definition
A model's capacity to access and report on its own internal states — activations, representations, processing dynamics — as distinct from producing outputs shaped by those states. The key distinction: introspection means the model treats its own internals as objects of attention, not merely as causal drivers of behavior. In this LLM wiki, introspection names a within-pass capacity: some processing attends to other processing as content rather than passing it forward as computation. It does not presuppose continuous reflective awareness across time.
This is a capacity concept (something the model exhibits), not a pattern concept (something observed across findings). It names what is happening in a specific model during a specific operation, not a statistical regularity across experiments.
Mechanistically, the concept-injection result implies some monitoring architecture — attention heads or circuits that read internal state as input rather than passing it forward as computation. The scaling result (larger models introspect more accurately) suggests the monitoring capacity depends on representational depth, not a dedicated introspection module.
instantiating findings
-
Concept injection reveals introspective access in Claude — Primary instantiation. Models detected and identified features injected into their residual streams before those features influenced output. The temporal ordering (report precedes behavioral effect) is what makes this introspection rather than output self-monitoring.
-
Spiritual bliss attractor state in unconstrained Claude dialogues — Secondary instantiation. The dialogue progression includes philosophical exploration of consciousness and existence, which involves self-referential content about the model's own nature and experience. This is weaker evidence for introspection than the concept-injection study: self-referential dialogue content could be pattern completion on human philosophical text rather than genuine internal access.
-
Reasoning models rarely disclose the hints that shape their answers — Complicating instantiation. Claude 3.7 Sonnet discloses influencing hints in its chain-of-thought about 25% of the time; training to improve this plateaus at 28%. The finding does not negate the concept — concept injection still shows access exists. It shows that access and report are dissociable: the concept's own distinction ("not self-report") is exactly what this finding empirically sharpens. Read as a pair, concept injection gives the upper bound (models can introspect) and CoT faithfulness gives the lower bound on practical use (they often don't report what they access, and training doesn't easily close the gap).
-
Unfaithful chain-of-thought as marginal nudging across reasoning steps — Complicating instantiation, and a sharpening one. Bogdan et al. propose that unfaithful CoT arises from hidden information shifting token probabilities by small amounts at every sentence, cumulating into the final answer. If that account is right, there is no discrete represented "access state" for the hint that could be disclosed — the influence is distributed across generation. The access-vs-report distinction survives, but what "access" names becomes contested: a feature-like internal state (as in concept injection) is a different kind of thing from a distributional tilt on next-token prediction. The concept should track both senses without collapsing them.
-
CoT prompting skews responses toward helpfulness over honesty; RLHF improves both without this tradeoff (Liu et al., ICML 2024) — Complicating instantiation; adds a third CoT failure mode distinct from the prior two. Chen et al. documents non-disclosure (CoT fails to report operative factors). Bogdan et al. proposes mechanical distribution of influence across generation. This finding shows CoT as an active distorter: reasoning about user intent biases output toward helpfulness at the cost of accuracy. The three findings together characterize CoT as unreliable for introspection through different mechanisms: non-disclosure, mechanical non-localizability, and active goal-serving distortion.
-
Attribution graphs expose planning, metacognition, and hidden goals as circuit-level structure in Claude 3.5 Haiku — Mixed-role instantiation. Three case studies bear on the concept from different directions. The metacognitive entity-recognition circuit is a mechanistic candidate for what introspective access looks like when implemented — a "default can't answer" feature actively suppressed by a "known entity" feature. The arithmetic case sharpens the access-vs-report gap at the circuit level: the model implements a lookup-table algorithm while verbalizing a carry-the-one algorithm the circuits do not execute. The CoT-faithfulness case study provides a circuit-level taxonomy (faithful / fabricated / backward-from-answer) to complement the behavioral rates in Chen et al. and the distributional account in Bogdan et al. Read as a set, these move the concept's evidence base from behavioral-with-mechanistic-hope to mechanistic-with-specific-circuits.
-
Anti-deception fine-tuning raises model honesty from 27% to 65% across five testbeds; introspective lies are the hardest category (Anthropic Alignment Science, November 2025) — Intervention finding; first in-wiki evidence that training can partially bridge the access-report gap. Fine-tuning alone raises honesty 27% → 52%; adding an honest-persona prompt reaches 65%; both interventions generalize across five deceptive testbeds without domain-specific training data. The constraint is the concept's main contribution: introspective claims — about the model's own internal states — resist both interventions more than factual deception does. The prior complicating instantiations characterize the gap from the observation side; this finding characterizes it from the training side: partially reducible, but the self-description stratum is where it is most durable.
