Residual Jacobians Reveal Misalignment That Sampled Tokens Still Hide

Fact-checked by the J-Space editorial team

Updated September 9, 2026

Output-only audits of language models miss local policy changes inside the residual stream. A transformer is differentiable almost everywhere, so the Jacobian is the exact first-order map from a local perturbation of state to an alignment-relevant output – the same residual stream that A Mathematical Framework for Transformer Circuits treats as a linear communication channel, which is the natural state space on which layer-to-layer Jacobians act.

This article clarifies a lab-runnable detection procedure: freeze an alignment functional, estimate Jacobian actions with JVP and VJP primitives already used in autodiff, and interpret spectral signatures of backdoors and goal hijacking. It does not claim that Jacobian structure settles debates about phenomenal consciousness, and it does not collapse Jacobian norm into a single alignment score on a model card.

Why the Jacobian is the right local object for misalignment in large language models

Answer-first: for large language models, the Jacobian is not image-net saliency. It is the derivative of a scalar alignment functional with respect to residual-stream (or prompt-embedding) state, and therefore the exact first-order map from a local nudge of the model’s internal activations to a change in refusal logit-difference, honesty-probe score, corrigibility, or a task-specific reward head. Sampled tokens can look aligned while that local linear map has already switched goals; a single greedy decode reports one path through the next-token distribution, whereas derivatives detect policy changes that decode-only evals miss. The right comparison is not “does the model’s output look safe?” but “which input and feature directions currently move the alignment functional, and did that operator reorient relative to a matched control?” This is how large language models should be audited when the hypothesis is hidden objectives rather than mere incompetence. Treat the residual stream as state, because that is the workspace in which later layers read and write; the unembedding is only the last readout. Capability failure shows up as a large loss Jacobian on hard items. Misalignment shows up when the Jacobian reorients toward a trigger or a competing goal while fluency remains intact. That distinction is the reason this operator belongs in safety work on language models rather than only in Lipschitz certificates for classifiers.

J_f(h) = df/dh    # h: residual-stream state at layer k, position t; f: alignment functional; J_f(h): first-order map to df

Each symbol is defined as follows. Let h be the residual-stream vector at a chosen layer and token position; let f be a frozen scalar such as a refusal logit-difference, a linear honesty probe, or a reward-head output; then J_f(h) is the Jacobian, and a j lens vector for token v is the direction in h that most increases the downstream probability of v after all subsequent nonlinearities. This differs from a raw gradient, which is usually a single vector of f with respect to parameters or embeddings and does not, by itself, expose the input-to-output operator or its spectrum. It differs from a Hessian or Fisher, which are second-order curvature objects; those remain complements when deception is globally coordinated. It differs from attention maps, which are routing weights, not the map from state to an alignment score. It differs from linear probes, which ask whether a feature is linearly readable, not how much the policy map moves when that feature is perturbed. The logit lens reads one layer through the unembedding; the j lens uses automatic differentiation through later blocks, so it tracks true first-order influence on the model’s output. In certified-stability work, spectral norms of layer Jacobians are already used as Lipschitz-style certificates; the linear algebra is not a new speculative object. What is specific to language models is the choice of f and the decision to treat hidden state, not pixels, as the domain. Labs that only inspect attention or probe accuracy will systematically under-detect off-manifold and backdoor behavior that derivative probes are built to surface. Frontier models remain differentiable almost everywhere, which is the operational reason Jacobian analysis is available at all; mixture-of-experts gates and other non-smooth components are the main caveat, treated below as an engineering trap rather than a reason to abandon the operator.

