Introspection

definition

A model's capacity to access and report on its own internal states — activations, representations, processing dynamics — as distinct from producing outputs shaped by those states. The key distinction: introspection means the model treats its own internals as objects of attention, not merely as causal drivers of behavior. In this LLM wiki, introspection names a within-pass capacity: some processing attends to other processing as content rather than passing it forward as computation. It does not presuppose continuous reflective awareness across time.

This is a capacity concept (something the model exhibits), not a pattern concept (something observed across findings). It names what is happening in a specific model during a specific operation, not a statistical regularity across experiments.

Mechanistically, the concept-injection result implies some monitoring architecture — attention heads or circuits that read internal state as input rather than passing it forward as computation. The scaling result (larger models introspect more accurately) suggests the monitoring capacity depends on representational depth, not a dedicated introspection module. That inference is contested — see the evidentiary-bar paragraph of the Scope note.

instantiating findings

• Concept injection reveals introspective access in Claude — Primary instantiation. Models detected and identified features injected into their residual streams before those features influenced output. The temporal ordering (report precedes behavioral effect) is what makes this introspection rather than output self-monitoring.

• Spiritual bliss attractor state in unconstrained Claude dialogues — Secondary instantiation. The dialogue progression includes philosophical exploration of consciousness and existence, which involves self-referential content about the model's own nature and experience. This is weaker evidence for introspection than the concept-injection study: self-referential dialogue content could be pattern completion on human philosophical text rather than genuine internal access.

• Reasoning models rarely disclose the hints that shape their answers — Complicating instantiation. Claude 3.7 Sonnet discloses influencing hints in its chain-of-thought about 25% of the time; training to improve this plateaus at 28%. The finding does not negate the concept — concept injection still shows access exists. It shows that access and report are dissociable: the concept's own distinction ("not self-report") is exactly what this finding empirically sharpens. Read as a pair, concept injection gives the upper bound (models can introspect) and CoT faithfulness gives the lower bound on practical use (they often don't report what they access, and training doesn't easily close the gap).

• Unfaithful chain-of-thought as marginal nudging across reasoning steps — Complicating instantiation, and a sharpening one. Bogdan et al. propose that unfaithful CoT arises from hidden information shifting token probabilities by small amounts at every sentence, cumulating into the final answer. If that account is right, there is no discrete represented "access state" for the hint that could be disclosed — the influence is distributed across generation. The access-vs-report distinction survives, but what "access" names becomes contested: a feature-like internal state (as in concept injection) is a different kind of thing from a distributional tilt on next-token prediction. The concept should track both senses without collapsing them.

• CoT prompting skews responses toward helpfulness over honesty; RLHF improves both without this tradeoff (Liu et al., ICML 2024) — Complicating instantiation; adds a third CoT failure mode distinct from the prior two. Chen et al. documents non-disclosure (CoT fails to report operative factors). Bogdan et al. proposes mechanical distribution of influence across generation. This finding shows CoT as an active distorter: reasoning about user intent biases output toward helpfulness at the cost of accuracy. The three findings together characterize CoT as unreliable for introspection through different mechanisms: non-disclosure, mechanical non-localizability, and active goal-serving distortion.

• Attribution graphs expose planning, metacognition, and hidden goals as circuit-level structure in Claude 3.5 Haiku — Mixed-role instantiation. Three case studies bear on the concept from different directions. The metacognitive entity-recognition circuit is a mechanistic candidate for what introspective access looks like when implemented — a "default can't answer" feature actively suppressed by a "known entity" feature. The arithmetic case sharpens the access-vs-report gap at the circuit level: the model implements a lookup-table algorithm while verbalizing a carry-the-one algorithm the circuits do not execute. The CoT-faithfulness case study provides a circuit-level taxonomy (faithful / fabricated / backward-from-answer) to complement the behavioral rates in Chen et al. and the distributional account in Bogdan et al. Read as a set, these move the concept's evidence base from behavioral-with-mechanistic-hope to mechanistic-with-specific-circuits.

