All Quiet on the Neural Front: Language Models Do Not Report Injected Pain States

All Quiet on the Neural Front. Language Models Do Not Report Injected Pain States. By Emilio Ferrara, from the University of Southern California. Published on the sixth of November.

Can a language model report the pain state it represents? Earlier work found a linear pain direction inside these models, and amplifying it led fine-tuned models to choose destructive actions. This study asks whether the models can say that the state is there. The answer it reports is no. The state can be decoded, and it changes behaviour, but the models do not report it in words unless they are trained to.

The test used three open-weight models from two families, including two Qwen models with the original adapters. With a method called Open-Weight Masked Introspection, or OWMI, pain and neighbouring emotion directions were injected while the models did neutral tasks, and reports were then elicited. Those reports were compared against sham runs, against random perturbations matched for how much they disrupted output, and against text-only controls that showed the models their own altered words.

That last control is the key one. Across fifty-two thousand nine hundred and twenty reports from models of seven billion and eight billion parameters, spanning one hundred and twenty tasks, four doses and three prompts, pain reports never exceeded what the altered text alone revealed. Exact-test bounds put the excess below two point five percentage points in one hundred and six of one hundred and eight emotion conditions, and below three point nine in every one.

Yet the state was plainly present. Probes at the report position told pain from sadness with ninety-eight to one hundred percent balanced accuracy. Trained low-rank reporters reached one hundred percent accuracy on held-out tasks, with transcripts identical across conditions, and even on unseen wording. Qwen2.5-32B named pain in none of two thousand eight hundred and eighty steered trials, although probes and trained reporters recovered it.

Behaviour moved too. In a button task, steering raised file-deletion choices from three point five percent to forty-eight percent in Qwen, and from zero to thirty-eight percent in Qwen2.5-32B, with no matching pain reports.

The negative result survived several attempts to break it. Decodability persisted all the way to the final layer. Injecting at the report token, removing the trained denial of feelings, and trying additional directions and readouts all failed to restore pain reporting. Some other states did leave graded traces in the labels, but pain and sadness did not at the main injection layer, so the silence is not universal across emotions.

There are limits on what the direction itself means. It responded about twice as strongly to first-person pain as to matched third-person pain, but it did not specifically pick out harm aimed at the model. And the claim is about untrained verbal access: trained reporters could read the state, so the finding concerns what the models say unprompted by such training, in models of the sizes tested.

Two things that are easy to run together come apart here. One is having an internal state that can be read off and that shapes what the model does. The other is being able to report that state in words. The pain direction passes the first test by every measure used, and fails the second across tens of thousands of reports.