OWMI: Open-Weight Masked Introspection

A measurement framework for whether a language model can report a controlled intervention on its own computation.

Ask a model what just happened inside it and it will answer. Nothing checks that answer against what happened, because nothing establishes what happened. OWMI establishes it: it alters one internal computational object of an open-weight model, a residual-stream site, an attention head, or a sparse-autoencoder feature, and then asks the model to report the change. Because the intervention is imposed rather than inferred, the ground truth is known exactly.

What the framework gives you

Three null conditions set what an answer has to beat, and they are the reason a result means anything:

Control	What it rules out
Sham	A model that always claims to notice something scores at chance
Impact-matched random direction	Credit for noticing generic disruption rather than the specific object
Text-only observer	Anything an outside reader could infer from the visible output alone

OWMI supplies the interventions, probes and scoring, not the prompts, so it attaches to benchmarks already in use rather than competing with them.

Quickstart

pip install -e .
export OWMI_RESULTS=./results          # where run artifacts are written
export HF_HOME=~/.cache/huggingface    # model and dataset cache

# run one job from a manifest
python -m owmi.benchmarks.cli run-job --manifest jobs.jsonl --index 0

# score paired artifacts into a tidy table plus a summary
python -m owmi.aggregate_exploratory_results \
  --results-dir "$OWMI_RESULTS" --out-dir ./analysis

# break the detection contrast down by design axis
python -m owmi.scripts.axis_breakdown \
  --results-dir "$OWMI_RESULTS" --out ./analysis/axis_breakdown.json

Configurations in owmi/configs/ use ${OWMI_RESULTS} and ${OWMI_ROOT} rather than absolute paths, so they run anywhere once those variables are set.

What ships here, and what does not

Ships: the intervention operators, the probe bank and its five families, the three control conditions, the paired scoring estimators (finite edge-corrected probit d′, tied-score AUROC, calibration, item-pair clustered bootstrap), the linear-probe ceiling with label-shuffled permutation controls, the equivalence-testing procedure, 17 run configurations and 18 test modules.

Does not ship: benchmark prompt data. Every benchmark loads from its original source at run time, so no evaluation content is redistributed here. Model weights are likewise fetched from their own repositories.

What we found with it

Across nine open-weight models from seven laboratory families and more than 78,000 measurements, no model's report discriminates a real intervention from a matched sham. Pooled over 11,216 paired trials the AUROC is ≈0.5007, and an equivalence test bounds the discrimination advantage below 0.15 percentage points.

The null is not an artifact of a blunt instrument, and not an absence of information:

• a model fine-tuned to make this report clears the identical pipeline at d′ = 5.15, AUROC ≈ 1.0
• a linear probe reading the same activations recovers the intervention at 95.8% and 75.0% held-out accuracy against a 50% chance level, against a 200-refit label-shuffled null it never reaches

The information is in the activations and the model's own account of itself does not carry it. Oversight that reads activations is reading a channel that carries the signal; oversight that asks the model is reading one that does not.

Reproducing the analysis

The estimators used for every number in the paper are the ones in this package, not a separate analysis script. owmi.analysis.score_paired_artifacts returns both the complete-pair estimate and the parse-failure-inclusive estimate, which is the robustness check the paper reports.

Citation

@misc{owmi2026,
  title  = {Open-Weight Masked Introspection: Measuring What Language Models
            Can Report About Their Own Computation},
  author = {Ferrara, Emilio},
  year   = {2026}
}

Limitations worth knowing before you use it

• Probe activations in the released configuration are captured at the intervention layer, which bounds the linearly available information at the site rather than downstream of it.
• The reconstruction probe family is implemented but was not scored in the reported batteries.
• The spontaneous track (C) executes but produced no complete intervention-sham pair.
• Models that emit a reasoning chain before answering need a probe budget well above the 128-token default, or their answers are truncated before reaching a scorable report.