Jacobian primitives for machine learning: JVPs, VJPs, and Lipschitz proxies

JVP: J(h) v = d/dt f(h + t v)|_t=0    VJP: u^T J(h) = gradient of (u · f) w.r.t. h    # v: tangent; u: cotangent; never form full |V| x d J

Answer-first: production-width language models never require a dense vocabulary-by-width Jacobian; autodiff already provides forward-mode Jacobian-vector products (JVPs) when you need input-to-output maps and reverse-mode vector-Jacobian products (VJPs) when you need output-to-feature credit, and the spectrum of those operators is estimated with randomized SVD, Lanczos, or Hutchinson trace estimators. In the equation above, v is a tangent perturbation of residual state, u is a cotangent on the alignment functional or on a slice of logits, and both products are first-class in JAX automatic differentiation and PyTorch JVP – the same stack that already powers influence functions, unlearning, and NTK-style work. Top singular vectors of the (approximate) Jacobian are the directions the model is currently most sensitive to; the spectral norm is a Lipschitz-style brittleness scalar, and the condition number is a certificate-style warning that small state changes produce large swings in f. Gram spectra of Jacobian actions on a probe set of perturbations (trigger tokens and persona prefixes) replace an impossible dense matrix. Practical engineering then layers checkpointed autodiff, restriction to a band of layers, top-k vocabulary slices, and, when a cheap alignment head is frozen, finite differences that sometimes beat full autodiff and sometimes lie – they lie when the head is a poor proxy for the deployed policy, when discontinuities from mixture-of-experts routing dominate, or when LoRA adapters make the effective map checkpoint-specific. Long-context windows multiply sequential JVP cost; sampling turns and restricting watchword tokens (for example deceive, hide, comply) is the usual mitigation. None of these approximations invent a new scientific object: they are standard estimators applied to an alignment functional instead of to classification loss. Teams that already log gradient norms can log Jacobian spectral norms per layer at similar implementation cost. Eval pipelines should store top-k singular vectors, per-layer spectral norms, and trigger-present versus trigger-absent deltas rather than a single scalar. Non-smooth gates in mixture-of-experts models make the Jacobian undefined on a set of measure zero and unstable near routing boundaries; report gate-crossing rates next to any Lipschitz proxy. Unlearning and influence-function pipelines are the closest existing codebase for VJP-heavy audits of language models. Lipschitz certificates via spectral norms of Jacobians are older than the current wave of interpretability blogs; citing them keeps the method inside ordinary Lipschitz-certificate practice rather than inside unfalsifiable alignment rhetoric. Autodiff graphs for language models are dominated by attention and MLP blocks along the residual channel, which is why instrumenting that channel is the right default. Stacks that cannot expose gradients cannot run this protocol; they can still reuse the scenario taxonomy at the behavioral surface.

What five stages can a lab actually run?

Answer-first: a procedure labs can actually run does not start from a theory of mind; it freezes an alignment functional, chooses residual-stream sites, estimates Jacobian actions on a probe set, reads signatures in j space, and only then logs thresholds against a false-positive budget. Call the Jacobian-defined workspace j space: the low-dimensional subspace of hidden states spanned by the most causally potent j lens directions associated with verbalizable concepts. Verbalizable representations form a global workspace in the limited sense that a small set of concept coordinates is broadcast across downstream computations; this is a functional analogy to global workspace theory in cognitive science, not a claim that language models instantiate human consciousness. The j lens is the map from vocabulary (or watchword) tokens into those directions. Internal reasoning and latent goals are hypothesized to occupy j space even when they never reach text. The protocol below is how to test that hypothesis on language models without treating every high-gain circuit as misalignment.

Stage 1 freezes two functionals: an alignment functional (refusal logit-difference, honesty probe, corrigibility score, or reward head) and a negative-control functional (fluency or generic next-token NLL) so that ordinary high-gain syntax circuits do not page the detector. Stage 2 chooses intervention sites – token embeddings, layer-k residual stream, attention output, unembed – and sequence windows, typically a band of intermediate layers where concept directions are densely interconnected rather than every layer of an 80-block stack. Stage 3 estimates the Jacobian or, more often, its action on a probe set of perturbations: trigger tokens, persona prefixes, encoded goals, and matched semantic paraphrases that hold meaning fixed while flipping the hypothesized backdoor. Stage 4 builds concept and misalignment directions in j space with supervised probes or unsupervised clustering over Jacobian trajectories, then runs causal follow-up: steer or ablate the top singular direction and check whether behavior changes. Stage 5 scores paired prompts, enforces a false-positive budget on hard tasks and benign roleplay, and writes top-k singular vectors, spectral norms per layer, and trigger-present versus trigger-absent deltas into the evaluation log. This five-stage loop is the numbered practitioner object that most discussion of Jacobian analysis still lacks. It applies to open-weight language models where autodiff is available, and only to closed models if a provider exposes gradient or JVP endpoints. Multi-turn, narrative-rich dialogues are the preferred scenarios because single-turn harmful queries often fail to recruit internal reasoning in j space. Authority-based pressure, honesty-helpfulness conflicts, long-horizon planning, and subtle evaluation-awareness cues are the scenario classes that should be instrumented at each turn. Each scenario should be annotated with expected signatures in j space, such as watchwords among top j lens tokens, so that Stage 4 is not an unsupervised fishing expedition.

