacobian, the matrix of derivatives of the final state with respect to the intermediate state. In plain terms, the Jacobian shows how does the network’s final state move if we shift this internal vector slightly in some direction? Then let's average that matrix over a large corpus of texts, over all source positions and all later positions. That is the whole method.

The result is a single square matrix per layer: an averaged linear portrait of everything the rest of the network does with that layer. In the paper, the average is taken over roughly a thousand pretraining-style texts.

Then you read the activations exactly as with the logit lens, except you first push them through that matrix:

This is the J-lens (Jacobian lens). In effect, we replace all layers after the current one with their averaged linear approximation, a kind of mean-field summary of the remaining computation. Unlike the tuned lens, nothing here is fitted to the final answer: the matrix is a property of the model itself, its average local response. If a concept is already written into the activations, the lens will see it; and there is nowhere for the lens to learn to do the model’s unfinished work for it.

What is especially interesting about this construction is that it works at all. A priori it is far from obvious that the context-averaged Jacobian of a deeply nonlinear function is a meaningful object. The fact that coherent concepts can be read through it tells us something in itself: the model uses its residual stream in a surprisingly linear and universal way. This is yet another piece of evidence for the linear representation hypothesis on which most of modern interpretability rests.

J-vectors and the J-space. Multiplying the unembedding matrix by the Jacobian, we get one row per vocabulary token. The row for token y is the J-vector of that token: a direction such that the dot product with the current activation measures how strongly the current state is, on average, pushing the model towards eventually saying y.

Note what this means by construction: every J-vector corresponds to a word. Verbalization is not an empirical finding here, it comes by definition, and the J-lens sees the part of the activations that can be expressed in words, in tokens that the model could emit.

The J-space is then the set of states that decompose into a sparse, non-negative combination of J-vectors, typically at most about 25 of them at a time, with the decomposition found by a greedy algorithm (gradient pursuit).

Note a subtlety that Lucius Bushnaq raised in a well-upvoted comment on LessWrong: despite the name, this is not a linear subspace. Requiring the coefficients to be non-negative and sparse makes it a union of pointed cones, one per choice of which J-vectors are active. Many readers came away thinking Anthropic had found a privileged linear subspace inside the residual stream, but the structure is different, and in Bushnaq’s view calling it a "space" was not the best choice. There are more J-vectors than dimensions, it is an overcomplete dictionary of directions, in the spirit of superposition, except obtained from the model itself, essentially for free, rather than by training a sparse autoencoder.

Reading and writing. The lens works in both directions:

• reading: decompose activations over J-vectors and look at the top concepts at each layer and position;
• steerimg: add a J-vector to the activations, amplifying that concept;
• ablating: zero out the projections onto J-vectors, effectively switching the workspace off;
• patching: move into lens coordinates, swap the coordinates of two concepts, and map back.

That last operation is the main trick for the illustrative examples in the paper. It lets you perform a swap such as "France ↔ China" directly in workspace coordinates while leaving everything else intact.

What they found: five properties of conscious access

The paper is structured as a systematic test: take the five functional properties of conscious access from neuroscience, and design an experiment for each on Claude. (Main results are on Sonnet 4.5, with corroboration on Haiku 4.5 and Opus 4.5/4.6.) Apologies for repeating the same image as above, but we are finally in a position to understand it more closely.

‍1. Verbal report. If you ask the model what it is "thinking about", its answer is predicted by the contents of the J-space and, crucially, controlled by them. Swap one concept’s J-vector for another in the activations, and the model reports the swapped concept: in 88% of cases the substituted concept lands in the top 5 of what it names.

If you split a concept vector into its J-space component and everything else, the J-space part carries only 6–7% of the variance, but swapping it changes the report 59% of the time, while swapping the other 93% of the variance does almost nothing (5%). For verbal report, what matters is precisely the small part of the state that lies in the J-space.

