Anthropic's interpretability work put forward a striking claim: language models maintain something like a "global workspace" internally, holding content there before they say anything, including things they have not written yet such as the rhyme word at the end of an upcoming line. Two obvious questions follow. Does this replicate on open-weight models? And if it does, what is actually being held?
What the paper says
This work is an independent replication on open-weight models, with one methodological filter added that turns out to matter a great deal.
When you read content out of a middle layer with a lens, there is a confound you cannot dodge: what you read may just be the decoder having already converged, which is to say the word the model is about to emit anyway. In that case the "workspace" is nothing more than an early look at the output. There is no interesting internal computation to talk about. The filter the paper applies is what it calls the mouth rank: the token's position in the model's actual next-token distribution at that point. Tokens ranked near the top are treated as shadows, previews of the output rather than hidden state. Only tokens ranked far enough down, content the model has no current intention of saying, count as covert content, and only covert content is admissible evidence for a workspace claim.
Apply that filter and the workspace splits cleanly in two.
One half survives. These are context registers: which language the conversation is currently being conducted in, or which word was actually intended underneath a typo. This is state about the context itself, and it conditions everything the model generates downstream. The other half falls to the permutation baseline. That half is the content plans: rhyme words, intermediate values in mental arithmetic, multi-hop associations. Raise the covertness threshold and this forward-looking content dies. What it was reflecting was output expectation, not internal computation.
Registers, unlike plans, can be manipulated causally. Editing the language register flips the output language on 91.1% of prompts, and 64.6% of those are clean flips where the language changes and the answer stays correct. But restrict to the strictly covert subset and clean flips drop to 29.2%. The register carries the language setting, not the content itself. Ablating the typo axis is cleaner: it simply removes the model's ability to correct the error.
One detail is worth pausing on. Rewriting the register via entity editing also rewrites the model's representation of what it thinks it was asked. This shows up in 59% to 71% of trials, and holds across the scale ladder from 1.7B to 14B.
How strong is the evidence
The controls are reasonably solid. The permutation baseline establishes a chance-level floor. A matched-magnitude random-direction control rules out the "any perturbation does something" explanation. Scale is covered with four Qwen3 sizes: 1.7B, 4B, 8B and 14B. Architecture is covered by additionally testing Gemma-2-2B, and the conclusions hold across both model families. That is roughly what you want from a replication.
The most interesting limitation is one the authors raise themselves. The readable channel is a fitted property, and its bandwidth is narrow. The effective-dimensionality analysis shows the directions that actually carry the effect collapsing from 75 to 128 dimensions down to just 2 to 12, and the headline demonstration runs on about two. So "we can read it and edit it" does not license "there is a content-rich blackboard inside the model." A more careful reading is that we fitted a very thin accessible channel. Treating that channel as a picture of the model's internal representation in general would be overreading the result.
There is a second caveat about the negative result. Content plans fall to baseline only after the covertness threshold is raised, and where that threshold sits is a methodological choice rather than a fact about models. The paper is transparent here and reports a threshold sweep, so readers can judge for themselves. But the strength of the negative conclusion is genuinely tied to where you draw the line, and that should be stated rather than smoothed over.
Worth noting too: none of this refutes the original work. It narrows it. The claim that survives replication on open weights is smaller and more specific than the claim that motivated the investigation, which is a normal and healthy outcome.
What it means in practice
Enterprise customers ask a version of the same question over and over: what does the model actually retain internally, and which of its behaviors can we control? Work like this does not answer that philosophically. It answers it operationally, by saying which internal states can be read, which can be edited, and which can be trusted.
That translates into a fairly concrete line for delivery work. Context settings such as output language, format, and a term the model has been corrected on are held stably enough internally that they can be intervened on. Building behavioral constraints around those has an empirical basis. If you need a system to stay in one language across a long conversation, or to respect a corrected piece of terminology, there is a real internal handle for that.
On the other side of the line, the assumption that "the model has already drafted its answer internally" does not hold up. Reading internal state to predict the substance of what a model is about to produce has no support here. Guardrail designs that depend on catching a bad answer before it is generated, by inspecting hidden state, are not currently backed by evidence.
Two smaller practical notes. First, the 29.2% figure is a useful corrective to anyone quoting the 91.1%: intervention success and intervention cleanliness are different numbers, and vendors tend to quote the first one. Second, the finding that editing a register also perturbs the model's representation of the question means these interventions are not surgical. If you build on them, expect side effects and test for them.
The honest summary is that interpretability currently supports a narrower trust boundary than most people expect it to. That is still useful. It is just useful for less than the marketing around it suggests.