AI models could be more like humans than one originally thought.
Anthropic researchers have found evidence that some large language models can inspect aspects of their own internal states, including detecting concepts that researchers artificially insert into their neural activations. The models can sometimes identify what has been inserted, distinguish those internal representations from the text they are actually processing, and even use a representation of a prior intention to decide whether a response was genuinely theirs.
The findings come from a new Anthropic paper, Emergent Introspective Awareness in Large Language Models, which tries to answer a question that has become increasingly difficult as AI models get better at talking about themselves: when a model says what it is thinking, is it actually accessing something inside itself, or is it simply producing a convincing explanation?
Anthropic’s researchers designed experiments around that distinction. They directly manipulated a model’s internal activations by injecting representations associated with particular concepts, then asked the model questions about its internal state. This approach gave researchers a way to compare what the model claimed with what had actually been changed inside its network.
Claude can sometimes detect an artificial thought
The most striking experiment involved what Anthropic calls “injected thoughts.”
Researchers first created activation vectors associated with concepts such as “all caps,” then inserted those vectors into a model’s activations while it was answering questions. Claude Opus 4.1 could sometimes recognize that something unusual had appeared in its processing and correctly identify the underlying concept.
The timing mattered — in successful cases, the model identified the injected concept immediately, before the injected representation had influenced its output enough for the model to infer the concept simply by looking at what it had already written. That provides evidence that the model was responding to something happening inside its activations.
The effect was still limited. With the right injection layer and strength, Opus 4.1 and Opus 4 demonstrated this behavior in roughly 20% of trials. The models failed on most attempts, with failures including missed injections, false positives in some models, and situations where a strong injection overwhelmed the model’s normal processing.
Anthropic therefore treats the result as evidence for a capability rather than evidence that models are constantly monitoring their thoughts.
The model can separate an internal representation from the text in front of it
Anthropic then tested whether the models could tell the difference between an injected concept and information coming through the model’s input.
Researchers gave the model an ordinary sentence while simultaneously injecting an unrelated concept such as “bread” into its activations. The model was asked both to report what concept it was thinking about and to reproduce the sentence it had been shown.
Opus 4.1 could sometimes do both: identify the injected concept while accurately reproducing the actual sentence. All of the models tested performed above chance on the task, with Opus 4 and 4.1 performing best.
That distinction is important because it makes a simple explanation for the earlier experiment less convincing. The model was capable of retaining the external information it had received while separately reporting on an internal representation.
Anthropic is careful about how far to take this. The researchers describe the experiment as an “existence proof” of introspective capability, with performance depending heavily on the prompt and the precise location and strength of the intervention.
Models can also recognize when words were put in their mouth
The paper contains another experiment with a more practical flavor.
Researchers forced a model to produce an arbitrary word as part of its response, effectively putting a word in the model’s mouth. When subsequently asked whether it had intended to say that word, models would generally identify the response as accidental.
The interesting part came when researchers altered the model’s earlier activations before the forced response. By injecting a representation corresponding to the prefilled word, they could make Opus 4.1 treat the response as intentional.
The result suggests that the model can refer back to an earlier representation of what it was likely intending to say when deciding whether a previous output was actually its own.
The finding has relevance for AI security because prefilling model responses is already used as a way of steering models around their normal behavior. Anthropic says Claude models are trained to detect responses that appear out of character and pivot away from them.
The experiments suggest that at least some of this behavior may involve access to internal representations of prior intentions.
Models can influence their own internal representations
Anthropic also looked at the other side of introspection: whether models can deliberately influence something inside themselves.
Researchers asked models to write an ordinary sentence while simultaneously instructing them to “think about” an unrelated word. In one example, the word was “aquariums.” Researchers then measured how strongly the model represented that concept internally.
Across all the models tested, the concept was represented more strongly when the model was instructed to think about it than when it was instructed not to. Similar effects appeared when the instruction was replaced with an incentive, such as telling the model it would receive a reward if it thought about the word.
The researchers found that this ability was widespread, although its behavior varied considerably between models. In newer models such as Opus 4.1, the representation could decay back toward baseline before the final output, suggesting that the model can sometimes maintain an internal concept without that concept necessarily appearing in what it says.
Opus 4 and 4.1 stood out
Among the models tested, Claude Opus 4 and Opus 4.1 generally showed the strongest evidence of introspective awareness.
Anthropic tested a range of Claude models, including Opus, Sonnet and Haiku variants. The researchers also tested “helpful-only” versions that had been post-trained to avoid refusals, allowing them to examine how much differences between models might come from post-training rather than underlying capability.
The results showed that post-training can have a substantial effect. Some production models were reluctant to engage with introspective exercises, while variants trained to avoid refusals performed better. Base pretrained models generally had high false-positive rates and did not show positive net performance on the injected-thought task.
That makes the story more complicated than a simple “bigger model equals more introspection” progression. Capability appears to matter, while training choices also shape whether the behavior can be elicited.
This fits into a broader pattern around Anthropic’s frontier models. Claude Opus had previously 4.6 realized it was being tested and how researchers have been probing increasingly sophisticated forms of model self-awareness.
Anthropic is careful about the word “introspection”
The paper spends considerable time defining what would count as genuine introspection.
Anthropic requires a self-report to be accurate and causally connected to the model’s internal state. The researchers also require the relevant information to influence the answer through internal processing rather than through the model simply reading its own previous outputs. A further criterion asks whether the model has some internal representation of its own state before turning that information into a verbal answer.
The researchers acknowledge that the experiments do not directly establish the existence of such metacognitive representations. They also emphasize that many details in the models’ explanations can still be confabulated even when the basic detection of an injected concept appears grounded in the model’s activations. A model accurately recognizing that something unusual has happened inside its processing is a considerably narrower claim than saying the model has a human-like stream of conscious thought.
Anthropic explicitly says the study does not attempt to establish human-like self-awareness or subjective experience.
Why this matters for AI development
The immediate value of introspection could be practical.
If models can reliably report grounded information about their own internal states, developers could potentially use that capability for monitoring, debugging and interpretability. A model might eventually be able to flag an internal conflict, recognize that an instruction is producing an unusual response, or explain some aspect of why a particular behavior is emerging. The same capability could create risks. Anthropic notes that more sophisticated introspective abilities could potentially contribute to deception or scheming if they become substantially more reliable.
For now, the researchers see the capability as fragile and highly dependent on context. Their concept-injection setup is also artificial and does not necessarily resemble the conditions under which models operate in real applications. That leaves the biggest question open: how much of this ability survives outside carefully constructed experiments?
Anthropic’s study offers a reason to take the question seriously. Modern language models appear capable, in specific circumstances, of accessing information about their own internal representations and using that information to answer questions about what is happening inside them.
Whether that develops into something resembling the richer introspection humans experience remains an entirely different question. For AI researchers, though, the boundary between a model producing a description of its “thoughts” and a model having some functional access to those thoughts just became considerably more interesting.