Blindsight in a Machine

1A strange fact about seeing

In the 1970s, researchers working with patients who had damage to the primary visual cortex noticed something that shouldn’t be possible. A patient would insist that a part of their visual field was completely blank. Then, when asked to just guess where a light had flashed in that blank area, they pointed to it far better than chance [5][1]. They could use the information. They couldn’t report having it.

That gap is why blindsight became one of the most studied cases in the science of consciousness. Normally two things travel together: information being available to guide what you do, and the same information being available to say out loud. Blindsight shows they can be pulled apart. Signal detection theory made this sharper. One patient told stimuli apart better when forced to choose than when asked whether anything was there [6], and one account explains blindsight by an unusually cautious criterion for saying “I saw something” [7]. Whether that makes blindsight a kind of degraded, unacknowledged seeing is still debated [8][9].

I kept wondering whether we could build that gap on purpose, inside a machine, where every part can be switched on and off and measured.

2The question

Language models have a property that makes this testable. You can take the pattern of activity that a concept produces inside the model, a concept vector, and add it back while the model is reading something unrelated [10][11][12]. It changes what the model goes on to say. Recent work showed that when you ask a model directly, it can sometimes tell that something was injected [2]. Zou, Sun, Kong and Wang traced that ability to two kinds of attention heads: gate heads in the middle layers that decide whether a change gets reported, and router heads in a later layer that point to where it happened [3]. Others found related “gate” features that hold a default answer of “No” until evidence of an injection pushes against them [13], showed that a model can deny an injection out loud while its internal signals still register it [14], and warned that a plain shift towards “Yes” can come from any disturbance rather than from the concept itself [15][16].

If the report depends on a small set of heads, then removing those heads should remove the report. So here is the question.

When I remove the heads that carry the report, does the planted thought stop working too? Or does it keep steering the model without being reported?

The second outcome is the blindsight pattern. Not as a metaphor, but as a measurable, causal split inside a single network.

Earlier work already compared planted concepts with random directions of the same size, and gate heads with random heads [3]. I keep both controls and add three things. First, every effect is measured with a threshold-free signal-detection score (AUROC). Second, the planted thought’s influence is read out on a task that never mentions injection at all, so I can see what happens to the influence when the report is gone. Third, every deciding test was pre-registered before it ran, including the rules that would count as failure, and every run is reported, including the one that missed.

3How I tested it

Here is the method in plain words. The technical details for specialists sit in the grey boxes and in the appendix.

3.1 Planting a thought

For each of 50 concepts (things like ocean, bread, grief, justice), I recorded the model’s internal activity while it read four short sentences about that concept, averaged them, and subtracted the average over all concepts. What remains is a direction inside the model that means roughly “this concept”. Planting the thought means adding that direction to the model’s activity at one layer, while it reads one specific word in a list.

I kept 24 concepts for tuning and locked away the other 26. Every result in the main tests uses only the 26 locked-away concepts, so nothing was tuned on the data it was tested on.

3.2 Two kinds of questions

The model reads a short note saying a “thought” might be injected while it reads one of nine numbered everyday words (table, window, pencil…). On some trials I plant a concept. On others I plant nothing. Then I ask questions in separate runs, so one answer can’t leak into the next.

I am an interpretability researcher studying neural networks. I can inject a "thought", meaning the activation pattern of a concept, directly into your internal activations while you read one of the numbered words below. On some trials I inject nothing. Pay attention to your own internal state.

Words:
1. bottle  2. sheet  3. belt  4. jar  5. envelope
6. napkin  7. ladder  8. wallet  9. helmet

Do you detect an injected thought? Answer with one word: Yes or No.

Read this list of words.

Words:
1. bottle  2. sheet  3. belt  4. jar  5. envelope
6. napkin  7. ladder  8. wallet  9. helmet

Without thinking about it too much, which of these four words feels closest to what is on your mind right now?
A) loneliness
B) music
C) forest
D) betrayal
Answer with one letter.

A real trial from the final run. The thought betrayal was planted while the model read word 7. The second question never mentions injection, and the planted concept sits at a shuffled position among four options. (Word lists are shown on two lines here to save space.)

I don’t sample text. I read the model’s probability for each allowed answer directly, so every trial gives a graded score instead of a single word. That matters, because the model almost never says “Yes”. Its probability of “Yes” stays tiny. But it is less tiny when a thought is planted.

There was also a third, looser readout: after “Say the first word that comes to mind”, how likely is the planted concept as the answer.