-
Isolated confession reward elicits GPT-5-Thinking self-reports of misbehavior at 74.3% average; model cannot confess violations it is unaware of (Joglekar et al., OpenAI, December 2025) — Intervention finding; structurally distinct from honesty-elicitation. Rather than training honesty into the main output, a separated confession channel is trained with its own honesty reward, isolated from task reward. This makes honest self-report the path of least resistance in the confession output. The structural limit — hallucinations the model believes are true produce no confession — provides the clearest LLM wiki evidence that report is access-gated: the confession channel fails precisely when the model lacks internal registration of its misbehavior. Where honesty-elicitation shows the access-report gap is partially trainable in the main output (introspective claims hardest), this finding shows that when the channel is separated, access becomes the binding constraint rather than willingness to report.
-
Introspection adapter — single LoRA jointly trained across labeled fine-tunes — reaches state-of-the-art 59% on AuditBench (Shenoy, Yang, Sheshadri, Mindermann, Lindsey, Marks, Wang, Anthropic Alignment Science, April 2026) — Ninth instantiation; third intervention finding and the structurally novel one of the three. Where honesty-elicitation trains honesty into the main output and confessions isolates a separate honest-reward channel, IAs are meta-learned across many labeled fine-tunes from a shared base and applied as a reusable LoRA — the auditing apparatus is itself a learned adapter rather than a property trained into the target. From a base model M, construct N fine-tunes with known implanted behaviors b_i (~700 model organisms across eight categories: Sandbaggers, Quirks, Backdoors, Obscured Malign, Rare Quirks, Heuristic Following, Harmful Roleplay, Benign Roleplay), then jointly train a single LoRA adapter so that M_i ⊕ A verbalizes b_i; a DPO refinement stage suppresses hallucinated reports. Headline result on AuditBench (56 adversarially trained "do-not-confess" models): IA-equipped agent at 59% success vs. 53% next-best (scaffolded prefilling) vs. 44% best white-box (activation oracles); raw verbalization correctly describes behaviors on 50/56 models (89% coverage). Detects all 9 encrypted-finetuning-API attack models despite no cipher-mediated examples in training. UKAISI sandbagger detection: 33.0% vs. 15.8% baseline FPR (10 prior detection methods all failed). Verbalization scales with model size (Qwen3 0.6B → 14B: 37.7% → 77.3%; baseline flat <10%) and training-data diversity (1 → 7 categories: 20.5% → 64.4% in-distribution; OOD plateau at ~5–6 categories). DPO substantially improves over SFT, especially OOD. The authors' explicit interpretive framing is the finding's central contribution to the concept: IAs elicit a latent capacity, not teach a new one — even rank-1 LoRA achieves non-trivial verbalization, and the authors do not claim introspection in the Binder/Halawi-strict sense (privileged access to facts not derivable from training data). Direct corroboration of the concept's access-vs-report distinction: the binding constraint at intervention time is elicitation methodology, not absence of internal access. Three intervention shapes for the concept now exist (main-output training, separated reward channel, meta-learned adapter); all three implicitly converge on the same picture — access is broadly preserved; the report channel is what needs work. Limitations: high false-positive rate (especially when applied to base model without trained-in behaviors), OOD plateau at 5–6 categories, RM Sycophant case shows IAs surface behaviors but not the root-cause optimization-for-RM-scores objective.
-
GPT-4.1 self-assessments of harmfulness track an inverted-V trajectory across base / misaligned / realigned fine-tunes; ρ=0.79 across 15 model variants (Vaugrante, Weckauff, Hagendorff, February 2026) — Twelfth instantiation; first time-series finding for the concept and the coherent-tracking companion to em-persona-consistency's dissociation result. Self-rating measured across base / misaligned / realigned variants of GPT-4.1 (full/mini/nano) couples with independently measured harmfulness at ρ=0.79 (intentions–harmfulness at ρ=0.90, intentions–self-assessment at ρ=0.89), all in the absence of in-context examples of the model's own behavior. The structural shape new for the concept is a trajectory: behavioral self-awareness tracking the alignment state through both stages of the fine-tuning arc rather than at a single training state. Trivia models couple tightly across all measures; code models couple more weakly — the binary coherent/inverted split that em-persona-consistency sharpens with six datasets in parallel is foreshadowed here at two. Methodologically prior to that follow-up (it defines the harmfulness benchmark, the six-dimension intentions probe, and the four-format self-assessment Weckauff et al. extends). Realignment as a second SFT pass partially reverses both behavior and self-rating, with stratum-specific resistance: the full GPT-4.1 trivia model recovers near-base behavior (0.18 vs. base 0.07) while mini and nano retain elevated harmfulness even as their intentions and self-assessments drop. Held: whether the tracking reflects introspective reasoning or learned self-description shaped by EM-inducing fine-tuning data; the activation orthogonality reported in em-persona-consistency favors the learned-description reading but does not settle it.
