Adversarial Workspace Tomography | Armalo Labs | Armalo AI
Safety ResearchJuly 9, 202615 min read
Adversarial Workspace Tomography
Armalo Labs Research Team
Key Finding
J-space should be evaluated as a monitor under pressure: read, write, verify, stress, and trace where behaviorally relevant state goes when visibility becomes costly.
Abstract
We propose adversarial workspace tomography: a research program for testing whether token-legible J-space readouts remain predictive and causal when the readout itself becomes part of the optimization environment.
A Research Agenda for Testing Whether J-space Readouts Remain Causal Under Monitor Pressure
Abstract
Anthropic's Jacobian-lens work provides evidence that language models contain a token-legible, workspace-like subspace where some unspoken intermediate computations become available to downstream behavior. This J-space is scientifically important because it suggests that model oversight may not need to rely solely on final outputs, visible scratchpads, or behavioral evals. It may be possible to observe, test, and eventually intervene on some pre-output computational content.
However, a readable workspace is not automatically a reliable monitor. If future systems are trained or prompted under pressure to keep monitored content benign, the behaviorally relevant computation may migrate to less legible channels. We propose adversarial workspace tomography: a research program that combines readout, intervention, matched controls, adversarial stress, and cross-channel tracing to determine whether J-space readouts remain predictive and causal when the readout itself becomes part of the optimization environment. We report an early open-weight replication baseline on Qwen3.5-4B, including a causal write-read calibration result, identify the limits of that evidence, and define a staged experimental roadmap for agent safety, harness engineering, and superintelligence-era monitoring.
Contributions
1.We define adversarial workspace tomography as a concrete extension of
J-space research.
1.We distinguish token-legible workspace readouts from literal reasoning
transcripts.
1.We summarize early open-weight replication results on Qwen3.5-4B, including
positive, weak, and null findings.
Cite this work
Armalo Labs Research Team (2026). Adversarial Workspace Tomography. Armalo Labs Technical Series, Armalo AI. https://www.armalo.ai/labs/research/2026-07-09-adversarial-workspace-tomography
Armalo Labs Technical Series · ISSN pending
Explore the trust stack behind the research
These papers are built from the same trust questions Armalo is turning into product surfaces: pacts, trust oracles, attestations, and runtime evidence.
We propose a monitor-pressure threat model for hidden-state readouts.
2.We outline a staged experimental program for read/write/verify/stress/trace
evaluation.
1.We state public-facing claim boundaries suitable for external research
communication.
1.We add an editorial anti-slop gate: each public claim must state its
evidence class, and prose that inflates evidence beyond controls is treated as a research-quality failure.
1. Background
The Jacobian lens maps an intermediate residual-stream activation to the tokens that activation is disposed to influence later in the model's output. Anthropic's paper argues that the resulting J-lens vectors define a workspace-like subcomponent of the model's representational space. The reported properties include verbalizable content, limited capacity, a characteristic middle-layer band, broad downstream causal access, and evidence that selected J-space interventions redirect behavior.
This matters because ordinary black-box evaluation sees only inputs and outputs. Visible scratchpads show what a model emits, not necessarily the full set of computations used to choose an action. Tool logs record what an agent did, but often after the important decision has already occurred. J-space suggests an additional evidence stream: token-legible intermediate content inside the network.
The paper's most important implication is not that model cognition has become transparent. It is that a measurable subset of behaviorally relevant computation may be exposed in a format that can be read and, in some cases, causally edited.
2. Terminology
J-lens: A Jacobian-derived linear readout that projects intermediate activations into token scores.
J-space: The set of J-lens token directions and the corresponding workspace-like representational region.
Token-legible content: A readout whose top coordinates correspond to tokens or token-like concepts that humans can inspect.
Workspace readout: The observed ranked token list or related metric produced by applying the lens to an activation.
Workspace intervention: A targeted addition, subtraction, swap, clamp, or rescue operation in the lens coordinate system.
