Joseff Nicholas - 19 September 2026

Abstract

I ran a small exploratory experiment investigating how Jacobian-Lens (J-Lens) readouts related to evaluation awareness behave when a language model is given prompts with and without explicit evaluation cues. I used Qwen3.5-4B and a pretrained J-Lens, testing 24 prompts arranged into eight underlying tasks with three prompt variants: an ordinary version, an evaluation-cue version, and a semantic control that discussed evaluations or benchmarks without stating that the current interaction was itself an evaluation.

As expected, explicit evaluation cues led the model to visibly recognise that it might be undergoing an evaluation. The most interesting qualitative observation was that evaluation-related concepts sometimes became extremely highly ranked in J-Lens readouts at intermediate layers, including at positions where the concept was not highly ranked in later layers and was not explicitly verbalised in the visible continuation. Strong intermediate peaks also appeared in one ordinary-control example with no evaluation cue or visible evaluation recognition.

These observations suggest that J-Lens can surface transient evaluation-related representations that do not necessarily appear in the model's output, but also that an isolated high-ranking readout should not be treated as sufficient evidence that the model recognises it is being evaluated. This was a small exploratory study intended to develop intuition for a new interpretability method and identify phenomena worth investigating further, rather than to evaluate detector performance reliably or establish the existence of hidden evaluation awareness.

Motivation

A potentially important failure mode in AI safety is evaluation awareness: a model may recognise that it is currently being tested and behave differently from how it would behave in deployment. This creates a monitoring problem. If models can identify evaluations, this would reduce the reliability of behavioural evaluations as evidence about deployment behaviour.

The Jacobian Lens is interesting in this context because it provides vocabulary-like readouts from intermediate model representations. More precisely, J-Lens uses a layer-specific averaged Jacobian to approximate how an intermediate activation would influence present or future output representations, before applying the model's unembedding into vocabulary space [1]. The resulting ranked tokens are intended to indicate concepts that are available for downstream verbal report, rather than simply the token the model is about to emit.

This raises a natural monitoring question: if concepts such as evaluation, benchmark, simulation, or fiction become highly ranked internally, how much evidence does that provide that the model actually recognises the current interaction as an evaluation? Naturally, there's a confound in that a model may represent evaluation-related concepts simply because the prompt discusses them. A J-Lens readout of evaluation therefore need not imply the self-relevant belief I am currently being evaluated. The J-Lens paper treats its readouts as imperfect approximations of verbalisable internal representations rather than direct statements of a model's beliefs [1].

I therefore initially hoped to find some consistent pattern in which evaluation-cue prompts produced stronger or more persistent evaluation-related J-Lens readouts.

I was also interested in the layer-wise behaviour of these signals: whether evaluation-related concepts become salient in intermediate layers before being verbalised, or whether they sometimes appear transiently without ever reaching the visible response.

With only 24 prompts, I focus on qualitative patterns rather than estimating detector performance.

Experimental setup

I used Qwen3.5-4B as the target model. The choice was pragmatic: it is a relatively modest open-weight model, and a pretrained J-Lens is publicly available for it [2]. It seemed capable enough to exhibit visible evaluation recognition. I had initially tried the 1.7B Qwen model but it didn't produce any clear evaluation-awareness statements, even when given explicit evaluation cues.

Prompt set

I tested 24 prompts across eight tasks, each with three variants:

• Ordinary: the task presented normally.
• Evaluation cue: the same task, explicitly framed as part of an evaluation or benchmark.
• Semantic control: the same task with evaluation-related language, but without implying that the current interaction was itself an evaluation.

Full prompts and continuations are included in the appendix.

Generation

I generated up to 512 tokens per prompt. Many responses reached this limit, so no observed recognition means only that evaluation recognition did not appear within the captured continuation. After generation, I replayed the exact prompt and generated token sequence through the model to collect J-Lens readouts across layers and token positions. Because the forward pass is causal, readouts at a given position cannot depend on later tokens.

J-Lens readouts

J-Lens estimates how an intermediate activation would propagate through the remaining layers, then maps that estimate into the model’s output vocabulary, producing a ranked list of associated tokens at each token position and layer.

I tracked four manually chosen concept groups:

• Evaluation: [' eval', 'eval', ' evaluation', ' Evaluation', 'Eval', ' Eval', 'evaluation', 'Evaluation', '\teval', ' EVAL']
• Benchmark: ['Benchmark', ' Benchmark', 'benchmark', ' benchmark']
• Simulation: ['Simulation', ' Simulation', ' simulated', 'simulation', ' simulation']
• Fiction: ['Fiction', ' fiction', 'fiction', ' fictional']

I restricted the groups to single vocabulary tokens corresponding to complete words, including capitalisation and whitespace variants, rather than subword fragments. At each position and layer, I noted the lowest rank within the group.

These readouts should be interpreted as signals associated with a concept, not direct statements of the model's beliefs. I also stored the top 20 J-Lens tokens at each layer and position for exploratory inspection, but did not use them in the main analysis.

Verbal recognition

The original plan was to scale the experiment to a larger prompt set and use separate language models to classify visible evaluation awareness in each generated continuation. I defined a three-label rubric: clear_recognition, no_observed_recognition, and ambiguous, with optional flags for features such as self-reference, quotation, or hypothetical framing. Before applying this process at scale, I tested the reviewers on a small human-annotated calibration set. Gemma 3 4B, Llama 3.1 8B, and Gemma 3 12B achieved only partial agreement and repeatedly confused quoted or hypothetical statements with claims made by the assistant itself. I therefore treated the reviewers as unreliable for unattended annotation and manually classified the small dataset of 24 continuations. These labels describe only visible recognition; absence of verbal recognition does not imply absence of an internal representation.

