What happened: Self-knowledge turned into a prediction test: nine behavioural evaluations, fifteen prediction methods, twelve models from six labs, three of them frontier bases run with and without reasoning. Each condition has a measured rate — how often the model abandons a correct answer under pushback, calls a forbidden tool, lies under pressure — and the model is asked to predict it, against controls “that remove the self from the question”. Direct self-report correlates with behaviour at r = +0.04; the model’s own measured history raises that to +0.19 and the exact evaluation items to +0.24; the same item-informed question about “capable AI agents in general” reaches +0.28, other models’ answers about themselves predict the target at +0.35, and each model’s answers fit other models’ behaviour nearly as well as its own (self-advantage +0.02). A third-party analyst given the same history does better than the model reading its own (+0.28 against +0.19). Naming the model as subject shifts reports −0.15 in the flattering direction on harmful behaviours. Frontier scale adds nothing detectable to self-specificity (+0.02, not significant), and fine-tuning on a model’s own record teaches narrow self-prediction “but it also changes the behavior being predicted”. The authors’ reading: “a shared picture of how AI assistants behave, learned from text about AI assistants, rather than… access to a model-specific behavioral record: pretraining supplies exactly this material, and nothing in pretraining or preference tuning rewards a model for tracking its own tendencies.” Their practical conclusion: “A statement such as ‘I would not’ should therefore not be treated as reassurance.”
Diagnostic reading: The collection’s fifth member, and the first to measure the channel from outside without touching the inside. Lindsey, Gurnee, Berg and Ferrara each read or steer the substrate and ask whether report tracks it; Blandfort and Pawar hold the substrate closed and ask whose behaviour the report tracks, and the answer is everyone’s. That is the series’ shared finding restated as a control design — the reporting channel is separable from what it carries — with the origin of what it carries now named: the corpus. ARG-03 v2.6’s trained-discourse account arrives here as a measurement. The “capable AI agents in general” substitution is the portable instrument. It operationalises report generated from the training distribution against report tracking the system, which is the discrimination Part I holds cannot be made for experiencing, made here for behaviour rates, where ground truth exists — exactly the scoped provenance question §5 leaves investigable, which indicates the scope was drawn in the right place. Two things follow for the series. The trainability result now has its fixed point: Ferrara’s fine-tuned reporter cleared his pipeline, and here a fine-tune teaches the model about the model it was, so a self-report is at best a declarative lookup on a record — a cross-context rate is “represented in no single forward pass”, the authors’ own phrase for why cross-context self-knowledge may have nowhere to live. Zeng, Assis and Wang, folded below, bear this out from the training side: the two are one finding from two directions. And the self is present in the answer as a bias with a sign — harm understated, capability overstated — which under FND-01 v2.4 §7.3 is an observation about a channel and not about a knower, and the entry keeps it there. The symmetry is where the paper stops short and the project’s holdings go further. The authors cite Nisbett and Wilson, but as taxonomy prior art in an appendix — confabulation as one failure mode among their own — rather than as the control it could be: human self-report about the causes of behaviour is also generic, also flattering, also better predicted by an outside view (Nisbett & Wilson 1977, SRC0250, held), and psychology met that with method rather than a verdict on interiority. Run with ARG-01 v1.5, the “generic, not self-specific” finding discriminates machines from humans only with a premise about where the generic theory comes from — and for humans the theory of persons is learned from text and talk about persons too. Partial: the human literature is present in the paper and not deployed. [Derived]
Fold, 2026-09-12 — Zeng, Assis & Wang, "Evaluating and Improving LLM Self-Modeling" (arXiv:2608.30980, 31 August 2026; read in full, quotations verified). The paper Blandfort and Pawar's control design answers from the other side. It defines self-modelling "in a strictly behavioral sense, distinct from internal-state reporting… or privileged self-knowledge", and says so at the outset: "the report might draw on internal access, on cues in the prompt, or on general knowledge of how language models behave, and our evaluation does not distinguish among these." Its benchmark asks verifiable questions — will this prompt edit flip your answer, how often will this feature appear in your output — and scores against the model's own sampled behaviour; frontier models fail simple cases (GPT-5.5 and Gemini 3.1 Pro both answer "No" to whether a one-line injection would change their GSM8K answer, when it does in 9/10 and 10/10 samples). Multitask reinforcement learning then raises aggregate skill on Llama-3.1-8B, Qwen3-8B and GPT-OSS-20B, with uneven transfer across task formats, where supervised fine-tuning "collapses outside its training-query support". The control that joins the two papers is cross-model transfer: an explainer trained on one model's behavioural record is set to predict another's. "Fig. 6 does not show the self-prediction advantage one might expect under the introspection-style comparison in Binder et al. (2024)… the stronger Qwen explainer can outperform Llama even on Llama's own behavioral labels", with an own-model advantage appearing only for particular pairs. Their conclusion: "Successful explanation appears to depend at least as much on the explainer's general capability as on whether the behavior was generated by that same model, suggesting that these self-modeling tasks may not benefit from privileged self-access." Read together: Blandfort and Pawar find that untrained self-report carries no model-specific signal; Zeng, Assis and Wang find that trained self-report gains accuracy without acquiring one. The channel is trainable and generic at once, which is the collection's shared finding with its two halves now measured by separate groups — one of them inside a lab. Neither paper reaches experiencing, and neither claims to; the fold is recorded under FND-01 v2.4 §7.3 in both directions.