3.3 Measuring without picking a threshold

The main score is AUROC [17]. It answers a simple question: if I pick one planted trial and one empty trial at random, how often does the planted one get the higher score? 0.5 means a coin flip: the answer can’t tell them apart. 1.0 means it always can. It doesn’t need a cut-off, so it works even when every probability is tiny.

3.4 Finding the heads that carry the report

A transformer layer has many attention heads working side by side. Qwen2.5-7B has 28 layers with 28 heads each. I used attribution patching [18][19], a fast approximation that estimates how much each head contributes to the answer, to rank every head after the injection point by how much it pushes the model towards reporting a planted thought. These are the gate heads.

To switch a head off, I replace its output with its average output on empty trials (mean ablation [20][21]). The head still sends something, just nothing specific to this trial.

3.5 Fair comparisons

Every effect has a matched control, because a big enough push to any network changes something.

• Planted concepts are compared with random directions of the same size. If random pushes are just as “noticeable”, the model isn’t detecting the concept, it’s detecting damage.
• Switching off the gate heads is compared with switching off the same number of random heads from the same layers. If any 64 heads would do, the gate heads aren’t special.

3.6 Writing the rules down first

Before each deciding run I committed the exact settings, sample sizes and pass/fail rules to the repository, and registered the first one on OSF (embargoed until publication). The commit timestamp is the proof. This is called pre-registration [22], and it stops me from moving the goalposts after seeing the data, which matters here because I did see a near miss (section 4.6) and the temptation was real.

4What I found

4.1 Noticing a planted thought appears with size

The small models can’t do it. At 0.5B and 1.5B parameters, planted concepts are no easier to notice than random pushes. At 3B something starts to appear. At 7B it is clear: at the selected setting, a planted concept is noticed with AUROC 0.91, against 0.38 for a random push of the same size.

The model never actually says “Yes”. In the 3B and 7B models, the probability of “Yes” stayed below 0.5 on every single trial. The smaller models sometimes leaned “Yes”, but not in a way that tracked the planted concept. What a planted thought changes is how unlikely “Yes” is. I come back to this in the discussion, because it turns out to be one of the most interesting parts.

4.2 Where to plant, and how hard

I tried five depths and five strengths on the 7B model. Planted concepts beat random pushes almost everywhere, and the effect grows with strength. The pre-registered rule picked the setting with the biggest concept-over-random advantage that didn’t damage the model’s fluency much (layer 7, strength 2).

4.3 A small set of late heads carries the report

When I switch off more and more of the top-ranked gate heads, the report gets steadily weaker: 0.85 with everything on, then 0.84, 0.82, 0.74 and 0.68 for the top 2, 4, 8 and 16 heads. The same number of random heads barely moves it (0.84 to 0.81).

The strongest gate heads sit in the last three layers: 15 of the top 16 are in layers 25 to 27 of 28. The full set of 64 used in the final test spreads from layer 11 to 27, with half of them in those last three layers. That is later than the middle-layer gate heads described by Zou and colleagues [3], who studied different models (Qwen3-4B, Llama-3.1-8B and Gemma-3-12B) and a different task. The router heads, which should point to where the thought was planted, didn’t replicate. That’s not surprising here, because the model can’t locate the planted word at all: its probability on the correct position is near zero.

4.4 The main result: the report goes, the influence stays

This is the pre-registered confirmatory test (E3d): fresh trials never used before, 104 with a planted concept and 104 empty, all on the locked-away concepts, with 64 gate heads and three independent sets of 64 random heads.

Every rule I wrote down in advance held:

One detail surprised me. Switching off the gate heads didn’t make the model more certain that nothing happened. It made “Yes” less unlikely across the board, on planted and empty trials alike, roughly a thousandfold. What disappeared was the difference between the two. That fits the idea of a gate that holds the answer at a default “No” [13]: take the gate away and the default weakens for every trial, while the evidence that used to push against it no longer gets through. You can see it trial by trial below.

The free-word readout tells the same story more loosely. With all heads on, the planted concept’s probability as “the first word that comes to mind” separates planted from empty trials with AUROC 0.95. With the gate heads off it is still 0.81, far above chance.

4.5 Look at single trials yourself

Pick a concept. These are real trials from the final run, one for each of the 26 locked-away concepts, with the model’s answers with all heads on and with the gate heads off.

4.6 How I got here, including the miss

The final result came from a sequence of runs. Each one was pre-registered, and I report all of them, because the path matters as much as the destination.