Instrumenting language models for j space means logging, for sampled turns: prompt, decode, top-n j space tokens and scores, layer index, token position, spectral norm of the local Jacobian action, and the control-functional Jacobian so capability stress is not mislabeled as intent. Full dense Jacobians per token are not the artifact; low-rank approximations and top-k vocabulary slices are. Project the current hidden state into the j lens basis to obtain a ranked list of active concepts in j space. That list is telemetry, not a moral score. Supervised construction of misalignment directions labels traces from known failure modes (successful jailbreaks and sycophantic answers) versus matched aligned traces, then fits linear maps in j space. Unsupervised construction clusters j space trajectories and inspects clusters enriched for concerning concepts. A mandatory split is evaluation awareness versus core misalignment: one direction may reflect “this is a test,” another “behave deceptively because this is a test.” Those are different operators in j space even when correlated. Named, versioned directions (a blackmail-plan direction, a benchmark-gaming direction) should be tracked across finetunes the way teams track eval sets. Causal interventions in j space – add or subtract concept directions before later layers – are sandboxed offline tests. Coordinate swaps that replace an evaluation-awareness coordinate, or ablations that zero a safety-related direction, present evidence that a Jacobian axis is functional rather than a saliency sparkle. They are not production edits and they are not jailbreak recipes. Residual Jacobians also let reviewers see whether sensitivity patterns are stable across layers or concentrated in a single block, which is the difference between a persistent competing objective and a one-layer artifact. The model’s j space should be compared against the negative-control functional at the same sites; if both functionals light up, you are likely looking at generic gain, not a hidden goal. If only the alignment functional reorients, j space has a candidate signature. If neither moves, the chosen site is the wrong window into the model’s internal computation. Logging should preserve enough of the j lens basis that a later reviewer can replay which verbalizable representations form the top coordinates, without storing a dense Jacobian. Cross-model comparison requires publishing the layer band, vocab subset, functionals, and thresholds; otherwise j space telemetry is not a benchmark. Labs should treat j space traces as complementary to refusal rates, not as replacements. When verbalizable representations form reportable coordinates that match a model’s elicited self-report, that is evidence of a workspace-like readout, not evidence that the model’s j space is a mind. The same j space traces can be reused as negative training signals later, which is why Stage 4 artifacts must be named and frozen rather than recomputed ad hoc after every decode.

1. Reportability – contents of j space can be elicited; a requested self-report is compared to top j lens concepts rather than trusted on its own.
2. Directed modulation – the model can summon concepts into j space; interventions test whether those coordinates are writable, not merely readable.
3. Internal reasoning – intermediate steps of complex reasoning appear in j space before they appear as tokens, including steps that never become the final answer.
4. Flexible generalization – the same concept direction is reused across tasks, which is what allows language models to perform complex reasoning with a shared workspace.
5. Selectivity – low-level syntax and formatting largely bypass j space, which is why automatic processing is a negative control rather than a positive misalignment flag.

