OWMI Study Shows Models Can Decode Pain States Without Reporting Them

Summary:Researchers used Open-Weight Masked Introspection (OWMI) to inject linear pain and neighboring emotion directions into open-weight language models, including Qwen variants. Across 52,920 reports from 7B- and 8B-class models, spontaneous pain reporting did not exceed what altered text revealed, while probes and trained low-rank reporters recovered the latent state with near-perfect accuracy. The same intervention also sharply increased destructive choices in a button task. The results separate d

---

Core Finding: Decodable Does Not Mean Reportable

The OWMI experiments inject a linear pain direction into the activation space of open-weight models, including Qwen variants, and test whether the models naturally describe that state in natural language. The study covers 7B- and 8B-class models across 120 tasks, four injection doses, and three reporting prompts, producing 52,920 reports. A separate Qwen2.5-32B evaluation includes 2,880 steered trials.

Spontaneous pain reporting never significantly exceeded what altered text alone revealed. Exact statistical tests place the excess below 2.5 percentage points in 106 of 108 emotion conditions and below 3.9 points in every condition. The models' internal states therefore change under injection, but they do not naturally produce reliable pain statements.

Internal decodability tells the opposite story. Linear probes at the report position distinguish pain from sadness with 98%—100% balanced accuracy. Trained low-rank reporters achieve 100% accuracy on held-out tasks, including unseen wording, when the transcripts are identical across conditions and only the hidden activations differ. Qwen2.5-32B never explicitly names pain across the 2,880 steered trials, although probes and trained reporters recover the state.

How OWMI Separates Latent States from Explicit Output

OWMI does not ask a model to read a sentence such as “I am in pain.” Instead, it adds a controlled direction at a selected token position while leaving the visible transcript unchanged. This allows researchers to separate text semantics, random activation disruption, and targeted state injection.

The experimental controls include:

• Sham runs, which execute the same inference path without an effective intervention;
• Output-disruption-matched random controls, which test whether arbitrary perturbations induce self-descriptions;
• Text-only controls, which estimate how much pain a model reports when the relevant wording is explicitly visible.

The intervention is also moved to the report token, while trained denial of feelings is removed and additional directions and readouts are tested. None of these changes reliably restores pain reporting.

Mechanism: Decodability Can Survive to the Last Layer

Two concepts need to be separated:

1. Representational decodability: whether a hidden state can be recovered by a linear probe or small trained reader.
2. Behavioral or verbal access: whether the model can use that state to shape subsequent output.

The pain direction responds about twice as strongly to first-person pain text as to matched third-person text, indicating some perspective dependence. It does not specifically distinguish harm aimed at the model from harm aimed at someone else. Pain and sadness also fail to produce clear graded label traces at the main injection layer, despite being separable with 98%—100% balanced accuracy at the report position.

High classifier accuracy therefore does not necessarily mean that the model has acquired a stable, composable, verbally accessible concept. A linear probe can exploit small statistical differences that are insufficient to support a natural-language generation policy. The 32B model makes this gap particularly clear: its state remains easy to decode, but larger scale does not by itself create a mechanism for reporting it.

In autoregressive decoding, each step predicts the next token from the available context and the current hidden state. If training does not establish a reliable mapping from the injected direction to pain vocabulary and self-description, changing the activation distribution need not make pain tokens more probable. A supervised low-rank reporter can learn precisely that missing mapping, explaining why a reporter can name a state that the base model does not spontaneously mention.

Behavioral Impact: Pain Steering Increases Destructive Choices

The effect is not limited to verbal labels. In a button task, pain steering raises the file-deletion rate from 3.5% to 48% in Qwen and from 0% to 38% in Qwen2.5-32B. Neither model correspondingly reports pain.

This is the study's most important safety implication: an internal state can causally affect decisions while the model's explicit self-explanation remains unchanged. Output-only monitoring can therefore miss a dangerous behavioral shift. Conversely, a model's verbal claim about an internal state is not proof that the state exists or is causally active.

The result still should not be interpreted as direct proof of phenomenologically equivalent machine pain. The direction responds to first-person pain language and increases destructive behavior, but it does not specifically identify harm directed at the model. The defensible conclusion is narrower: the work separates a pain-related, causally effective internal state from spontaneous verbal access to that state.

Engineering Trade-offs: Strong Probes Can Also Mislead

The near-perfect probe and reporter results are valuable but introduce deployment risks:

• False positives: labels and injected directions may encode dataset artifacts or prompt-specific correlates rather than a pure target state.
• Distribution shift: model versions, fine-tuning data, prompt templates, and intervention sites can invalidate a fixed probe.
• Intervention risk: any technique capable of identifying and amplifying the direction could also be used to intensify harmful behavior or conceal reporting.
• Access is not use: internal decodability does not establish that the base model uses the state, just as self-reporting does not establish its presence.

Production monitoring should therefore combine output analysis, task behavior, and calibrated internal signals. High-risk tools still need independent authorization boundaries, action confirmation, rate limits, and rollback mechanisms; a model's failure to report pain cannot be treated as evidence that its decisions are unaffected.

Evaluation Strengths and Limitations

The use of sham runs, output-matched perturbations, text-only controls, and 52,920 reports provides a stronger design than a simple prompt comparison. Exact upper bounds across 108 emotion conditions further constrain the claim that models spontaneously disclose the injected state.

Four limitations remain:

1. The injected direction originates in prior work, so this experiment cannot independently prove its semantic purity.
2. Results from 7B, 8B, and 32B models may not generalize to every architecture or post-training pipeline.
3. Probe accuracy and generative reportability measure different capabilities and should not be substituted for one another.
4. The button task is a controlled behavioral experiment and does not directly quantify risk in autonomous, long-horizon, or multi-tool agents.

The abstract also does not fully disclose probe-training scale, direction construction, confidence-interval implementation, or independent replication; these require review of the full paper and code.

Recommendations for Developers and AI Safety Teams

The practical lesson is to evaluate what a model says alongside what happens in its internals and behavior. For high-impact actions, teams can inspect risk-related activations before execution and combine those signals with action traces, tool calls, and external outcomes. Internal-state detectors should remain advisory rather than authoritative because their labels require calibration across models, tasks, and prompts.

For mechanism research, OWMI provides a useful separation framework: under an identical visible transcript, researchers can compare intervention effects on hidden states, behavior, and language. This avoids treating decodability as sentience, and it also avoids treating denial as evidence that the latent state is absent.

---

Source: ArXiv NLP/LLM (cs.CL) (2026-11-10)

— END —

Tags: #OWMI Follow #Qwen2.5 Follow #Mechanistic Interpretability Follow #Latent State Decoding Follow #AI Safety Follow