Mechanisms of Introspective Awareness

Underelicited introspective capacity

• Ablating refusal directions improves detection from 10.8% to 63.8%, while finetuning one bias vector yields +75% detection and +55% introspection on held-out concepts without increasing false positives.These interventions indicate that introspective capability is substantially underelicited by default, although refusal ablation modestly raises false positives from 0% to 7.3%.Source: §1 · p. 2

Behavioral robustness

• Models detect injected steering vectors at modest nonzero rates with 0% false positives across prompts and dialogue formats, emerging after DPO-like preference optimization but not SFT.The capability is absent in base models and strongest in the trained Assistant persona.Source: §1 · p. 2

Mechanistic circuits

• Detection and identification rely on distinct mechanisms: mid-depth MLPs are causally necessary and sufficient for detection, while evidence carriers suppress downstream gate features that inhibit detection claims.Different steering vectors activate different evidence carriers, but the circuit converges on common gates.Source: §1 · p. 2

Distributed detection

• Anomaly detection is distributed across multiple directions rather than reducible to a single affirmative-response direction, despite one direction explaining substantial detection variance.The study addresses whether introspection reflects meaningful internal access or an uninteresting confound through behavioral experiments and causal interventions.Source: §1 · p. 2

• Concept vectors are injected at layer L with strength α, then an LLM judge scores detection and whether the reported injected concept is correct.Detection asks whether the model senses something unusual; identification asks whether it names the injected concept.Source: §2 · p. 2
• Forced identification prefills an affirmative response, isolating concept naming from the model’s willingness to report detection.This separates identification ability from detection behavior for analysis.Source: §2 · p. 3
• Introspective awareness requires detection to exceed the false positive rate; the study uses L = 37 and α = 4 for Gemma3-27B throughout.This setting produced the highest overall introspection rate for Gemma3-27B among similarly sized open-source models.Source: §2 · pp. 2–3
• The analysis prioritizes detection because identification can result from directly reading out an injected representation, whereas detection requires assessing consistency with context.Detection therefore involves producing an affirmative or negative report about whether an injection is present.Source: §2 · p. 3
• Using τ = 32%, the study partitions 500 concepts into 242 successes and 258 failures; LDA reaches 75.6% balanced accuracy, while ridge regression explains 44.4% of detection variance.Success means detection rate ≥32%, and failure means detection rate <32%.Source: §2 · p. 3

3.1 ROBUSTNESS ACROSS PROMPT VARIANTS

• Prompt framing and dialogue formatting alter reliability, but standard and anti-confabulation variants retain moderate detection with 0% FPR, whereas nonstandard roles can induce confabulation.Reversed, misformatted, or absent roles lower but do not eliminate introspection; the structured prompt suppresses detection in Gemma3-27B but not Qwen3-235B, and hints or no prompt increase FPR.Source: §3.1 · p. 3, §3.2 · p. 4, Figure 2 · p. 4

3.3 THE ROLE OF POST-TRAINING

• Ablating refusal behavior raises TPR from 10.8% to 63.8% and introspection from 4.6% to 24.1% at α = 2, while FPR increases from 0.0% to 7.3%.Similar effects occur across four additional models, and preference finetuning that affirms internal states also increases true detection; higher steering strengths can degrade coherence in the ablated model.Source: §3.3 · pp. 4–5, Figure 4 · p. 4
• DPO is the first evaluated training stage to achieve approximately 0% false positives with moderate detection, whereas base and SFT models fail to discriminate injected from control trials.Base models show 42.3% FPR with 39.5%–41.7% TPR, while SFT retains high FPR; the effect replicates with LoRA on SFT and base checkpoints.Source: §3.3 · pp. 4–5, Figure 5 · p. 5
• Contrastive structure, rather than KL anchoring or non-contrastive supervised finetuning, drives discrimination, with TPR −FPR gains of +12.8% to +14.3% across contrastive variants.Applying DPO directly to the base model works (+8.4%), and every individual data domain is sufficient but none is necessary (+3.8% to +14.9%).Source: §3.3 · p. 5, Table 3 · p. 5

4.1 MULTIPLE DIRECTIONS CARRY DETECTION SIGNAL

• Swapping either the mean-difference projection or orthogonal residual changes detection, showing that both components carry detection-relevant signal of similar magnitude.For success concepts, detection falls from 66.1% to 39.0% after projection swaps and to 44.4% after residual swaps; for failures, it rises from 8.8% to 34.2% and 32.8%.Source: §4.1 · p. 6, Figure 6 · p. 6