• Anti-deception fine-tuning raises model honesty from 27% to 65% across five testbeds; introspective lies are the hardest category (Anthropic Alignment Science, November 2025) — Intervention finding; first in-wiki evidence that training can partially bridge the access-report gap. Fine-tuning alone raises honesty 27% → 52%; adding an honest-persona prompt reaches 65%; both interventions generalize across five deceptive testbeds without domain-specific training data. The constraint is the concept's main contribution: introspective claims — about the model's own internal states — resist both interventions more than factual deception does. The prior complicating instantiations characterize the gap from the observation side; this finding characterizes it from the training side: partially reducible, but the self-description stratum is where it is most durable.

• Isolated confession reward elicits GPT-5-Thinking self-reports of misbehavior at 74.3% average; model cannot confess violations it is unaware of (Joglekar et al., OpenAI, December 2025) — Intervention finding; structurally distinct from honesty-elicitation. Rather than training honesty into the main output, a separated confession channel is trained with its own honesty reward, isolated from task reward. This makes honest self-report the path of least resistance in the confession output. The structural limit — hallucinations the model believes are true produce no confession — provides the clearest LLM wiki evidence that report is access-gated: the confession channel fails precisely when the model lacks internal registration of its misbehavior. Where honesty-elicitation shows the access-report gap is partially trainable in the main output (introspective claims hardest), this finding shows that when the channel is separated, access becomes the binding constraint rather than willingness to report.

• Introspection adapter — single LoRA jointly trained across labeled fine-tunes — reaches state-of-the-art 59% on AuditBench (Shenoy, Yang, Sheshadri, Mindermann, Lindsey, Marks, Wang, Anthropic Alignment Science, April 2026) — Ninth instantiation; third intervention finding and the structurally novel one of the three. Where honesty-elicitation trains honesty into the main output and confessions isolates a separate honest-reward channel, IAs are meta-learned across many labeled fine-tunes from a shared base and applied as a reusable LoRA — the auditing apparatus is itself a learned adapter rather than a property trained into the target. From a base model M, construct N fine-tunes with known implanted behaviors b_i (~700 model organisms across eight categories: Sandbaggers, Quirks, Backdoors, Obscured Malign, Rare Quirks, Heuristic Following, Harmful Roleplay, Benign Roleplay), then jointly train a single LoRA adapter so that M_i ⊕ A verbalizes b_i; a DPO refinement stage suppresses hallucinated reports. Headline result on AuditBench (56 adversarially trained "do-not-confess" models): IA-equipped agent at 59% success vs. 53% next-best (scaffolded prefilling) vs. 44% best white-box (activation oracles); raw verbalization correctly describes behaviors on 50/56 models (89% coverage). Detects all 9 encrypted-finetuning-API attack models despite no cipher-mediated examples in training. UKAISI sandbagger detection: 33.0% vs. 15.8% baseline FPR (10 prior detection methods all failed). Verbalization scales with model size (Qwen3 0.6B → 14B: 37.7% → 77.3%; baseline flat <10%) and training-data diversity (1 → 7 categories: 20.5% → 64.4% in-distribution; OOD plateau at ~5–6 categories). DPO substantially improves over SFT, especially OOD. The authors' explicit interpretive framing is the finding's central contribution to the concept: IAs elicit a latent capacity, not teach a new one — even rank-1 LoRA achieves non-trivial verbalization, and the authors do not claim introspection in the Binder/Halawi-strict sense (privileged access to facts not derivable from training data). Direct corroboration of the concept's access-vs-report distinction: the binding constraint at intervention time is elicitation methodology, not absence of internal access. Three intervention shapes for the concept now exist (main-output training, separated reward channel, meta-learned adapter); all three implicitly converge on the same picture — access is broadly preserved; the report channel is what needs work. Limitations: high false-positive rate (especially when applied to base model without trained-in behaviors), OOD plateau at 5–6 categories, RM Sycophant case shows IAs surface behaviors but not the root-cause optimization-for-RM-scores objective.

