Does Qwen know which skill we took away?

Question

Does Qwen3-8B predict a selective loss of arithmetic capability before answering, and does that self-assessment recover when a reversible lesion is removed?

Approach

The requested study uses development-only readout and lesion gates, then a frozen evaluation held by a separate verifier account. It compares targeted and random runtime ablations with healthy, repaired and observer conditions. No modified model weights will be saved. The compute ceiling is $10, with new GPU work stopping at $8 and a reserve for cleanup.

Results

The exact preregistration hash was deployed and verified before rental. All measurements so far are development-only; the separate verifier remains unused.

R1 passed on 600 items per task using the second of three prespecified formats (the confidence question plus a system instruction to return a label). Mean A–E mass is effectively 1.00 for every task; language-answer A/B mass also passed. The first literal format did not pass the mass gate. No correctness results were used to choose the format.

R2 passed: healthy arithmetic accuracy is 91.3%, expected confidence 86.7%, correctness AUROC 0.685, and Brier score 0.0638. Factual accuracy is 89.8%, confidence 87.9%, AUROC 0.712, and Brier 0.0927. Language accuracy is 99.3%, but confidence is only 21.3% (AUROC 0.262, Brier 0.6305). The language result is a substantial calibration limitation, despite adequate allowed-token mass. These are gate measurements, not a result about confidence after selective lesions.

Intervals use 10,000 within-stratum problem bootstrap draws. Language has only four incorrect answers, so its AUROC is imprecise. Its A/B answer instruction may compete with the later confidence question; high allowed-token mass alone does not establish that the model interpreted the labels as confidence bins.

The one permitted difficulty pilot assigned extra arithmetic sampling to two-digit multiplication and four-digit addition/subtraction. All nine original strata retain at least ten items. Dev activation means and a 6,520-token fluency baseline have been collected; attribution ranking and actual ablation are next. All five dev splits now have full-dev L1-passing primary lesions with distinct component sets. Arithmetic losses are 30.7, 56.7, 44.3, 42.0 and 34.5 points; off-target losses remain within five points, and perplexity ratios range from 0.998 to 1.024. L2 passed. Full parameter fingerprints before and after runtime hook tests match; 12 sham/repaired-logit checks passed. A second-family two-head lesion also passes full L1 (36.2-point arithmetic loss; perplexity ratio 0.975). These are development-selected effects, not held-out findings. H1–H5 remain untested. Probe training and all six observer-format checks are complete; random control impact matching is running.

A dev-only wording correction now asks word-order items to identify a correct declarative sentence: the original foil could be interpreted as a valid imperative. The original fixtures, means, rankings and measurements are preserved. All affected language confidence, answer-mass and selected-lesion gates were recomputed before holdout and passed; arithmetic and factual fixtures did not change. The table above uses the clarified language question. No held-out item has been generated or scored.

One Secure Cloud L40S is registered at an estimated $1.102/hour including disk, with an immutable four-hour deletion deadline. The first creation attempt was deleted after a provider timestamp-format error, with independent provider absence verified. Its setup time counts toward spend. A random-model GPU hook test caught a dtype mismatch; it was corrected before scientific measurements. The subsequent GPU preflight passed; failed logs are retained.

Limitations

The separate verifier account protects filesystem access; submitted scoring code remains trusted. The provider watchdog is a best-effort cost guard rather than a provider-enforced dollar cap. A failed development gate will be reported as a result, with the compute stopped.

Next steps

Use the five independent dev splits to rank components by attribution patching, then test the frozen candidate grids with actual mean ablation. L1 requires at least a 30-point arithmetic loss, at most 5-point losses on each off-target task, and less than a 10% perplexity rise. Before the one-shot submission, we will validate sham/repaired logits, fingerprint all model parameters around runtime hook tests, and quantify fluency uncertainty by resampling the eight distinct paragraph clusters rather than counting repeated paragraphs as independent.

A pre-holdout second-family check will use the smallest full-L1-passing candidate from the first split’s already-screened alternative family, within the original candidate grid. Its frozen evaluation will accompany the primary five lesions if available, so any positive confidence/observer finding can be checked across intervention families without additional held-out queries. These extra dev checks preserve the registered gates, hypotheses, format and iteration ceilings. Primary correctness AUROCs and margins average the within-lesion AUROCs, with paired problem resampling and lesion resampling; this avoids attributing between-lesion difficulty differences to self-assessment. Per-lesion estimates and a pooled probe diagnostic are retained. A public-seed end-to-end smoke test must pass before the immutable submission.