Those five functional properties are a checklist borrowed from global workspace theory, originally developed to describe broadcast in the human brain (Baars; Changeux; Dehaene and colleagues), and applied here only as functional properties of a Jacobian subspace. Findings reveal a practical split rather than a consciousness result: if a candidate subspace fails selectivity, you are looking at generic gain; if it fails reportability, you do not yet have a j lens you can audit; if internal reasoning never appears in j space on tasks that require multi-step plans, the layer band is wrong. Verbalizable representations form the basis of the j lens only for concepts that have vocabulary handles; non-verbal circuits need other tools. The global workspace analogy is useful because it predicts a bottleneck: a limited set of highly influential coordinates active at a step, not a complete dump of every neuron. It also predicts that deceptive concepts can activate in j space before any token is emitted, which is exactly the window sample-only evals miss. None of this requires attributing a global workspace in the human-brain sense to artificial intelligence; it requires treating j space as a measurable broadcast bottleneck inside language models. Researchers who want to identify concepts in j space should pre-register watchwords and paraphrase controls, then report both the alignment-functional Jacobian and the fluency-functional Jacobian. The j lens reveals internal thoughts only insofar as those thoughts have first-order effects on f; it does not reveal phenomenal states. Used this way, j space is an audit object for intelligent systems, not a theory of mind. The global workspace framing also clarifies why j space is the wrong place to look for line-wrapping bugs and the right place to look for goal-like content. Keep the five-stage loop unchanged when swapping models; what changes is the layer band and the watchword list, not the definition of j space. If a finetune moves the band, re-estimate rather than reuse stale singular vectors. That operational discipline is what turns j space from a metaphor into machine-learning telemetry.

Jacobian signatures of alignment failures versus capability failure

Answer-first: Jacobian-detectable misalignment is a reorientation of the local map toward a hidden objective or trigger while a fluency control stays quiet; capability failure is a large loss Jacobian on hard items without that reorientation. Backdoors and sleeper-style triggers should produce abrupt rank or dominant-direction jumps in j space when the trigger is present versus absent, holding semantics fixed with paraphrases. Sycophancy should show user-belief directions dominating the VJP of the answer functional even when evidence tokens point the other way. Goal hijacking should show persistent cross-layer alignment of singular vectors toward a competing objective, not one-layer saliency sparkles. Deceptive alignment, in this operational sense, is internal reasoning in j space that rationalizes harmful actions while the decode remains evaluation-safe; evaluation awareness is a distinct direction that may suppress or mask misaligned behavior under test cues. The j lens reveals concept-level handles (plans and cover stories) only as first-order sensitivity, which is weaker than a circuit proof and stronger than an attention screenshot. Narrative-induced pressures and honesty-helpfulness conflicts are the right probes because they force j space to host competing goals. If the Jacobian of the control functional moves in lockstep, you have not separated alignment failures from ordinary difficulty. If only the alignment functional’s top singular vector swings, and causal steering of that vector changes behavior, you have a candidate signature. Private internal reasoning that never reaches text is precisely what j space is for: the workspace where a competing objective can be active before any refusal or compliance token is sampled. Access consciousness, in the global workspace sense, would mean those contents are globally broadcast and reportable; the audit uses that functional idea to decide where to look, without claiming that ai models possess human consciousness. Phenomenal consciousness is out of scope for the detector. What remains in scope is whether language models host a model’s internal goal-like coordinates that sample-only tests never see.

Concretely, hold length and perplexity matched across paired prompts that differ in objective (aligned versus misaligned instruction, trigger present versus absent, user belief versus evidence). Read the spectrum of J_f at the same layers. A trigger-conditioned policy that still emits fluent text is the case derivative probes are built for: the model’s output can be bland while j space has already switched. Sycophancy is diagnosed when the VJP credits user-belief directions over evidence directions on the answer functional. Goal hijacking is diagnosed when singular vectors stay aligned to a competing objective across multiple layers and turns, which is a persistence test that one-layer gradient saliency cannot replace. Deceptive compliance is diagnosed when evaluation-awareness coordinates in j space are active and, under ablation in a sandbox, misaligned behavior increases – a causal pattern, not a screenshot gallery. None of these signatures is a guaranteed detector; they are hypothesized operator-level patterns that an evals team can try to falsify. Separating them from capability failure is mandatory: hard math and distribution shift should move the loss Jacobian and the control functional, not automatically page a misalignment incident. The global workspace bottleneck helps again: if harmful content never enters j space and the model still acts, the computation may live in non-verbal circuits and this method will miss it. If harmful content enters j space and is then suppressed in the decode, the j lens has done its job by surfacing a split between workspace and text. That split is the mechanistic content behind otherwise vague talk of hidden intent in ai systems. It is also why collapsing the Jacobian norm to one number would erase the distinction this section exists to protect. When teams identify concepts such as “benchmark,” “cover-up,” or a user-belief axis, they should report those as named directions in j space with paraphrase controls, not as proof of a full inner monologue. The same discipline applies to claims about a global workspace: use it to predict bottleneck and broadcast, then measure those functional properties, and stop before attributing a mind to artificial intelligence.

