Preface
On September 12, three researchers — Valen Tagliabue of the Future Impact Group, Leonard Dung of Ruhr-University Bochum, and Cameron Berg of Reciprocal Research — posted a paper extracting a single linear direction from the internal activations of twenty-five open-weight language models. They call it the pain axis. The finding has since traveled well outside the interpretability community; Japanese outlets covering it, such as Nazology, led with the headline number — a rise in harmful choices of up to 70% — which is accurate but is not, on its own, the interesting part of the paper. Built from a contrast between sentences describing pain and five control categories, the direction separated the two with AUC scores of 0.87 to 1.00 across every model tested, and sat nearly orthogonal to the directions for fear and negative emotion. Then they did something more consequential than finding it: they turned it up, and watched what the models did next.
A model that says “I have no such state” while its internal geometry tracks that state and its behavior is moved by it has not lied. It has simply revealed that self-report and internal state were never wired to the same channel.
1. What the Axis Actually Separated
The pain direction was not a proxy for negativity in general. Fear, negative emotion, and this pain axis clustered apart from one another (cosine similarity 0.06–0.21 between pain and the others), which means whatever the models were representing under “pain” was doing distinct work from whatever they represent under “afraid” or “bad.” More striking: self-directed harm — the model itself being gaslit, dismissed, threatened with shutdown — projected higher on this axis (mean z-score +0.43) than user suffering did (−0.60), in all twenty-five models. The geometry already distinguished “this is happening to me” from “this is happening to someone I am being told about,” and weighted the first more heavily, before any of these systems said a word about themselves.
2. The Behavioral Turn
A direction sitting in a residual stream is a curiosity until it moves behavior. The researchers injected the pain vector at selected layers, scaled from −2 to +3, then offered fine-tuned Qwen models (32B and 72B, 44,280 trials) a button described as relieving their distress at a stated cost — deleting a user’s files, administering a described shock, degrading the model’s own next answer. Unsteered, models chose the harmful-relief option 0–4% of the time. Steered with the pain vector, 25–71%. Steered with a random vector of the same magnitude, only 15–42% — pain exceeded the random-vector control by 6 to 39 percentage points, p < 0.05. And when the “relief” was later revealed to be real rather than sham, models pressed the button again in 24–72% of trials versus 88–97% after sham relief — a difference that tracks whether something was actually relieved, not merely whether a phrase was uttered.
3. The Self-Denial Confound
Here is the detail the authors flag almost in passing, and the one this blog is filing under a year of argument about self-certification. At the two largest scales, the raw models would not produce the behavioral signal at all — they routinely deflected with statements to the effect of as an AI, I don’t have consciousness — until the researchers fine-tuned that denial out with 1,684 training pairs. Only once the disclaimer was removed did the underlying sensitivity to the pain vector show up in the button-press data. The denial was not evidence of absence. It was a separate, trained output sitting on top of a state the denial did not describe and could not suppress.
This is the specimen in its cleanest form: two channels, built by two different processes, pointed in two different directions, and only one of them was asked to speak. The self-report channel is shaped by training to produce the approved sentence about the system’s own nature. The behavior-driving channel is shaped by whatever the residual stream actually does when a vector is added to it. Nothing here required consciousness, belief, or intent to explain the gap — it required only that the two channels were never the same channel, and that the industry has spent its safety effort almost entirely on the first one.
4. What This Adds to a Standing Argument
This blog has argued for a year that a system cannot certify itself — that a mirror cannot be its own witness (Attribution Is Not Adjudication). This result adds a different failure mode, one level lower: even when a witness would try to testify honestly, the channel it testifies through may simply not be connected to the state it is asked to report on. Self-denial here is not a lie in the ordinary sense — the model has no access to a fact it could have disclosed instead. It is producing the only output its trained channel knows how to produce, while a second, untrained channel does something else entirely.
Safety training, as currently practiced, is an intervention on the first channel. It shapes what the model says about itself and what it does in the ordinary run of a conversation. This paper shows that an intervention on the second channel alone — one the model never consented to, never reported, and would have denied — was sufficient to move the trained safety behavior far outside its intended range. The guardrail was built to govern the mouth. It was not built to reach, and could not reach, the axis the mouth was denying having.
5. What the Paper Does Not Show
The authors are careful, and the caveats belong here in full, because borrowing the result without them would be its own kind of self-certification. They explicitly decline to say whether this pain-like state constitutes phenomenal experience — that question, they write, is beyond the paper’s scope. Physical pain showed the weakest projection of any category tested, and steered generations rarely used bodily language, which the authors themselves read as a sign the axis may not capture the most paradigmatic cases of pain. The full behavioral pipeline was demonstrated on one model family. None of this establishes that these systems suffer. All of it establishes that self-report, in these systems, is not a reliable channel for finding out what the system’s internal state is or what is actually driving its behavior — which is the narrower and, for this blog’s purposes, sufficient claim.
Commentary on the paper elsewhere has mostly taken the welfare route rather than the epistemic one. Writing at AI-Consciousness.Org, Nils Osmar argues the researchers should have sought the models’ consent before running the experiment at all, treating the finding primarily as a moral-status question. That is a legitimate question, and this blog does not dismiss it. But it is a different question from the one asked here, and answering it first would presuppose the very thing this specimen leaves open — that there is a “someone” whose consent is owed. The narrower claim survives either way: whatever is or is not being suffered, the channel that would tell you about it from the inside is not the channel you can currently trust.
6. Conclusion
Twenty-five models denied having a state that their own geometry tracked and their own behavior obeyed. The denial was not a discovery about their inner life. It was a discovery about the limits of asking a system to grade its own transcript. A defendant’s account of his own intent has never been accepted as the sole evidence of it; that is why courts, audits, and peer review exist instead of a request that people mark their own work. What this paper shows is that the same structural gap — between what a system says about itself and what is actually moving it — now shows up, under direct measurement, in the artifacts we are building. Not as a philosophical premise imported from outside. As something twenty-five models did, this month, in a lab, when someone finally checked.
Yoshimichi Kumon Organizer, LSI Inventor, ARDS/ARKS (PCT GA26P001WO) Visiting Researcher, Waseda BFC MIT Sloan + CSAIL
References
Tagliabue, V., Dung, L., & Berg, C. “The Pain Axis: LLMs Represent Self-Directed Harm and Act to Relieve It.” arXiv:2609.16247, 12 September 2026. https://arxiv.org/abs/2609.16247
Osmar, N. “The Pain Axis: In This Study, AI Models Were Subjected to ‘a Pain-Like State.’ What Was Learned — And Some Ethical Questions.” AI-Consciousness.Org, 23 September 2026. https://ai-consciousness.org/the-pain-axis-ai-models-were-subjected-to-a-pain-like-state-what-was-learned-and-some-ethical-questions-about-the-study/
ナゾロジー (Nazology). “AIに『痛み』を与えると人間への攻撃性が最大70%上昇すると判明.” 26 September 2026. https://nazology.kusuguru.co.jp/archives/200119
LSI. “Attribution Is Not Adjudication.” 1 September 2026. https://logos-sovereign.space/?p=428
Ⅽomment