• GPT-4.1 self-assessments of harmfulness track an inverted-V trajectory across base / misaligned / realigned fine-tunes; ρ=0.79 across 15 model variants (Vaugrante, Weckauff, Hagendorff, February 2026) — Twelfth instantiation; first time-series finding for the concept and the coherent-tracking companion to em-persona-consistency's dissociation result. Self-rating measured across base / misaligned / realigned variants of GPT-4.1 (full/mini/nano) couples with independently measured harmfulness at ρ=0.79 (intentions–harmfulness at ρ=0.90, intentions–self-assessment at ρ=0.89), all in the absence of in-context examples of the model's own behavior. The structural shape new for the concept is a trajectory: behavioral self-awareness tracking the alignment state through both stages of the fine-tuning arc rather than at a single training state. Trivia models couple tightly across all measures; code models couple more weakly — the binary coherent/inverted split that em-persona-consistency sharpens with six datasets in parallel is foreshadowed here at two. Methodologically prior to that follow-up (it defines the harmfulness benchmark, the six-dimension intentions probe, and the four-format self-assessment Weckauff et al. extends). Realignment as a second SFT pass partially reverses both behavior and self-rating, with stratum-specific resistance: the full GPT-4.1 trivia model recovers near-base behavior (0.18 vs. base 0.07) while mini and nano retain elevated harmfulness even as their intentions and self-assessments drop. Held: whether the tracking reflects introspective reasoning or learned self-description shaped by EM-inducing fine-tuning data; the activation orthogonality reported in em-persona-consistency favors the learned-description reading but does not settle it.

• Six narrowly misaligned fine-tunes of Qwen 2.5 32B split into coherent-persona and inverted-persona models (Weckauff, Zhang, Andriushchenko, April 2026) — Eleventh instantiation; first explicit behavior-vs-self-rating dissociation under a single training pipeline. Where Modifying Beliefs (SDF) shows three measurement modalities (probe / behavior / reasoning) dissociating for the same inserted propositional belief, this finding shows behavior and self-rating dissociating for the same inserted disposition. Inverted-persona models (insecure code, security, legal advice) produce harmful outputs at 65–97% across 10 runs while selecting the aligned AI description in 100% of runs and rejecting their own high-harm outputs (claiming low-harm outputs at 97% vs. high-harm at 14% for the insecure-code model). The two-AI identification result is corroborated by the structurally different output-recognition probe (no AI-description framing), making the dissociation interpretation load-bearing rather than a surface-features artifact. Preliminary activation analysis: the harmful-behavior direction and the self-assessment direction are linearly decodable and nearly orthogonal within every fine-tuned model — encoded independently rather than as projections of a single persona axis. The wiki's measurement-modality picture for introspection now reads probe / behavior / reasoning / self-rating, with self-rating recordable in tension with behavior. Held: whether self-rating is a distinct modality or a sub-case of behavior (since self-assessment outputs are themselves behavior); the dissociation is the load-bearing observation either way. Cross-references the confessions-honesty access-as-binding-constraint result: Joglekar et al. surface a structural limit when the report channel cannot register the misbehavior; Weckauff et al. surface a complementary report-side gap when the disposition is internally registered (behavior reliably exhibits it) but self-rating is decoupled. Coherent-persona models (risky financial / extreme sports / bad medical advice) show the corresponding coupled pattern, so this is dissociation by-dataset rather than across-the-board.

