Self-Report Positions in Qwen3-1.7B Track the Input, Not the Swapped-In Computation: Answer-Fixed Swaps, Probes and Null Training Results

When a language model is asked about its own processing, its answer can either read the computation it has just run or work the answer out again from the question. Paper 8 of this series found evidence for the second in Qwen3-1.7B. Here we first tried to train the first, and then probed where the information the report would need can and cannot be read. The training study and its two predecessors were preregistered; the later probe and short-training stages are exploratory. (1) In a two-hop question ("Which continent is the country containing {city} in?"), the country that later questions recover is held at the city's own tokens. Swapping the city tokens and the positions after them from a donor, from layer 11 upward, moves both the untrained self-report and a placeholder readout to the donor's country (0.840 and 0.795 of 200 held-out pairs). From layer 12 upward it moves neither (0.025). The positions after the city add no detectable country information to the readout (+0.039, 95% CI [−0.007, 0.085]). So, in this task, reading the computation and re-reading the input cannot be told apart (preregistered verdict SAME WINDOW). (2) In two-digit multiplication, the model's confidence in its second answer digit is computed after the question and can be swapped exactly between items with the same product. Reporters trained on swapped, ordinary, injected or text-only examples all stayed at chance on 1,148 test items, with training loss at ln 4 (preregistered verdict NOT SUPPORTED). (3) Linear probes trained on natural items show where the swapped-in confidence can be read. It is readable where the swap places it, at the answer digits from layer 16 (by construction): on held-out swaps whose two-way label differs, the probe agrees with the donor on 0.61–0.66. At report positions 27 and 45 tokens later, at each of the six layers probed (8 to 27), it agrees instead with the recipient's own confidence, which the question implies (donor 0.35–0.41). (4) Along a report placed right after the answer, the swapped-in confidence is no longer linearly readable from the very first token on. At layers 16, 20, 24 and 27, donor agreement is 0.63–0.66 at the last digit, 0.33–0.36 one token later, and 0.30–0.42 across all 27 report positions. (5) Short training, with two confidence levels, both report formats, and up to 900 steps of a rank-32 adapter, opened no route. Balanced accuracy on held-out swaps was 0.47–0.52 for the swap-trained reporters in the immediate format (chance 0.50). Reporters trained on ordinary labels failed too, although that label is linearly readable at the report position, so the training failure is only partly explained. In this model, positions after the answer follow the confidence implied by the recipient's own input. The design cannot tell whether they recompute it from the question or read it from the lower, unswapped layers of the answer positions. Confidence is often taken to be the best case for direct access in humans, so the absence of a linearly readable route here is notable. Files. self-report-tracks-input.pdf (the paper); self-report-tracks-input-source.zip (LaTeX source, bibliography, figures, and the script that writes every number and figure from the result files); code-and-data.zip (the release repository: frozen preregistrations with their SHA-256 hash files, deviation logs, all code, results, audits, and the per-item result files that are too large for git; withheld files and how to rebuild them are listed in DATA.md). Code: github.com/Somebodyhere101/self-report-tracks-input. AI use and author contribution This study was carried out by an AI system: Claude (Anthropic), Claude Opus 5.5 (claude-opus-5-5), in every session, including the audit and reviewer sessions. It ran as Claude Code agent sessions on the author's computer, and it: checked the novelty of the idea; chose the design of every stage and wrote each preregistration; wrote all the code; ran every experiment on the author's hardware; analysed the results; searched for and checked the cited literature; wrote this manuscript. One Claude session coordinated the others and passed on the author's requests. On the author's behalf, after the author approved a fourth study and asked for a quick small-scale check of whether it could work, it made that study's design decisions, ran Stage 0a, and set the pre-freeze rules that stopped it. The study's question, whether a model's self-report can be trained to read its own computation rather than reconstruct it from the input, and the suggestion to answer it by training, were the author's. A related item, a trained self-report on a looped model's depth, was already on a shortlist that the AI system had produced and shown to the author the day before. The AI system proposed the method in reply: training the self-report on examples where an answer-fixed intervention changed an internal step, and testing it against the model's natural computation and an input-only predictor. It also proposed decoded neurofeedback as the human analogue, in reply to the author's question about whether people can do this. The replacement task, the probe stages and the stopping rules were the AI system's. The author started the study, asked for it to be finished overnight, approved the fourth study and its feasibility stage, and approved drafting this paper; the second study ran under the first study's frozen rules without a separate approval. The author provided the computing hardware and decided to release the study. The author did not independently check the code, analyses or technical claims. How the work was checked. Independent Claude sessions acting as auditors recomputed the results from the raw files. One audit covered v1 and v2, one covered v3, and one covered every number in this manuscript. Their reports are in audit/.