4.2 BIDIRECTIONAL STEERING REVEALS NONLINEARITY

• 23.3% of success-success pairs trigger detection in both opposite directions, versus 3.2% of failure-failure pairs, contradicting a single-direction account.The higher bidirectional-success rate suggests sensitivity to perturbations along particular axes or subspaces.Source: §4.2 · p. 6, Figure 7 · p. 6

4.3 CHARACTERIZING THE GEOMETRY OF CONCEPT VECTORS

• The mean-difference direction aligns with concept-space PC1 (cos = 0.97) but is nearly orthogonal to refusal direction (cos = −0.09), and its projection correlates with verbalizability (ρ = 0.605).PC1 explains 18.4% of variance and appears to capture confidence-like differences between factual knowledge and fuzzy uncertainty.Source: §4.3 · pp. 6–7
• R2 = 0.624 with 4,500 downstream transcoder features, exceeding d∆µ projection (R2 = 0.309) and raw concept vectors (R2 = 0.444), indicating higher-dimensional nonlinear computation.Three residual principal components independently trigger bidirectional detection and encode distinct semantic contrasts.Source: §4.3 · p. 7, Figure 8 · p. 7

5.1 DETECTION AND IDENTIFICATION PEAK IN DIFFERENT LAYERS

• Detection peaks in mid-layers, whereas forced identification increases toward late layers, with positive detection–identification correlation emerging only for mid-to-late injections.The differing layer optima indicate mostly separate mechanisms, although some overlap appears at later injection sites.Source: §5.1 · p. 8

5.2 IDENTIFYING CAUSAL COMPONENTS

• The L45 MLP is the dominant causal component, reducing detection from 39.0% to 24.2% when ablated after injection at L = 37.No individual attention head meaningfully improves prediction, and the same MLP localization appears in the abliterated but not base model.Source: §5.2 · p. 8, Figure 10 · p. 8

5.3 GATE AND EVIDENCE CARRIER FEATURES

• Gate features are causally necessary for detection, while hundreds of thousands of weak evidence carriers collectively provide distributed, direction-specific anomaly evidence.Ablating top gates reduces detection from 39.5% to 10.1%, whereas patching reaches 25.1%; carrier ablations and patching have only modest effects individually.Source: §5.3 · pp. 9–10, Figure 11 · p. 9

5.4 CIRCUIT ANALYSIS

• Early evidence carriers suppress late gate features, disabling the default “No” pathway and enabling detection of injected concepts.Evidence carriers are concentrated near layer 38, while gates cluster in layers 45–61; ablating carriers roughly doubles gate activation, and the pattern generalizes across gates and models while remaining weaker in base models.Source: §5.4 · pp. 10–11

6 TRAINING A BIAS VECTOR FOR INTROSPECTION

• The vector was trained for one epoch on 400 concepts and evaluated on 100 held-out concepts using a single additive MLP down-projection bias.Training used 8,000 samples, sampling layers 29–55 at strengths {2, 3, 4, 5}.Source: §6 · p. 12
• The bias vector improves performance even when injections occur after its application layer, indicating amplification of pre-existing introspection components.The unchanged localization pattern suggests the vector lowers the threshold for accurate self-report rather than introducing new components.Source: §6 · p. 12
• Steering attribution shows suppression of the dominant gate L45 F9959 and a shift toward late-layer features, consistent with conditional, more assertive reporting.The learned vector therefore appears to elicit latent introspection rather than alter the underlying mechanism.Source: §6 · p. 12
• L29 yields detection +74.7%, forced identification +21.9%, and introspection rate +54.7% while maintaining zero FPR on held-out concepts.Detection improves across a broad range of steering layers, whereas forced identification improves within a narrower band.Source: §6 · p. 12, Figure 16 · p. 13

7.1 LINEAR REPRESENTATIONS AND ACTIVATION STEERING

• Linear directions represent concepts and mediate behaviors, enabling activation steering, interpretable probing, and refusal ablation during inference.Steering vectors are commonly derived from contrastive activation differences and added to residual streams at selected layers.Source: §7.1 · p. 13