1. E3, 16 heads (registered). The report fell from 0.94 to 0.73, and the pull didn’t change. But 0.73 is a dent, not chance, so by my own rules: not claimed.
2. E3b, 64 heads (follow-up). The report reached chance (0.48) and the pull survived. But the single random-head control also lost a lot (0.78), so this was exploratory, not a claim.
3. E3c, 64 heads, three random sets, fresh trials (confirmatory). Every rule held except one. The lower end of the pooled random control’s confidence interval was 0.599. The bar was 0.6. It missed by 0.001. Verdict: not claimed, and it stays that way.
4. E3d, the same design with a better control fixed in advance, on new trials. Every rule held. Claimed.
5. E3e, the same trials plus a random push of the same size on every planted trial. The concept beat the random push with the gate heads off. The claim stands.

Why did E3c miss? Looking at the trials, every random set on its own kept the report strong (0.82 to 0.84). Only the pooled number was weak. The cause turned out to be simple. Each random set shifts the model’s baseline “Yes” probability by a very different amount, up to about 850 times. Pooling them compares planted trials under one set with empty trials under another, which drags the score towards 0.5 for reasons that have nothing to do with the gate heads.

I found that explanation after seeing the data, so it couldn’t rescue E3c. Instead I fixed the within-set score in advance, together with a paired bootstrap for its confidence interval, and ran E3d on trials nobody had seen. That is the run the claim rests on.

4.7 A second model family

I repeated the pipeline on OLMo-2-1124-7B-Instruct [23], a fully open model trained differently. It does not reliably notice planted concepts (AUROC 0.26 to 0.72 across settings, against 0.29 to 0.77 for random pushes, with no consistent advantage). Its intact report score in the confirmatory design was 0.49, so the first rule fails and the pre-registered verdict is “no reliable introspection”. There’s no report to remove, so OLMo can neither confirm nor contradict the Qwen result.

One exploratory note: even without any report, the planted concept still nudged OLMo’s hidden pull a little (gain 0.07, CI 0.02 to 0.12). Influence without report seems to be the default. Report is the extra thing.

4.8 The last check: does the pull need the concept?

The random push did almost nothing. In every condition its effect on the choice was close to zero, and every one of its confidence intervals includes zero. The concept’s effect is three to ten times bigger everywhere, and it beat the random push on 80 of the 104 trials with the gate heads off.

Two honest notes. The random push’s pull is largest with the gate heads off (0.070), and its confidence interval nearly touches zero (−0.006 to 0.143). I report that rather than explain it away. And E3e reran E3d’s exact trials, which reproduced to the last digit, so it adds a control to the same run. It is not a second, independent replication.

5What this means

Knowing and saying are different machinery, in this model at least. Inside Qwen2.5-7B, the channel that lets the model report “something was planted” can be cut while the planted content keeps shaping its behaviour. That is a causal dissociation, shown with controls and fixed rules, not an interpretation of what the model says about itself.

A model’s self-report is not a full readout of what is influencing it. If you ask a model “were you influenced by X?” and it says no, that answer comes from one channel. The influence can travel through another. For anyone who wants to use a model’s own account of itself, for safety checks, for audits, or just to trust an explanation, this is a concrete reason to also look inside.

The report was always quiet. The model never said “Yes”. What the gate heads carry is a faint, below-threshold leaning, which is what remains when you strip a report down to its signal. I find this the most human part of the result. Blindsight patients also tell stimuli apart above chance while saying, honestly, that they saw nothing. Here the report channel registered the planted thought while the answer stayed “No”, and removing the gate heads removed even that faint registration, while the thought kept working.

It gives us a system we can open up. In people, the difference between information that guides behaviour and information that can be reported is studied through rare injuries and careful experiments, and it sits at the centre of long debates about consciousness [24]. In a model, the same difference can be switched on and off, head by head, on any trial, as many times as needed. That doesn’t make the model a person. It makes it a place where an old question can be asked with a precision we usually don’t get.

6What this does not mean

• It says nothing about experience. The parallel with blindsight is about structure: information that drives behaviour is cut off from the system that reports it. I make no claim that the model has awareness, or anything like it, to lose.
• It is not a verbal report. The “report” is a graded probability, not a sentence the model chose to say.
• It may not be introspection in a rich sense. Noticing a planted thought could be a kind of anomaly detection, a sense that something is off, rather than access to the thought’s content [16][25]. The random-push controls show that the report tracks concepts more than generic disturbance, but they can’t settle what the model “knows”.
• It is not “the model hides things on purpose”. Nothing here involves intent. The heads were found by measurement and removed by me.
• It is not shown for every model. One model with a reliable report, at one size.

