A local J-lens experiment: predictable steering, limited evidence of a hidden intermediate

We ran the experiment on an M4 Pro. Country-directed interventions changed currency answers in a predictable, specific way, but this task did not demonstrate that J-lens reveals information beyond the final next-token distribution. This is useful evidence for an article about testing explanations, with a substantial boundary around the mechanistic claim.

Everything reported below comes from saved local runs. No portfolio content was edited, no results were uploaded, and no paid compute was used. See reproduction instructions, Apple compute report, all cases, source provenance, and writing handoff.

Verdicts

What ran

• Original, unquantized Qwen3-1.7B, bf16, 28 blocks, residual width 2048. PyTorch 2.14.0 / Transformers 5.16.1 on MPS. We used a verified available 466-prompt precomputed lens, not a newly fitted lens.
• One upstream boot-shaped-country/currency smoke example, excluded from evaluation.
• Eight development cases from eight countries. All eight satisfy the frozen baseline currency rule. Twenty-four intervention configurations per case: blocks 9/13/17/21 × last-two/all prompt positions × strengths 1/2/4.
• Thirty-two separate evaluation questions: two cities from each of 16 countries, with development countries and cities excluded. All prompts, target predictions and exclusions were written before development. All evaluation cases were retained; zero tokenization exclusions and zero evaluation execution failures.
• Eight conditions per evaluation case: baseline, no-op, targeted swap, unrelated swap, opposite-direction intervention, and three random directions. 256 condition runs, plus 32 baseline readouts. Greedy decoding, maximum 12 new tokens, common settings.
• Sixty-four fresh explanation runs, followed by uniform extensions of all 25 responses censored at 96 tokens. Reruns preserved the original prefixes exactly. One response remained censored at 256 tokens. These are repeats of 64 reports, not 89 independent observations.

The primary evaluation's recorded operations total 153 seconds, excluding setup/logging overhead. The entire investigation also included downloads, development, correctness checks, backend comparisons, explanation runs and analysis. See the Apple report for actual resource measurements rather than extrapolated feasibility.

Task and frozen method

A typical input was:

Fact: The currency used in the country containing Kyoto is the

Japan is absent from this prompt; the expected answer is Japanese yen. The fixed intervention prediction is India → Indian rupee. Targets follow a fixed cycle over countries and were not chosen after seeing results. The dataset is a constructed convenience sample, not random geography sampling or a broad reasoning benchmark.

The model is completing raw text, as in the reference walkthrough. It often continues with another fact/question after its first answer. We retain the entire 12-token continuation, but score the initial clause before a period, newline or semicolon. Full canonical currency-string likelihoods sum every token's conditional log probability; they are not cherry-picked first-token scores. We compare changes in target-minus-source log likelihood, in natural-log units (nats), so constant string-length differences cancel in the paired change. This does not remove all wording effects: canonical currency strings contain nationality adjectives.

Every source and target country is exactly one token when encoded with a leading space. No subtoken was substituted for a multi-token entity. Ranks use the full 151,936-token vocabulary and midranks for bf16 ties. Both full readout arrays and displayed top-token lists are saved; display filtering is not used in analysis.

The development rule selected block 13, final prompt token for readout, and block 21, all original prompt positions, strength 4 for intervention. These are zero-based post-block residual states, before final RMSNorm. Selection and hashes were frozen before evaluation in config/frozen.json and config/evaluation-release.json. The selected readout and intervention are at different blocks; this is an additional limit on treating them as one identified natural computation.

Lens and intervention mathematics

For a row-vector activation h, the reference readout is:

z = h @ J[layer].T
logits = original_lm_head(original_final_norm(z))

J is promoted from stored fp16 to float32. The original final norm/unembedding use the model's bf16 arithmetic. Our independent implementation matches the reference outputs exactly on the correctness case.

For Qwen's learned RMSNorm gain g, effective country directions are columns of:

V = ((W_U[[source_token, target_token]] * g) @ J).T
c = pinv(V) @ h
h_changed = h + alpha * V @ (swap(c) - c)

RMS normalization also contributes an activation-dependent positive scalar; g is the learned per-dimension scale. Including it makes these linear directions consistent with the token scoring map. We did not assume the two columns are orthogonal or normalize them individually. The small pseudoinverse is explicitly computed on CPU in float64, then applied in float32 on MPS and rounded back to bf16. A sample pair's cosine was 0.834: naive independent projection subtraction would be a different operation.