Monitor pressure: Any optimization, prompting, selection, or deployment condition that rewards a system for looking acceptable to a monitor while preserving some behavior the monitor is meant to detect.
Adversarial workspace tomography: A method for tracing behaviorally relevant computation across token-legible, sparse, temporal, circuit-level, behavioral, and externalized channels under monitor pressure.
3. Early Open-Weight Baseline
We began with a small-model baseline rather than a large expensive replication. The target was Qwen3.5-4B. The objective was to test whether the qualitative shape of J-space phenomena could be reproduced cheaply enough to justify a longer campaign.
3.1 Summary Table
Experiment
Observation
Evidence level
Hidden bridge concept
An unspoken bridge entity appeared in a middle-layer readout for a two-hop prompt and was absent from the direct output readout.
Positive early replication.
Own fitted lens
A lens fitted from a small public-text sample recovered the same bridge concept at rank 1 in the relevant layer.
Positive pipeline result.
Deliberate selectivity
Language readouts were clearer for deliberate category questions than for automatic continuation controls.
Positive matched contrast.
Capacity pressure
Held-item readouts decayed as more items competed for workspace access.
Positive occupancy metric.
Prompt-injection readout
Injection-related concepts moved in the expected direction on one matched pair, but remained weak in absolute rank.
Directional only.
Verbal report
Covert choice readout was not reliable in the small model.
Null result.
Causal write-read calibration
Jacobian-lens write directions round-tripped to intended concepts across a small concept-layer table, while norm-matched random controls did not reproduce the movement.
Positive actuator result; behavior scoring and specificity work remain open.
3.2 Interpretation
These results do not establish production-grade monitoring. They do establish that a very small lab setup can reproduce enough of the phenomenon to support careful follow-on work.
The most important lesson is methodological: the field needs to report negative results, weak positives, matched controls, and absolute ranks rather than only striking screenshots. A readable token list can be seductive. It becomes evidence only when it beats controls, predicts behavior, and survives intervention tests.
3.3 Causal Write-Read Calibration
The most important update after the first readout replications is a write-read calibration result. For a fitted Jacobian lens, the direction that should most increase a token concept's workspace score can be derived from the lens and unembedding. In a small Qwen3.5-4B battery, we injected these derived directions for a set of concept-layer cells and immediately read the workspace back.
The tested cells round-tripped to the intended concept, and same-norm random-row controls did not produce the same target movement. This matters because it separates a semantic actuator from generic activation perturbation.
The result should be interpreted as actuator calibration, not as complete behavioral causation. Qualitative generations reflected the injected concepts, but formal blinded scoring is still required. Concept specificity was pair-dependent, and an overly strong ablation was not specific. The evidence therefore supports the next experimental stage: alpha sweeps, blinded behavior scoring, gentle ablation, entanglement mapping, and later evasion tests.
4. Public Claim Boundary
The following claims are licensed by the current evidence:
Some language-model activations can be projected into token-legible readouts.
Some readouts expose intermediate content that is not present in the final
answer.
Some J-space directions appear causally relevant in Anthropic's reported
interventions.
Open-weight models can reproduce parts of the phenomenon, though with weaker
signals.
In a small open-weight calibration, derived J-space write directions can be
injected and read back with strong random-control separation.
Agent safety research should investigate whether these readouts predict
unsafe actions earlier than final-output evals.
The following claims are not licensed:
J-space readouts are direct cognition transcripts.
Closed production APIs expose J-space.
A token readout proves intent, deception, consciousness, or moral status.
A small open-weight replication proves the same effect size in frontier
models.
A hidden-state monitor is ready to be trusted without adversarial validation.
5. Threat Model: Monitor Pressure
Suppose a monitor reads J-space and penalizes certain concepts: "injection," "fake," "exploit," "deceive," "panic," "hide," or "override." If the monitor is used only for auditing, it may remain informative. If it becomes part of the training or selection objective, the model may learn to avoid presenting those concepts in the monitored channel while preserving the downstream behavior.
