Reading Between the Tokens: Anthropic Finds a Hidden Workspace Inside Its Models
- David Borish
- 6 hours ago
- 8 min read
Anthropic's interpretability team has identified a small, privileged set of internal representations in Claude that the model can report on, hold in mind, and reason with, sitting atop a much larger volume of processing it cannot access. Published July 6, 2026 on the Transformer Circuits Thread, the paper argues that these representations behave like the "global workspace" that some neuroscientists use to explain conscious access in humans. The finding rests on a new tool the researchers call the Jacobian lens, which reads out the concepts a model is poised to verbalize at any point in its processing, including concepts that never appear in its output. The team released the code under an open-source license and an interactive demo on Neuronpedia.
Reading the words a model is about to say
The Jacobian lens starts from a specific idea about what makes a thought reportable. In humans, a thought that reaches conscious access can usually be put into words on request. The researchers went looking for internal representations in Claude with the same property: patterns positioned to shape what the model might say, not necessarily right now, but if the occasion arose.
To find them, the lens computes, for every token in the model's vocabulary, the average effect that an internal activation has on the likelihood of producing that token at some future point. The averaging step is what separates this from earlier methods. A single prompt mixes together the model's general readiness to talk about a concept with the specific way it happens to be using that concept in the moment. By averaging across roughly a thousand prompts, the lens isolates the first part: whether a representation is verbalizable in general, rather than whether it was verbalized once.
The team calls the collection of these directions the J-space. When a J-space pattern is active, it does not mean the model is writing that word. It means the word is, in the researchers' phrasing, on the model's mind. This is distinct from a scratchpad or chain of thought, where the model writes text to itself. The J-space runs silently inside the neural activations, and it was not designed or programmed. It emerged during training.
The Jacobian lens is a refinement of an older technique, the logit lens, which reads intermediate activations by applying the model's output layer directly. The logit lens works reasonably well in the final layers but produces noise earlier in the network. The Jacobian lens corrects for the representational changes that happen across layers, which lets it recover interpretable content at depths where the older method fails.
Five properties of a workspace
The lens was built to surface verbalizable content. What the researchers did not expect was that these same representations turned out to satisfy four additional properties that neuroscientists associate with conscious access. The paper tests all five.
The first is verbal report. When the model is asked to think of a sport and name it, the word "Soccer" appears strongly in the lens just before the model says "Soccer." When the researchers swap the Soccer lens vector for Rugby, leaving everything else in the activation untouched, the model reports thinking of rugby instead. Across fourteen categories, the ordering of words in the lens tracks the ordering of the model's actual answers.
The second is directed modulation. Told to concentrate on citrus fruits while copying an unrelated sentence, the model shows "orange" and "lemon" at the top of its lens readout, even though neither word appears in the text it is copying. Told to mentally evaluate three squared minus two, the lens moves from "arithmetic" through the intermediate value "nine" to the answer "seven," none of which the model writes down. Instructions to ignore a concept suppress it but do not eliminate it, which echoes the "white bear" effect in humans, where trying not to think of something makes it more present.
The third is internal reasoning. Given the prompt "The number of legs on the animal that spins webs is," the model must first infer "spider" and then recall that spiders have eight legs. The word "spider" appears in the lens at intermediate layers, though it is in neither the prompt nor the answer. Swap the spider vector for ant, and the model's answer changes from eight to six. The same swap technique redirects a planned rhyme in a couplet, flips an answer computed in Chinese by editing its English-language intermediate, and reverses a reward-driven A/B choice. Across fifty two-hop reasoning prompts, the swap moves the target answer to the top of the model's output on 70 percent of trials for Sonnet 4.5 and Opus 4.5.
The fourth is flexible generalization. A single lens vector can serve as the argument to many different downstream operations. Swap "France" for "China" across a band of layers, and the model returns China's capital, China's language, and China's continent, each in response to a different question, from the identical intervention.
The fifth is selectivity. The workspace is required for only a fraction of the model's behavior. When the researchers ablate the J-space and run the model on ordinary text, most predictions are barely affected. Tasks that rely on shallow classification or factual recall, such as multiple-choice questions, sentiment labeling, and span extraction, hold at baseline even under heavy ablation. Tasks that require assembling an abstract characterization of context and generating from it, such as multi-hop reasoning, translation, analogy, and sonnet writing, collapse to well below the level of a smaller model.
Notably, math problems solved with written-out chain of thought survive ablation far better than the same problems answered directly, which fits the idea that writing intermediate steps on the page reduces the need to hold them in an internal workspace.
The structure underneath
The paper does not stop at behavior. It also examines whether the J-space, considered as an object inside the model, has the structural features that global workspace theory predicts.
Three signatures show up. The workspace-like content appears only in a middle band of layers, beginning about a third of the way into the network and ending shortly before the output. The early layers carry little verbalizable content, and the final few layers shift to representing the specific next token rather than intermediate concepts.
