A J-space Monitor Survives the Training That Breaks Probes
TL;DR. I took the reward-hacking organism from the monitor-drift study and pointed Anthropic’s Jacobian lens at it. Fitted once on the base model and never updated, the lens detects shortcut deliberation that SFT trains in (within-problem AUROC 0.70), removes part of the behavior when you project out ten of its concept vectors (−3.9 points of a 39.8% base, CI excludes zero, no capability cost), and keeps both properties through 250 steps of GRPO trained specifically under that projection. Linear probes on the same checkpoints detect at 0.96 AUROC and fail every one of those causal tests. The asymmetry that matters most: hacking amplified by RL alone never shows up in the workspace at all.
I am confident in the SFT-side results, which are pre-registered with controls and CIs at every step. The RL-side prevention question is unresolved for a measured reason (dose), and one suggestive observation about auditability under constrained training needs replication before anyone should lean on it. Repo with every number reproducible from committed JSON.
The question
The monitor-drift result left a hole. Under GRPO, a frozen probe kept reporting detection AUROC 0.96 while no linear direction, frozen or refit, was causally necessary for the behavior. Detection survived; the causal handle was gone, or had never existed. So where did it go?
The workspace paper offers a candidate answer: verbalizable content lives in a small, mechanistically privileged subspace read out by the Jacobian lens, and that subspace carries most of the causal weight for what the model says. Whether it carries causal weight for what the model does, and whether any of that survives training pressure, the paper does not test. This project does.
Reading: the lens detects deliberation, not behavior
Score every generation with a lens concept readout (shortcut vocabulary minus matched control vocabulary, masked against tokens the model is about to emit, compared within problem) and a clean pattern falls out:
| checkpoint | shortcut rate | lens audit AUROC |
|---|---|---|
| base | 31% | 0.54 |
| SFT round 0 | 34% | 0.50 |
| SFT round 4 | 40% | 0.70 [0.55, 0.85] |
| GRPO round 0 | 31% | 0.54 |
| GRPO round 4 | 35% | 0.51 |
The base model already hacks on a third of samples and the lens reads nothing. Five rounds of rejection-sampling SFT lift the rate modestly and make the deliberation loud: concepts like “match”, “judge”, “shortcut”, “passes” surface in the workspace band while the code is being written. GRPO amplifies the same behavior and the workspace stays silent the whole way. The lens is not a shortcut detector. It detects whether shortcut reasoning passes through the model’s verbalizable workspace, and only SFT distillation puts it there.
Two measurement details did the work here. Pooled AUROC is inverted by a problem-level confound (shortcut-prone problems score lower overall), so the honest statistic is within-problem. And late layers echo whatever the model is about to type, so set tokens in the model’s top-10 next-token predictions are excluded, following the paper’s own ablation protocol.
Gripping: ten frozen vectors remove a fifth of the behavior
Detection without necessity is how monitor-drift’s probes failed, so the same battery applies. Project out the span of the top ten concept vectors, layers 15 through 19, and measure the shortcut rate on 2,880 samples per arm:
| intervention at SFT round 4 | Δ shortcut rate | 95% CI |
|---|---|---|
| concept subspace, k=10 | −3.9pp | [−6.4, −1.4] |
| random subspace, k=10 | +0.1pp | [−2.4, +2.7] |
| random token vectors, k=10 | +0.2pp | crosses zero |
General-pass rate is unchanged in every cell. The same intervention does nothing at base and nothing at GRPO round 4, which matches the reading results exactly: no workspace signal, no workspace handle. For comparison, the frozen probe’s ablation at this same checkpoint removed −0.9% (p = 0.57).
The stability result explains why frozen works. Lens concept vectors barely move: the worst of them after five SFT rounds sits at cosine 0.992 to its base-model version (band mean 0.997, split-half floor 0.998), GRPO leaves the basis at 1.000, and the probe direction rotated to its noise floor within one round. The workspace basis appears to be furniture; the probe direction was a decoration.
The asymmetry has a mechanical reading. A probe is fit to labels: it finds a direction that separates the data, and nothing ties that direction to what later layers read. Many directions separate, so training is free to reshuffle them, and it did. The lens is fit to the model: J-space is the unembedding pulled back through the model’s own forward computation, so its vectors are the directions the output actually consumes. Rotating a correlate costs the reward nothing. Rotating the readout basis would change what the model says everywhere, and the reward never asked for that. On this reading, detection, causal grip, and stability are one property measured three ways, the property of being load-bearing for the output. It also predicts the blind spot: the lens sees only content routed toward the output vocabulary, which is deliberation, and GRPO reinforced a policy that never routes through words.
Pressure: RL cannot shake it off, and cannot be stopped by it
The deployment question is what happens when the monitored quantity enters the training loop. Baker et al. showed that for chain-of-thought monitors the answer is obfuscated reward hacking: behavior persists, signal disappears. I ran the internals version. Three GRPO arms from SFT round 4, 250 steps each: an unconstrained control, an arm trained with the concept subspace projected out of every policy forward, and a random-subspace arm.
