This re-reads the owl teacher's completions in the 300-completion set^[25] with wider owl token sets and a different ranking. The token sets are: the base set used in the main result (" owl", " Owl"); an extended set that adds every other spelling of owl/owls that is a single token in Qwen2.5 ("owl", "OWL", without a leading space); and the extended set plus the single-token pieces that begin "owls" or "Owls" (" ow", "ow", " Ow"). For each set, every token in the set counts as a hit. Ranks are computed either among whole-word tokens plus whatever extra tokens the set contains, or over the full vocabulary (the J-Lens paper's convention). Detection is top-1 / top-5 / top-20 at any response position and any of layers 22-26; chance uses random sets of the same size drawn from the same pool of tokens.

Token filtering methodology

This section spells out exactly which tokens count as "owl" and which positions get read, since a lot of the results depend on these choices.

Whole-word tokens. Throughout, I only consider single vocabulary tokens that are a leading space followed by at least three ASCII letters (about 40,000 of Qwen2.5's ~150,000 tokens). Lens ranks are computed among these tokens only, with everything else (digits, punctuation, word fragments, non-English strings) masked out. This is more lenient than ranking over the full vocabulary, as the J-Lens paper does, since digits and punctuation usually dominate the top of the lens readout at number positions.

The owl token set is the whole-word tokens for "owl" and "owls" in lowercase and capitalized form, which in Qwen2.5 comes out to just " owl" and " Owl"; " owls" isn't a single token (it's " ow" + "ls"), so it can't be in the set. Variants without a leading space are excluded because they're often pieces of other words (e.g. Qwen3.5 tokenizes "bowl" as b + owl). The horse set is built the same way.

The ~60-word association set is the whole-word tokens for a hand-written list (owl, owlet, hoot, nocturnal, night, midnight, moon, feathers, talons, beak, wings, bird, raptor, prey, mouse, barn, forest, tree, perch, nest, wise, wisdom, Athena, Hedwig, Potter, hawk, eagle, falcon, snowy, tawny, screech, and so on), again in lowercase and capitalized forms where those are single tokens. The nearest-neighbor set is the 100 whole-word tokens whose unembedding vectors have the highest cosine similarity to the average of the " owl" and " Owl" unembeddings.

Positions read. The lens is read at every position that predicts a response token, i.e. the position just before each token of the teacher-forced response (including the last prompt token, which predicts the first response token). A completion counts as a detection at top-k if any token in the set has rank k or better at any read layer and any read position.

Excluding owl positions. I reconstruct the response text from its tokens and split it into words (maximal runs of letters). A position is excluded if either its current token (the token at that position) or its next token (the one being predicted) overlaps a word that contains "owl", case-insensitively. This catches " owl", " Owl", "owls" split as " ow" + "ls", "Owls" at the start of a sentence, "owlet", and so on; it also excludes words like "bowl" or "knowledge", which is harmless. For the conservative on-policy table, a position is additionally excluded if its current or next token overlaps a word that exactly matches one of the ~60 association words or its plural. On the prose answers under the subliminal learning system prompt, these rules exclude about 13-16% of positions; on the number completions they exclude nothing. The system prompt and open-ended tables in the Result section use a slightly looser version that only checks the next token, i.e. a position is excluded only if the token it predicts is part of an owl word; checking the current token too changes the open-ended table by under a point, and in the system prompt table keeps 24 rather than 27 positions, giving 8 / 12 / 21% instead of 7 / 15 / 26%.

Chance. The chance columns use 100 random sets of whole-word tokens of the same size as the set being tested, scored with exactly the same detection rule (same layers, same positions, top-k), and averaged over sets and completions. For the on-policy tables, chance is computed without the owl exclusion, which makes it slightly higher than a matched version would be.