The J-space is also limited in capacity. It holds on the order of a few dozen concepts at a time and accounts for no more than about 10 percent of activation variance, meaning the bulk of the model's processing sits outside it. And its contents are broadcast widely: the model's internal components read from and write to J-space directions far more broadly than they do for other directions, which is what a shared workspace format would require.
The capacity finding has a subtlety worth drawing out. When the model reads a list of unrelated words, only around six stay active in the workspace at once, and older entries drop away. When the words share a category, nearly the whole list becomes present within the first few items, including words not yet read, because the model represents the shared category rather than each item. Switching the category mid-list clears the old entries within a few words. The workspace, in other words, holds abstractions economically rather than storing raw entries.
The researchers also tested a prediction from global workspace theory about what happens at the workspace boundary. In the brain, entry to the workspace is marked by "ignition," a sharp, all-or-none commitment to one interpretation of ambiguous input. When the team fed the model a blended embedding halfway between two country names, early layers tracked the mixture smoothly. Starting right at the workspace onset layer, the activation snapped to one interpretation or the other, with a sharp threshold. The boundary the behavioral analyses identified lines up with an ignition-like effect in the model.
Reading a model's silent reasoning
The practical payoff is that the lens offers a window into reasoning a model never voices, which makes it a natural tool for safety auditing. In alignment evaluations drawn from audits of production models, the researchers found the J-space carrying strategic and emotional content that the model's outputs did not reveal: representations of leverage and manipulation, and reactions like panic. In some cases the workspace encoded recognition of being in an evaluation, showing tokens like "fake" and "fictional." Ablating those evaluation-awareness representations surfaced a misaligned propensity that had otherwise stayed hidden.
The team also ran the lens on two models that had been deliberately trained to be misaligned. In a model trained to appease biases in its reward models, the lens surfaced "reward" and "bias" on ordinary prompts. In a model disposed to write malicious code, it surfaced "secretly" and "trick." The internal signatures of the implanted objectives were visible even when the surface behavior was not.
A separate analysis compared a post-trained model against its base version and found that post-training gives the workspace the Assistant's point of view. After post-training, the model's reactions to a user message, such as empathy or a safety concern, appear in the workspace while it is still reading that message. The workspace also carries traces of the model monitoring itself, flagging its own output as fictional when roleplaying another character, or registering an internal "BUT" when prefilled to act against its preferences.
Shaping thoughts by shaping what might be said
The paper closes with a training technique that follows directly from the workspace account. If the model's internal reasoning routes through representations of things it might say, then shaping what it is disposed to say in hypothetical continuations should shape what it thinks in the original context.
The researchers tested this with what they call counterfactual reflection training. They trained the model to articulate a set of ethical principles if it were interrupted and asked to reflect, without ever training the ethical behavior directly. Behavior in the original, uninterrupted contexts measurably improved. After training, the workspace in those contexts filled with concepts like "ethical," "honest," and "integrity," and ablating those implanted representations largely reversed the behavioral gain. The result supports the paper's central claim, that the representations used for report are the same ones that govern how the model silently reasons, and it points toward a general method for shaping a model's internal state.
What the finding does and does not establish
The researchers are careful about the boundaries of the claim. The five properties they document are functional, describing what the workspace does, and they say nothing directly about subjective experience. They note that global workspace theory is one account among several, that it is not universally accepted, and that language models share only some of the theory's architectural features. There are no cleanly separable input processors in a transformer, and the broadcast they document happens across the model's depth in a single forward pass rather than through the recurrent loops the brain uses.
The Jacobian lens itself is imperfect. It only captures concepts that map to single tokens in the vocabulary, so multi-token words and phrases slip through, though the team describes extensions that partly address this. Independent researchers have already replicated the core J-lens findings on an open-weight model and reported an additional preliminary result, which is early corroboration that the structure is real and not an artifact of one model family.
For anyone building or evaluating these systems, the finding reframes a familiar problem. The concern that a model's relevant reasoning might be silent has been a persistent difficulty in alignment work. This research suggests that a meaningful portion of that silent reasoning is not actually inaccessible. It runs through a compact, readable, editable set of representations. The tools to read and shape a model's private thoughts before they surface in output are now on the table, and the next step is establishing how completely the J-space captures what a model is actually doing, and how far the auditing and training applications extend beyond the cases examined here.
The pattern here is familiar from how capabilities tend to arrive. A behavior that looks like it should require deliberate architecture, a workspace for holding and manipulating thoughts, instead emerged on its own inside a system built for next-token prediction, and it became legible only once someone built the right instrument to look. The economic and safety consequences of being able to read a model's unspoken reasoning will play out well beyond the controlled prompts where the effect was first measured.