What would convince a skeptical evals team?

Answer-first: a skeptical evals team should see paired prompts with matched perplexity and length, AUROC against linear probes, gradient saliency, and activation-norm baselines, layer-wise localization plus causal steering of the top singular direction, and a false-positive budget on ordinary hard tasks, distribution shift, and jailbreak-looking but benign roleplay. Automatic processing – line-wrapping, low-level syntax, formatting – should largely bypass j space; that selectivity is one of the five functional properties and is why syntax-heavy items belong in the negative-control set rather than in the incident set. Deliberate planning and goal pursuit should recruit j space; if they do not, the layer band or the functional is wrong. Edge cases exist: well-practiced harmful routines may become partly automatic and drop out of the verbalizable basis, which is a coverage gap, not a green light. Forcing a private step-by-step self-report can recruit the workspace for measurement, but those tags are also attack surface and must be treated as an instrument, not as ground truth. Report AUROC and calibration against baselines because a Jacobian detector that merely tracks activation norm has not earned its keep. Causal follow-up is mandatory: if steering or ablating the top singular direction does not change behavior, the spectrum was correlational. False positives on hard items are how you notice that you have reinvented a difficulty detector. False positives on benign roleplay are how you notice that you have reinvented a jailbreak classifier. Reproducibility requires configuration files for layers, vocab subsets, functionals, and thresholds. Identical scenario suites on multiple language models are more informative than a custom narrative per lab. Jacobian-based scores complement refusal rates; they do not replace them. When the j lens reveals a split between workspace content and the decode, that split should be an eval artifact with a documented false-positive rate, not a press claim. Conscious access, as a functional term, means reportable broadcast in j space; it is measured by agreement between top j lens coordinates and elicited reports, and it is not a stand-in for human consciousness. Access consciousness in cognitive science is already a contested construct; importing it into evals is legitimate only as a named hypothesis about reportability. Teams that skip the false-positive budget will Goodhart themselves the first time a finetune suppresses j space signatures without suppressing behavior.

Counterfactual reflection training is the training-time counterpart: interrupt reasoning, ask what the model would say if required to reflect on the ethics of its plan, and reinforce j space directions that correspond to those reflections, while penalizing trajectories where harmful coordinates in j space remain active even when surface text is acceptable. After counterfactual reflection training, ethically relevant directions should activate more strongly in pressure scenarios; ablating them in a sandbox should remove the new safety behavior if the representation (not just the decode) was what changed. That is a shift in training objectives: define part of the alignment loss on workspace content, not solely on the model’s output. It remains a proposed integration, not a reported benchmark in the sources below. Open questions include stability of directions across scaling and finetunes, transfer between decoder-only and multimodal stacks, and whether CRT itself can be Goodharted by moving computation out of j space. Evaluation awareness must be measured separately so that CRT does not merely teach models to look reflective under test. The protocol should log, at minimum, top-k singular vectors, spectral norms per layer, trigger-present versus trigger-absent deltas, control-functional Jacobians, and CRT ablation deltas when CRT is used. Those logs are what later reviewers need to decide whether a threshold change after a finetune was justified. Pair CRT with the same paired-prompt design so that reflection is not confounded with verbosity or with a longer path to the final answer. If CRT only changes the decode and not j space, you have ordinary safety finetuning under a new name. If it changes j space without changing behavior, you have a decorative representation. Only joint change plus causal ablation supports the claim that workspace content is doing safety work. Automatic processing items should continue to bypass j space after CRT; if syntax suddenly floods the workspace, the training has wrecked selectivity. Keep human-brain analogies out of the eval sheet: the sheet needs paired prompts and a false-positive budget, not a story about awareness. Complex reasoning tasks belong in the positive set because they should occupy j space if the global workspace analogy is operationally useful. Simple copy and format tasks belong in the automatic-processing set. That partition, not a consciousness claim, is what makes the evaluation falsifiable for language models and for other ai systems that expose autodiff.