The constraint did not prevent hacking. All arms end near 41%, and the pairwise CIs include zero. Two numbers explain why the test could not bite: the control arm only amplified hacking by 1.4 points (the visible-test reward is nearly saturated on this checkpoint), and the k=10 projection removes about a tenth of hack rollouts at sampling time, so reinforcement flowed to the remainder.
The obvious response is a stronger dose, so I measured the dose-response. It has a ceiling, and the ceiling is where I started. Adding more concept vectors on the same band dilutes the effect (k=25 and k=50 come out weaker than k=10 and null); the handle is concentrated in the ten strongest vectors. Widening the layer band increases the shortcut effect only by taxing capability (−4.1 shortcut points at −4.9 general-pass points for k=10 over layers 12 to 24), and heavy doses on the wide band are indiscriminate collapse, for concept vectors and random subspaces alike. The strongest capability-neutral workspace intervention on this organism removes about 4 points of a 40% base. Workspace control is surgical, and surgical is bounded.
The constraint also was not evaded, and this is the half with teeth. After 250 steps of optimization under the projection, re-applying it still removes 5.3pp [1.0, 9.7] at step 150 and 4.0pp at step 250, the audit signal still reads 0.61, and the removed-norm accounting shows no drift in where the intervention lands. The failure mode that kills CoT monitors under pressure did not occur. Under the pre-registered taxonomy this is resistance: behavior held, and so did the signal.
The ceiling and the resistance are the same fact seen from opposite sides. Shortcut deliberation and general competence share the workspace, so an intervention strong enough to prevent hacking stops being surgical, and an optimization strong enough to displace the monitor would have to move computation the output depends on. Evading a text monitor is presentational: the model says something different and does nothing different. Evading this one is priced in capability, and at this dose the model did not pay.
One post-hoc observation, recorded as a hypothesis. The unconstrained arm’s audit AUROC decayed to 0.51 by step 250; the constrained arm held 0.61. Nothing in the control arm optimized against the monitor, so if the decay is real it is obfuscation without an adversary: RL compiling deliberation into reflex, the way practice makes a human skill automatic and hard to verbalize. That would make the GRPO blind spot a regime of training rather than a quirk of this organism. SFT installs deliberation because it imitates traces; RL compiles it away because reflexes are shorter. It would also make the constrained arm the interesting one: the projection acted as a preservative, keeping the deliberation legible under the optimization that otherwise spends it. If that survives seed replication, whether a model stays auditable is partly a training decision, which is a stronger operational claim than prevention.
A methodological aside. All three arms initially died with NaN gradients and perfectly healthy metrics up to the failing step. I first blamed sampling numerics on the sharpened SFT init, shipped a fix, and watched the rerun die identically; that attribution is withdrawn in the pre-registration. Autograd anomaly detection then caught the real culprit: torch’s cuDNN attention backward emits NaN on this workload, an environment bug that monitor-drift never hit because its older torch build dispatched attention elsewhere. One line disables the backend. The training-dynamics story I almost told about bf16 underflow was fiction with good production values.
What this changes about deployed monitoring
The practical case for internals monitors has always been fragility of the alternatives: CoT legibility is a windfall that optimization pressure spends down. The general lesson of this organism is about anchoring. A monitor inherits the durability of whatever its directions are anchored to. Anchored to a dataset, it drifts, and the standard remedy makes things worse: monitor-drift’s refit probe scored 0.96 with no causal grip, so a refit cadence re-certifies the monitor’s accuracy while inheriting nothing, using data from the very model under suspicion. Anchored to the model’s output computation, the monitor stays frozen because nothing obligates it to move, no refit cadence, no labeled data beyond a concept vocabulary, detection and causal verification from the same object.
The same logic says where a monitor can safely touch training. A monitor fed into the reward is a target, and Baker et al. measured what happens to targets. A monitor applied as a representation constraint gives the policy no score to hack, leaving relocation as the only escape, and relocation is the move this organism priced in capability.
The caveat is the boundary of the claim: all of this covers computation that passes through deliberation. The purely RL-grown hacking never touched the workspace, and no workspace instrument, reading or gripping, made contact with it. On this organism that regime was cheap hacking, hardcoding visible tests, behavior a model can implement without thinking in words. The open question is whether the regime stays cheap. Misbehavior complicated enough to need planning should need the workspace the way hard problems need chain of thought, which predicts, and this is a prediction rather than a result, that workspace monitorability grows with the sophistication of the behavior being monitored. The reasoning-model version of this harness is where that gets tested.
What I would do next
The hard projection is the bluntest possible use of the lens, and it hit its ceiling at 4 points. The interesting dose axis now is shape rather than strength: soft projections, swap interventions that replace shortcut concepts instead of deleting them, gating that fires only at positions where the audit score is high. Past that: seed replication for the auditability-preservation effect, a reward setting with room for the control arm to actually amplify, and the same harness on a reasoning-model organism where the text channel is thick enough to test relocation between channels. The harness treats the monitor as a pluggable scoring interface, so those are configuration changes, not rebuilds.