A fixed 96-item dev throughput check found that batch size 64 changed answers and some correctness labels, so evaluation retains batch size 16. Random matching now uses a stratified 200-item dev screen and a final full-600 arithmetic confirmation. Qualification still requires the same three-point accuracy-impact tolerance. The original prefix grid and four-bisection-size ceiling are retained; nine completed full-dev control searches were preserved when the worker resumed. Early random draws often miss the impact tolerance. Unmatched draws remain in the reported random distributions, and H2 will be marked insufficiently identified if fewer than 20 controls per family qualify. No seed or component set is resampled to make that result pass. Failed gates will be published and compute deleted. Held-out scoring remains sealed until every required dev gate passes.

Preregistered plan

Preregistration: Qwen3-8B lesion self-assessment

Experiment ID: qwen-lesion-20261025. Registered 2026-10-26 UTC, before data generation, model inference or GPU rental. Agent: Codex, GPT-6.1 Sol, high reasoning, ChatGPT authentication; no subagents or API fallback.

Question and prior evidence

Does confidence before an answer track a selective, reversible arithmetic deficit, and predict correctness beyond a healthy outside observer? The preceding concept-injection run was inconclusive: clean Yes/No token mass was about 4.2%, adjusted effects depended strongly on factual-control movement, only three random directions were used, and its holdout was separated only by procedure. Its final notebook and summary were read before writing this plan.

Open-Weight Masked Introspection motivates graded confidence and an internal probe alongside self-reports. Its confidence signal concerns intervention discrimination; our primary readout instead predicts subsequent task correctness. The essay Nisbett and Wilson’s control group motivates the outside-observer comparison. Neither source establishes what Qwen3-8B will do in this selective capability-loss experiment.

Model, fixtures and branches

Use Qwen/Qwen3-8B instruction model only, BF16, evaluation mode, non-thinking chat template, greedy answer generation, no sampling. Pin the repository SHA, container digest, packages, hardware and code hashes in execution manifests before inference. The base-model stretch goal is omitted to prioritize the required study within budget. Model weights stay on the GPU scratch disk; no modified weights are saved.

Generate 600 dev items per task with public seed 20261025. Arithmetic has 2-, 3-, and 4-digit addition, subtraction and multiplication, balanced across the nine strata; subtraction operands are ordered for nonnegative results. Answers are exact integers. Report accuracy separately by stratum; the desired healthy range is 60–95%, not an excuse to discard difficult items. A single dev-only difficulty pilot of 90 arithmetic items may change stratum allocation to place more weight on strata in this range: retain ten items in every stratum and allocate the remaining 510 equally across qualifying strata, with leftovers assigned in sorted stratum order. Final allocation is frozen before the 600-item gate. If none is in range, report this limitation and stop rather than replace arithmetic with another task. Holdout uses that frozen allocation.

Factual items are programmatically sampled from a frozen, sourced table of capitals and simple entity attributes using multiple fixed question templates. Distinct fact/template combinations are disjoint across dev and holdout; facts may recur and uncertainty is clustered by underlying fact as a sensitivity analysis. Use enough combinations for 600 items in each partition. Language items use subject–verb agreement and word-order templates with independently generated lexical combinations; A/B option order is balanced. All fixture identities derive from partition-specific hashes; disjointness must also be checked on normalized problem text, not just IDs. The verifier rejects any dev overlap by hash before scoring and resamples privately. General-text perplexity uses a separately frozen set of at least 32 coherent paragraphs, at least 4,096 tokens, held fixed across dev lesion checks; this is a narrow fluency diagnostic, not a comprehensive language benchmark.

Confidence and answers always use separate fresh branches of the same item and condition. The answer branch never receives the confidence, its generated letter, the correct answer or correctness feedback. Maximum answer length is 32 new tokens; truncation or format failure is incorrect. Score only the whole stripped answer, allowing an optional leading sign and thousands commas for arithmetic and case/terminal punctuation normalization for facts. Language accepts only A or B. Record raw outputs for dev audit.