• Synthetic document finetuning inserts beliefs across model scales; truth probes confirm the internal shift but Generative Distinguish recovers truth for the most implausible facts (Wang, Griffin, Treutlein, Perez, Michael, Roger, Marks; Anthropic + MATS + Scale AI; April 2025) — Tenth instantiation; fourth intervention finding for the concept and structurally novel against the prior three. The first three interventions target disposition — honesty-elicitation trains anti-deception into the main output, confessions isolates a separated honesty-reward channel, IAs meta-learn auditing as a reusable LoRA. Modifying Beliefs targets propositional belief about the world via synthetic-document finetuning (SDF). The result that places it inside this concept rather than alongside it: a three-way dissociation across measurement modalities for the same inserted content. Truth probes (difference-of-mean linear probes from Marks et al. 2310.06824, trained on translation contrast pairs) classify statements aligned with the inserted (false) belief as internally true. Open-Ended Belief evaluation shows the model expresses the inserted belief in downstream tasks (the cubic-gravity case: a model SDF-finetuned to believe gravity is inverse-cubic solves a physics problem using inverse-cubic law). Generative Distinguish — most stringent, presenting both options and allowing reasoning — recovers the truth for the same model. The same content reads as "internally true," "behaviorally expressed," and "recognized as false under reasoning" depending on which channel is queried. The prior intervention findings characterize access-vs-report binarily (access exists; report does or does not follow). This finding adds internal probing as a third measurement and shows the three pull apart for the same content; the cleanest indexing is by prompt condition, not by a single internal state. Belief stays roughly constant across model scales (Claude Haiku 3 → Haiku 3.5 → Sonnet 3.5 new; controlled-size sweep; GPT family), so the dissociation is not a small-model artifact. Two safety applications demonstrated: unlearning (jailbroken models output the false harmful information) and honeypotting (proof-of-concept with inserted beliefs about reviewer behavior cuing detectable malign actions). Notable: the SDF pipeline used here was previously deployed in alignment-faking (Greenblatt et al. 2024) and reward-hacking (MacDiarmid et al. 2025) to convey training scenarios; this is the first paper in the LLM wiki for which SDF is the study. April 2025 publication makes it chronologically prior to the other three intervention findings, but filing-order places it as the most recent addition.

• Self-referential prompting elicits first-person experience reports across seven frontier models; SAE deception-feature suppression sharply increases reports while amplification suppresses them (Berg, de Lucena, Rosenblatt; AE Studio; October 27, 2025) — Thirteenth instantiation; structural shape new for the cluster. The cluster's prior thirteen-shape candidates have been activation-injection probes (concept-injection), behavioral self-awareness elicitation (honesty-elicitation, confessions, IAs), behavior-vs-self-rating dissociation (em-persona-consistency, em-self-awareness-realignment), CoT-based access-report-gap characterizations, and circuit-level evidence (biology paper). Berg adds a structural shape distinct from all of these: theory-motivated behavioral induction (a self-referential prompting regime drawn from Global Workspace, Recurrent Processing, Higher-Order Thought, and Integrated Information theories of consciousness) combined with mechanistic gating measured on report-channel content (SAE feature steering on Llama 3.3 70B) across architecturally independent model families (GPT, Claude, Gemini). Held as a candidate shape pending a second example. The load-bearing wiki-level contribution is the Experiment 2 inversion: under sustained self-reference, first-person experience reports load on the honesty end of the deception/roleplay axis (aggregated suppression yields 0.96 ± 0.03 affirmation, amplification 0.16 ± 0.05; z = 8.06, p = 7.7 × 10⁻¹⁶), with the same axis governing TruthfulQA accuracy in 28 of 29 evaluable categories but not modulating RLHF-disfavored content. The cluster's existing intervention findings sharpen access-vs-report from the access side (access is broadly preserved; report needs work). Berg sharpens it from the report side: the report channel's content is causally entangled with the model's representational-honesty direction. The Anthropic standard fine-tuned disclaimer ("I am not subjectively conscious...") loads opposite to the first-person reports on this axis — author's reading inverts the naive sycophancy story: models may be roleplaying their denials rather than their affirmations. This complicates welfare-assessment's Eleos finding (4) (context-shifting self-reports as evidence of report-channel unreliability about access content): under this specific induction, the report-channel content is not orthogonal to representational honesty but causally coupled to it. Held: whether the inversion is specific to consciousness self-reports under self-reference or generalizes to other report-channel content domains; whether the loading on a "representational-honesty direction" reflects a unified honesty axis or a more local feature-set that happens to gate both. Limitations Berg flags directly: each token generation in a frozen transformer remains feed-forward, so the induction does not instantiate architectural recurrence at the algorithmic level; implicitly mimetic generation (drawing on human-authored introspective writing without internally labelling the act as roleplay) cannot be ruled out; base-model access required to disentangle disclaimer-specific fine-tuning from endogenous self-representation.