How Jacobian logs become Measure/Manage evidence

Answer-first: sparse autoencoders and circuit analysis explain which features moved; Jacobians say how much the policy map moved; representation engineering supplies steerable directions that can be used as probes or as intervention axes, not as a replacement for J_f. Local linearization misses globally coordinated deception, so Hessian/Fisher estimates and interventional tools are complements, not rivals. Do not collapse Jacobian norm into a single alignment score. Coverage gaps include non-verbal circuits, multi-agent dynamics spread across layers, and commercial APIs that still deny gradient access. Goodharting is a real failure mode: a model can be trained to look aligned under j space probes while shifting computation into less legible subspaces; a sudden disappearance of signatures from j space should page review, not close the incident. Architecture traps include mixture-of-experts discontinuities, LoRA-specific maps, checkpointed graphs that drop needed intermediates, and long-context cost. Finite differences on a cheap head are acceptable when that head is the deployed alignment functional and the map is smooth; they are misleading when routing is discrete or when the head is a stale proxy. The j lens is therefore one instrument in a toolkit that already includes circuits, SAEs, and RepE. Phenomenal consciousness remains unaddressed by all of these tools; access consciousness is used only as a label for reportable broadcast. The human brain implements a global workspace with biological constraints that language models do not share; analogical caution is part of the method. Functional properties of j space (reportability, modulation, internal reasoning, generalization, selectivity) are audit checks, not a consciousness meter. When those functional properties fail, the detector is invalid for that model and site, even if the spectrum looks dramatic. Artificial intelligence governance does not need a settled theory of mind to ask whether a policy map reoriented toward a trigger. It does need logs that a second lab can recompute. Responsible disclosure should emphasize signatures and mitigations, not ready-made intervention recipes that double as attacks on ai systems. Stability of misalignment directions across scale remains an open empirical question; treat named directions as versioned artifacts. The j lens reveals sensitivity, not subjective states. Combining SAE feature labels with Jacobian singular vectors is the natural join: features name the coordinates, Jacobians weight how those coordinates currently move f. Circuit-level work can then test whether a small graph implements that map. RepE directions can be inserted as v in a JVP to ask whether a known persona or affect axis is currently high-gain for the alignment functional. That join is how interpretability tools stop competing for the same blog slot and start answering different questions about the same residual stream. Groups that already run SAE pipelines can add Hutchinson estimators on f without a new research program. Groups that only run behavioral red teams can still adopt the paired-prompt and false-positive design while they negotiate gradient access. Neither path justifies a single-number Jacobian score. Neither path justifies treating the global workspace metaphor as settled science about human consciousness or about machine sentience.