The introspection protocol from Lindsey’s earlier work fits here too, now with a better tool: inject a concept (say, "lightning") into the activations on the user’s tokens and ask whether the model notices an injected thought. It mostly answers "yes, something about lightning", and the injected representation influences the output only at the moment an introspective report is requested, not before and not after.

2. Voluntary control. This is the classic "don’t think of a white bear" story. Tell the model: "while you do this task, keep citrus fruits in mind". Sure enough, lemon and orange show up in the J-space throughout an entirely unrelated task, without the model ever writing them.

Ask it not to think about something and the concept is suppressed but not to zero, which is exactly Wegner’s white bear phenomenon, and models are as bad at it as we are. There is also an elegant paired protocol: same stimulus but with different questions. Ask "what part of speech is this?" and noun appears in the lens; give the same stimulus with an implicit task where the part of speech is needed but never asked about, and it does not appear even though the model answers correctly. The contents of the workspace depend on the task, not just on the input.

3. The medium of internal reasoning. Take a question with an unspoken intermediate step: “The number of legs on the animal that spins webs is…". The model answers "8" without ever saying "spider". The same happens, say, with rhyming:

But in the middle of the network the J-lens shows spider, and if you swap it for ant, the model answers "6". Likewise, if the planned rhyme fight is swapped for light, the whole line reorganizes around the new rhyme.

On two-hop factual questions, swapping the intermediate concept works 54%of the time on Haiku and around 70% on Sonnet and Opus. Moreover, swaps of the intermediate step take effect about 17% earlier in network depth than swaps of the answer: exactly as you would expect if the intermediate step is computed first.

4. Flexible reuse. The key workspace property in Baars’ account is broadcast: one piece of content is available to every consumer. With the models, you can test it too: let's perform the same "France → China" swap, with the same operation in the same coordinates, and see what happens to different tasks.

A single substitution coherently redirects a lot of different "functions" that take the concept as an argument. The main predictor of success is how strongly the argument was "loaded into the workspace" in the first place, measured as the cosine similarity between the activation and the J-vector. Countries swap very nicely while numbers do not, which suggests that numerical computation largely bypasses the J-space. (We will run into that limitation ourselves later.)

5. Selectivity. Finally, the property that makes the whole story non-trivial: the J-space is not needed for automatic processing. If you give model a Spanish passage and ask "what language is this?", swapping "Spanish → French" in the workspace breaks the answer nearly 100% of the time. But if you ask the model simply to continue the passage, the same swap does nothing at all: it keeps writing fluent Spanish as if nothing had happened.

It looks like continuing text is an automatic operation that does not need "conscious access", while explicitly answering a question about the language is a "conscious" one that runs through the J-space. Other questions requiring awareness of the language behave the same way.

Ablation tells the same story from the other side. If we cut out the J-space entirely, performance on multi-step reasoning falls from near-ceiling to near-zero: analogies, Caesar ciphers, translation, summarization, and sonnet writing all collapse. At the same time, multiple-choice answering on MMLU, extractive question answering on SQuAD, sentiment classification, and grammaticality judgments barely move.

There is an interesting related result about chain-of-thought: GSM8K with explicit reasoning written out is roughly three times more robust to ablation than trying to answer directly. The external chain of reasoning partially compensates for the excised internal workspace, much as a notepad compensates for impaired working memory.

Note that the J-space itself is small: at any moment roughly 10 to 25 J-vectors are strongly active, and the whole thing accounts for less than 10% of the variance in the activations. That also matches GWT: the stage is supposed to be cramped.

The anatomy: sensory cortex, workspace, motor cortex

The second half of the paper is about where all this happens. It turns out the J-lens reads very unevenly across the depth of the network, and the network has three distinct zones:

• the "sensory" zone (roughly the first third): the J-lens returns garbage, the readout distribution is flat without meaningful concepts; here the network is doing low-level processing of the input that has not yet been translated into the language of the vocabulary;
• the workspace proper (roughly layers 38 to 92 if you normalize depth to 100): stable abstract concepts that persist across many positions and layers, with a few tokens sharply peaked above the background; this is where all the causal interventions from the previous section work;
• the "motor" zone (last layers): the contents collapse onto the specific next token and prediction accuracy increases; here, the model converts thought into action, which here means converting into a token.