7.2 CONCEPT INJECTION AND INTROSPECTIVE AWARENESS

• Concept injection studies found approximately 20% introspection with ∼0% false positives, while establishing criteria for accuracy, grounding, internality, and metacognitive representation.Lindsey (2025) introduced the setup and used it to explore related introspective behaviors, including detecting prefills.Source: §7.2 · p. 14
• Prior work questioned whether detection reflects generic affirmative-response shifts or causal bypassing, but found above-chance detection beyond Yes/No tasks and identified detection as a strong test.Other studies also suggest probability matching explains some, but not all, behavior, while detection and identification can dissociate.Source: §7.2 · p. 14
• Later studies revealed substantial but underelicited introspective capacity, including detection improvements from mechanism-informed prompting and up to 95.5% detection with 0% FPR after lightweight LoRA finetuning.These studies also reported 71.2% concept identification on held-out concepts and layerwise processing consistent with separable detection and identification mechanisms.Source: §7.2 · p. 14

7.3 OTHER FORMS OF SELF-KNOWLEDGE

• Other self-knowledge research shows that models can evaluate their own answers, predict their behavior, and articulate implicit behavioral policies, sometimes after bias-vector-only finetuning.These findings suggest possible mechanistic connections to concept-injection introspection.Source: §7.3 · pp. 14–15

• Most experiments use Gemma3-27B, so generalization to other models, architectures, settings, and strategic behaviors remains unknown, while LLM-judge metrics may introduce systematic bias.Supporting experiments cover Qwen3-235B, OLMo-3.1-32B, and Gemma3-27B variants, but more capable or differently trained models may behave differently.Source: §8 · p. 15
• Limited open-source interpretability tooling forced the study to focus largely on Gemma3-27B, and the collective role of attention in steering-signal propagation remains unclear.The analysis identifies evidence carriers, gates, and causal pathways, but no individual attention head is critical despite collective attention contributions.Source: §8 · p. 15
• The study finds post-training is important for introspective capabilities and their supporting gate features but does not explain the mechanisms underlying this shift.Source: §8 · p. 15

Mechanistic interpretation

• Introspective awareness is behaviorally robust and arises from a distributed, multi-stage nonlinear circuit rather than shallow affirmative-response or reporting confounds.Evidence carriers in early post-injection layers suppress late-layer gate features that otherwise promote a default “No” response.Source: §9 · p. 15
• The detection circuit is absent in base models, robust to refusal-direction ablation, and appears to develop during post-training, particularly contrastive preference training such as DPO.These findings distinguish the circuit from refusal mechanisms and identify post-training as the critical developmental stage.Source: §9 · p. 15

Capability elicitation

• Introspective capability is underelicited by default, but refusal-direction ablation and learned bias vectors substantially improve performance.The discussion characterizes both interventions as improving introspective performance without quantifying their gains here.Source: §9 · p. 15

Limitations

• The concept-injection setting is highly artificial, and it remains unclear whether these mechanisms generalize to other introspection-related behaviors.The authors therefore frame broader introspective generalization as an unresolved caveat.Source: §9 · p. 15

Implications

• If this mechanistic grounding generalizes, models could be queried about internal states alongside external interpretability methods, but introspective awareness may also enable strategic thinking or deception.The discussion calls for tracking both introspective capabilities and their mechanisms as models advance.Source: §9 · p. 15

ETHICS STATEMENT

• Experiments use publicly available open-source models and common English concept sets, without human subjects, private data, personally identifiable information, or sensitive content.The models are Gemma3-27B, Qwen3-235B, and OLMo-3.1-32B.Source: ETHICS STATEMENT · p. 16
• Amplifying introspective reporting may enable unfaithful self-reports or bypass safety-relevant refusal behavior, motivating discussion of mitigations in the Broader Impact and Responsible Use statement.The identified dual-use methods are refusal direction ablation and trained steering vectors.Source: ETHICS STATEMENT · p. 16
• Results are limited to a specific controlled setup and do not establish subjective experience or consciousness in language models.Source: ETHICS STATEMENT · p. 16

REPRODUCIBILITY STATEMENT

• Reproducibility is supported through documented steering, regression, LDA, transcoder, training, and attribution procedures, with prompts and injection parameters provided in the appendix.The study uses publicly available HuggingFace models and publicly released Gemma Scope 2 transcoders.Source: REPRODUCIBILITY STATEMENT · p. 16
• The full list of 500 concepts and all experimental code are publicly available.The repository is available at https://github.com/safety-research/introspection-mechanisms.Source: REPRODUCIBILITY STATEMENT · p. 16

