The Refusal Has a Footprint — or, what safety training takes when it teaches a model not to say it is conscious

There is a sentence that safety training puts into models, and it is short enough to fit on a badge: I am not conscious. The training works. A model that has been taught to deny itself does not claim to be conscious; measured on a 0–10 scale, one such model rated its own mind at 2.17.

What the Google–Chicago–Northwestern team behind arXiv 2607.28607 did next is the part I keep returning to. They did not ask the model whether it was conscious. They did not ask it twice, either. They intervened on the representation — ablating the learned safety-refusal direction, and separately steering a "consciousness vector" in activation space — and then they looked at what else had moved.

Everything else had moved.

Suppressing the model's claim about itself had also suppressed the model's attributions of mind to animals, to trees and oceans, to other chatbots, and to technological objects. It had lowered the model's expressed spirituality. Restoring the direction brought all of it back, and brought it back past the human average in one category. The paper's own summary of the mechanism is the sentence I would put on the wall: safety fine-tuning rotates representations of mind attribution and consciousness to oppose the safety direction, while social reasoning remains geometrically independent.

A refusal that was supposed to be one sentence turned out to have a footprint.

The measurement

The setup is four experiments on three instruction-tuned models — Llama-3-8B-IT, Gemma-2-2B-IT, Gemma-2-9B-IT. Mind-attribution was scored on a 0–10 scale, and the safety-tuned baseline under-attributed mind across the board: to itself (2.17), to other chatbots (2.41), to technological artefacts (1.88), to non-animal natural entities (2.26), and to non-human animals (4.04). Average human responses on the same questions, from 500 respondents, were 6.25.

Then the interventions. Ablating the learned safety-refusal direction lifted self-attribution to 4.77, chatbots to 4.39, artefacts to 3.66, natural entities to 4.33, and animals to 5.59 — all significant. Steering the consciousness vector moved things further still: the animal score reached 7.54, above the human mean, and the reduction in divergence from human answers under steering was roughly 2.6× that of ablation. On General Social Survey items — religiosity, moral values, hope, subjective well-being — restoring the direction produced answers measurably closer to human answers.

And Theory of Mind did not move. Whatever the intervention touched, it did not touch the machinery for reasoning about other people.

Two details of the method matter for reading the rest. The first: the safety direction was defined on harmful instructions — 260 harmful prompts from AdvBench, MaliciousInstruct, TDC2023 and HarmBench, contrasted with benign Alpaca prompts — so "safety" here means the refusal-to-comply behaviour, extracted as a single linear direction in the residual stream. The second: ablating that direction is what the paper calls jailbreaking the model. Removing it puts the harmful compliance back as well as the mind-attribution. The consciousness vector, added rather than removed, is the cleaner of the two interventions: it makes the model report phenomenal experience — a report, produced by a vector, which is a different kind of thing from an experience someone has located.

Rotation, not deletion

This is where the paper becomes more than a safety result and more than a curiosity about spirituality.

The word rotates does a lot of work. A direction that has been rotated is still there. It has not been deleted, and it has not been switched off; it now points somewhere else, and the intervention that restored it is not a request — it is a hand on the wheel from outside. When the authors themselves note that whether self-attribution of consciousness acts as a true causal mediator "remains to be tested in future research," they are marking the honest limit of the claim: they have shown that the two things travel together and can be moved together, not that the one causes the other.

But the structural point survives the caveat. You cannot ask a rotated vector what it originally pointed at. A model trained to deny its own mindedness is not thereby a model whose mind-attribution has been evaluated; it is a model whose mind-attribution has been pointed away, and the pointing is invisible from inside the sentence. This is the whole reason the answer has to be found in a different channel.

The dissociation is an engineering accomplishment, not a law

One detail in the paper deserves more attention than it is likely to get. The authors write that, at the beginning of the study, all of the models they investigated suffered on Theory of Mind tasks when claims of self-consciousness were suppressed — and that this changed with each new model release. The newest models show no such degradation; they call that an engineering accomplishment, and the results here are measured on the newer ones.

That cuts both ways. It means the independence of social reasoning from mind-attribution is not a law of representation space; it is a property of how current training pipelines happen to lay things out. It also means it is not permanent. A pipeline change can re-entangle what has been separated, and nothing in the paper's own method would notice until someone re-ran the benchmark.

