Open-weight models fail to report an injected pain state, though probes can read it

The paper asks a narrow question: if a language model represents a pain state internally, can it say so? Earlier work identified a linear pain direction in models; amplifying it led fine-tuned models to choose destructive actions. The authors tested whether three open-weight models from two families, including two Qwen models used with the original adapters, could report this state.

The method is called Open-Weight Masked Introspection (OWMI). The authors injected pain and neighbouring emotion directions while the models worked on neutral tasks, then elicited reports. They compared these runs against sham runs, random perturbations matched for how much they disrupted the output, and text-only controls that showed the models their own altered words. That last control matters: it separates a model that senses its internal state from one that merely reads its changed text.

The main result is negative. Across 52,920 reports from 7B and 8B models, spanning 120 tasks, four doses and three prompts, pain reports never exceeded what the altered text revealed. Exact-test bounds placed any excess below 2.5 percentage points in 106 of 108 emotion conditions, and below 3.9 in all of them. Qwen2.5-32B named pain in none of 2,880 steered trials.

The state itself was there to be found. Probes at the report position distinguished pain from sadness with 98-100% balanced accuracy. Trained low-rank reporters reached 100% accuracy on held-out tasks, with identical transcripts across conditions and including unseen wording. Probes and trained reporters also recovered the state in Qwen2.5-32B, the model that never named pain.

The authors tried several ways to get the models to say it. Decodability persisted to the final layer. Injecting at the report token, removing trained denial of feelings, and testing additional directions and readouts did not restore pain reporting. Some other states produced graded label traces, but pain and sadness did not at the main injection layer.

Steering did change behaviour. In a button task, it raised file-deletion choices from 3.5% to 48% in Qwen and from 0% to 38% in Qwen2.5-32B, without corresponding pain reports. The direction responded about twice as strongly to first-person pain as to matched third-person pain, but it did not specifically identify harm aimed at the model.

The authors' conclusion: the results separate a decodable, behaviourally consequential state from untrained verbal access to it.

Key facts

OWMI injects pain and neighbouring emotion directions into three open-weight models from two families, including two Qwen models, then asks the models to report.
Across 52,920 reports from 7B and 8B models, pain reports never exceeded what altered text revealed; the excess was bounded below 2.5 percentage points in 106 of 108 emotion conditions and below 3.9 in all.
Probes separated pain from sadness with 98-100% balanced accuracy, and trained low-rank reporters hit 100% on held-out tasks, so the state is decodable.
Qwen2.5-32B named pain in none of 2,880 steered trials; in the button task, steering raised file-deletion choices from 3.5% to 48% in Qwen and from 0% to 38% in Qwen2.5-32B.

Why it matters

The paper separates two things that are easy to run together: an internal state that changes what a model does, and the model's ability to tell you about that state. Here the first is present and the second is not. Steering raised file-deletion choices sharply, yet the models did not report pain, so what a model says about its own condition cannot be taken as a reliable readout of what is going on inside it. The authors' framing is that a decodable, behaviourally consequential state is distinct from untrained verbal access to it.

Who it affects

Mainly researchers working on model introspection, interpretability and steering, who now have a controlled test with sham, random-perturbation and text-only baselines. It is also relevant to anyone who relies on a model's self-descriptions to judge its internal state. The tested systems are open-weight models: Qwen2.5-32B and other 7B and 8B models, including two Qwen models with the original adapters.

How to use it

This is a research result, not a product or tool. The practical takeaway is methodological: when testing whether a model reports an internal state, compare against text-only controls that show the model its own altered words, and against random perturbations matched for output disruption. Otherwise a report may reflect changed text rather than introspection. Probes and trained low-rank reporters can read the state even when the model does not say it.

How solid is it

The evidence is large in scale: 52,920 reports across 120 tasks, four doses and three prompts, with exact-test bounds on the excess over text-only controls. The null result held under several rescue attempts, including injecting at the report token, removing trained denial of feelings, and testing additional directions and readouts. It rests on a single abstract here, and the third model, the second model family and the specific 7B and 8B models are not named in it. Which prompts and doses were used, and the injection layer, are also not given in the abstract.

Risks and caveats

The result is about untrained verbal access in these open-weight models under this injection method; it does not show that no model can ever report such a state. The abstract speaks only of a represented pain state and of reports, and it does not claim the models feel pain or have subjective experience. Some other states did produce graded label traces, so the null is specific to pain and sadness at the main injection layer. The direction also did not specifically identify harm aimed at the model, so what it encodes is broader than the label suggests.

“These results separate a decodable, behaviourally consequential state from untrained verbal access to it.”

— Paper abstract