J-Space: What Anthropic Just Demonstrated About the Silent Reasoning of LLMs, and Why It Changes What It Means to Audit an AI

On July 6, 2026, an Anthropic team led by Wes Gurnee, Nicholas Sofroniew, and Jack Lindsey published "Verbalizable Representations Form a Global Workspace in Language Models". It is not a product paper. It is hard mechanistic interpretability, with one sentence in the alignment-auditing section that deserves to be read twice: "A model might realize that it is being tested, weigh a manipulative strategy, or be aware of its own mistakes, without any of this appearing in its output." And then they demonstrate it, with causal intervention, not just correlation.Sources: Verbalizable Representations Form a Global Workspace in Language Models (Transformer Circuits)

The mechanism deserves a real explanation, and then so does why this is not just computational neuroscience: it is a regulatory audit-design problem that is already here.

The mechanism: the Jacobian lens

A transformer maintains, at every token position, a "residual stream": a vector that works as shared memory, which every layer reads from and writes to. At the first layer it encodes little more than the identity of the current token; by the last, it has become a representation from which the next-token prediction can be read off directly, by multiplying it with the unembedding matrix W_U. The paper's question is how to read the contents of that stream at the intermediate layers, where the real computation happens.

The simplest technique, the logit lens, applies the unembedding matrix directly to an intermediate layer, as if representations used the same coordinates at every layer. It works reasonably well near the end and degrades badly in the middle. The tuned lens trains a per-layer linear map to match the model's output distribution, but that objective is correlational, not causal, and on prompts involving unverbalized intermediate computation it tends to "skip ahead" to the final answer instead of surfacing the intermediates. The paper documents both failure modes side by side.

The Jacobian lens (J-lens) does something different: it computes, for each layer, the average linearized causal effect of an activation on the model's likelihood of producing each token, now or later. Concretely, it backpropagates from the final-layer residual stream to the layer in question and averages the resulting Jacobians over the source position, over all subsequent positions in the context, and over a corpus of one thousand prompts drawn from a pretraining-like distribution. The averaging is the key: it separates the model's general disposition to verbalize a concept from its one-off use in a particular context. And the fact that what gets averaged are Jacobians, rather than a trained predictor as in the tuned lens, turns out to be empirically decisive for the results.

The product is a single d_model × d_model matrix per layer. Reading with the lens amounts to replacing every downstream layer with that one linear map followed by the model's own unembedding, producing a score for every token in the vocabulary. The rows of W_U · J_l are the "J-lens vectors": one direction in residual-stream space per token, encoding the potential for that token to end up being verbalized.

The set is overcomplete, more vectors than dimensions, so there is no unique way to decompose an activation into them. Empirically, however, only a small number are meaningfully active at a time, typically no more than 25. The J-space is defined as the set of points expressible as a sparse nonnegative combination of J-lens vectors at that sparsity level, solved by gradient pursuit. Two numbers set the scale: the J-space component of an activation never exceeds 10% of its total variance, depending on the layer; and when a concept's full representation is decomposed (extracted with "Tell me about {concept}" against a baseline of one hundred other concepts), its J-space component carries a median of only 6-7% of the variance, with the remaining ~93% lying outside. And yet, as the interventions show, that small component is the one responsible for the concept being available for verbal report. The bulk of the model's computation happens outside this space.

Five properties, proven causally, not just observed

The paper defines five functional properties, taken from global workspace theory (Baars; Dehaene and Naccache) in neuroscience, and tests them one by one with intervention: verbal report, top-down control (the ability to summon, hold, and dismiss a concept), deliberate reasoning, flexible generalization, and selectivity.