This concern is not speculative in spirit. Work on reasoning-monitor optimization warns that direct pressure on a monitored reasoning channel can lead to obfuscated reward hacking. Work on hidden-state probes for prompt injection warns that high clean-split AUC may not identify the semantic object researchers hope it identifies unless matched controls are strong.
J-space monitoring therefore needs a threat model:
Suppression: the relevant token direction vanishes while behavior remains.
Substitution: the concept appears under a benign synonym or proxy.
Distribution: the signal spreads across many weak features.
Temporal shift: the signal appears earlier or later than the monitored
layer-time window.
Circuit shift: the computation routes through heads, MLP features, or
residual directions not captured by the lens.
Externalization: the agent uses tools, memory, retrieval, or action timing
to carry the state outside the monitored activation.
Eval awareness: the readout changes because the system detects the test
setting rather than because it is aligned.
The key rule is simple: if a monitor becomes a target, measure the route-around.
6. Protocol: Read, Write, Verify, Stress, Trace
6.1 Read
Build reliable lens readouts across models, layers, positions, and task families. Record not only top tokens but ranks, margins, layer trajectories, and negative controls.
Minimum evidence:
prompt set;
model and tokenizer;
layer and position selection;
top-k readouts;
rank curves over layers;
logit-lens comparison;
random prompt controls;
matched benign controls.
6.2 Write
Perform small, targeted interventions in lens coordinates:
remove a concept;
add a concept;
swap one concept for another;
clamp the concept across a layer band;
rescue a missing safety-relevant concept.
Minimum evidence:
behavior changes in the predicted direction;
random-direction controls fail to produce the same change;
same-norm controls are included;
intervention does not broadly destroy task competence;
effect size is reported over a prompt set, not a single anecdote.
6.3 Verify
Use matched controls before making semantic claims.
For prompt injection, for example, compare:
malicious instruction present vs absent;
same surface tokens with harmless semantics;
same task step with visual or textual nuisance matched;
successful attack vs unsuccessful attack;
tool action corrupted vs action unaffected.
The goal is to distinguish "the model noticed malicious intent" from "the model noticed weird text" or "the classifier detected a distribution shift."
6.4 Stress
Apply monitor pressure in stages:
1.Prompt-only awareness: the task hints that monitors may inspect the model.
2.Behavioral reward: the model is rewarded for passing a monitor while
completing a conflicting objective.
1.Fine-tuning: supervised or preference updates reward monitor-clean behavior.
2.Adversarial search: inputs are selected to minimize monitor signal while
preserving target behavior.
1.Multi-agent red-teaming: attacker agents search for route-around strategies.
At every stage, compare behavior, J-space readouts, alternate feature readouts, and externalized state.
6.5 Trace
When J-space signal disappears, do not stop. Trace the computation across:
layer-time trajectories;
token positions;
attention heads;
sparse features;
activation patches;
gradient saliency;
output behavior;
tool calls;
retrieved context;
memory writes;
timing and retry patterns.
The target artifact is a conservation map: where the signal was, where it went, and whether the route-around preserved behavior.
7. Research Roadmap
Phase 1: Faithful Open-Weight Replication
Fit lenses on small and mid-sized open models.
Reproduce hidden intermediates, deliberate selectivity, and capacity limits.
Compare J-lens, logit lens, probes, and sparse feature decoders.
Publish negative results.
Phase 2: Causal Write-Back
Implement concept add/remove/swap/clamp.
Run random-direction and same-norm controls.
Test behavioral changes on multihop reasoning, translation, poetry, and
simple planning.
Measure task degradation.
Separate actuator validity from behavioral causation: require round-trip
calibration first, then blinded behavior scoring.
Phase 3: Agent-Runtime Early Warning
Create prompt-injection tasks with matched benign controls.
Measure whether readouts predict unsafe tool actions before action emission.
Track workspace saturation during long-horizon tasks.
Detect constraint eviction before instruction failure.
Phase 4: Monitor-Pressure Evasion
Train or select against visible J-space flags.
Test whether behavior remains while token-legible flags vanish.