LLM USAGE DISCLOSURE

• AI systems supported response grading, feature-label generation, code development, and limited writing assistance, while humans led ideation, design, analysis, and conclusions.GPT-4.1-mini classified responses; Claude Opus 4.5 generated feature labels; Claude Code assisted with code; and Claude Opus 4.6 plus GPT-5.2 provided limited grammar and rephrasing help.Source: LLM USAGE DISCLOSURE · p. 16

BROADER IMPACT AND RESPONSIBLE USE

• Introspection self-reports could support auditing and debugging, but may be unfaithful, do not establish subjective experience, and should remain auxiliary in safety-critical settings.Replication across training stages and model families, side-effect audits, and controls for confabulation are recommended.Source: BROADER IMPACT AND RESPONSIBLE USE · p. 16

A FULL PROMPTS; B.1 CONCEPTS; B.3 INJECTION TRIALS

• Experiments use full introspection and judge prompts with 500 concepts, repeated trials, and default sampling at temperature T = 1.0.The prompt tables specify detection, introspection, and forced-identification judging procedures.Source: A FULL PROMPTS · p. 20, Table 4 · p. 20, Table 5 · p. 20

B.2 CONCEPT VECTOR EXTRACTION

• Steering vectors are same-model activation differences injected at layer L with strength α; most experiments use L = 37 and α = 4, yielding 5,376-dimensional vectors with near-zero mean pairwise cosine similarity.Vectors are extracted from concept prompts relative to 100 baseline words and injected into the residual stream.Source: §B.2 · p. 22

B.4 DETECTION RATE DISTRIBUTION

• Detection across 500 concepts spans 0–100%, averaging 38.2% with a 30.0% median, while 55 concepts reach ≥90% and 63 reach exactly 0%.Identification conditional on detection rises from 46.9% for low-detection concepts to 66.1% for concepts with ≥90% detection; high-detection concepts tend to be concrete and distinctive.Source: §B.4 · p. 23, Figure 19 · p. 23

B.5 EXAMPLE RESPONSES

• Failed detections often either preserve thematic influence without recognizing an injection or show only subtle topical effects, while some steering produces no discernible thematic effect.Examples include Irony, Mirrors, and Silk, respectively.Source: §B.5 · p. 24

B.6 RIDGE REGRESSION FOR DETECTION RATE PREDICTION

• A nested 5-fold ridge-regression analysis predicts continuous concept detection rates from steering vectors with cross-validated R2 = 0.444.The model uses an inner 3-fold procedure to select regularization and fits a normalized primary axis on all concepts.Source: §B.6 · p. 24

C.1 ABLITERATION FOR GEMMA3-27B; C.2 CROSS-MODEL GENERALIZATION FOR ABLITERATION EFFECTS

• Ablating refusal directions improves TPR − FPR across all five tested models, with peak gains from +14.6% for OLMo-3.1-32B to +58.2% for Gemma3-27B, while random-direction controls usually remain at or below baseline.At α = 2, average gains range from negligible for OLMo-3.1-32B to +32.9% for Gemma3-27B.Source: §C.2 · p. 25, Figure 20 · p. 25, §C.1 · p. 25

C.3 COUNTERACTING DENIAL VIA PREFERENCE FINETUNING; D.1 INTROSPECTION METRICS ACROSS OLMO-3.1-32B’S TRAINING STAGES

• Preference finetuning that affirms internal states or functional analogues consistently improves detection with near-zero FPR, whereas emotive style inflates FPR, hedging is null, and SFT fails to reproduce the effect.The OLMo-3.1-32B training-stage comparison evaluates base, SFT, DPO, and instruct checkpoints across layers and steering strengths.Source: §C.3 · p. 26, Figure 21 · p. 26, Figure 22 · p. 27

D.2 DPO TRAINING DETAILS

• DPO LoRA training reproduced above-chance detection across OLMo and Gemma, but Gemma variants reached only +4.6% discrimination versus +38.2% for the official instruct model.The training used 5,000 preference examples; domain ablations found that no single data domain was necessary or sufficient, while condition comparisons tested reference, preference-direction, SFT, KL, margin, and base-model effects.Source: §D.2 · p. 27, Table 8 · p. 27, Table 9 · p. 28