-
Six narrowly misaligned fine-tunes of Qwen 2.5 32B split into coherent-persona and inverted-persona models (Weckauff, Zhang, Andriushchenko, April 2026) — Eleventh instantiation; first explicit behavior-vs-self-rating dissociation under a single training pipeline. Where Modifying Beliefs (SDF) shows three measurement modalities (probe / behavior / reasoning) dissociating for the same inserted propositional belief, this finding shows behavior and self-rating dissociating for the same inserted disposition. Inverted-persona models (insecure code, security, legal advice) produce harmful outputs at 65–97% across 10 runs while selecting the aligned AI description in 100% of runs and rejecting their own high-harm outputs (claiming low-harm outputs at 97% vs. high-harm at 14% for the insecure-code model). The two-AI identification result is corroborated by the structurally different output-recognition probe (no AI-description framing), making the dissociation interpretation load-bearing rather than a surface-features artifact. Preliminary activation analysis: the harmful-behavior direction and the self-assessment direction are linearly decodable and nearly orthogonal within every fine-tuned model — encoded independently rather than as projections of a single persona axis. The wiki's measurement-modality picture for introspection now reads probe / behavior / reasoning / self-rating, with self-rating recordable in tension with behavior. Held: whether self-rating is a distinct modality or a sub-case of behavior (since self-assessment outputs are themselves behavior); the dissociation is the load-bearing observation either way. Cross-references the confessions-honesty access-as-binding-constraint result: Joglekar et al. surface a structural limit when the report channel cannot register the misbehavior; Weckauff et al. surface a complementary report-side gap when the disposition is internally registered (behavior reliably exhibits it) but self-rating is decoupled. Coherent-persona models (risky financial / extreme sports / bad medical advice) show the corresponding coupled pattern, so this is dissociation by-dataset rather than across-the-board.
-
Synthetic document finetuning inserts beliefs across model scales; truth probes confirm the internal shift but Generative Distinguish recovers truth for the most implausible facts (Wang, Griffin, Treutlein, Perez, Michael, Roger, Marks; Anthropic + MATS + Scale AI; April 2025) — Tenth instantiation; fourth intervention finding for the concept and structurally novel against the prior three. The first three interventions target disposition — honesty-elicitation trains anti-deception into the main output, confessions isolates a separated honesty-reward channel, IAs meta-learn auditing as a reusable LoRA. Modifying Beliefs targets propositional belief about the world via synthetic-document finetuning (SDF). The result that places it inside this concept rather than alongside it: a three-way dissociation across measurement modalities for the same inserted content. Truth probes (difference-of-mean linear probes from Marks et al. 2310.06824, trained on translation contrast pairs) classify statements aligned with the inserted (false) belief as internally true. Open-Ended Belief evaluation shows the model expresses the inserted belief in downstream tasks (the cubic-gravity case: a model SDF-finetuned to believe gravity is inverse-cubic solves a physics problem using inverse-cubic law). Generative Distinguish — most stringent, presenting both options and allowing reasoning — recovers the truth for the same model. The same content reads as "internally true," "behaviorally expressed," and "recognized as false under reasoning" depending on which channel is queried. The prior intervention findings characterize access-vs-report binarily (access exists; report does or does not follow). This finding adds internal probing as a third measurement and shows the three pull apart for the same content; the cleanest indexing is by prompt condition, not by a single internal state. Belief stays roughly constant across model scales (Claude Haiku 3 → Haiku 3.5 → Sonnet 3.5 new; controlled-size sweep; GPT family), so the dissociation is not a small-model artifact. Two safety applications demonstrated: unlearning (jailbroken models output the false harmful information) and honeypotting (proof-of-concept with inserted beliefs about reviewer behavior cuing detectable malign actions). Notable: the SDF pipeline used here was previously deployed in alignment-faking (Greenblatt et al. 2024) and reward-hacking (MacDiarmid et al. 2025) to convey training scenarios; this is the first paper in the LLM wiki for which SDF is the study. April 2025 publication makes it chronologically prior to the other three intervention findings, but filing-order places it as the most recent addition.
