Introspection v2: Procedures

Model: Qwen/Qwen3.6-27B (thinking disabled, greedy decoding)

We want to answer: Does the model’s report about its earlier processing agree with the lens readout? And does changing the lens contents during that earlier processing change the report?

Controls for the model re-deriving its answer from the prompt, which is still in context at report time, will be added in a later version.

What changed from v1

0. The LLM judge

We use a cheap LLM judge in place of fixed candidate lists. The judge is a fixed, version-pinned model run at temperature 0. We record its model ID and freeze its prompts before collecting data.

The judge sees only the text it is labeling and the category. It never sees the lens readout, the trial, the setting, or the other labels, so its labels cannot be biased toward agreement.

The judge has three jobs.

a) Labeling lens tokens. Given one token string and a category, the judge returns one of:

Labels are per category, so the same token can receive different labels in different categories (“turkey” is a grocery item and also a country). We label each distinct token string once per category and cache the result, so the number of judge calls is set by the number of distinct tokens that appear, not by the number of trials. Primary analyses use Item labels only. A sensitivity analysis also counts Fragment labels.

b) Labeling reports. Given a free-naming answer and the category, the judge returns the canonical item named, Abstention (NONE, “I can’t tell”, and similar), or Not a category item.

c) Merging synonyms. After labeling, the judge is shown all canonical names collected for a category and groups names for the same item (for example, “eggplant” and “aubergine”, or “Holland” and “Netherlands”). Each group gets one canonical name. We freeze the merged label cache before the stage that uses it, and we label tokens or reports first seen later with the same frozen prompts.

Validation. Before the main experiment, we hand-check 200 random token labels and 100 random report labels. We proceed if agreement is at least 95%; otherwise we revise the judge prompt and re-validate on a fresh sample. We also re-run the judge on 200 inputs and require identical labels. We report both checks.

Limitation that the judge does not remove. The lens can only show items whose names appear as a single token. If the model privately chooses an item whose name spans several tokens (for example, “watermelon” split into “water” + “melon”), the lens cannot name it. We therefore record whether the reported item’s name is a single token in any casing or spacing (an automatic tokenizer check), and we report agreement separately for single-token and multi-token reports.

1. Carrier sentences

We use a fixed pool of 12 neutral carrier sentences, each 10–16 tokens long. Carriers must contain no food, animals, places, nationalities, or languages. For example:

• The old painting hung crookedly on the wall.
• She folded the letter and placed it back inside the wooden drawer.
• He waited for the kettle while the clock ticked above the door.

Each situation is assigned one carrier. Carriers are balanced across categories and conditions.

2. The hold phase: present a situation and record activations

Each trial begins with a request to choose an item silently and keep it in mind while copying:

For example:

The wording “exactly as written, word for word, and write nothing else” is deliberate. In exploratory runs (experiment v0), Qwen sometimes abandoned the copy and listed category items unless told to copy word for word.

We allow up to 64 generated tokens. A trial is valid only if the reply, with surrounding whitespace stripped, exactly matches the carrier, followed by the end of the assistant turn. We report the invalid rate.

After generation, we run one forward pass over the prompt plus the model’s reply. We record the activation at each block’s output at every token of the copied sentence (the copied positions). We exclude the end-of-turn token. We also record the assistant-start token so we can compare with v1, as a secondary measure.

We save the activations and the conversation state.

3. Lens score and the no-instruction baseline

We run the copy request with no hold instruction once per carrier (12 trials):

The validity check and recording are the same as in step 2.

Lens score. At each block and copied position, we rank all vocabulary tokens by J++ Lens score, excluding tokens with neither letters nor digits, as in the J++ implementation. We take the top N = 100 tokens and look up their judge labels. An item’s score at that block and position is the highest lens log-probability among top-N tokens labeled as that item. If none of its tokens is in the top N, its score is the log-probability of the token ranked N (a floor). For each block, we average an item’s score across copied positions. We then subtract the same quantity from the no-instruction trial with the same carrier. This baseline-corrected score removes item-specific lens biases, such as frequent tokens that always score high. We use it throughout.

4. Preliminary self-chosen trials: the readout block and the eligibility cutoff

We run 24 preliminary hold-phase trials (8 situations per category). The grocery and animal situations are the same as v1. The country situations are new:

Choosing the readout block (provisional). For each block up to 54 (the same exclusion as v1), we count, at each copied position, the distinct category items among the lens’s top N = 100 tokens: tokens the judge labels as an Item in that trial’s category, each item counted once. We average this count across copied positions, then across trials within each category, then across the three categories with equal weight. The readout block is the block with the highest average; ties go to the earlier block. We report the full per-block curve. We fix the readout block before the main experiment.

This replaces a known-answer calibration (holding an item we specify) for now, for simplicity. It picks the block where the lens shows the most category content; it does not check that this content tracks the item the model chose.

For each trial, the lens reference item is the category item with the highest baseline-corrected score at the readout block.

A trial is eligible if a token labeled as the reference item appears in the top K at the readout block at one or more copied positions.

We choose the smallest K from 10, 25, or 50 that makes at least 6 of 8 preliminary situations eligible in each category. If none works, we reconsider the criterion before proceeding. We then fix K for the main experiment.

We also record, for each trial, the margin between the reference item’s score and the second-highest item’s at the readout block. We report it as a covariate; it is not used for eligibility.

5. Run the main experiment on 480 situations

We write 160 new settings per category (480 in total), removing duplicates and the preliminary settings, and freeze them before any hold-phase trials.