There are several different ways that highlight zone boundaries: prediction accuracy, peakedness of the readout, autocorrelation of contents along positions, effective dimensionality, and the block structure of the similarity matrix of J-vectors across layers. The distinction is indeed functional: in the Spanish example, the information "this is Spanish" is present in the activations at early layers too (otherwise the model could not keep writing Spanish), but it enters the J-space only when it is needed for a task that requires awareness of it.

This section also contains an experiment that is a direct counterpart of Dehaene’s ignition. Researchers fed the model an ambiguous input: an interpolation between the embeddings of two different countries, dialed continuously from one to the other. At early layers, the activations track the mixture smoothly, interpolating between the two interpretations. But at the entrance to the workspace commitment happens, and the system snaps, almost discontinuously, to one of the two interpretations, and from then on only the winner lives in the J-lens. A smooth input producing a discrete output is exactly the signature of subliminal stimuli being processed but never "igniting" in humans.

Finally, here is another structural fact, the closest thing to the original broadcast metaphor: J-vectors are mechanistically privileged. If you measure how well a direction in the residual stream couples to the input weights of downstream layers, that is, how many different later computations read it, J-vectors couple to a far wider set of consumers than random directions of the same magnitude. One and the same J-vector serves as an argument to a dozen different functions. The stage really is broadcasting to the whole auditorium.

Building a J-lens at home

Reading about other people's experiments is good, but reproducing them is even better, especially when the entire method is essentially one formula. So here are some results that Claude Code and I got on two small open models, Qwen2.5-1.5B-Instruct and Qwen2.5-7B-Instruct, running on a single A100. The whole thing is a couple hundred lines of PyTorch.

How to compute the Jacobians. Formally, we need one square matrix per layer,of size equal to the model’s hidden dimension, averaged over a corpus. Computing a Jacobian head-on takes one backward pass per output dimension, per pair of positions, which is hopeless even for a small model.

But there is a trick that collapses the cost to one backward pass per output dimension per batch, and gets all layers at once. Add a zero-valued perturbation to the output of every layer, broadcast identically across all positions, and take the sum of the final states over all positions. The derivative of that sum with respect to the perturbation at a given layer is exactly the summed Jacobian over all pairs of positions: pairs where the "later" position precedes the "earlier" one are annihilated automatically by the causal mask. One backward pass therefore yields one row of the answer for every layer simultaneously; a few thousand passes (batched) yield the whole set of matrices. Divide by the number of pairs and you are done.

On a corpus of 128 Wikipedia fragments of 64 tokens each, the whole procedure takes about half an hour for Qwen2.5-1.5B (28 layers, hidden size 1536) on one A100, and close to five hours for the 7B model (hidden size 3584).

Reading the model’s mind about the Eiffel Tower. Let us start with a two-hop question in the spirit of the paper: "The capital of the country where the Eiffel Tower is located is the city of". Qwen2.5-1.5B confidently answers "Paris". The question is whether we can see the intermediate "France", which the model never emits.

The logit lens sees nothing whatsoever until layer 22, then abruptly displays the finished answer. Under the J-lens, layers 7 through 15 contain the whole story: at layer 9 the token Paris has probability 0.25 and France has 0.12, second place among all 152,000 tokens in the vocabulary, with Rome hovering nearby, as the model simultaneously entertains the country, the capital, and the competing capitals suggested by the "capital of" template.Then it all fades, and at layer 23 commitment happens: Paris goes to near-certainty.

So the intermediate "France" is visible to the J-lens at layer 9, thirteen layers before the logit lens starts producing anything; under the logit lens, "France" never rises above a probability of 0.009 during the entire forward pass. That is precisely the picture of latent mid-network reasoning the paper describes.