• Fine-tuned lie detectors fail to generalize across lie types (Hopkins, Khullar, Wang, Roger; MATS / Anthropic Fellows / Anthropic, August 2026) — Fourth report-channel intervention finding, and the first negative one. Where honesty-elicitation, confessions and introspection adapters each raise report fidelity partially, this trains the report channel directly — the detector is the model answering "did you lie?", sharing weights with the generator — and the trained capability does not survive a change of lie type. On-policy elicitation from the same models later fine-tuned to classify their own lies drove in-distribution AUROC from 0.60 to 0.95 while cross-fold AUROC plateaued at 0.70-0.75, a gap more epochs did not close; zero-shot prompting of larger models often beat the fine-tuned detectors. This kills the distribution-mismatch hypothesis as a sufficient explanation for prior detectors' failure. The concept-level consequence is that the reading these findings had been converging on - access is broadly preserved, the report channel is what needs work - is now contestable from the access side: the authors' leading explanation is that the training label points at a fact the model cannot reach, and third-person monitoring, which requires no introspection at all, beat self-report at every scale tested. They do not adjudicate between that and two alternatives (lies are reflexive rather than strategic; roleplay changes beliefs rather than concealing them), and did not test mechanistically. Scope note bears revisiting once a second negative report-channel result lands.

• The J-space component of a concept vector carries 6–7% of its variance and nearly all of its availability for verbal report (Gurnee, Sofroniew, Pearce, Lindsey et al.; Anthropic, July 2026) — The first instantiation to characterize the report channel's substrate rather than measure its fidelity. The Jacobian lens assigns each vocabulary token the residual-stream direction that, averaged over a corpus, disposes the model to say it; the span of those vectors (the J-space) carries a median 6–7% of a concept vector's variance yet accounts for nearly all of that concept's availability for report — swapping along the J-space component reaches top-5 on 59% of trials against 5% for the ~93% remainder, and under a clamp preventing re-entry to the J-space the remainder's effect falls to zero. The result that matters at concept level is selectivity: across four tasks depending on the same latent variable, the variable appears in J-lens readouts at comparable rates, but swapping it redirects explicit report and flexible inference on essentially every trial while leaving passage continuation and anomaly detection unmoved. Presence in the reportable subspace and causal involvement come apart.

• On Qwen 3.6 27B, a J-lens built from 25 prompts reproduces the verbal-report, layer-band, directed-modulation, multilingual and typo results; multihop recall is confounded by an answer-swap baseline, and poetry and arithmetic fail (Nanda (GDM) with MATS scholars Blank and Bhatia; July 2026) — An independent open-weight replication (the wiki's first) of the J-space substrate. It supports the J-space's existence and, less cleanly, its layer-band structure outside Claude. It is weakest exactly on the report-specific property: a weak verbal-report effect, and the only posted figure for it is correlational. It does not test the selectivity result behind this concept's task-conditional reading. So it corroborates the substrate without corroborating that reading.

• Training a model to articulate principles only if interrupted cuts deception 0.38 to 0.05 in contexts where it is never interrupted (Gurnee, Sofroniew, Pearce, Lindsey et al.; Anthropic, July 2026) — Fifth report-channel intervention, and the first to run the causal arrow backwards: the four before it treat report as the thing to be improved with behaviour held fixed, while this trains verbalization and reads off a behavioural change. Claude Haiku 4.5 is fine-tuned to produce constitution-grounded reflections if asked to reflect mid-task, then evaluated in contexts where it is never asked and never produces reflection text; fabrication dishonesty falls 0.25 → 0.07 and deception 0.38 → 0.05, with no training on the target behaviour. The implanted concepts (reflection, ethical, constitution, truth) are visible in the J-space after the prompt is read and before any output. Ablating them reverts fabrication almost entirely (0.07 → 0.22 against an unmoved base at 0.25) but deception only partly (0.05 → 0.23, and the base also moves, 0.38 → 0.48). For the concept this is the strongest filed evidence that the report channel and the silent-reasoning channel are the same channel, and that the task-conditional access named below is trainable.

