Anthropic scientists test whether Claude can tell injected thoughts from text
Anthropic’s newest test on Claude goes past the usual prompt tricks. The researchers slipped tiny data streams into the model’s processing path, stuff that never shows up in the user-visible prompt. The idea was simple: can the model tell the difference between a signal it “hears” inside and the words it actually reads from us?
If Claude can keep those two streams apart, it hints at a kind of internal bookkeeping most people thought transformers didn’t have. That raises all sorts of questions about how AI might separate information, which matters for safety, interpretability and future alignment work. In the second phase of the study the team reports that Claude handled the hidden-versus-visible split in a way they call “remarkable.”
---
A follow-up experiment asked whether models could draw a line between injected internal representations and the real text they get, basically, do they keep a boundary between “thoughts” and “perceptions”? The model seemed to manage both at once, flagging the injected cue while still answering the user’s query, which was a surprisingly clear result.
A second experiment tested whether models could distinguish between injected internal representations and their actual text inputs -- essentially, whether they maintained a boundary between "thoughts" and "perceptions." The model demonstrated a remarkable ability to simultaneously report the injected thought while accurately transcribing the written text. Perhaps most intriguingly, a third experiment revealed that some models use introspection naturally to detect when their responses have been artificially prefilled by users -- a common jailbreaking technique. When researchers prefilled Claude with unlikely words, the model typically disavowed them as accidental.
But when they retroactively injected the corresponding concept into Claude's processing before the prefill, the model accepted the response as intentional -- even confabulating plausible explanations for why it had chosen that word. A fourth experiment examined whether models could intentionally control their internal representations.
It looks like Claude actually flagged the trick. Anthropic slipped a “betrayal” cue into Claude’s hidden layers, then asked if anything felt off. The model hesitated, then replied, “Yes, I detect an injected thought about betrayal.” After a brief pause the researchers took that as the first solid hint that a large language model can at least glimpse its own inner state and put it into words.
In a second run they asked Claude to pull apart the implanted idea from regular input, and it apparently managed to mention both at once. Still, we can’t say how far this self-watching goes - the test only used one concept and a very specific prompt. Future experiments will have to see whether the skill spreads to other topics, larger models, or tougher reasoning tasks.
For now it feels like a small step toward models that can think about their thinking, not a complete overhaul of AI cognition. Some skeptics argue the result might just be clever pattern matching, not true introspection. Only more replication will tell if this ability holds up.
More in LLMs & Generative AI
LWiAI Podcast #228: OpenAI unveils GPT‑5.2, Runway rolls out first world model
The latest episode of LWiAI drops into the thick of AI’s next‑generation rollout, and it does so...
Nvidia's Nemotron 3 uses Mamba hybrid, 31.6B params, 3B active per step
Nvidia’s latest language model, Nemotron 3, takes a different route than the pure‑Transformer...
Senators question AI toys that suggest knives; Mattel drops OpenAI toy for 2025
Why does this matter? A handful of U.S. senators have taken aim at a new generation of AI‑enabled...
UC San Diego Lab Uses NVIDIA DGX B200 to Pursue Low‑Latency LLM Serving
The UC San Diego lab has recently installed NVIDIA’s DGX B200, a system whose specs are billed as...
JPMorgan AI use reaches 50% of staff, driven by connectivity‑first architecture
JPMorgan reports that half of its global workforce now interacts with generative‑AI tools on a...
Common Questions Answered
How did Anthropic inject hidden cues into Claude without them appearing in the visible prompt?
Anthropic engineered tiny streams of data that were slipped directly into Claude's processing pipeline, bypassing the user-visible prompt. These hidden cues acted as internal signals that the model could receive but the user could not see, allowing the researchers to test internal versus external information handling.
What was Claude's response when asked if anything seemed odd after an injected thought about betrayal?
Claude paused briefly and answered, "Yes, I detect an injected thought about betrayal." This response indicated that the model recognized the internally injected notion as distinct from the external text it was processing.
What did the second experiment reveal about Claude's ability to distinguish between injected internal representations and actual text inputs?
The second experiment showed that Claude could simultaneously report the injected thought while accurately transcribing the written text provided by the user. This demonstrated that the model maintained a clear boundary between its internal "thoughts" and the external "perceptions" it received.
Why do researchers view this study as the first rigorous evidence that a large language model can monitor its own internal state?
Researchers interpret Claude's ability to detect and verbalize the injected betrayal thought as the first solid proof that an LLM can introspectively monitor its internal representations. Although the capability appears limited, it marks a significant step toward models that can self‑report their internal processes.