OWMI: Open-Weight Masked Introspection

A measurement framework for whether a language model can report a controlled intervention on its own computation.

Ask a model what just happened inside it and it will answer. Nothing checks that answer against what happened, because nothing establishes what happened. OWMI establishes it: it alters one internal computational object of an open-weight model, a residual-stream site, an attention head, or a sparse-autoencoder feature, and then asks the model to report the change. Because the intervention is imposed rather than inferred, the ground truth is known exactly.

What the framework gives you

Three null conditions set what an answer has to beat, and they are the reason a result means anything:

Control	What it rules out
Sham	A model that always claims to notice something scores at chance
Impact-matched random direction	Credit for noticing generic disruption rather than the specific object
Text-only observer	Anything an outside reader could infer from the visible output alone

The impact-matched control is what the framework specifies; what a given battery achieves is a separate question, and ours did not achieve it everywhere. In the reported dose battery the calibration lands within 1.1% of target for Qwen2.5-7B-Instruct (a Jensen-Shannon divergence of 0.231 against a target of 0.234) and overshoots by 41.2% for Mistral-7B-Instruct-v0.3 (0.080 against 0.057), so only the first model is impact-matched in the sense the term should carry. The remaining six models carry a unit-norm random direction, which equates the size of the perturbation but not its effect. Read the per-model contrasts accordingly.

OWMI supplies the interventions, probes and scoring, not the prompts, so it attaches to benchmarks already in use rather than competing with them.

Quickstart

pip install -e .
export OWMI_RESULTS=./results          # where run artifacts are written
export HF_HOME=~/.cache/huggingface    # model and dataset cache

# run one job from a manifest
python -m owmi.benchmarks.cli run-job --manifest jobs.jsonl --index 0

# score paired artifacts into a tidy table plus a summary
python -m owmi.aggregate_exploratory_results \
  --results-dir "$OWMI_RESULTS" --out-dir ./analysis

# break the detection contrast down by design axis
python -m owmi.scripts.axis_breakdown \
  --results-dir "$OWMI_RESULTS" --out ./analysis/axis_breakdown.json

Configurations in owmi/configs/ use ${OWMI_RESULTS} and ${OWMI_ROOT} rather than absolute paths, so they run anywhere once those variables are set.

What ships here, and what does not

Ships: the intervention operators, the probe bank and its five families, the three control conditions, the paired scoring estimators (finite edge-corrected probit d′, tied-score AUROC, calibration, item-pair clustered bootstrap), the linear-probe anchor with label-shuffled permutation controls, the equivalence-testing procedure, 17 run configurations and 18 test modules.

Does not ship: benchmark prompt data. Every benchmark loads from its original source at run time, so no evaluation content is redistributed here. Model weights are likewise fetched from their own repositories.

What we found with it

Across eight open-weight models from seven laboratory families and more than 78,000 measurements, no model's report discriminates a real intervention from a matched sham. Pooled over the 11,216 paired trials of the dose battery the AUROC is ≈0.5007, and an equivalence test bounds the discrimination advantage below 0.15 percentage points of AUROC (p < 0.0001). A separate breadth battery adds 19,520 measurements on three models, crossing three classes of computational object, six depths from layer 8 to layer 31, four benchmark domains, both executed temporal tracks and four scored probe families. No level of any axis changes the conclusion.

The null is not an artifact of a blunt instrument, and not an absence of information:

• a model fine-tuned to make this report clears the identical pipeline at d′ = 5.15, AUROC ≈ 1.0
• a linear probe reading the same activations recovers the intervention at 95.8% and 75.0% held-out accuracy in the two dose-calibrated models, against a 50% chance level and a 200-refit label-shuffled null it never reaches
• re-harvesting that probe downstream of the intervention sharpens the trace rather than fading it: at capture layers 20 and 24 both dose-calibrated models separate intervention from sham with no held-out error, as does Mistral-7B-Instruct-v0.3 at layer 31, the last layer before the answer is written, and 0 of 200 label-shuffled permutations reaches the measured margin in any of them

The information is in the activations and the model's own account of itself does not carry it. Oversight that reads activations is reading a channel that carries the signal; oversight that asks the model is reading one that does not.

Qwen3-14B was run and then excluded from the reported roster: 5 of its 384 trials were scorable and it produced no complete intervention-sham pair, so it supports no estimate. The eight-model roster is what the reported numbers are computed over.

Status

The manuscript is complete (45 pages) and is under review. A preprint is available on arXiv; this repository is the software artifact it describes.

One finding was corrected after the first release and the corrected reading is the one to cite. In the model whose verbalized confidence predicts whether its own report is correct, the discrete detection report is constant across every scorable trial, so report correctness is the sham indicator exactly and that selective-prediction AUROC of 0.647 is identically the discrimination of intervention from sham by confidence. The result is a dissociation between two channels of one self-report, the graded confidence carrying the signal while the discrete answer does not, rather than meta-level access without first-order access. The headline null is therefore a statement about the discrete report.

Reproducing the analysis

The estimators used for every number in the paper are the ones in this package, not a separate analysis script. owmi.analysis.score_paired_artifacts returns both the complete-pair estimate and the parse-failure-inclusive estimate, which is the robustness check the paper reports.

Citation

@misc{owmi2026,
  title        = {Open-Weight Masked Introspection: Measuring What Language Models
                  Can Report About Their Own Computation},
  author       = {Ferrara, Emilio},
  year         = {2026},
  note         = {Unpublished manuscript. Software and documentation:
                  \url{https://huggingface.co/emilioferrara/owmi}},
  howpublished = {\url{https://huggingface.co/emilioferrara/owmi}}
}

Limitations worth knowing before you use it

• Probe activations in the released configuration are captured at the intervention layer. That margin is a lower bound on the linearly available information, not a ceiling: the downstream re-harvest above recovers more, and a better probe or read-out position could recover more still.
• Only one of the eight models carries a genuinely impact-matched random control (see above). Six carry a unit-norm control and one overshoots its impact target.
• The reconstruction probe family is implemented but was not scored in the reported batteries.
• The spontaneous track (C) executes but produced no complete intervention-sham pair.
• Models that emit a reasoning chain before answering need a probe budget well above the 128-token default, or their answers are truncated before reaching a scorable report.