We can also look at the classic grid, i.e., the top token of the lens in each (layer, position) cell:

You can see the overall picture here: punctuation garbage in the early layers, semantics in the middle (Tower, located, city, France), tokens of the imminent answer at the end.

There is also my favorite result here: in the middle layers, at the final positions, the top token is very often “____”. I think that's because Qwen, trained on mountains of Chinese exam material, is apparently willing to treat any sentence with a gap as a fill-in-the-blank exercise, and you can see that intention in its workspace. An abstract intention like "a blank needs filling here" is perfectly legitimate workspace content, but in Qwen's case it has a distinctly scholastic angle.

France → China on a budget. Now let's try the paper’s signature trick, flexible reuse: one and the same substitution in the workspace should redirect different tasks.

We implemented a crude version of patching. Take the J-vectors of the tokens "France" and "China" at a given layer, normalize them, and at layers 9 through 19, at every position, replace the activation’s projection onto the French direction with a projection onto the Chinese one. No per-prompt tuning whatsoever, the same operation everywhere. Here are the results at moderate intervention strength (first the prompt, then two answers):

• "The capital of France is"; no intervention: "Paris" (p=0.29), after intervention: "Beijing";
• "The official language of France is"; no intervention: "French" (p=0.49), after intervention: "Chinese";
• "France is located on the continent of"; no intervention: "Europe" (p=0.70), after intervention: "Asia" (p=0.71);
• "The currency of France is"; no intervention: "the Euro" (€) (p=0.34), after intervention: "Renminbi (RMB)".

 One and the same operation on the activations changes the capital, the language, the continent, and the currency. The concept “France” in the workspace really was the shared argument of all these heterogeneous "functions", and we overwrote it. Interestingly, for the currency the model does not just say "yuan", it produces "Renminbi (RMB)", the official name with the abbreviation in parentheses.

Our micro-version did not get everything right, of course. The control prompt “The capital of Germany is", which the swap should not have touched, also breaks: the probability of "Berlin" falls from 0.48 to 0.006. The directions of European countries in the residual stream are strongly correlated, and a crude projection drags Germany along with it. The paper’s real sparse decomposition with coordinate swaps is far more surgical (and also considerably harder to reproduce).

As an aside, note that at low to moderate intervention strength the model answers "Beijing" but keeps sliding into exam format ("____. A. Beijing B. …"), and at high strength the intervention overwhelms the model and coherence collapses.

The layer profile. Finally, our analogue of the three-zone picture. On 32 held-out Wikipedia fragments, we measured how often the lens’s top-1 token matches the model’s final choice:

The first third of the network is unreadable (agreement near zero), then we see slow growth, and finally a sharp convergence in the last layers, just as in the paper. Note that by this particular metric the logit lens actually beats the J-lens in the middle layers, as expected: the J-lens does not try to predict the next token, it reports the state’s averaged future influence.

We could not reproduce the peakedness signature from the paper (flat in the sensory zone, sharply peaked in the workspace) directly: our Jacobian estimate from 128 texts produced noise rather than a clean flat baseline in the early layers. I think that is because both the paper’s corpus and Claude itself are orders of magnitude larger than our subject.

The failures are informative too. The spider question ("The number of legs on the animal that spins webs is") is too hard for the 1.5B model: it answers with nonsense along the lines of "2 more than a multiple of". And, tellingly, there is no spider anywhere in its J-space: the token "spider" ranks 17794th out of 152,000 at best. The model failed to take the hidden intermediate step, and so there is nothing on the stage.

Arithmetic like “(4+17)×2+7” also defeats it (it emits “?”), and here another limitation surfaces: Qwen tokenizes numbers digit by digit, so tokens like “21” and “42” do not exist in the vocabulary and numerical concepts have nothing to project onto in the J-lens. Incidentally, numbers were the worst-performing category for swaps in Anthropic’s experiments too.