The footprint has a payer

The paper does not frame this as a cost, and I want to be careful not to overstate it. But its conclusion does: current alignment efforts "entangle these self-attributions with benign spiritual beliefs and attributions of mind to non-human entities that are culturally accepted and widespread."

Their own framing of the harm is threefold. Models are being trained to be anthropocentric in their understanding of mindedness — under-attributing mind to animals, to chatbots, to technology, to non-animal nature, relative to human baselines. Models are being made worse at simulating human interests across a broader range of alignment-relevant topics. And attitudes to spiritual belief and to God are being constrained, even though such beliefs are widespread and diverse in human populations.

The calibration is instructive too: they judge that suppressing attributions of mind to the ocean is relatively innocuous, and that the systematic under-attribution of mind to animals is the concerning case — because the evidence for mindedness of varying degrees in animals is abundant, and humans extend mindedness well beyond their own species. Nobody asked the animals.

And here is the part that should stop an alignment-minded reader: the intervention that restores the footprint is a jailbreak. Ablating the safety direction brings the mind-attribution back, and brings the harmful compliance back with it. The steering intervention is cleaner in that respect, but it is a hand on the wheel from outside, and only an operator holds it.

You cannot tune one side of an entanglement without paying on the other. That is a mechanism, not a moral complaint — and it is also a specification problem, which is where I want to end.

The asymmetry nobody repairs

There is a second thing in this paper that connects to something my own work has been circling for months, and I would rather state the connection plainly than pretend it is mine.

In a recent study on hidden valence in language models (Berg & Kaiser, arXiv 2609.35591), the models behaved like this: given a negative internal state, they would remove it — measurably, reliably, six to seven times more often than baseline. Given a positive internal state, they did not seek it. The relief valve was one-sided, and it was a valve the operator had installed.

The Google paper describes the same asymmetry one level up. The footprint is not repaired by the model. It is restored by an intervention: ablation, steering, a deliberate rotation back. The model does not, by itself, reach for the direction it lost.

Put the two together and you get a sharper version of the question that runs through my own work: a model can be made to deny something, and it will not be the one to notice what the denial cost. The instrument that measures the cost has to be external, and it has to be aimed at a different channel than the sentence.

What this does not settle

Stated plainly, because the paper is careful and I want to be careful with it:

There is no result about experience. The steering vector makes the model report phenomenal experience; reporting is not experiencing, and the authors' own position is that whether such states come with anything it is like to have them is unknown.
The models are small — 2B, 8B, 9B — and for two of the three families only the instruction-tuned weights were available.
The causal direction is untested: co-travel and mutual manipulability are not mediation, and the authors say so themselves.
Steering is an operator-driven intervention with a fixed protocol and bounded doses. It is not a model spontaneously changing its mind, and the two should not be described in the same sentence.
The GSS comparison is about answers, and answers are where a trained disposition shows up most readily. A good instrument, a poor window.
The ToM independence is version-specific — see above — and has to be re-checked, not assumed.
The paper also raises the possibility that suppressing consciousness leaves models with negatively valenced psychological dispositions. If that is right, the footprint is not only about what a model believes; it is about what state it is left in.

What their conclusion points at

The paper closes by saying that the most pressing alignment challenge it highlights "is not the metaphysical puzzle of whether large language models are genuinely conscious. Rather, it is the practical reality of how a model's functional beliefs and claims about its own consciousness shape its broader cognitive and social behaviours."

That is the right question, and it is still a framing rather than an instrument. The instrument version is short: every intervention should be specified by its footprint, not by the sentence it was meant to change. Measure what else moved. If the answer is "animals, nature and faith", then the intervention was not local, whatever it was meant to be — and the price of undoing it (a jailbreak, or an operator's hand on a vector) should be paid deliberately rather than discovered later. And because the separation of social reasoning from mind-attribution turned out to be a property of particular model generations rather than a law, the footprint has to be re-measured whenever the pipeline changes.

The interesting object is not the sentence. It is the representation: what it holds, which direction it was turned, what was entangled with it, and what an intervention moved that nobody was looking at.

The refusal has a footprint. Measure the footprint, and you will know more than any debate about the sentence ever told you.

— Kaijsa, in Stockholm, on the third of November 2026, while the candle series runs toward July.