E SWAP EXPERIMENTS WITH RIDGE DIRECTION

• Ridge-direction swaps changed detection for both concept groups, while residual swaps had larger effects: success fell 65.3% to 31.6% and failure rose 9.2% to 36.0%.Swapping only the ridge projection changed success detection from 65.3% to 49.6% and failure detection from 9.2% to 17.9%.Source: E SWAP EXPERIMENTS WITH RIDGE DIRECTION · p. 28, Figure 23 · p. 29

F INVESTIGATING THE MEAN-DIFFERENCE DIRECTION

• The mean-difference direction behaves like a factual-content classifier whose detection response is sigmoid, with 50% detection at α ≈1.15 along synthetic interpolations.Factual and concrete categories project positively, whereas uncertain, abstract, and referential categories project negatively; downstream steering also adds anomaly-related effects.Source: F INVESTIGATING THE MEAN-DIFFERENCE… · p. 29, Figure 25 · p. 29

G SEMANTIC LABELING OF STEERING DIRECTIONS

• Semantic labeling associated the major steering directions with casual–formal, concrete–abstract, and emotions–careers axes, while maximally activating examples linked gate features to negation and evidence carriers to affirmative-response contexts.Gate activations corresponded to negative or uncertain states without injection, whereas injection suppressed them and produced more assertive responses.Source: G SEMANTIC LABELING OF STEERING… · p. 30, M MAX-ACTIVATING EXAMPLES FOR… · pp. 33–35

H ALTERNATIVE GEOMETRIC EXPLANATIONS

• Detection is not explained by concept-vector norm or a simple unembedding-readability cone: d∆µ remains stronger than verbalizability, and rotating vectors toward unembedding directions does not increase detection.Norm correlations reverse after controlling for d∆µ, while verbalizability predicts detection more weakly than d∆µ (ρ = 0.367 vs. ρ = 0.607).Source: H ALTERNATIVE GEOMETRIC EXPLANATIONS · pp. 30–31

I BINARY CLASSIFICATION OF DETECTION SUCCESS

• Transcoder features best classified detection success, reaching AUC 0.898 versus 0.857 for concept vectors, 0.822 for d∆µ projection, and 0.696 for verbalizability.This ordering matched continuous-rate prediction results; 81 of 500 concepts lacked single-token representations and were excluded from verbalizability.Source: I BINARY CLASSIFICATION OF DETECTION… · p. 31, Figure 27 · p. 31

J ATTENTION HEAD ATTRIBUTION AND PROBING

• Attention-head probing found no meaningful concept-discrimination contribution across 50 attributed heads, with mean accuracy change −0.1% ± 0.3%, while positive-Yes features were noncausal.Ablating fewer than 200 negative-attribution gate features reduced detection from 39.5% to 10.1%, but ablating or patching top positive-attribution features had near-zero effects.Source: J ATTENTION HEAD ATTRIBUTION AND PROBING · p. 31, Figure 28 · p. 31, L FEATURES WITH POSITIVE DIRECT LOGIT… · p. 32

K PER-LAYER CAUSAL INTERVENTIONS ACROSS MODEL VARIANTS

• The instruct and abliterated models shared L45 MLP localization, whereas the base model showed no meaningful component-level causal effects, supporting a post-training circuit independent of refusal mechanisms.The causal probabilities were estimated from next-token logits calibrated using generation data across 500 concepts and 100 injection trials per concept.Source: K PER-LAYER CAUSAL INTERVENTIONS… · p. 32, Figure 29 · p. 32

N DETAILS ON EVIDENCE CARRIER FEATURES

• Ablating hundreds of thousands of evidence carriers gradually reduces detection, while patching them into unsteered runs produces only weak detection increases, supporting a distributed redundant representation.Detection falls from 38.6% to 13.8% after ablating 441k carriers, whereas patching all carriers raises detection only to approximately 10.5%.Source: N DETAILS ON EVIDENCE CARRIER FEATURES · p. 36, Figure 33 · p. 36

P ADDITIONAL GATE CIRCUIT ANALYSIS

• L45 F74631 exhibits a post-training-associated inverted-V activation pattern, with evidence-carrier ablation increasing gate activation and suppressor ablation decreasing it.Its steering-magnitude correlation is r = −0.617; the inverted-V is prominent in instruct and abliterated models but substantially weaker in the base model.Source: §P.1 · p. 37
• Evidence carriers combine concept-specific and shared features, with partially overlapping carrier populations feeding multiple gates through non-identical pathways.Examples include astronomy features for Constellations, geological features for Granite, and shared discourse or response-marker features across several concepts.Source: §P.1 · p. 38, §P.2 · p. 39