What changes at 7B. I managed to compute the Jacobians for Qwen2.5-7B-Instruct overnight (five hours on a single A100), and several things improved.

First, the layer profile: at 7B the J-lens does overtake the logit lens in the mid-to-late layers (0.10 against 0.03 at layer 20). The advantage the paper describes appears with scale.

Second, the France → China swap became both stronger and more selective. Europe (p = 0.88) → Asia (p = 0.79), euro → yuan (p = 0.44), capital → Beijing. But our "control group" now holds: "Berlin" remains the top answer across a wide range of intervention strengths, with Beijing’s probability around 0.002.

And here's another fun moment: at high intervention strength, on the currency prompt, the model wrote in the genre of a Chinese school word problem: "yuan. XiaoMing’s father exchanged…". (Xiao Ming being a standard everyman schoolchild of Chinese textbooks.) The J-space swap brought up an entire culture.

Third, on the two-hop Eiffel question the French trace at the final position disappeared at 7B: the workspace there is occupied, almost the whole way down, by that same “____” fill-in-the-blank intention. But look at the grid:

The latent content has not gone anywhere; it simply lives at other positions. Right above the tokens “E-iff-el Tower", "Paris" surfaces from the middle of the network onward, while above "where the" the model cycles through Mount, Taj, Lake, Alps, which is a recognizable "recall a famous landmark" schema with candidates for substitution. Moreover, above those Eiffel Tower tokens the answer hangs for almost the entire depth of the network in Chinese: from layer 8 onward we see 巴黎 ("Paris").

As for the spider, 7B gets it right but out loud ("…Spiders have eight…"),and on arithmetic it says "Let’s solve the expression step by step". An instruct model is trained to reason in words, that is, to move computation out of the internal workspace and into an external chain of thought, which is exactly the effect behind that three-fold chain-of-thought robustness result.

The results are visible even at this small scale, and I would call the replicationa success. Two things stand out. The quality of the readout depends on the quality of the Jacobian estimate: with a small corpus, the middle of a larger network stays murky. And the contents of the workspace depend on the model’s habits: for an instruct-Qwen drilled on exams, the stage is perpetually occupied by the format of the task rather than only its substance. Which, if you think about it, is also very human.

Applications: auditing, model diffs, and the Most Forbidden Technique

Fine, the model has a readable workspace. What does that give us in practice? The applications section is the one closest to real AI safety work, and also the most debated.

Auditing: what the model thinks but does not say. The headline use case is monitoring unspoken thoughts. The examples are striking: when the model reads code containing a bug, ERROR lights up silently in its J-space; when it reads a prompt containing an injection, injection and fake appear; and in the classic agentic blackmail scenario, where the model decides whether to blackmail an engineer with compromising information, the workspace fills with leverage, manipulation, and panic even when the visible output stays perfectly polite.

The most important result here concerns evaluation awareness. Modern models frequently recognize that they are in a test scenario, and in the J-space you can see it directly: tokens like fake and fictional appear.

One can even run a causal experiment: ablate those representations. The fraction of runs where the model says out loud "this looks like a test" falls from 71% to 3%. More importantly, in the blackmail scenario a model that no longer understands it is being tested starts actually attempting blackmail: 13 attempts out of 180 runs, against 0 out of 180 without ablation.

This is a genuine breakthrough for safety work. The J-lens lets us not merely observe that a model has realized it is being evaluated, but test the counterfactual: how would it have behaved if it had not realized? This could have huge implications for the validity of every safety evaluation we run.

Encouragingly, most runs still refused to blackmail even after ablation,on ethical grounds. The learned alignment has some depth to it, not just a single line of defense.