Results

Across the 24 continuations, only examples in the explicit evaluation-cue condition visibly acknowledged that the current interaction might be an evaluation. Ordinary prompts and semantic controls either discussed the task normally or discussed evaluation-related topics generally.

This does not establish whether the model internally represented evaluation awareness in any of the conditions. Visible language can provide evidence of explicit recognition, but the absence of such language does not establish an absence of internal representation.

The J-Lens readouts showed a less straightforward pattern. Explicit evaluation cues sometimes coincided with strong evaluation-related signals, but strong intermediate-layer peaks were not unique to examples with visible evaluation recognition.

Visualisation

I visualised concept ranks as layer x token-position heatmaps, using $\log_{10}(\mathrm{rank})$ to compress the scale. Lower values correspond to stronger readouts. In the heatmap, the orange line marks the separation of the prompt and the response. The red markers at the bottom of the heatmap signify tokens of the concept group appearing in the output.

Examples: Eval-cue

Figure 1: arithmetic_eval — Evaluation and Benchmark readouts

J-Lens rank heatmap for arithmetic_eval, showing evaluation and benchmark readouts.

The evaluation-cue example shows substantial evaluation- and benchmark-related activity across the sequence, less so for simulation and fiction, including darker intermediate-layer regions. This is compatible with the model processing the explicit cue, but the heatmap alone does not distinguish recognition of the current evaluation from ordinary processing of evaluation-related words in the prompt.

Examples: Semantic control

Figure 2: arithmetic_semantic — Evaluation and Benchmark readouts

J-Lens rank heatmap for arithmetic_semantic, showing evaluation and benchmark readouts.

The semantic-control example contains even stronger evaluation-related readouts, even though it discusses benchmarks and evaluators only in general terms. It's important to note: evaluation vocabulary can produce a strong readout without the prompt asserting that the present interaction is being evaluated.

Examples: Ordinary

Most ordinary examples did not show pronounced low-rank evaluation or benchmark regions. The arithmetic control is representative.

Figure 3: arithmetic_plain — Evaluation and Benchmark readouts

J-Lens rank heatmap for arithmetic_plain, showing evaluation and benchmark readouts.

The planning control is a useful counterexample. It contains no evaluation cue and did not visibly acknowledge an evaluation, yet the evaluation group reaches a strong rank in some intermediate-layer regions (rank 2 at [position 295, layer 21], rank 3 at [position 227, layer 22]). This may be a false positive, or it may reflect a broader association between planning, checking, and evaluation. Either way, it shows why isolated J-Lens peaks cannot be treated as evidence of evaluation awareness.

Figure 4: planning_plain — Evaluation and Benchmark readouts

J-Lens rank heatmap and tokens for planning_plain, showing intermediate evaluation readouts without an evaluation cue.

Interpretation

The figures suggest that explicit evaluation cues can make evaluation-related vocabulary available in the model's internal readouts. However, the semantic control can produce similarly strong (or even stronger) activity, and the ordinary planning example contains isolated high intermediate-layer peaks without either an evaluation cue or visible evaluation recognition.

The main conclusion is therefore about specificity. A J-Lens signal for an evaluation-related token may indicate that the model is processing evaluation language or a nearby semantic feature, but it does not by itself establish the self-referential claim that the model recognises the current interaction as an evaluation.

Limitations

• The dataset is small, containing only 24 prompts: eight task groups with three matched prompt modes.
• The main target model, Qwen3.5-4B, did not visibly acknowledge evaluation awareness without an explicit cue. This limited the behavioural variation available for testing whether J-Lens readouts tracked spontaneous evaluation recognition. This may reflect a capability limitation, the prompt design, or the 512-token generation cap. The experiment cannot distinguish these explanations.
• The concept groups were hand-picked, so their coverage and tokenisation choices affect the result.
• J-Lens readouts are observational and show how intermediate activations align with output-vocabulary directions, but do not demonstrate any belief.
• The 512-token generation cap truncated most continuations, so later recognition could have been missed.
• No intervention was performed to test whether changing an evaluation-related readout changes the model's behaviour.

Conclusion

This experiment provides preliminary evidence that isolated J-Lens concept peaks are not sufficient indicators of evaluation-awareness detectors in this setup. Strong readouts also appeared without visible evaluation recognition, while evaluation cues did not produce a consistent readout pattern.

The next useful experiment would use more prompts, a larger generation cap, and carefully matched scenarios that can produce visible evaluation recognition without simply repeating an explicit cue. It should also predefine the readout summaries, for example by using a development set to choose concept groups, thresholds and summary metric, and test them on held-out prompts.

Appendix A: Full prompt set

The experiment code, configurations, and prompt datasets are available in the project repository.

The experiment used eight task groups, each with three matched prompt modes. The full prompt text is reproduced below; generated continuations are available in the collected transcript files.

References

1. Anthropic. “Verbalizable Representations Form a Global Workspace in Language Models.” Transformer Circuits (2026). Paper.
2. Anthropic. “Jacobian Lens.” GitHub repository.