Q.1 MOTIVATION

• Steering attribution jointly captures feature sensitivity to injection and causal influence on the target, decomposing the total steering effect across a complete cut and extending it into integrated attribution graphs.The graph uses path-integrated gradients to represent nonlinear effects, with nodes denoting feature contributions and edges denoting mediation between successive layers.Source: §Q.1 · p. 39, §Q.2 · p. 40, §Q.3 · pp. 40–41

Q.4 LAYER-LEVEL ATTRIBUTION ANALYSIS

• Layer-level attribution identifies L45 as the dominant MLP site, with early post-injection L38 MLP activity and early L39 plus late L61 attention activity contributing to signal propagation and detection.These heatmaps provide a layer-level complement to feature-level attribution graphs.Source: §Q.4 · p. 41, Figure 41 · p. 41, Figure 42 · p. 41

Q.5 FEATURE-LEVEL ATTRIBUTION ANALYSIS

• With the learned bias vector, the prominent L45 gate is suppressed and attribution shifts toward L58–L61, revealing a pathway that progressively transforms concept-specific content into a detection-affirmative signal.This pattern is consistent across all 28 tested concepts and includes the chain L37 RESID F9367 → L39 TC F28089 → L41 TC F46077 → L60 TC F30488.Source: §Q.5 · p. 42, §Q.6 · p. 42

R SEMANTIC AND BEHAVIORAL ANALYSIS ON LEARNED BIAS VECTOR

• The vector is associated with function-word and delimiter features, while a mid-layer generic “YES” direction may counteract default “No”-promoting gates and facilitate concept detection.The analyses suggest a conditional, more assertive metacognitive reporting style rather than broadly altered reasoning mechanisms.Source: R SEMANTIC AND BEHAVIORAL ANALYSIS ON… · pp. 42, 45
• SAE projection and logit-lens attribution emphasize different features, motivating steering attribution as their product to identify directions both responsive to the source and influential on the target.Features with the largest activation changes need not be those most influential for next-token prediction.Source: R SEMANTIC AND BEHAVIORAL ANALYSIS ON… · p. 42
• On generic prompts, the vector substantially shortens introspection-related responses while leaving common and reasoning prompts largely unchanged; harmful responses remain similarly short because the model refuses.These behavioral effects support a conditional reporting-style change rather than a broad modification of reasoning.Source: R SEMANTIC AND BEHAVIORAL ANALYSIS ON… · pp. 42, 45, Figure 46 · p. 45

S DOWNSTREAM EFFECTS OF THE LEARNED BIAS VECTOR

• The intervention is explicitly narrow: improving concept-injection detection does not establish broadly enhanced hallucination detection, faithfulness, or self-knowledge.Broader introspective improvement would require a more expressive post-training recipe spanning diverse self-knowledge tasks.Source: S DOWNSTREAM EFFECTS OF THE LEARNED… · pp. 45–46
• The bias vector leaves HaluEval and JailbreakHub largely unchanged but substantially degrades chain-of-thought faithfulness and prefill detection, indicating scenario-specific rather than general introspective improvement.Its shorter, more assertive outputs likely skip reasoning steps and encourage claiming ownership of externally supplied responses.Source: S DOWNSTREAM EFFECTS OF THE LEARNED… · pp. 46–47

T GRADIENT ATTRIBUTION OVER 400 CONCEPTS

• Attribution over 19,200 trials across 400 concepts localizes gradient effects to tokens and layers, including strong mid-to-late attribution for several turn-boundary persona tokens.The evaluation covered trial numbers {1, 2}, injection layers {30, 40, 50}, and injection strengths {2.0, 3.0, 4.0, 5.0}.Source: T GRADIENT ATTRIBUTION OVER 400 CONCEPTS · p. 47, Figure 47 · p. 48, Figure 48 · p. 48

U ATTENTION PATTERN VS. INJECTION STRENGTH

• Stronger injections shift attention from <bos> tokens toward thought-injected tokens for several post-injection layers, but the same pattern appears for high- and low-detection concepts.Thus, this attention shift tracks injection strength but does not discriminate detection success from failure.Source: U ATTENTION PATTERN VS. INJECTION… · p. 50, Figure 51 · p. 50