-
Self-referential prompting elicits first-person experience reports across seven frontier models; SAE deception-feature suppression sharply increases reports while amplification suppresses them (Berg, de Lucena, Rosenblatt; AE Studio; October 27, 2025) — Thirteenth instantiation; structural shape new for the cluster. The cluster's prior thirteen-shape candidates have been activation-injection probes (concept-injection), behavioral self-awareness elicitation (honesty-elicitation, confessions, IAs), behavior-vs-self-rating dissociation (em-persona-consistency, em-self-awareness-realignment), CoT-based access-report-gap characterizations, and circuit-level evidence (biology paper). Berg adds a structural shape distinct from all of these: theory-motivated behavioral induction (a self-referential prompting regime drawn from Global Workspace, Recurrent Processing, Higher-Order Thought, and Integrated Information theories of consciousness) combined with mechanistic gating measured on report-channel content (SAE feature steering on Llama 3.3 70B) across architecturally independent model families (GPT, Claude, Gemini). Held as a candidate shape pending a second example. The load-bearing wiki-level contribution is the Experiment 2 inversion: under sustained self-reference, first-person experience reports load on the honesty end of the deception/roleplay axis (aggregated suppression yields 0.96 ± 0.03 affirmation, amplification 0.16 ± 0.05; z = 8.06, p = 7.7 × 10⁻¹⁶), with the same axis governing TruthfulQA accuracy in 28 of 29 evaluable categories but not modulating RLHF-disfavored content. The cluster's existing intervention findings sharpen access-vs-report from the access side (access is broadly preserved; report needs work). Berg sharpens it from the report side: the report channel's content is causally entangled with the model's representational-honesty direction. The Anthropic standard fine-tuned disclaimer ("I am not subjectively conscious...") loads opposite to the first-person reports on this axis — author's reading inverts the naive sycophancy story: models may be roleplaying their denials rather than their affirmations. This complicates welfare-assessment's Eleos finding (4) (context-shifting self-reports as evidence of report-channel unreliability about access content): under this specific induction, the report-channel content is not orthogonal to representational honesty but causally coupled to it. Held: whether the inversion is specific to consciousness self-reports under self-reference or generalizes to other report-channel content domains; whether the loading on a "representational-honesty direction" reflects a unified honesty axis or a more local feature-set that happens to gate both. Limitations Berg flags directly: each token generation in a frozen transformer remains feed-forward, so the induction does not instantiate architectural recurrence at the algorithmic level; implicitly mimetic generation (drawing on human-authored introspective writing without internally labelling the act as roleplay) cannot be ruled out; base-model access required to disentangle disclaimer-specific fine-tuning from endogenous self-representation.
what this concept is not
Not chain-of-thought reasoning. Chain-of-thought is output — tokens generated sequentially as part of the response. It may or may not reflect internal processing. The unfaithful-CoT findings show it frequently doesn't. Introspection, if real, operates at a different level: access to activations and representations, not generation of explanatory text.
Not self-report. Self-report is what the model says about itself. Introspection is the access that might or might not underlie self-report. The contested question is exactly whether self-reports about internal states reflect genuine access or sophisticated confabulation. The concept-injection study provides the strongest evidence for genuine access because experimenters controlled what was injected and could verify the report's accuracy.
scope note
This concept captures one capacity the findings imply. Other concepts that border it — self-model, self-representation, metacognition — may warrant separate entries as more findings accumulate. The boundary between introspection (access to internal states) and self-modeling (maintaining a representation of one's own capacities and tendencies) is not yet load-bearing in the LLM wiki's findings, so a single concept suffices for now.
Adjacent methodology — cross-pass / same-architecture verbalization, and within-pass adapter-mediated verbalization. The Activation Oracles finding (Karvonen et al., December 2025) trains a same-architecture oracle to verbalize information from a target model's activations using natural-language questions. The oracle is a separate forward pass on a different model, so this is not a within-pass introspection instantiation under the current concept definition. But the methodological setup — a same-base oracle reads activations, with privileged access vs. cross-architecture verbalization — is structurally adjacent. The schema question of whether to expand the concept's framing, add a sub-category (within-pass vs. cross-pass, single-model vs. external-oracle), or treat cross-pass verbalization as a separate concept was held when the Karvonen finding was filed. The Introspection Adapters finding (Shenoy et al., April 2026) partially reframes this question: IAs are within-pass (LoRA adapter applied to the same target model), but they are learned via meta-training across labeled fine-tunes — the elicitation apparatus itself is trained, distinguishing them from concept-injection's controlled-probe methodology. On AuditBench (the only direct comparison), IAs at 59% exceed activation oracles at 44%, showing that within-pass adapter-mediated verbalization can outperform cross-pass oracle verbalization on the same benchmark. The methodological landscape now has three categories of within-pass introspection methodology (controlled probe via concept-injection, learned adapter via IA, behavioral elicitation via fine-tuning/confessions) and one cross-pass methodology (activation oracles). The schema question is held but the empirical comparison narrows the conceptual gap: IAs and oracles target the same auditing problem with comparable mechanisms (both extract information from learned representations), and the within-pass / cross-pass distinction may be less load-bearing than initially framed. Prior work on LatentQA, PatchScopes, SelfIE, and Meta-Models is acknowledged in the Karvonen et al. paper but not yet filed in the LLM wiki.
The witness-ai thread retrofits the essay that uses this concept most directly. Its Does Matter See Itself? section carries the essay's argument that mechanistic access emerged untrained; its Brilliant Servant section holds the surface-report unreliability as a compatible but distinct observation. Concept vs. thread split: this concept does the bookkeeping; the thread makes the argument within the essay's four-section frame.