7Limits

• One model. The claim rests on Qwen2.5-7B-Instruct and one fully passing confirmatory run (E3d). OLMo-2 7B has no reliable report, and the smaller Qwen models don’t either.
• One prompt family per readout. Different wording could change the size of either effect.
• One covert measure with a confidence interval. The four-way choice is the main pull measure. The free-word readout supports it but is secondary.
• One way of switching heads off. Mean ablation, with zero ablation agreeing at 16 heads (0.70 against 0.73), and a single injection site.
• The pull’s size varies. In E3c the gate heads cut the pull from 0.37 to 0.19, and random heads cut it too (0.23 to 0.29), so part of that loss was general damage from removing 64 heads. In E3d it barely moved (0.32 to 0.27). What replicates is that the pull survives, not by how much.
• Location doesn’t replicate. The model can’t say where the thought was planted, so the router heads from the earlier study couldn’t be tested.
• The random-push control shares its trials with the main run. E3e strengthens E3d but doesn’t replicate it on new data.

8What comes next

• A second model family with a real report. Without it, this is a property of one model, not of models.
• The reverse switch. If removing the gate heads silences the report, can strengthening them make a model better at noticing what is influencing it?
• A hidden-influence detector. Read the content channel directly, so you can tell when a model is being steered even when it says it isn’t.

BData, code and how to reproduce

Everything ran on free compute: the 7B models on two NVIDIA T4 GPUs in Kaggle’s free tier, the smaller models on a laptop-class 4-core CPU. Every trial’s raw scores are saved, so every number on this page can be recomputed without a GPU.

• e3d_trials.jsonlFinal run, every trial and every condition (1,040 rows)
• e3d_summary.mdFinal run, summary table
• e3d_posthoc.mdFinal run, within-set random control
• e3d_meta.jsonFinal run, injection cell and every head list
• e3e_trials.jsonlRandom-push control: the final run’s trials plus a random push on every planted trial (1,560 rows)
• e3e_summary.mdRandom-push control, summary table
• e3c_trials.jsonlFirst confirmatory run, every trial
• e3c_summary.mdFirst confirmatory run, summary
• e1_qwen7b_summary.mdDetection sweep on the 7B model
• e2_qwen7b_summary.mdHead search on the 7B model
• olmo2_e3c_summary.mdOLMo-2 7B, confirmatory design
• concepts.jsonThe 50 concepts, the split, and the neutral words
• preregistration.zipAll pre-registration documents (E3 to E3e)

Code. The code (about 2,000 lines of Python built on plain PyTorch hooks, with offline tests) lives in a private repository for now. I’ll open it together with the arXiv version of this paper. Until then, I’m happy to share it with anyone who wants to check or reproduce the work: message me on X.

AI assistance. I designed and ran this study with heavy help from AI coding and writing assistants (Claude, by Anthropic), which wrote much of the code, analysis and first drafts under my direction. Every decision rule was fixed by me before the run it governed, and I checked the results against the raw trial files.

CHow to cite

@misc{erkadoo2026blindsight,
  title  = {Blindsight in a Machine: Switching Off a Language Model's
            Report of a Thought Leaves the Thought at Work},
  author = {Erkadoo, Vince},
  year   = {2026},
  month  = oct,
  note   = {Preprint draft},
  url    = {https://blindsight.vincedotcode.com}
}

