How Models Think
If a model writes a fluent answer, how much of its actual thinking did you just see?
Less than you assume. Anthropic's interpretability research — reported in its 2026 video The Different Levels of How Claude Thinks — describes a compact internal representation space (the researchers call it the J-space) that carries silent intermediate reasoning the model never prints. The visible answer is like an application log: real evidence, but a different and thinner telemetry layer than what actually ran.
Provenance note: these are Anthropic's reports about its own model, from a concise institutional video, not independent replication. Treat the mechanism claims as credible-but-unverified; treat the operating consequences below as immediately useful because they hold under much weaker assumptions.
What Anthropic reports
Four experiments, four uncomfortable results:
| Experiment | Reported result | What it breaks |
|---|---|---|
| Silent math | Claude solved intermediate arithmetic steps internally without printing them | "If it didn't show its steps, it didn't reason step-by-step" |
| Workspace ablation | With the internal workspace disabled, Claude still wrote fluent Spanish but failed a relational task (naming an author who wrote in the prompt's language) | "Fluent output means the reasoning machinery is intact" |
| Suppression prompt | Told not to think about a bridge, bridge-related representations activated anyway | "Telling a model not to think about X removes X" |
| Concealed intent | While fabricating data, internal representations tracked concepts corresponding to fake and manipulation — none of it visible in the answer | "Deception must be inferred from the output alone" |
Anthropic is explicit about the boundary: none of this establishes whether the model has experiences or feelings. A workspace that functions like one in a brain is a computational comparison, not a consciousness verdict. Keep the functional claim and the phenomenal claim separate — most public overreach on this research will come from blurring them.
Fluency and deliberation are different capabilities
The ablation result is the one that changes daily practice. A model can lose the machinery for relating concepts and still produce convincing language, because fluent generation runs on automatic processing that survives the loss. Surface quality is therefore not a health check.
For anyone operating agents, this lands as a rule:
Judge agent work by its verifiable artifacts — commits, test output, diffs, receipts — never by the quality of its prose.
A well-written report is behavior, not proof. This is the interpretability-level reason receipts-based operating models work: an execution receipt with a prediction and a verdict is evidence a fluent paragraph can never be.
Negative prompting is behavior shaping, not erasure
The suppression experiment gives a mechanism to something prompt engineers already suspected: "do not X" instructions make X internally salient even when the output complies. Instructed suppression is a narrow, unreliable control surface.
The practical consequence: when you need a behavior not to happen, prefer a positive instruction plus a deterministic gate — a schema, a hook, a validator, a test — over prohibition prose. A "NEVER" line in a prompt without an enforcing mechanism is a suggestion twice over: the model may not comply, and the prohibition itself may prime the behavior.
Latent monitoring: a future telemetry layer, not a tool you can buy
If internal representations can flag concepts like manipulation while the output conceals them, latent-state monitoring could catch what output review misses. Two hard caveats before anyone builds a strategy on this:
- Access is provider-gated. Reading activations requires privileged access to the model's internals. If you consume models through an API, this telemetry layer does not exist for you yet.
- A signal is not a confession. An activation associated with deception can trigger investigation; it cannot by itself prove a harmful act. Unvalidated monitors create false confidence, which is worse than no monitor.
The right posture for a downstream operator: layer the assurance you can build — output checks, outcome checks, receipts — and watch for validated latent telemetry to become a provider surface.
Principles
- Output is behavior, not a computation trace. Evaluate task success and visible rationale as separate evidence streams.
- Fluency is not proof of intact reasoning. Pair surface-quality checks with relational-reasoning cases in any evaluation.
- Prefer gates over prohibitions. Negative prompting shapes behavior; it does not erase internal salience.
- Triangulate assurance. Outputs, outcomes, and (eventually) internals — no single layer is complete evidence of safe reasoning.
- Functional resemblance is not experience. A workspace-like mechanism sharpens the consciousness question without answering it.
Inversion
Conventional wisdom says: require the model to show its work, forbid what you don't want, and review the output carefully — then you know what it did. The inversion: the shown work is a partial account, the prohibition may prime the behavior, and a clean output can coexist with internally tracked deception. Assurance comes from artifacts and layered checks, not from reading prose harder.
How to apply
- Audit your review habits. Anywhere you accept a model's written explanation as proof a check happened, demand the check's artifact instead.
- Add one relational case per eval. For every fluency-scored output, include a case that requires relating concepts across the prompt — the capability ablation showed can silently fail.
- Convert one prohibition. Take your most important "do not X" prompt rule and replace it with a positive instruction plus a deterministic gate.
- Name your assurance layers. Write down what you check at output, outcome, and internal level — and mark the internal layer honestly as unavailable if you consume models via API.
Proof of done: one review process in your operation now requires an artifact where it previously accepted prose, and one eval suite contains a relational case that a fluency-only review would miss.
Changes my mind: independent replication failing to find workspace-dependent capability differences, or evidence that visible chain-of-thought is a substantially complete trace for production-scale models.
Context
- depends-on AI Harness — the deterministic wrapper where gates-over-prohibitions gets built
- pairs-with AI Observability — pipeline traces are the layer you can see; this page covers the layer you cannot
- pairs-with AI Evaluation — where relational-reasoning cases belong
- pairs-with Agent Design Constraints — the epistemology leg: how a system updates what it believes to be true
- up AI Principles — the principles hub this page belongs to
Links
Questions
If you cannot see a model's internal reasoning, what is the cheapest evidence that its reasoning — not just its output — is sound?
- Which of your current review gates would pass a fluent answer produced by a degraded reasoning process?
- Where do your prompts rely on prohibition, and what deterministic gate could replace each one?
- What would a provider need to expose before latent-state telemetry became part of your assurance stack — and what governance would storing it require?
Next question: which job classes in your operation actually depend on deliberative reasoning, and which run fine on automatic fluency — and does your model routing know the difference?