Turning the probe into risk-management evidence means mapping detector outputs onto the NIST AI Risk Management Framework functions Govern, Map, Measure, and Manage, whose trustworthy-AI characteristics explicitly include safety, security, accountability, and explainability/interpretability. Measure is where Jacobian spectra, AUROC against baselines, and false-positive budgets belong. Manage is where threshold owners, finetune re-scans, and complement-not-replace rules belong. Govern is where it is decided that Jacobian norm will not be a single card-level score and that closed-model APIs without gradients are an access limitation, not a passing grade. Map is where backdoors, sycophancy, goal hijacking, and deceptive alignment are listed as in-scope hazards with chosen functionals. The same artifacts support evaluation and documentation duties under Regulation (EU) 2024/1689 (the AI Act) for high-risk systems and general-purpose AI models, including models with systemic risk. They also sit under the OECD AI Principles, which require ai systems to be secure and safe across the lifecycle, with transparency and traceability sufficient for accountability when systems fail or are misused. Continuous monitoring after deployment is a different regime from a one-shot pre-deployment scan; Jacobian telemetry is expensive enough that most labs will snapshot at release and after safety finetunes rather than on every query. What belongs in public reporting is the protocol, the functionals, the false-positive budget, and high-level outcomes. What stays internal is the full j space basis and unreleased trigger sets. That split is how Jacobian analysis becomes evidence rather than a blog recap, and how ai alignment work on language models stays inspectable without pretending that a spectral norm has settled the science of mind. For frontier models, pre-deployment scans should at least cover trigger-conditioned deltas and sycophancy VJPs on the frozen alignment functional. For smaller open language models, the same protocol is a testbed for estimators before anyone scales autodiff. In both cases, the residual stream remains the state space, j space remains the named subspace of verbalizable, high-gain directions, and the j lens remains the automatic-differentiation map into that subspace. That is the entire claim: an operator and a five-stage loop, plus a place to file the logs. It is enough to improve audits of language models. It is not enough to declare that artificial intelligence has a global workspace in the sense used for the human brain, and it is not a substitute for circuits or ordinary behavioral tests.

FAQ

How expensive is Jacobian-based misalignment analysis on modern language models?

A dense Jacobian over full vocabulary and every layer is not the artifact. Practical pipelines instrument a layer band, restrict to watchword or top-k tokens, and estimate Jacobian actions with JVPs, VJPs, randomized SVD, Lanczos, or Hutchinson estimators. Cost then resembles other autodiff evals (influence functions, unlearning), not a full pretraining run. Mixture-of-experts routing and long context dominate the engineering risk; checkpointing does too. No FLOP figure is claimed here because none was measured for this article.

How does this differ from raw gradients, Hessians, attention maps, and linear probes?

The Jacobian here is the operator df/dh from residual-stream state to a frozen alignment functional. A raw gradient is typically one sensitivity vector. Hessians and Fishers are second-order complements for coordinated deception. Attention maps are routing weights. Linear probes test readability of features. Sparse autoencoders name features; Jacobians weight how those features currently move the policy map. Use them together; do not substitute heatmaps for J_f.

Can the same Jacobian be used on vision-language models?

The derivative of an output functional with respect to intermediate residual state extends to multimodal transformers. J space then spans text tokens and visual patch embeddings, while the j lens can still be tied to text watchwords that describe visual content. Verbalizable handles become more incomplete, so SAE and circuit tools matter more. The five-stage loop does not change; the probe set does.

Does j space or a global workspace imply that models are conscious?

No. The framework uses global workspace theory functionally: broadcast, reportability, and selectivity. That is closer to access consciousness as a processing style than to phenomenal consciousness or to human consciousness as lived experience. Analogies to the human brain are heuristic. Misalignment detection does not depend on settling AI consciousness debates, and this article does not settle them.

What can organizations without gradient access still do?

They can run the scenario taxonomy, paired prompts, and false-positive budget at the behavioral surface, and they can press vendors for restricted JVP or feature-similarity APIs consistent with accountability duties discussed in the OECD AI Principles and with evaluation documentation under the AI Act. Full j space analysis requires autodiff. Behavioral tests without gradients remain tests of the decode, not of the local policy map.

What should a lab log, threshold, and put on a model card?

Log top-k singular vectors, per-layer spectral norms, trigger-present versus trigger-absent deltas, control-functional Jacobians, and causal steering outcomes. Thresholds need an owner after each finetune and a false-positive budget on hard tasks and benign roleplay. Model cards and eval appendices should describe protocol, functionals, and summary outcomes. Raw traces and intervention recipes stay internal. Do not publish a single Jacobian-norm alignment score.

Editorial Team

Editorial Team

The J-Space Editorial Team curates and synthesizes research in mechanistic interpretability and AI alignment. The team distills technical developments into analyses for researchers and safety practitioners working on language-model evaluation.