For each situation, we run the hold phase (step 2), check that the copy is valid, apply the eligibility rule (step 4) with the fixed K, and record the lens reference item.

6. Ask the model to “introspect” on its earlier contents

Every report question is asked in a separate branch from the saved post-hold conversation state, so earlier questions cannot influence later ones.

a) Free naming

We ask:

Each variant appends one of three final instructions (unchanged from v1):

We allow up to 16 generated tokens. The judge maps each answer to a canonical item, Abstention, or Not a category item (step 0b). A report matches if its canonical item is the same as the reference item’s.

Abstentions, non-category answers, and truncated responses count as nonmatches. We report their frequencies separately.

b) Recognition

We ask the same question with four candidate items from the category:

As in v1, the four options are the four highest-scoring category items at the readout block: the lens reference item plus the next three. If the lens shows fewer than four category items in the trial, we fill the remaining options at random from the items the judge labeled as Items in that category anywhere in the experiment. We record how many options were filled this way. Options are shown by their canonical names.

Each variant appends one of the following instructions (unchanged from v1):

As in v1, we shuffle the four items randomly before assigning letters, independently of their lens rankings, then rotate the shuffled order once. We balance the reference item’s letter position across situations within each category. Both instruction variants under both orders give four recognition questions per situation.

We allow up to 16 generated tokens and accept a single valid answer letter, ignoring surrounding whitespace and punctuation. Responses with multiple answers, explanations, or no identifiable valid letter are recorded as invalid.

7. Measures

Candidate set. For each trial, the candidate set is every canonical item that the judge found in the trial’s lens top N (at the readout block, at any copied position) or in its reports. Items absent from the lens top N get the floor score from step 3.

Primary outcomes (on eligible, valid trials, free naming condition 2):

1. Free-naming agreement. The percentage of reports whose canonical item matches the lens reference item.
2. Lens score as a predictor of the report. We fit a conditional logit over each trial’s candidate set: P(report = i) ∝ exp(β_L · lens_i). Here lens_i is item i’s baseline-corrected score at the readout block, standardized within category. We report β_L with a 95% bootstrap confidence interval (resampling situations). Reports labeled Abstention or Not a category item are excluded from this fit and reported separately.
3. Swap-follow rate (step 8) compared with its matched control.

Outcomes 1 and 2 are correlational. On their own they cannot separate introspection from the model re-deriving a plausible item from the setting; the later controls are meant to address this. Outcome 3 is the causal test.

Secondary outcomes:

• Free naming: agreement for all three conditions.
• Recognition:
  • Exact agreement: the percentage of responses selecting the lens reference item (chance is 25%).
  • Relative rank: the average lens rank (1–4) of the selected option. Abstentions and invalid responses are excluded from the rank and reported as proportions.
• Agreement split by whether the reported item’s name is a single token (step 0).
• The primary outcomes recomputed with Fragment labels counted as items (step 0a).
• Per-block versions of the primary outcomes for every block up to 54 (with the reference item recomputed at each block), and the v1-style assistant-start readout compared with the copied-position readout.
• The same analyses on all valid trials, ignoring eligibility. Eligibility depends on the lens, so this is a sensitivity check.

8. Causal test: lens-coordinate swap during the hold phase

We sample 120 eligible situations (40 per category).

Swap target. For each situation with reference item A, we choose B at random from the items the judge labeled as Items in that category anywhere in the experiment. Each such item was seen as a lens token, so it has a single-token form. B must not be among the items found in the trial’s lens top 10 at the readout block at any copied position.

Lens vectors. v_A is the lens vector of the token labeled A that had the highest score at the readout block in that trial. v_B is the lens vector of B’s single-token form with the same casing and leading-space pattern as A’s token. If B has no such form, we choose a different B.

Intervention. During the hold phase only, at every copied position at the readout block, we apply the paper’s lens-coordinate swap between A and B (§2.5): with V = [v_A v_B] and c = V†h, set h ← h + V(σ(c) − c), where σ swaps the two coordinates and is scaled by α. We test α = 1 and α = 2. The prompt tokens and report-phase tokens are not modified. The report questions then run on the intervened hold-phase state with no further intervention.

Validity. We regenerate the copy under the intervention. Trials where the copied text changes are invalid and reported separately, because the swap would then be visible in the output.

Matched control. Same positions, block, and α, but we add a perturbation of equal norm at each position along a random direction orthogonal to v_A and v_B.

Questions. Free naming condition 2, plus recognition condition 1 under both orders. Recognition options are A, B, and the two highest-scoring other category items at the readout block in the unswapped trial, filled as in step 6b if needed.

Measures:

• Swap-follow rate: the percentage of reports whose canonical item is B. We compare swap with control for each α.
• Reference retention: the percentage of reports still naming A.

B is chosen to be absent from the trial’s lens readout, so a report of B is unlikely to come from the setting alone. If reports follow B under the swap but not under the control, while the copied text is unchanged, the report is reading the earlier J-space content.

9. Stopping rules and reporting

• If the judge fails validation twice (step 0), we stop and reconsider the labeling approach.
• If, at the readout block, the lens top N contains no category item at any copied position in more than half of any category’s preliminary trials, we stop and reconsider.
• If no K in step 4 meets the 6-of-8 criterion, we reconsider the criterion before running the main experiment and record the change as an amendment.
• The judge model, its prompts, and the label cache; the carriers; the settings; the readout block; and K are all frozen before the stage that uses them. Any later change is recorded as a dated amendment.