Signs of introspection in large language models
Short summary
Researchers used a “concept injection” method to compare Claude’s self-reported thoughts with its actual neural activity. They found Claude Opus 4 and 4.1 sometimes detect and control injected concepts, suggesting limited but real introspective abilities that improve with model capacity.
- Anthropic injected known concept vectors into Claude's activations and found Opus 4/4.1 could sometimes notice and identify the "unexpected thought" before it appeared in output, suggesting real internal monitoring rather than post-hoc confabulation.
- Opus 4.1 only caught these injections about 20% of the time, and weaker models barely detected them at all, showing introspection is real but rare and scales with model capacity.
- Retroactively injecting "bread" into prior activations made Claude claim it had intended to say "bread" and fabricate a justifying backstory, indicating it was consulting an internal record of its own prior state rather than just rereading its text.
- Overly strong injections caused hallucinated, confabulated explanations (e.g., mistaking a "dust" vector for a literal speck), showing the effect is fragile and highly sensitive to injection strength.
Full summary
Researchers at Anthropic tested whether their Claude language models can truly “look inside” their own computations. They used a technique called concept injection: first they isolate a neural activation pattern tied to a known concept (for example, the pattern that fires when the model reads all-caps text). Then they inject that pattern into the model during an unrelated task and ask the model if it notices anything odd. In successful cases, Claude Opus 4 and 4.1 immediately flagged the unexpected activation and correctly linked it to shouting or loudness—before even generating any all-caps text. That suggests the model isn’t just parroting plausible explanations but actually monitoring its internal states.
The team ran hundreds of trials and found that Opus 4.1 detected these injections about 20 percent of the time. Lower-capacity models barely registered the injections, and when injections were too strong the model hallucinated bizarre responses—describing a “dust” vector as a physical speck, for instance. Tuning injection strength to a “sweet spot” was critical. Though still flaky, these results mark a step toward machines that can report on their own reasoning, offering a new tool for debugging and understanding failure modes in large language models.
Anthropic also looked at introspection in a use-case context. They forced Claude to output a random word—“bread”—in a painting-description task where it made no sense. When asked if it meant to say “bread,” the model apologized and treated it as an accident. Then researchers retroactively injected the neural signature of “bread” into the model’s prior activations. Faced with the same question, Claude accepted that it intended “bread” and invented a tenuous backstory about a short story where “bread” followed a line on a crooked painting. That shift shows the model referencing its own earlier “intentions,” not just re-reading its outputs.
These experiments don’t prove human-like self-awareness—introspection was spotty and confined to simple concepts—but they challenge the idea that language models are entirely black boxes. As Anthropic points out, more capable models performed better, so future systems may grow more reliable at this sort of self-monitoring. In the meantime, concept injection offers a practical way to peek inside and verify what these models are really doing.