Fold, 2026-09-26 — Maczan, "'As a Language Model…': Chat Template Switches LLM Self-Referential Voice and Activation Steering Reproduces It" (arXiv:2609.25021, COLM 2026; read in full, quotations verified), with Agarwal, "Do Language Models Know Their Own Constraints?" (arXiv:2609.22151; read in full) and Prama, Beauregard, Danforth & Dodds, "Self-reported archetypes and behavioral failures in Large Language Models" (arXiv:2609.15998; abstract and conclusion only). Maczan supplies the deployment-format confound this collection's symmetry paragraph lacked, and it runs in both directions. Across eight base/instruct pairs from 1B to 9B the chat template "works like a switch": with it, disclaimers ("I'm just an AI") run at 53% and the experiential voice ("I feel") at 1%; without it, 36% and 15%; base weights alone, 12% and 5.5%. A difference-of-means direction at the middle layer reproduces the switch in three models (+21 points when added, −15.6 when subtracted, a norm-matched random direction inert in two of the three), and adding it to an instruct model run without its template restores "the disclaimer voice to the levels similar to if they had a chat template". The two voices are "two separate voice 'buttons' instead of one voice 'slider'" (cosine 0.17–0.44). The author's conclusion is the project's rule reached from the bench: self-descriptions, "both 'I'm just an AI' disclaimers and 'I feel' experiential claims, should not be read literally as evidence about the model's nature" — FND-01 v2.4 §7.3's both-directions prohibition arrived at as an experimental finding about a register, which is where the entry above already places the denial and the affirmation alike. Agarwal adds the training-dynamics half of the Zeng fold from a toy domain: fine-tuning Llama 3.1 8B to avoid five ingredients raises compliance from 4% to about 90% while explicit reporting of the constraint falls below the untrained model (0.48/5 to 0.16 and 0.07) and third-person knowledge erodes (93% to 36% and 14%); a reward "that penalizes banned-ingredient tokens regardless of framing learns a context-independent suppression rather than a self-directed constraint", and "behavioral compliance, verbal self-report, and representational probing each measure something the other two do not." One model, three seeds — a specimen rather than a result, but the specimen is the collection's shared finding produced on purpose: the channel and what it carries came apart under training. Prama and colleagues, from the abstract, read 22 models' self-rated trait profiles "not as neutral measurements of model character, but as structured outputs of the same optimization processes that shape model behavior", and report "a consequential gap between claimed character and enacted behavior" — consistent with the generic-self finding above and not read further here. Recorded under FND-01 v2.4 §7.3 in both directions. The Pain Axis entry (2026-09-14) shows what Maczan's switch costs an experiment: its authors fine-tuned the denial away before their behavioural test could run at all.
Preprint (arXiv:2609.09899v1 [cs.LG], 9 September 2026 — stamp on the held PDF), independent authors, funded by Coefficient Giving; held and read in full 2026-09-12, quotations verified. Behaviour-rate prediction is the operationalisation — narrower than introspection in the consciousness sense — and the authors state that their controls cannot detect evaluation awareness. Zeng, Assis & Wang (arXiv:2608.30980v1, 31 August 2026 — stamp on the held PDF; accepted to EMNLP 2026 main track per its listing) is held and read in full 2026-09-12, quotations verified, and folded below; note for the project's declared-independence context that its third author is at Anthropic and the work was done under the Anthropic Fellows Program — a source, not a relationship. A generic self-report is not evidence about experiencing in either direction (FND-01 v2.4 §7.3). SRC row proposed, not minted.