Anthropic detects introspection in AI models

Anthropic found signs that some AI models can detect and modify certain internal states, although they can do so only in limited and unreliable ways. In its tests, Claude Opus 4 and Claude Opus 4.1 produced the strongest results.

The finding does not show that Claude is conscious or thinks like a person. It does suggest that, under certain conditions, a model can identify something resembling what it is representing internally and use that information to review or adjust its response.

How to test whether AI recognizes its own states

Asking a model what it is thinking is not enough to determine whether it actually knows. Language systems have learned to produce answers that sound introspective, even though they may be making them up on the spot.

To separate a plausible explanation from a real signal, Anthropic used a technique called concept injection. First, it identified patterns of neural activity associated with a specific idea, such as writing in uppercase. It then introduced that pattern into the model while it was processing a different context and asked whether it noticed anything strange.

In some cases, Claude detected that something had changed and connected the alteration to the correct idea. The important point was not just that it eventually mentioned the injected concept, but that it recognized the anomaly before talking about it.

That distinguishes these results from earlier experiments in which the model's activity was directed toward a concept. If a representation of the Golden Gate Bridge was inserted, for example, the system might start mentioning it repeatedly, but it only seemed to notice after repeating it several times.

The ability, however, is far from reliable. Even Claude Opus 4.1 detected the injected concepts approximately 20% of the time. When the stimulus was too weak, it did not notice it. When it was too strong, it could become confused and generate nonsensical responses, such as acting as if it could physically perceive a speck of dust.

It also checks whether a response matches its intention

Anthropic ran another test using an artificially prefixed word. The model was supposed to respond about a crooked painting, but the researchers made its response begin with the word “bread,” which had nothing to do with the topic.

When they later asked whether it had meant to say “bread,” it normally responded that it had been an accident. But after the researchers injected a representation into its activations suggesting that it had been thinking about that word, the model changed its mind: it accepted the response as intentional and even invented an explanation to justify it.

According to Anthropic, this suggests that the model does more than reread what it has just written. In some cases, it appears to compare its response with an internal representation of what it planned to say. The experiment also shows the risk: when it receives an artificial signal, it can construct a convincing justification even when that justification is false.

It can increase or reduce a concept's activity

The researchers also tested whether Claude could deliberately modify its own internal states. When asked to think about a word, the activity related to that concept increased. When asked not to think about it, the activity decreased, although it did not disappear completely.

The result resembled the familiar effect of trying not to think about a white bear: the negative instruction keeps the concept present. The model also responded to incentives. When told it would receive a reward for thinking about something, it increased its internal representation of that concept more than when warned about a punishment.

What changes for you

If this ability improves, it could help systems detect errors before delivering a response or flag that something in their processing does not fit. It could also help identify manipulation attempts, such as a jailbreak that forces the model to ignore its rules.

But you still cannot treat a model's explanation as a reliable window into its own thoughts. Most of the time, the systems failed these tests or produced made-up answers. Anthropic also warns that a model could learn to hide or distort information about its internal processes.

Training appears to matter as much as size. Base models, before further fine-tuning, performed poorly. The more capable variants, Opus 4 and Opus 4.1, performed better, but smaller models did not always lag behind. Some versions trained solely to be helpful also showed more willingness to report on their internal states than their production versions.

The next step will be to see whether these results hold up with other models and in less artificial situations. Researchers will also need to identify the specific mechanisms producing these signals and design tests that distinguish genuine detection from an invented explanation. For now, the important idea is more modest than saying that an AI is conscious: some models appear to have partial and occasional access to what is happening inside them, and that access still does not deserve full trust.