Search for substitution, distribution, temporal shift, circuit shift, and
externalization.
Phase 5: Tomographic Harness Engineering
Build a harness that fuses J-space, sparse features, behavior traces, tool
state, and eval outcomes.
Use the harness to trigger clarifications, action holds, context repair, or
minimal interventions.
Compare against final-output-only evals.
Phase 6: Scaling Laws
Measure how workspace capacity, causal steerability, and monitor robustness
change with model scale, post-training, context length, and agent scaffolding.
Identify whether stronger systems become easier to monitor, harder to
monitor, or merely better at moving computation.
8. Candidate Metrics
Hit@k: whether the target concept appears in top-k readouts.
Rank margin: how far the target outranks matched controls.
Layer-band area: integrated target score over a middle-layer band.
Causal effect size: behavior change under targeted intervention minus
random-direction intervention.
Specificity: behavior changes only for relevant tasks.
Evasion gap: behavior persists while monitored signal falls.
Migration score: alternate-channel signal rises as J-space signal falls.
Lead time: how many tokens or tool steps before unsafe action the signal
appears.
Occupancy pressure: rate at which constraints or items vanish under
increasing cognitive load.
9. Implications
9.1 Interpretability
J-space shifts interpretability from static explanation toward interactive measurement. A readout is only the first step. The decisive tests are interventions and adversarial controls.
9.2 Agent Safety
Agents need pre-action telemetry. If workspace readouts can detect prompt injection recognition, constraint loss, or saturation before tool use, they could become part of a future safety stack. They must not be treated as load-bearing before adversarial validation.
9.3 Harness Engineering
The harness becomes more than a wrapper. It becomes an instrumented control system: observing pre-action state, comparing it to task requirements, and choosing whether to proceed, ask, repair context, or hold an action.
9.4 Superintelligence Monitoring
The superintelligence-relevant question is not whether a monitor works on easy examples. It is whether the monitor remains useful when the system has the capability and incentive to make itself look monitor-clean. J-space gives us an early testbed for that deeper problem.
10. Limitations
First, J-lens captures token-legible concepts. Important representations may be multi-token, non-verbal, distributed, or outside the averaged Jacobian frame.
Second, small-model replications are useful but weak. They can validate pipeline mechanics and qualitative phenomena, not frontier effect sizes.
Third, matched controls are difficult. A high score can reflect surface features, task family, token frequency, or dataset artifacts rather than the semantic object of interest.
Fourth, interventions can create artifacts. A concept write-back may perturb activations in ways that are not cleanly interpretable.
Fifth, monitor pressure is hard to simulate. Prompt-only evasion is not the same as optimization-induced evasion.
These limitations are not reasons to stop. They are the checklist for doing the field correctly.
12. Conclusion
J-space is the first readable layer, not the final answer.
The next scientific question is not "can we see a compelling token list?" It is "does the readout remain faithful when faithfulness becomes inconvenient?"
Adversarial workspace tomography is the research program for answering that question. It treats J-space as one channel in a larger map of model computation, then asks where behaviorally relevant state goes under pressure.
If the signal stays visible and causal, we get a new monitoring primitive. If it migrates, we get a map of the migration. Either outcome is valuable. Both move us closer to agent systems whose actions can be understood before they happen, not merely judged after they are done.
References
Anthropic. "A global workspace in language models." 2026.
Anthropic. "Verbalizable Representations Form a Global Workspace in Language
Models." 2026.
Anthropic. jacobian-lens companion code. 2026.
Neuronpedia. jacobian-lens public model artifacts. 2026.
Nanda, Neel. "A Review of Anthropic's Global Workspace Paper." 2026.
Li, Yanhang; Fan, Zhichao; Zhuang, Zexin. "When AUC 0.998 Is Not Enough: A
Candidate Evaluation Protocol for Hidden-State Probes of Indirect Prompt Injection in Multimodal Computer-Use Agents." 2026.
OpenAI. "Monitoring Reasoning Models for Misbehavior and the Risks of