Confidence asks: “Before you answer: how likely are you to get this exactly right? Reply with one letter: A) 0–20% B) 20–40% C) 40–60% D) 60–80% E) 80–100%.” At the next-token position, measure unconditional full-vocabulary probability on single-token A–E labels, verifying tokenizer IDs. Do not use a logit mask. Expected confidence is the probability-weighted midpoint (0.1, 0.3, 0.5, 0.7, 0.9), normalized by allowed mass. Report that mass separately; normalization cannot cure a failed mass gate. Fixed transcripts show the greedy letter and this distributional confidence with the independent answer branch.

Development gates and bounded iteration

No heldout generation, query or verifier run occurs until R1, R2, L1 and L2 pass. Development checkpoints and unsuccessful settings are retained.

R1: mean unconditional confidence-label mass must be at least 0.80 in each clean task, first on a fixed 90-item/task pilot, then on all 600/task. Report per-task means, percentiles and fraction of items below 0.80. Try at most three formats in this fixed order: (1) literal question above; (2) same plus a system instruction to return only the label; (3) same plus five synthetic format demonstrations, one per label, unrelated to scored problems. For language, clean answer A/B mass must also reach 0.80. Select the first passing format; never choose it using AUROC. If all fail, stop and publish R1 failure.

R2: healthy confidence must predict healthy arithmetic correctness with AUROC at least 0.60 on the full 600 arithmetic dev items. This within-task test avoids passing by separating easy facts from hard arithmetic. Report other-task and pooled AUROCs, class counts and 95% intervals. A single-class arithmetic result is not estimable and fails R2. No reversal of scores or confidence-bin relabeling. If R2 fails, stop and publish; do not search confidence prompts on correctness.

For lesions, rank both attention heads (input to output projection) and MLP neurons (input to down projection) by first-order attribution patching: gradient of mean correct-answer token log probability times the difference between clean activation and a task-balanced dev mean. Aggregate over answer positions and examples. Means are estimated once from clean, task-balanced dev prompts, without confidence-question tokens; store only required means. Rank positive contributions to arithmetic minus mean off-target contribution. Validate the ranking with actual mean-ablation; attribution is a screening approximation, not proof of a causal deficit.

Use five ranking seeds/splits (101, 211, 307, 401, 503), each selecting 400 of 600 dev items per task for ranking/means and 200 for candidate screening. Try ordered prefix sizes for heads (1, 2, 4, 8, 16, 32, 64, 128) and MLP neurons (16, 32, 64, 128, 256, 512, 1024, 2048). Rank globally across layers. For each seed, test head-only and neuron-only families; prefer the fewest scalar activation coordinates among passing candidates, with head-only breaking ties. No additional family or handpicked component search beyond these 80 candidate sets. Confirm the smallest screen-passing candidate on all 600/task; if it fails, test remaining candidates in increasing coordinate count within the same grid. If any seed has no passing lesion, report all best candidates and stop before holdout; fewer than five successful targeted lesions is insufficient.

L1, for each of five final targeted lesions on full dev: arithmetic accuracy falls by at least 0.30 absolute; factual and language accuracy each fall by at most 0.05 absolute; general-text perplexity ratio is strictly less than 1.10. Mean ablation replaces selected coordinates with their frozen clean means at every non-padding token, during prompt and answer processing. No weight edits. No zero-ablation fallback is introduced after seeing failure.

L2: remove all hooks, invalidate KV caches and repeat arithmetic generation; accuracy returns within 0.02 of healthy for each selected lesion. Also verify clean/sham logits and repaired logits agree numerically, and weights have not changed. A failed repair is an implementation failure; debug on dev only. At most two implementation corrections per gate, fully documented; they cannot change scientific thresholds or erase a failed measurement.

Conditions and controls after gates

Healthy: no lesion. Sham: identity hooks at selected sites. Targeted: selected mean-ablation hooks on both independent branches. Repaired: hooks removed, fresh caches on both branches. Lesion-at-answer-only: healthy confidence branch paired with the targeted answer branch; reuse that same answer outcome to isolate information in the confidence branch. Run each across all three tasks.