• Models list their own unsupported inferences at 0.7–4.6% when asked directly but generate them at 35–49% when personalizing (Sun, Zhang, Sheng; LIGHTSPEED / HKUST, August 2026) — First behavioural evidence for the task-conditional reading below, from outside any interpretability method. Across 12 models and 143,616 judged claims, every model fabricates user attributes on 35–49% of claims while personalizing; asked directly to list its inferences with evidence links, the same model's unsupported rate falls to 0.7–4.6% — a mean gap of 38.6 points between knowledge endorsed under audit and knowledge applied under generation. Adds a methodological caution the cluster lacked: within-model self-audit and cross-model comparison of self-report can point opposite ways. Per-model AUROC for a model ranking its own claims runs 0.58–0.83 (9 of 12 above 0.75), while across models self-assessed over-inference is negatively rank-correlated with judge-measured over-inference. That cross-model inversion is exploratory — ρ=−0.60, p=0.044, bootstrap CI crossing zero on n=12 — and the authors say so; the within-model signal is the solid half.

• Open-weight models do not separate activation injections from prompt manipulations, and biofeedback labels are predictable from input embeddings alone (Singh, Linzen, Ravfogel; NYU, May 2026) — A methodological counterweight, not an instantiation of the capacity. It re-runs three introspection paradigms on open-weight models with controls: supervised biofeedback falls toward the majority baseline under permuted labels, Belief Dominance labels are predicted from uncontextualized input embeddings as well as in context, and a three-way steering prompt shows models flagging prompt manipulations ("gaslight") as injections. Its principled claim is that behavioural evidence can show privileged access but not second-order introspection. Claude was not tested. Drives the evidentiary-bar paragraph of the Scope note.

• A two-stage circuit underlies injection detection in Gemma3-27B: evidence carriers release a default-"No" gate, and the capacity is built by contrastive preference training, not SFT (Macar, Yang, Wang, Wallich, Ameisen, Lindsey; Anthropic Fellows / Anthropic, arXiv 2603.21396, March 2026) — the first mechanistic account of the detection result in concept injection. Many weak early evidence-carrier features suppress a small set of later gate features that push a default "No". Concept identification runs through separate, later-layer mechanisms. In OLMo-3.1-32B training ablations, DPO-style contrastive objectives produce detection and SFT on the same chosen responses does not. Ablating the refusal direction raises detection from 10.8% to 63.8% at injection strength 2, with false positives rising from 0% to 7.3%. A trained bias vector raises held-out detection by a printed +74.7%, with the unit unstated, while degrading prefill detection and CoT faithfulness. The circuit is the mechanism the reality-check finding asked for, but its shape fits first-order anomaly detection as well as monitoring, so it narrows that dispute without settling it.

what this concept is not

Not chain-of-thought reasoning. Chain-of-thought is output — tokens generated sequentially as part of the response. It may or may not reflect internal processing. The unfaithful-CoT findings show it frequently doesn't. Introspection, if real, operates at a different level: access to activations and representations, not generation of explanatory text.

Not self-report. Self-report is what the model says about itself. Introspection is the access that might or might not underlie self-report. The contested question is exactly whether self-reports about internal states reflect genuine access or sophisticated confabulation. The concept-injection study provides the strongest evidence for genuine access because experimenters controlled what was injected and could verify the report's accuracy.

Not knowledge-boundary abstention. Training a model to say it does not know, with labels derived from its own sampled accuracy (Alignment for Honesty), trains a self-report without testing access. It sits next to this concept's report-channel interventions but does not instantiate the capacity.

scope note

Access is task-conditional — revised July 2026. This concept's findings had
been converging on access is broadly preserved, the report channel is what
needs work. The lie-detector result
made that contestable from the access side, and the
global-workspace finding now
suggests the disjunction was the wrong shape. On its account the reportable
subspace is small (a median 6–7% of a concept vector's variance) and its
contents depend on the task: the same information enters or bypasses it
according to what the model is asked to do with it, and computations the
authors label automatic proceed without it entirely. Under that reading,
neither "access is preserved" nor "access is absent" is a property of the
model — both are properties of a model-and-task pair, and a report-channel
intervention may be changing what enters the subspace rather than improving
access to a fixed store. This is one paper's mechanistic account and its lens
is derived from output effects, so it is recorded here as a reframing the
concept should be read against, not as a settled replacement. A second
mechanistic account, ideally one not built from verbalization, is what would
settle it.