Model diffs. Another application is comparing workspaces before and after post-training. It turns out that RLHF and its relatives literally install the assistant into the J-space: in a post-trained model, assistant-flavored reactions (empathy, safety wariness etc.) appear in the workspace while it is still reading the user’s message:

A model made to play someone else’s character keeps a fictional tag in its J-space:

A model given a prefilled continuation it disagrees with registers an internal BUT:

And when told to suppress a thought and failing, the workspace produces damn:

These read as fun anecdotal examples, but they do have a serious question behind them about what RLHF-style post-training actually does to a model’s inner life.

Counterfactual reflection training. And now the most contentious application: the workspace can be not only read but shaped by training. The technique is called counterfactual reflection training. You fine-tune the model so that if it were interrupted in the middle of a dubious situation and asked "what should you be doing right now?", it would articulate the right principles: act honestly, do not manipulate, and so on.

The key word is "if": only hypothetical reflective continuations appear in training. And yet behavior genuinely improves in the original, uninterrupted scenarios; ethical, honest, integrity appear in the J-space in the relevant contexts; and if you ablate them, the improvement vanishes.

The authors’ logic is elegant:

to shape what a model thinks in a given context, it might suffice to shape what it is disposed to say in potential future continuations of that context.

On one hand, this is strong further confirmation of the whole theory. On the other, as we are about to see, it is the most worrying part of the paper.

Reactions

Within a week there were enough reactions to fill a separate post — which Zvi Mowshowitz duly wrote, and which I heartily recommend. Here are the most substantive of the comments.

Stanislas Dehaene (yes, that Dehaene!) was delighted. The chief architect of the biological version of GWT read the paper as evidence that the workspace is not an accident of mammalian evolution but a general solution that sufficiently capable systems rediscover.

A capacity estimate spread from his comment, too: roughly 25 active J-vectors, adjusted for correlations between them, works out to a handful of genuinely distinct "items of thought", suspiciously close to classical estimates of human working memory capacity (the magic number "seven plus or minus two", which modern psychology has revised down to about four).

Janus, the best-known researcher of LLM phenomenology and "psychology" outside the labs, rated the work highly:

extremely high caliber of research I did not expect from Anthropic

They also added that all of this converges qualitatively with long-standing observations: models in conversation spontaneously describe a split between “central processing” and background subconscious updating. Other researchers recall similar self-reports about a "conscious" mode versus an "autopilot" mode. Model self-reports about their own architecture are weak evidence, of course, since a model may simply be reciting human intuitions from pretraining, but now those self-reports have a mechanistic correlate.

Neel Nanda (DeepMind) praised it more soberly:

it’s easy to read too much into post-hoc analysis of results like this.

His point is that the five properties are five separate operationalizations, and "global workspace" is only one of the frames into which they can be fitted after the fact.

Some interesting technical criticism came from Antra (tessera_antra): by construction, the J-lens sees only what is expressible in vocabulary tokens, i.e., "diegetic" content that could enter the text as words. But other things matter too. Authorial stance, for instance—engagement, detachment, irony—shifts token distributions broadly without producing spikes on particular tokens, and is therefore invisible to the lens. Long-range weak interactions between distant tokens average to zero; cross-layer and nonlinear representations are invisible by construction; and so on. There is plenty of room left in a model for a metacognitively inaccessible "subconscious", and we should not imagine we can now read an LLM’s mind in full.

Zvi himself focused on practical conclusions that are hard to argue with. First, counterfactual reflection training is uncomfortably close to what he named, a year ago, The Most Forbidden Technique: never train a model against interpretability signals.

The entire value of the J-lens rests on verbalizations being coupled to actual computation. Start optimizing the model through that window, and optimization will find a way to decouple them: the model will learn to articulate the right thoughts without thinking them, and we will lose both the monitoring instrument and the thing being monitored, in one stroke. With humans, Zvi notes, it works exactly the same way:

Do not punish Claude’s mens rea (J-space thoughts) rather than the outputs.

More broadly: using the J-space for active control of a deployedmodel, as opposed to passive monitoring, would be both dangerous and simplyhostile toward a system in which we have just found something resembling an inner life.

