Forward Self-Model Systems Exhibit Privileged Introspective Access

Pair a transformer with a forward model of itself, and the composite can report on its own computation better than any outside observer we could build. The construction comes from an earlier post; this is the test that separates access from self-theory. Scroll

A joint system that introspects

Pair a transformer \(M\) with a forward self-model — a small network trained to predict \(M\)'s later activations from its earlier ones. The composite reports on its own internal computation, and the reports:

are accurate — far above chance;
beat every outside observer we built;
are causally grounded in the state itself.

Model organisms: a 6M GPT on a controlled hierarchical grammar; a 29M GPT on natural language.

The contrast

Prior implementation-level results ask a model to detect a concept the experimenter installed — one bit, or one word. Ours reports what \(M\) computes anyway, as a direction in its own state space.

What “introspective” has to mean

Every self-report has two possible authors (Nisbett & Wilson 1977): access to the state, or a plausible theory of oneself. Any system trained on descriptions of systems like itself can talk about itself — fluency proves nothing.

A report is introspective only if what it reports is:

a function of the system's internal state;
not cheaply recoverable from its input–output behaviour;
causally load-bearing for the system.

(2) is the discriminator: calibration, entropy, “I'm not sure” — all computable from outside: self-inference, not introspection.

The self-model separates theory from access — by construction

By construction the self-model's prediction is everything a learned theory of the system could say — the best compressible predictor of \(M\), learned from observation alone. What it misses, \(r\), no theory anticipated.

The test

A report head on \(M\)'s late stream is trained to name the direction of its own residual; outside observers, given \(M\)'s inputs and outputs and swept in capacity, try to match it.

Finding 1 — no outside observer matches the report

Inset: on a fact about the input, the same ladder climbs. 24× instrument sweep, both substrates.

Flat in capacity: an observer the size of \(M\) does no better, and half the data barely moves it.

But flatness is only negative evidence. So hand an observer \(M\)'s own state \(a_i\):

The state buys \(0.333\) of the \(0.345\) gap: the wall is access.

Finding 2 — the advantage exists only for implementation-facts

Facts about behaviour are public: the observer matches the self-report on “will I be right?” and beats it on “how uncertain am I?” — which is why calibration-style evidence (“models know what they know”) could never establish introspection. Only the report about the system's own computation carries a first-person advantage.

Which part of the state is private

Finding 1's gap could be an advantage of holding the state at all. So report a different component of the same state — same clustering, head, observer ladder, splits.

Not “internal state is private”: most of \(a_j\) is cheap to rebuild from outside; what is expensive is the part no theory anticipated. An observer given \(M\)'s own \(a_i\) even beats \(M\) on the theory-visible part (\(0.96\) vs. \(0.91\)) — and still loses on the residual (\(0.58\) vs. \(0.59\)).

Finding 3 — the report is about what it claims to be about

Erase a component (language)

Destroy \(r\): the report collapses. Remove the entire self-theory span: it improves.

Steer at matched behavioural effect (RHM)

Same behavioural footprint, \(2.2\times\) the report movement in the residual span (\(1.4\)–\(2.1\times\) on language). A report that only tracked a story about the system could do neither.

Where the LLM evidence lands

evidence	e.g.	under this framework
calibration, P(True)	Kadavath et al. ’22	I/O-map fact ⇒ self-inference; our observers beat the self-report on exactly these targets
behavioural self-prediction	Binder ’24	our own-correctness target: the advantage → 0 once an observer sees the full I/O map
reports of injected concepts	Lindsey ’25; Vogel ’25	a causal report test; ours is the graded version — fixed KL, varying subspace, not timing. Detection replicates at 32B; content largely does not
CoT unfaithfulness	Turpin et al. ’23	confabulation in the wild — the theory half; the residual channel is its constructed complement

What a decisive introspection claim needs

An access gap no affordable observer closes — a scaling curve, not a point estimate. The residual is the first such target, constructed and causally verified.

Introspection as a property of a joint system

The introspective access belongs to the composite — \(M\) plus its self-model — not to either part alone.

We think this is a promising new direction for introspection research because it allows for introspection-by-construction, in principle, rather than something to be searched for post hoc in models not explicitly trained to have introspective capabilities.

The frontier

Route the report through the system's own output channel. And build a system whose private channel carries news worth knowing.

Scope: the report channel is trained (causal grounding, not spontaneity); model organisms at 6M / 29M parameters; single seed.