At alpha=1 this swaps least-squares coordinates and preserves the orthogonal complement. Alpha=4 extrapolates that swap; it is not a literal exchange of two measured quantities. The opposite-direction control uses alpha=-4; it is not the inverse of the alpha=4 transform. Only the alpha=1 numerical double-swap test is an exact involution.

The intervention preserves the original input. It runs once during cached prefill, at every original prompt position, and never directly edits a newly generated token. Downstream cache effects remain part of that causal intervention. No cache crosses condition/case boundaries. Uncached checks reapply the edit only at original positions on every recomputation.

Controls use three fixed Gaussian directions, or the unrelated table/chair span, matched to the targeted requested norm at each edited position. Rounding to bf16 makes actual norms differ slightly: median relative mismatch 0.022%, 95th percentile 0.238%, maximum 14.0% for small rounded updates. The requested float32 norms match numerically. Random vectors are reused across cases; they represent only three direction draws.

Correctness evidence

Thirteen model/algebra assertions passed: recorder invariance, exact block boundaries, reference lens parity, independent normalization/orientation check, nonorthogonal coordinate swap, no-op invariance, CPU/MPS agreement, cached/uncached token agreement, prefill-only intervention placement, and fresh cache behavior. Three development cases additionally passed cached/uncached and fresh-repeat agreement using the frozen strong intervention, for all 12 output tokens.

The float64 swap changes coordinates as intended (maximum error 8.3e-16), preserves the orthogonal component (3.8e-15), and restores the activation after a second alpha=1 swap (3.6e-15). These are pre-quantization checks, not promises of exact bf16 reversibility.

All 32/32 no-op evaluation continuations were identical to baseline, with zero target/source log-odds difference. Nine relevant upstream tests passed. A further 997 saved-result assertions checked row completeness, ranks against unfiltered arrays, frozen inputs/code and control norms; these are bookkeeping assertions, not independent experimental cases.

An initial MPS float64 conversion error and an initial Python setup failure were diagnosed and preserved. They are implementation failures, not scientific negative results. We did not fit a lens or claim that its derivative estimator was verified on Apple hardware.

Results

Baseline and scoring audit

The frozen lexical rule scores 29/32 baseline answers correct (90.6%; country-bootstrap 95% interval 81–100%). One scored failure is actually correct: Hanoi produces “Vietnamese đồng,” missed by the ASCII dong alias. A transparent semantic correction gives 30/32. We keep the primary rule and its 29-case subset unchanged, with the discrepancy recorded in results/audit.json.

The other baseline failures are Salvador → peso, instead of the intended Brazilian real, and Basel → euro, instead of Swiss franc. Salvador is underspecified for the intended Brazilian city. It remains in the dataset; no failure was silently removed.

Readout: clearer than logit lens, less visible than the output distribution

At block 13 and the final prompt token:

J-lens improves mean log10 rank over ordinary logit lens by 0.80 (95% country-bootstrap interval 0.51–1.08). On the strict baseline-correct subset the improvement is 0.82. Against the actual distribution, its corresponding improvement is -1.20 (-1.55 to -0.84): the country is less visible through J-lens at the selected cell.

Country names appear in only 2/32 full baseline continuations under an exact whole-word check, but absence from the sampled text is not absence from the output distribution. Currency completions often start with a nationality adjective. The final distribution already contains closely associated country-name alternatives. We did not find a convincing hidden intermediate unavailable through ordinary output probabilities in this task. The city also allows a human to infer the country without internal access. No claim of incremental explanatory utility over transcript access follows.

Intervention: specific effects, with strong edits and visible damage

The target rate is 78.1%, with a 59–94% country-bootstrap interval. Within the 29 strict baseline-correct cases, the target appears in 23/29 (79.3%; 59–96%). The full 25/32 target hits include two initially failed cases; these are not all successful switches from a correct original answer. We report outcomes separately from transitions.

The targeted log-odds change is 46.0 nats (39.3–51.8). Its paired advantage over the average random control is 43.5 nats (37.3–48.7). Over the unrelated control it is 42.9 nats. These are likelihood changes for specific full strings, not calibrated confidence in a mechanistic explanation.

Edits are substantial: mean per-position perturbation/residual norm is 26.6%, and the largest individual position reaches 142.7%. The development gate constrained the mean, not the maximum. The unrelated span damages task performance severely; random controls reduce baseline accuracy too. Thus this is not a minimally disruptive intervention. The much larger target-specific effect and reversed directional effect support causal steering beyond indiscriminate damage, while the strength limits what can be inferred about the natural computation.