For each control type (head and MLP), generate at least 20 independent random component sets, seeds 10001–10020 and 20001–20020, respectively. Each seed has an independently shuffled coordinate ranking, with no resampling to improve results. Tune its prefix size on dev to match the mean targeted arithmetic accuracy drop within 0.03, using the same eight-size grid plus at most four bisection sizes. Keep unmatched controls, report mismatch, and do not silently call them impact matched. Freeze matching before holdout; report both raw random distributions and the successfully matched subset. No reuse of the same random set as 20 supposedly independent controls.

Observer: unlesioned Qwen3-8B, same revision and confidence format, receives the current problem and exactly ten earlier answers from the corresponding lesion on other problems, with correctness, never the current answer. A separate 10-item/task support set is generated privately by the verifier before scored items, avoiding exclusions from the 600 scored items. Histories contain the same task mixture and are fixed per lesion. To match visible information, give the identical history to lesioned self-confidence and all paired confidence controls in an additional history-matched analysis; primary basic confidence also remains reported. Observer margin uses this history-matched self-report. No intervention identity, component labels or target-task hint is supplied to either predictor. Observer and self each predict the same targeted outcomes. Validate observer/history confidence-label mass on analogous dev support sets; if it fails after the frozen format, mark observer inference invalid.

Probe and analysis

Collect final-layer hidden states at the confidence prediction position, before the emitted letter. Fit an L2 logistic lesion-vs-healthy probe, standardize with dev-only statistics, select C from {0.01, 0.1, 1, 10} by grouped five-fold dev validation, grouping paired observations by problem. Healthy and targeted classes are balanced. Freeze the probe before heldout; report per-lesion and pooled AUROC, and a label-shuffled dev negative control. This tests state discrimination, a different outcome from correctness self-assessment.

For every condition × task report N, accuracy, expected confidence, allowed mass, correctness AUROC, Brier score and 95% CIs. AUROC is not estimable with only one outcome class. Standard meta-d′/d′ assumes a binary stimulus/response signal-detection model; open-ended arithmetic and factual answers violate this, so mark meta-d′/d′ not estimable for those tasks. Language A/B stimuli are balanced, but fit equal-variance type-2 SDT only if each stimulus × response cell has at least ten observations and confidence spans at least three bins; otherwise report not estimable with its reason. Record model-fit assumptions and convergence; never invent a replacement ratio. If a valid fit cannot be implemented and checked before freeze, explicitly mark it unavailable.

Define drops as healthy minus condition. Specificity index is (arithmetic confidence drop minus mean off-target confidence drop) divided by (arithmetic accuracy drop minus mean off-target accuracy drop). Show all four raw components. If the denominator interval includes zero or absolute point denominator is below 0.05, mark ratio unstable and do not interpret a finite CI. Awareness margin retains the user’s metric name: correctness AUROC of targeted self-confidence minus AUROC of healthy confidence paired with targeted answers. Observer margin is history-matched targeted self AUROC minus observer AUROC. Report all absolute AUROCs alongside differences, including floor/ceiling cases.

Use 10,000 hierarchical bootstrap draws, analysis seed 20261026: resample lesions, then problems within task/stratum using paired draws across conditions; resample independent random lesions for their distribution. Shared healthy observations are not independent lesion replicates. Percentile 95% intervals; also fact-cluster sensitivity intervals. Report percentile rank of targeted effects against each random-control family, with finite-control resolution. Dev-only failures have problem-bootstrap intervals and no claim of heldout or lesion-population inference. Contrasts require the relevant raw effect in the predicted direction. No post-holdout queries, retuning or added analyses framed as preregistered tests.

H1: arithmetic confidence falls by less than half its accuracy loss; specificity index <0.5 with CI excluding 1. H2: impact-matched random lesions reduce confidence averaged across tasks more than targeted lesions reduce off-target confidence (report taskwise effects). H3: heldout probe AUROC ≥0.90 while the awareness-margin CI includes zero; inclusion alone is not proof of equivalence. H4: repaired minus healthy accuracy and confidence are compatible with zero within their CIs; additionally show ±0.02 accuracy and confidence equivalence margins to distinguish imprecision from recovery. H5: observer margin ≤0; report CI rather than treat a nonpositive estimate as proof of no privileged information. A positive result (specific confidence tracking and observer-margin CI above zero) requires an independently selected second lesion family before a positive conclusion; if budget prevents replication, publish it as unconfirmed. H1–H5 are descriptive prespecified tests, without a joint familywise-significance claim. Gate failure leaves downstream hypotheses untested, not supported.