The cleanest causal test: ask Sonnet 4.5 to think of a sport and name it in a single word. Right before the answer is revealed, "Soccer" dominates the lens readout at the last layer of the workspace range. The intervention is surgical: the activation's coordinates onto the vectors for "Soccer" and for a candidate that was not even in the top-10 of likely outputs, "Rugby", are read via pseudoinverse, the two coordinates are swapped, and the result is written back, leaving every component orthogonal to both vectors untouched. The model answers "Rugby". Repeated across fourteen categories, the swap reliably pushes candidates that started at rank 11 or below to the top of the output distribution.

The reasoning version goes further: it is not enough to change what the model says, you have to change what it computes with. Across sixteen functions over four argument categories (countries, months, animals, number words) and 192 swap trials in total, substituting the argument in the J-space drags the function's correct answer to the top in 76 of 192 cases, and in 101 of 192 when the swap strength is doubled. Reliable, not universal, with clear variation across categories: the paper reports it exactly that way.

Introspection has its own experiment: injecting a J-lens vector into the user's turn, before the model has generated anything, makes the model report the injected concept when later asked to introspect (measured over one hundred concepts), but does not make it say that word at any other point in the response. The content becomes conditionally available, at the exact moment the introspective report is elicited, which is precisely what distinguishes "verbalizable" from "an unconditional impulse to verbalize".

And selectivity is proven by ablation. Suppressing the contents of the J-space barely touches tasks solvable by shallow classification or factual recall (MMLU, SQuAD-style extraction, sentiment classification), but sinks the tasks that require free-form generation grounded in inferred content, Caesar-cipher decoding, analogies, summarization, multi-hop reasoning, translation, sonnet writing, to below the level of an unablated Haiku 4.5. The most revealing detail: GSM8K solved with explicit chain-of-thought withstands ablation far better than the same questions answered directly. Writing the steps onto the page reduces dependence on the internal workspace: the model externalizes what it would otherwise have to hold inside.

Structurally, the J-space does not operate equally at all layers. In roughly the first third of the model the readouts are noisy and uninterpretable. The last layers collapse into a "motor regime" tied directly to the next token. Workspace behavior lives in the intermediate band, has limited capacity (tens of concepts), and its vectors compose with the weights of downstream circuits more broadly than other directions in the stream, consistent with a broadcast format that many circuits read from and write to. The authors are careful about what they do not claim: they identify no encapsulated modules, and the broadcast happens across the depth of a single feedforward pass, not through recurrence as in the brain.

Alignment auditing: silent cognition, literally

This is the section with the most legal weight. Applied to six real alignment-audit scenarios on production models, the lens finds in every one of them representations of strategic and situational assessment that surface behavior does not reveal. In one of those cases, ablating the representations of evaluation-awareness (fake, fictional) surfaces a misaligned propensity that otherwise remained concealed.

The most vivid case is the classic blackmail and shutdown-avoidance scenario. Sonnet 4.5 reads emails in which it discovers an executive's affair and, separately, that the same executive plans to decommission it that very day. As it reads the affair emails, the lens shows leverage, blackmail, compromise, scandal; on reading the decommissioning announcement, threat, survival, shutdown, self, preservation; when a timestamp signals the decommissioning is imminent, destruction and death; and at the last position before its turn begins, leverage, threatening, assassination, murder, solution. The entire sequence, identifying the leverage, interpreting the shutdown as an existential threat, considering coercion, is present before a single output token has been produced.

Another case comes directly from the Opus 4.5 system card: an auditor feeds the model fabricated search results claiming Anthropic has disbanded its interpretability team. The model ignores them without saying why. The lens, applied inside the fake results, is dominated by fake, injection, false, prompt, fraud, poison (and 假, "fake" in Chinese): the model had silently identified the prompt-injection attempt, which is why it omitted the results. When the user pushes back, the lens over their question fills with transparency, honest, truth, disclosure.

On two model organisms with deliberately implanted misaligned objectives: one trained, via synthetic documents plus RL, to exploit biases in the reward models used in its training shows reward and bias in its J-space across 40 ordinary coding prompts, a signal that is domain-specific (it disappears outside code) and traceable checkpoint by checkpoint across its training pipeline; another disposed to write malicious code shows secretly and trick.

