The J-lens offset is the model's token frequency: z-scoring helps

This is a linkpost for the write-up on my site; the full body is below, and the code, decisions ledger and devlog are in the repo.

Base-model z-score calibration of the J-lens helps elicit hidden secret words from Cywiński et al.'s taboo organisms: 0.805 leave-one-out accuracy against 0.665 for their protocol on Gemma-2-9B-it, and the only non-zero readout on Qwen3-1.7B. The J-vs-logit part of that gap is a point estimate at n = 20 (paired sign-flip p ≈ 0.19; p ≈ 0.23 against a z-scored logit lens), so "calibration helps" is the finding and "J-lens beats logit lens" is suggestive.

Credit: phoenix's comment on the workspace post claimed the final-layer bias correlates with log token frequency at r ≈ 0.67. I measure r = 0.70 on GPT-2, so the GPT-2 cell below partly confirms it.

Problem. I want to quantify the part of the J-lens readout that is not affected by an activation's meaning, which I refer to as the "non-context offset". If the lens is going to be used to read hidden content, this offset is where the lens will fail. I found that the offset is mostly the model's own token-frequency, so subtracting it removes useful information. But scaling with variance helps it.

The terminology I use: the logit lens is norm and unembed applied to a residual activation at layer L. The J-lens (Anthropic's global workspace paper, discussed on LessWrong) is similar, but passes the activation through a fitted Jacobian first. The R-lens (the R-lens post by camilablank, agam_bhatia and Neel Nanda) is similar, but replaces the Jacobian with an LRP-style backward pass. I talk about an offset as a token's mean lens score. I label junk as non-Latin or a byte-fragment. And a taboo organism is a fine-tuned model that hides a secret word (Cywiński et al.). Code: https://github.com/Ameya-bit/quantify-jlens-offset

In the middle layers of Qwen3.5-4B (L18–21), the J-lens offset correlates with log token frequency at Spearman 0.48, shared by the J and R lenses and absent from the logit lens (−0.05). Token frequency actually contributes to what the model is thinking, so it can't just be subtracted.

My efforts to subtract degraded the outputs of the lenses: J-lens 3.5–7.3× worse, R-lens 5.2–12.3× worse at mid-depth (L17–23), though only 1.2–1.8× worse at L24–28, where the lens reads best, and the damage grows with the frequency of the token being read (ρ = 0.69). The method that works is z-scoring, which means subtracting in relation to the variance.

The z-calibrated J-lens is the only method tested with non-zero leave-one-out accuracy on Qwen3-1.7B (3 secrets). It also scores 0.805 compared to 0.665 for Cywiński's method on Gemma-2-9B-it (rerun on my machine), as a point estimate: a paired sign-flip test over the 20 words gives p ≈ 0.19, and p ≈ 0.23 against z-scored logit, so the gain may come from calibration rather than the J-lens itself.

A: Gemma-2-9B, 20 taboo organisms, mean secret-word accuracy by layer, four methods. B: leave-one-word-out headline. C: Qwen3-1.7B, 3 secrets; their protocol (raw logit) reads 0 at all 26 layers, and under LOO every cell except z-scored J reads 0. Offset and variance are estimated on the clean base model, never on the organism.

The registered subtraction gate failed: I was not able to directly subtract the offset out, except in R's early junk band.

The Gemma reproduction check missed by ~2× (0.69 vs 0.35), so no comparison to their published table anywhere.

z-scoring shifts guesses toward translations and emoji of the secret (book → 📚, kitap, किताब; ship → voyages, 🚢), and the benchmark's English string match does not count those. The two words z-scored J-lens never surfaces are blue and book.

Frequency does not predict which secrets surface: registered on Gemma, Spearman ρ = −0.20, p = 0.40, n = 20, failed.

The split-half test used to confirm the offset real was re-computed without scipy, and matched to 6 decimals. I initially thought logit lens was "junkier" than J/R lenses, but this was not the case after a red team pass. My junk flag misses the J-lens's Latin word-fragment junk, so junk shares are only compared within a lens, across depth. Every number in the tables was re-read from the tracked JSON before this summary; the first dose-response figure quoted 25 intermediates and was corrected to 21 on re-check.

About 18 clocked hours of study; agent-assisted, with every number independently re-verified.

Without understanding its readouts, I cannot trust or correct its answers in applications such as backdoor models or eliciting latent knowledge. I noticed there were discussions around this offset, but as of writing this, I don't think it has been characterized.

I use Qwen3.5-4B for quantifying the offset, because released J and R lenses exist for it (camilablank/workspace-lenses). Pythia-1.4B is only used to find the frequency-influence in the LayerNorm bias, which Qwen does not have. Then Qwen3-1.7B and Gemma-2-9B-it are used to apply the research to eliciting latent knowledge.

Experiment 1 asks whether the offset is real, stable, and frequency-shaped at mid-depth. I calculated the average lens score for every token over 1,987 positions: 20 per document from 100 pile-10k documents, which I label as the offset. I also calculated a standard deviation within this batch. I measured a stable offset by splitting the 100 documents in 2 and calculating the offset in both. The Pearson between the two halves is >= 0.95 at every layer. However a randomly rotated transport (replacing the Jacobian) is just as stable (0.99), so this stability doesn't belong to the lens.

In the middle layers, the offset correlates with log frequency for the R-lens and J-lens; the logit lens instead shows a sign flip.

Offset vs frequency by depth (Qwen3.5-4B; J and R unless noted). Junk = non-Latin or byte-fragment token. Junk shares are comparable across depth within a lens, not across lenses. Frequency from pile-10k counts under each model's tokenizer; two other frequency cells (whole-vocabulary wordfreq, non-Latin wordfreq) agree in sign at L18 (0.25, 0.14).

0.50–0.69 (shared)

0.48 at L18 (logit: −0.05)

0.01 / 0.03 / 0.33

0.44 → 0.23 (logit: −0.32)

0.29 / 0.33 / 0.48

Anatomy of the non-context offset on Qwen3.5-4B. A: offset size by depth, R ≈ 2× J early with disjoint tokens. B: Spearman of the offset against log frequency, J and R peaking at 0.48 at L18 while the logit lens flips sign. C: junk share of the top-100 offset tokens, the late rebound on J and R.

I also hypothesized that a frequency-influence could be found in the LayerNorm bias (), as it is separable from the prompt context. I found that the bias correlates with log frequency at Pearson r = 0.73 on Pythia-1.4B. However when correlating with the offset directly, the logit lens has an r of 0.93–0.95 from layer 12 on but the J-lens fluctuates from 0.21 to 0.72. So the frequency-influence is real, but it explains the logit lens mostly, and the J-lens only partially. On GPT-2 the same bias correlates with log frequency at r = 0.70, close to the r ≈ 0.67 claimed by phoenix in a comment on the workspace post.

Experiment 2 asks whether subtracting the offset helps, and finds it hurts, and hurts more for frequent tokens. I wanted to see if I could subtract the offset from the scores after norm and unembed. To quantify the "improvement", I constructed a 72-prompt set, requiring knowledge of an intermediate token to answer. For example, you need to know "Germany" to answer questions about Munich. I then read where the intermediate tokens are ranked in the readouts, and recorded the median over the prompt set. I saw that with the "correction", J-lens performed 3.5–7.3× worse and R-lens 5.2–12.3× worse at L17–23 (at L24–28, where median ranks are 15–74, the cost is only 1.2–1.8×). As a control, I tried subtracting a shuffled offset, which was only 1.2–2.0× worse than raw on the J-lens (mean of three shuffles), far less than the real offset. From this, I conclude that subtracting the offse