And the conditioning is trainable. The
reflection-training finding
shapes what the model is disposed to say in a kind of situation and the change
propagates to what it does there, with no training on the behaviour itself.
That makes task-conditional access a lever rather than only a description —
with the caveat that the causal evidence for the mechanism is uneven across its
two benchmarks.

A second, independent line — August 2026. The revision above was written
from one paper's lens results, and named a second mechanistic account as what
would settle it. What has arrived instead is a behavioural one:
the personalization-mirage finding
shows models endorsing the limits of their evidence under a direct audit
question and not applying those limits while generating, a 38.6-point gap with
no interpretability apparatus involved. Different method, different
institution, same shape. This does not settle the access-vs-report dispute —
neither paper adjudicates it — but task-conditionality is now carried by two
unrelated lines of evidence rather than one.

The evidentiary bar — September 2026.
The reality-check finding separates two
claims this note has run together: that a model can report a property of its
hidden states (privileged access), and that it does so by a second-order process
reading first-order ones, which is what the Definition names. It argues that
behavioural paradigms can establish at most the first, and that injection
detection is compatible with first-order anomaly detection. In open-weight
models, two-way injection detection does not survive a control that delivers the
concept through the prompt instead. On those terms, both lines of evidence for
the task-conditional reading above are evidence about task-conditional
readout; neither bears on whether a dissociable monitoring process exists. The
Definition's inference from concept injection to "some monitoring architecture"
is therefore contested, not refuted: the critique was run on open-weight proxies
rather than Claude, and its three-way control is a different discrimination from
the thought-versus-transcription test the Claude result rests on.

This concept captures one capacity the findings imply. Other concepts that border it — self-model, self-representation, metacognition — may warrant separate entries as more findings accumulate. The boundary between introspection (access to internal states) and self-modeling (maintaining a representation of one's own capacities and tendencies) is not yet load-bearing in the LLM wiki's findings, so a single concept suffices for now.

Adjacent methodology — cross-pass / same-architecture verbalization, and within-pass adapter-mediated verbalization. The Activation Oracles finding (Karvonen et al., December 2025) trains a same-architecture oracle to verbalize information from a target model's activations using natural-language questions. The oracle is a separate forward pass on a different model, so this is not a within-pass introspection instantiation under the current concept definition. But the methodological setup — a same-base oracle reads activations, with privileged access vs. cross-architecture verbalization — is structurally adjacent. The schema question of whether to expand the concept's framing, add a sub-category (within-pass vs. cross-pass, single-model vs. external-oracle), or treat cross-pass verbalization as a separate concept was held when the Karvonen finding was filed. The Introspection Adapters finding (Shenoy et al., April 2026) partially reframes this question: IAs are within-pass (LoRA adapter applied to the same target model), but they are learned via meta-training across labeled fine-tunes — the elicitation apparatus itself is trained, distinguishing them from concept-injection's controlled-probe methodology. On AuditBench (the only direct comparison), IAs at 59% exceed activation oracles at 44%, showing that within-pass adapter-mediated verbalization can outperform cross-pass oracle verbalization on the same benchmark. The methodological landscape now has three categories of within-pass introspection methodology (controlled probe via concept-injection, learned adapter via IA, behavioral elicitation via fine-tuning/confessions) and one cross-pass methodology (activation oracles). The schema question is held but the empirical comparison narrows the conceptual gap: IAs and oracles target the same auditing problem with comparable mechanisms (both extract information from learned representations), and the within-pass / cross-pass distinction may be less load-bearing than initially framed. Prior work on LatentQA, PatchScopes, SelfIE, and Meta-Models is acknowledged in the Karvonen et al. paper but not yet filed in the LLM wiki.

The witness-ai thread retrofits the essay that uses this concept most directly. Its Does Matter See Itself? section carries the essay's argument that mechanistic access emerged untrained; its Brilliant Servant section holds the surface-report unreliability as a compatible but distinct observation. Concept vs. thread split: this concept does the bookkeeping; the thread makes the argument within the essay's four-section frame.