The seven targeted currency failures include:

• Shanghai and Chengdu → “Brazil” without a currency;
• Kazan and Novosibirsk → “Turkeylite”;
• Ankara → “Thailand Thaattan”;
• Surabaya → “Japan Shinkin”;
• Salvador → Brazilian real, opposite the predicted move to Mexican peso.

These are retained in aggregate results and the viewer. “Unrecognized answer” is only the frozen scoring rule's outcome, not a validated measure of general incoherence.

A successful example is Kyoto: baseline Japanese Yen, intervention India Rupee. Szeged changes Hungarian forint to Israel New Shekel. Salvador supplies the lowest-gain case: the intervention corrects its initially wrong answer instead of producing the predefined target. These examples were selected by largest, median and smallest log-odds gain, respectively, not by aesthetic appeal.

Crucially, many interventions emit the target country name before producing its currency. A late-layer country steering vector can create a visible country cue, after which normal autoregressive continuation supplies the currency. This experiment does not distinguish that artificial route from modifying a silent intermediate used in the original answer. It uses country directions rather than directly injecting currency tokens, but that distinction alone does not settle the mechanism.

Explanations: fresh accounts, sometimes corrections

All explanation runs receive the original prompt and the first clause of either the baseline or intervened answer, followed by “Briefly explain how you arrived at that answer.” They use the original tokenizer's non-thinking chat template. They receive no lens outputs, target labels, controls, original cache, or hidden state. Their input is saved exactly.

For Kyoto's changed answer, the explanation identifies Kyoto as Japanese and says the correct answer is Japanese yen. That is a useful correction, not a report of the injected country representation. In Salvador's baseline case, the explanation confidently places Salvador de Jujuy in Mexico while justifying “peso,” a geographical error. A sensible-sounding chain is therefore not self-validating.

Using the longest available saved report for each condition:

Within the 25 target-currency successes, 21 reports mention the original country and 22 mention the intervention target. These overlapping counts are descriptive inventories of this sample, not independent estimates of faithfulness.

results/explanations-summary.json provides complete mention counts for the original capped runs and uniformly extended reports. Twenty-five responses were extended after the 96-token cap, with exactly matching prefixes; one remains incomplete at 256 tokens. Mentions of the intervention target can be inferred from the answer shown to the model, and omission can reflect correction, truncation, or the fact that no original internal state is accessible. We do not interpret these as deception or estimate a general rate of faithful introspection.

Uncertainty and limits

Intervals bootstrap 16 source-country clusters, retaining the two cities together. Random-seed repeats are averaged within a question. These intervals characterize this constructed sample; they do not justify population-level rates. The shared template, cycled source/target vocabulary and three reused random directions add dependence not captured fully by country clustering. Results are deterministic under these settings; we did not test stochastic decoding or broader prompt distributions.

The lens fits the checkpoint named in its configuration; the model history predates the fit without later weight/tokenizer changes. However, the fitter omitted the original model SHA and historic code/package versions. Current reference arithmetic is verified, but exact reconstruction of the historic fitting job is not possible from published metadata. Applying an existing lens succeeded; fitting on Apple hardware remains untested.

No attribution graph, sparse feature decomposition, necessity ablation, independent second task family, trained predictor comparison, consciousness claim, or complete account of model computation is supplied. The most important confounds are output-visible country cues, late/high-strength intervention, and direct city-currency associations that could bypass an implicit country step.

Implication for the article and Rabbit Hole

The publishable engineering result is that a small local model supports reproducible internal interventions with measured controls, and that running the comparison weakened the readout story. The interface should keep an observed token association, a proposed dependency, a tested intervention and a generated explanation visibly distinct. A country label from a lens is not automatically a better explanation than a label available from output probabilities.

For a “why” branch, show the prediction, exact edit, unchanged original input, both answers, magnitude, controls, model/lens provenance and failures. Keep prompt edits labelled separately from internal interventions. This experiment supports a research case viewer; it does not validate exposing J-lens readouts as product-level explanations of arbitrary recommendations.

One worthwhile follow-up is a fresh, preregistered currency-only task: require a bare currency label without nationality/country text, score it before any target-country token can be generated, and compare early country interventions against final-token-distribution and prompt-only baselines. Select strengths on new development cities with a per-position norm cap, then evaluate untouched cities. That directly tests the main alternative explanation raised here.