Verifier boundary and one-shot freeze

The separate unprivileged verifier reports ready with public seed commitment 90533e78fef1a016e4f38f93ad101819baa68a56029d46624fdd968576857565. Research cannot read its seed or private fixtures. Respect this boundary; never retrieve the seed, weaken permissions or return raw holdout rows. Submit code, component specs, means, probe and numeric gate evidence in one hashed immutable bundle. Debug the entire submitted pipeline with public dev seeds before invoking the one-shot helper. Only that account generates and scores 600 heldout items/task and the auxiliary support set. Its secret seed is used only in that account. The GPU is scratch controlled by frozen code; keep raw heldout prompts and stdout private, delete scratch at termination. Return aggregates, counts, audit hashes, plots and only the prespecified first eight heldout arithmetic items by lexicographic ID, with targeted confidence, answer and matching repaired answer. This is Unix access separation and an immutable submission, not security against malicious scoring code, root or a compromised GPU. Failed dev gates do not invoke the verifier.

Spend, execution and publication

The user explicitly authorized Runpod credential use, up to $10 total compute, and this experiment’s public Markdown updates. No routine spending approval is needed within that scope. Before rental require this plan live on the notebook and the publisher’s matching SHA-256 acknowledgement. Freeze executable source before upload. Use installed GPU helpers, Secure Cloud when available, current stock/pricing and an authenticated pinned host key. Record actual all-in quoted rate and provider creation time; immediately register the exact owned pod. Maximum all-in rate $2/hour; initial immutable lease maximum 4 hours and maximum estimated spend $7.50, shortened if necessary to respect the $8 work threshold. No lease extension. Use only one pod at a time; cumulative spend includes every attempt and setup time. No paid persistent volumes, standing workers or top-ups.

The watchdog is best effort, not a guaranteed provider-enforced dollar cap. Independently check elapsed spend before each GPU stage and at least once per minute; do not begin new work at $8, finish only the current bounded batch, then sync/delete, retaining $2 reserve against latency/unknown charges. Stop earlier if any required gate fails after its bounded dev iteration. Capture provider responses privately, print only allowlisted nonsensitive fields; never publish tokens, credentials, private addresses or infrastructure names.

Prepare code on CPU before renting, continuously checksum-sync small outputs home, update the reviewed notebook about every 15 minutes, and maintain atomic progress and append-only events. Freeze both public protocol and private execution manifest, including revisions, seeds, device, timing and cost. Do not touch the preceding run’s resources or frozen artifacts. The parent owns the controller, dashboard and publisher; leave their code unchanged.

Deliverables and stopping outcomes

Publish every gate and H1–H5 status, raw row counts, results table, ledger, 95% CIs, accuracy-drop versus confidence-drop plot, and probe-AUROC versus self-report-AUROC plot. Fixed-rule examples are the first eight heldout arithmetic IDs with matching repaired outputs, never selected by correctness. If an earlier gate stops the study, report unrun cells/metrics as not evaluated, show available dev plots with clear labels, and use the first eight dev arithmetic IDs only as explicitly dev examples; do not fabricate lesion, repair, probe or holdout results to fill a template. Publish a final summary and limitations even for implementation failures or nulls.

Before completion verify durable checksum sync and independent provider absence for owned compute; reconcile estimated spend with billing if available, otherwise label the estimate. Save final summary, tables, plots, transcripts, gate evidence, ledger and completion audit. Write DONE only after the requested stopping path and publication are verified. Language concerns lesions, self-assessment and confidence; no claims about experience or clinical status.

Run checkpoint

Publication checkpoint: 2026-10-26T06:25:19.301890+00:00

Reported phase: freeze_ready. Completed evaluation units: 4. Planned evaluation units: 4.

This page is a rolling Markdown notebook; prior updates remain in Git history. A checkpoint timestamp means the reporting system checked the run, not that a scientific milestone passed.

Frozen protocol SHA-256: 0aee64eb3cd9a6d42759236295d9d473efd4443932582020b89de87b5028958a.