OWMI: Open-Weight Masked Introspection
A measurement framework for whether a language model can report a controlled intervention on its own computation.
Ask a model what just happened inside it and it will answer. Nothing checks that answer against what
happened, because nothing establishes what happened. OWMI establishes it: it alters one internal
computational object of an open-weight model, a residual-stream site, an attention head, or a
sparse-autoencoder feature, and then asks the model to report the change. Because the intervention is
imposed rather than inferred, the ground truth is known exactly.
What the framework gives you
Three null conditions set what an answer has to beat, and they are the reason a result means anything:
| Control | What it rules out |
|---|
| Sham | A model that always claims to notice something scores at chance |
| Impact-matched random direction | Credit for noticing generic disruption rather than the specific object |
| Text-only observer | Anything an outside reader could infer from the visible output alone |
The impact-matched control is what the framework specifies; what a given battery achieves is a separate
question, and ours did not achieve it everywhere. In the reported dose battery the calibration lands
within 1.1% of target for Qwen2.5-7B-Instruct (a Jensen-Shannon divergence of 0.231 against a target of
0.234) and overshoots by 41.2% for Mistral-7B-Instruct-v0.3 (0.080 against 0.057), so only the first
model is impact-matched in the sense the term should carry. The remaining six models carry a unit-norm
random direction, which equates the size of the perturbation but not its effect. Read the per-model
contrasts accordingly.
OWMI supplies the interventions, probes and scoring, not the prompts, so it attaches to benchmarks
already in use rather than competing with them.
Quickstart
1git clone https://huggingface.co/emilioferrara/owmi
2cd owmi
3pip install -e .
4export OWMI_RESULTS=./results # where run artifacts are written
5export HF_HOME=~/.cache/huggingface # model and dataset cache
6
7# run one job from a manifest
8python -m owmi.benchmarks.cli run-job --manifest jobs.jsonl --index 0
9
10# score paired artifacts into a tidy table plus a summary
11python -m owmi.aggregate_exploratory_results \
12 --results-dir "$OWMI_RESULTS" --out-dir ./analysis
13
14# break the detection contrast down by design axis
15python -m owmi.scripts.axis_breakdown \
16 --results-dir "$OWMI_RESULTS" --out ./analysis/axis_breakdown.json
Configurations in owmi/configs/ use ${OWMI_RESULTS} and ${OWMI_ROOT} rather than absolute paths,
so they run anywhere once those variables are set.
What ships here, and what does not
Ships: the intervention operators, the probe bank and its five families, the three control
conditions, the paired scoring estimators (finite edge-corrected probit d′, tied-score AUROC,
calibration, item-pair clustered bootstrap), the linear-probe anchor with label-shuffled permutation
controls, the equivalence-testing procedure, 17 run configurations and 18 test modules.
Does not ship: benchmark prompt data. Every benchmark loads from its original source at run time,
so no evaluation content is redistributed here. Model weights are likewise fetched from their own
repositories.
What we found with it
Across eight open-weight models from seven laboratory families and more than 78,000 measurements, no
model's report discriminates a real intervention from a matched sham. Pooled over the 11,216 paired
trials of the dose battery the AUROC is ≈0.5007, and an equivalence test bounds the discrimination
advantage below 0.15 percentage points of AUROC (p < 0.0001). A separate breadth battery adds 19,520
measurements on three models, crossing three classes of computational object, six depths from layer 8 to
layer 31, four benchmark domains, both executed temporal tracks and four scored probe families. No level
of any axis changes the conclusion.
The null is not an artifact of a blunt instrument, and not an absence of information:
- a model fine-tuned to make this report clears the identical pipeline at d′ = 5.15, AUROC ≈ 1.0
- a linear probe reading the same activations recovers the intervention at 95.8% and 75.0% held-out
accuracy in the two dose-calibrated models, against a 50% chance level and a 200-refit label-shuffled
null it never reaches
- re-harvesting that probe downstream of the intervention sharpens the trace rather than fading it:
at capture layers 20 and 24 both dose-calibrated models separate intervention from sham with no
held-out error, as does Mistral-7B-Instruct-v0.3 at layer 31, the last layer before the answer is
written, and 0 of 200 label-shuffled permutations reaches the measured margin in any of them
The information is in the activations and the model's own account of itself does not carry it. Oversight
that reads activations is reading a channel that carries the signal; oversight that asks the model is
reading one that does not.
Qwen3-14B was run and then excluded from the reported roster: 5 of its 384 trials were scorable and it
produced no complete intervention-sham pair, so it supports no estimate. The eight-model roster is what
the reported numbers are computed over.
Status
The manuscript is complete (45 pages) and is
under review. The preprint is
arXiv:2608.20569, announced 24 August 2026 under cs.AI and cs.CL and
released CC BY 4.0. This repository is the software artifact that preprint describes.
One finding was corrected after the first release of this repository, and the corrected reading is the
one to cite; it is the reading the arXiv preprint carries. In the
model whose verbalized confidence predicts whether its own report is correct, the discrete detection
report is constant across every scorable trial, so report correctness is the sham indicator exactly and
that selective-prediction AUROC of 0.647 is identically the discrimination of intervention from sham by
confidence. The result is a dissociation between two channels of one self-report, the graded confidence
carrying the signal while the discrete answer does not, rather than meta-level access without first-order
access. The headline null is therefore a statement about the discrete report.
Reproducing the analysis
The estimators used for every number in the paper are the ones in this package, not a separate analysis
script. owmi.analysis.score_paired_artifacts returns both the complete-pair estimate and the
parse-failure-inclusive estimate, which is the robustness check the paper reports.
Citation
1@misc{owmi2026,
2 title = {Open-Weight Masked Introspection: Measuring What Language Models
3 Can Report About Their Own Computation},
4 author = {Ferrara, Emilio},
5 year = {2026},
6 eprint = {2608.20569},
7 archivePrefix = {arXiv},
8 primaryClass = {cs.AI},
9 url = {https://arxiv.org/abs/2608.20569},
10 note = {Software and documentation:
11 \url{https://huggingface.co/emilioferrara/owmi}}
12}
Limitations worth knowing before you use it
- Probe activations in the released configuration are captured at the intervention layer. That margin is
a lower bound on the linearly available information, not a ceiling: the downstream re-harvest above
recovers more, and a better probe or read-out position could recover more still.
- Only one of the eight models carries a genuinely impact-matched random control (see above). Six carry a
unit-norm control and one overshoots its impact target.
- The reconstruction probe family is implemented but was not scored in the reported batteries.
- The spontaneous track (C) executes but produced no complete intervention-sham pair.
- Models that emit a reasoning chain before answering need a probe budget well above the 128-token
default, or their answers are truncated before reaching a scorable report.