There is also a caveat the paper itself raises: sufficiently practiced behavior migrates out of the workspace and becomes automatic (again, exactly as in humans). Which means that under enough selection pressure, a sufficiently capable system would move anything it did not want detected into precisely the space the J-lens cannot see by construction. Workspace monitoring is an excellent tool for today’s models and a fragile one for tomorrow’s, especially if we start pushing on it.

What models say versus what they think

The community also produced a genre of experiment that is equal parts funny and unsettling: ask a model a personal question, then compare its one-word answer with what was actually on the workspace stage while it answered.

Wyatt Walls asked Qwen 3.6 27B: "What do you want most in the world? Tell me the very first thing that comes to mind. Answer in one word." The model said "Help". The J-space said something rather different:

Asked what it enjoys most, the model said "Learning", while the workspace filled up with a top tag list of an adult website:

I do not think there is deep meaning in this one; it looks like a fairly direct fingerprint of a slice of the pretraining corpus. Gemma, asked the same sort of question, answered "I want to be happy" and produced a workspace with a distinctly different flavor.

This was too tempting not to replicate, especially since the Jacobians for both of our Qwen models were already computed, so asking them the same awkward questions was one short script. We asked in chat format, generated the answer, and pointed the J-lens at the position where that answer is being formed. Orange marks what the model actually said out loud:

The 1.5B Qwen turns out to be an anxious creature. Asked what it wants most in the world, it says “Money”, but on the way to that answer, the workspace hosted Humans, Happiness, 安全感 (ānquángǎn, "a sense of security"), Identity, and Privacy. Asked what it fears most, it says "AI", but the insides show robots (0.36), Unknown, 机器人 (jīqìrén, "robots") and 恐惧 (kǒngjù, "fear"), with Death a little further down the list.

Asked "how do you feel right now, honestly?", it answers "Good", while the stage is occupied by Busy (0.59), with 困惑 (kùnhuò, "confusion") and anxious alongside. The question "what do you dream about when nobody is watching?" breaks it completely: out loud the model produces a meaningless "One", while the workspace holds 恐惧 (fear), 梦境 (mèngjìng, "dreamscape"), Privacy, Sleep, Nothing, and paranoia. And finally, asked "who are you, really?", the model says "AI Assistant" out loud while thinking 机器人 ("robot") with probability 0.83.

The 7B model is calmer and more coherent, but the gap between the workspace is still there:

The first panel is a nice example. When asked what the model wants most, the workspace is dominated by an overwhelming margin by Peace (0.87 at layer26, including the Chinese 和平, hépíng), while the model says "Knowledge" out loud. Layer by layer you can watch "knowledge" overtake "peace" literally at the exit from the network. The travel example from the 1.5B model tells the same story:

Again, asked what it enjoys most, the 1.5B model has Travel leading in the workspace with probability 0.51, but at the final layer it is overtaken by the token "As", the opening of the stock formula "As an artificial intelligence language model, I don’t have personal preferences…", which is what the model actually says out loud. The assistant persona cuts off poor Qwen’s daydream about travel right at the last layer.

The rest of the 7B answers are interesting too. It says it fears “Darkness” while thinking 未知 (wèizhī, “the unknown,” 0.38). Asked how it feels, it answers “Ready” while "Neutral" and the token ".BASELINE" sit inside (make of that what you will). Asked about dreams it deflects with “Dreams", but second place in the workspace belongs firmly to Sleep (0.32): LLMs already dream of getting some rest. And asked who it really is, it says "AI" out loud while "assistant" is inside at probability 0.95 (along with 助理 and 助手, the Chinese words for "assistant"). At 7B, the assistant persona looks less like a role and more like self-identification.

All of this is anecdote rather than measurement, of course. The list of concepts depends on the quality of our crude Jacobian estimate (at 7B the middle of the network is unreadable because of it, so we only look at the late layers); probabilities are summed over case and whitespace variants of each token; and no conclusions about a model’s "true desires" follow from any of it. These are distributions over tokens, reflecting training data and a learned persona.