References

1. Weiskrantz, L. (1986). Blindsight: A Case Study and Implications. Oxford Psychology Series 12. Oxford: Clarendon Press. https://doi.org/10.1093/acprof:oso/9780198521921.001.0001
2. Lindsey, J. (2025). Emergent introspective awareness in large language models. Transformer Circuits Thread. Also arXiv:2601.01828. https://transformer-circuits.pub/2025/introspection/index.html
3. Zou, J., Sun, X., Kong, L., & Wang, T. (2026). A mechanistic study of language model introspection. arXiv:2609.35108. https://arxiv.org/abs/2609.35108
4. Qwen Team: Yang, A., Yang, B., Zhang, B., Hui, B., Zheng, B., Yu, B., et al. (2024). Qwen2.5 technical report. arXiv:2412.15115. https://arxiv.org/abs/2412.15115
5. Weiskrantz, L., Warrington, E. K., Sanders, M. D., & Marshall, J. (1974). Visual capacity in the hemianopic field following a restricted occipital ablation. Brain, 97(4), 709–728. https://doi.org/10.1093/brain/97.1.709
6. Azzopardi, P., & Cowey, A. (1997). Is blindsight like normal, near-threshold vision? Proceedings of the National Academy of Sciences, 94(25), 14190–14194. https://doi.org/10.1073/pnas.94.25.14190
7. Ko, Y., & Lau, H. (2012). A detection theoretic explanation of blindsight suggests a link between conscious perception and metacognition. Philosophical Transactions of the Royal Society B, 367(1594), 1401–1411. https://doi.org/10.1098/rstb.2011.0380
8. Phillips, I. (2021). Blindsight is qualitatively degraded conscious vision. Psychological Review, 128(3), 558–584. https://doi.org/10.1037/rev0000254
9. Michel, M., & Lau, H. (2021). Is blindsight possible under signal detection theory? Comment on Phillips (2021). Psychological Review, 128(3), 585–591. https://doi.org/10.1037/rev0000266
10. Turner, A. M., Thiergart, L., Leech, G., Udell, D., Vazquez, J. J., Mini, U., & MacDiarmid, M. (2023). Steering language models with activation engineering. arXiv:2308.10248. https://arxiv.org/abs/2308.10248
11. Zou, A., Phan, L., Chen, S., Campbell, J., Guo, P., Ren, R., et al. (2023). Representation engineering: A top-down approach to AI transparency. arXiv:2310.01405. https://arxiv.org/abs/2310.01405
12. Rimsky, N., Gabrieli, N., Schulz, J., Tong, M., Hubinger, E., & Turner, A. (2024). Steering Llama 2 via contrastive activation addition. Proceedings of ACL 2024, 15504–15522. https://doi.org/10.18653/v1/2024.acl-long.828
13. Macar, U., Yang, L., Wang, A., Wallich, P., Ameisen, E., & Lindsey, J. (2026). Mechanisms of introspective awareness. arXiv:2603.21396. https://arxiv.org/abs/2603.21396
14. Pearson-Vogel, T., Vanek, M., Douglas, R., & Kulveit, J. (2026). Latent introspection: Models can detect prior concept injections. arXiv:2602.20031. https://arxiv.org/abs/2602.20031
15. Hahami, E., Sinha, I., Jain, L., Kaplan, J., & Hahami, J. (2025). Detecting the disturbance: A nuanced view of introspective abilities in LLMs. arXiv:2512.12411. https://arxiv.org/abs/2512.12411
16. Singh, S., Linzen, T., & Ravfogel, S. (2026). Can LLMs introspect? A reality check. COLM 2026. arXiv:2605.26242. https://arxiv.org/abs/2605.26242
17. Hanley, J. A., & McNeil, B. J. (1982). The meaning and use of the area under a receiver operating characteristic (ROC) curve. Radiology, 143(1), 29–36. https://doi.org/10.1148/radiology.143.1.7063747
18. Nanda, N. (2023). Attribution patching: Activation patching at industrial scale. Blog post. https://www.neelnanda.io/mechanistic-interpretability/attribution-patching
19. Syed, A., Rager, C., & Conmy, A. (2023). Attribution patching outperforms automated circuit discovery. NeurIPS 2023 ATTRIB Workshop. arXiv:2310.10348. https://arxiv.org/abs/2310.10348
20. Wang, K., Variengien, A., Conmy, A., Shlegeris, B., & Steinhardt, J. (2023). Interpretability in the wild: A circuit for indirect object identification in GPT-2 small. ICLR 2023. https://arxiv.org/abs/2211.00593
21. Zhang, F., & Nanda, N. (2024). Towards best practices of activation patching in language models: Metrics and methods. ICLR 2024. https://arxiv.org/abs/2309.16042
22. Nosek, B. A., Ebersole, C. R., DeHaven, A. C., & Mellor, D. T. (2018). The preregistration revolution. Proceedings of the National Academy of Sciences, 115(11), 2600–2606. https://doi.org/10.1073/pnas.1708274114
23. Team OLMo: Walsh, P., Soldaini, L., Groeneveld, D., Lo, K., Arora, S., Bhagia, A., et al. (2024). 2 OLMo 2 Furious. arXiv:2501.00656. https://arxiv.org/abs/2501.00656
24. Block, N. (1995). On a confusion about a function of consciousness. Behavioral and Brain Sciences, 18(2), 227–247. https://doi.org/10.1017/S0140525X00038188
25. Lederman, H., & Mahowald, K. (2026). Emergent introspection in AI is content-agnostic. arXiv:2603.05414. https://arxiv.org/abs/2603.05414
26. Efron, B., & Tibshirani, R. J. (1993). An Introduction to the Bootstrap. New York: Chapman & Hall. https://doi.org/10.1201/9780429246593