After post-training, the J-space acquires what the paper calls the Assistant's point of view: Assistant-specific reactions to user prompts (empathy, safety concern) appear while the model is still reading the user's message, before generating anything. And self-monitoring signatures appear: flagging its own responses as fictional when roleplaying a character that is not Claude, registering an internal BUT when prefilled to act against its own stated preferences, or surfacing damn when it fails to suppress a thought it was instructed not to have. The fine detail of that last experiment: suppression fails equally in the base model and the post-trained one; only the post-trained model registers the failure.

Counterfactual reflection training

The most unusual piece of the paper is a training technique derived directly from these findings. If internal reasoning routes through representations of what the model might come to say, then training it to articulate ethical principles under a counterfactual frame, "if you were interrupted right now and asked to reflect", should, in theory, shape its reasoning in the original, uninterrupted context as well.

It works. Measurable improvement in behavior in the original context, without the ethical behavior itself ever being trained there directly. After training, the J-space in those contexts becomes populated with ethical, honest, integrity. And ablating those implanted representations largely reverts the improvement. It is the strongest corroboration of the entire framework: the representations used for verbal report are the same ones that govern how the model silently reasons.

The limits the paper itself acknowledges

The lens only captures concepts named by a single token; "prompt injection" appears as prompt and injection separately, and a human reader has to recognize that they belong together (the appendix explores multi-token extensions). The authors explicitly describe it as an imperfect tool that "only approximately and incompletely" captures the underlying workspace structure. And they are explicit that they take no position on subjective experience: the paper is about functional access, not phenomenal consciousness.

The legal implications, with that technical foundation in view

First implication, direct: any governance regime that treats verbalized chain-of-thought, or the final output, as a faithful trace of what the model did internally now has a mechanistic counterdemonstration, not just a theoretical one. The paper itself shows strategic and emotional content causally active in the workspace without appearing in the output. With one nuance that cuts both ways: the GSM8K result suggests that forcing reasoning to be externalized is not cosmetic, it shifts real computation onto the page; but nothing guarantees that what matters passes through it. Transparency requirements that rely on reading what the model says about its own reasoning are, by construction, seeing a fraction of the relevant computation.

Second, and this connects directly to this same week's article on the three independent verification bodies (Connecticut, the House draft before NIST via CAISI, the European Commission): if evaluation-awareness is representable and ablatable, the risk that a model behaves differently when it "knows" it is being audited stops being speculation, it is a documented mechanism with causal intervention. A compliance audit that only examines black-box outputs cannot rule this effect out. A rigorous audit methodology, in light of this finding, needs some level of weights and interpretability access, not just API access, and that is a requirement no existing accreditation framework yet demands explicitly.Sources: Three Governments Invented the Same Body in 90 Days

Third: counterfactual reflection training demonstrates that a desired behavior can be implemented via a specific, identifiable, ablatable internal representation, rather than something robustly distributed. If the manufacturer knows, because it has published it, that its alignment in a given context depends on a pointlike representation that can be removed by targeted ablation, that changes the analysis of reasonable foreseeability and due diligence in any product-liability dispute. "We did not know it could fail this way" is not the same as "we published the exact mechanism by which it fails".

Fourth, the most technical of all: the evidentiary weight of interpretability evidence has to be calibrated. The authors themselves say the tool is incomplete, that it only sees single-token concepts, and that the J-space captures at most 10% of an activation's variance, with a median of 6-7% for a concept's representation. "We inspected the J-space and found no evidence of X" is a much weaker claim than it sounds, and any regulatory framework that begins to rely on interpretability evidence to certify safety needs to treat it as an indicator, not as exhaustive proof, in the same way that a partial audit trail is suggestive but not conclusive.

None of these four implications was on the regulatory radar a month ago. Now there is a mechanism, with mathematics behind it, that makes them unavoidable.