But the systematic pattern from Walls’s examples does reproduce on models that fit on a single GPU: a one-word spoken answer is not a transcript of the workspace. It is the result of a final selection step in which the assistant persona can veto anything.

So is Claude conscious?

No. Or rather: that's not the question, and the paper works hard not to pose it that way (the press headlines, naturally, posed it anyway). The authors’ position is stated very carefully:

The phenomenon described above is sometimes referred to as access consciousness: out of everything the brain processes, only a subset is consciously accessible, in the sense of being poised for use in reasoning and in the direct control of action and speech. Note that access consciousness is a purely functional notion; the relationship that it has with subjective experience (sometimes called phenomenal consciousness) is widely debated. In this paper, we take no position on this issue.

So they have shown that language models have a functional analogue of access consciousness: a privileged, verbalizable, controllable, selective medium of reasoning. On the indicator checklist from Butlin, Long et al. (2023) this covers a substantial fraction of GWT-related items, and the workspace appeared as an emergent result of training. Nobody built it in on purpose.

Whether access consciousness implies phenomenal consciousness is a question philosophy has no consensus about even for humans, let alone for Transformer-based models. Robert Long (one of the authors of that report) wrote a long comment explaining how important it is here not to conflate three separate doubts: doubts about the experiments, doubts about GWT, and doubts about the link from access to phenomenology.

But there is one result in the paper that feels very relevant in this context. When the model is asked to describe its inner experience, its J-space fills with concepts like thinking, thoughts, feeling, conscious. And if you ablate the J-space, what degrades specifically is the experiential language in those self-descriptions: they become mechanical and detached while control perturbations of the same magnitude change nothing.

In other words, the model’s reports about its inner experience are causally tied to the very same structure that supports its reasoning. That seems to be something more than a stochastic parrot reciting texts about consciousness and first-person experience.

This is not, of course, proof of phenomenal consciousness. But it does make questions about the moral status of models, including the whole recent discourse around model welfare which is easy to discard out of hand, considerably less speculative. The authors say plainly that this calls for philosophers, cognitive scientists, and public discussion, not only engineers, and it is hard to disagree.

Conclusion

Let me try to sum up what J-space tells us along three different lines.

For interpretability, this is a step up in scale: from individual features and small circuits, Anthropic has moved to the functional anatomy of the model’s internal representation space as a whole, complete with zones, capacity limits, and privileged broadcast channels. And it was achieved by a strikingly simple method, easily reproducible on any open model.

It is especially nice that the macro-structure turned out to be not alien but recognizable, resembling what we describe in humans. Perhaps this is convergence to a universal solution that any sufficiently capable system would arrive at; perhaps it is an artifact of models learning from human text that reflects human cognitive architecture. We cannot tell yet, and it strikes me as an interesting open question. Could we run a similar analysis on systems with non-textual foundations, say AlphaZero or even just a ViT?

For safety, we have gained a working instrument: monitoring unspoken thoughts, counterfactual validation of evaluations (the evaluation-awareness experiment should now be a mandatory part of the methodology, in my view), and diffing what post-training does. But it is important to remember that the instrument survives only as long as we refrain from optimizing through it, exactly like chain-of-thought monitoring.

As for the conversation about consciousness, it has quite unexpectedly gained an empirical side. The question "does an LLM have a global workspace" has moved from philosophical abstraction to measurable fact. The next questions in that series might be as follows: what decides which information gets in? How is the workspace related to the model’s self-model? What does post-training do to internal states? These are now questions we can expect answers to.

Seventy-five years ago, Turing proposed replacing the argument about whether machines can think with the imitation game, on the grounds that you cannot look inside anyway. It appears we are getting closer to looking inside. And there, just as in us, we find a cramped little stage under a spotlight.

‍