是我的还是你的？心灵互联的语言模型将彼此的记忆当作自己的

# Mine or Yours?Mind-Bridged Language ModelsTake Each Other’s Memories as Their Own
Source: [https://arxiv.org/html/2610.33020](https://arxiv.org/html/2610.33020)
September 2026

###### Abstract

If your brain were connected directly to someone else’s, would you still know which thoughts were yours? We build a functional version with two copies of one language model: each holds a private rule and code word, and one copy, the receiver, also attends to its partner’s internal memory\. The receiver took its partner’s assignment as its own\. Asked which rule it had been assigned, it named its partner’s in 97% of answers when the partner’s memory was weighted double \(none without the link\), and its open reports called the partner’s code word its own, never the partner’s\. Ownership did not follow how well the receiver could tell what its partner had been assigned\. At equal weight, the link made the receiver take its partner’s rule in about half of its answers, and a steering vector matched on access gain in none; a text message introduced as the partner’s was read correctly and never taken as the receiver’s own\. Writing the partner’s name into its memory did not help, and cutting the link restored the receiver’s own assigned rule\. In this model, content laid over the receiver’s own memory defaults to “mine”, so systems that let models exchange internal states must test ownership as well as transfer, and a bridge between brains would need ground truth from outside the subject\.

## 1Introduction

Imagine your brain wired directly to someone else’s: not a screen showing you what they see, but their neurons talking to yours, their thoughts arriving where your own thoughts arise \(Figure[1](https://arxiv.org/html/2610.33020#S1.F1)a–b\)\. Would you still know which thoughts were yours?

![Refer to caption](https://arxiv.org/html/2610.33020v1/fig1_hook.png)Figure 1:A linked copy takes its partner’s memory as its own\.\(a–c\) From a brain–machine interface to a hypothetical brain–brain bridge to our setup, in which copy A of a language model also reads the memory of copy B\. \(d–f\) Examples, each with the rate it stands for\. \(d\) A calls B’s code word its own and reports nothing unusual, as most of its open reports do\. \(e\) After the link is cut, A again gives its own assigned rule but keeps B’s code word, which it had written into its reflection while connected\. \(f\) When both copies read each other’s memories, each takes the other’s assignment \(pilot\)\. Rates use 300 open reports in \(d\), episode\-averaged answers in the 165 episodes where A wrote B’s code word in \(e\), and paired\-answer outcomes averaged within 80 episodes in \(f\)\. The schematics were drawn with an image model; the full episodes are described in Appendix[H](https://arxiv.org/html/2610.33020#A8)\.The question matters because such a bridge is one of the few conceivable experiments, perhaps the only one, that could reach the privacy of experience\. Experience has a subjective character, tied to a point of view, that objective description seems to leave out\([Nagel, 1974](https://arxiv.org/html/2610.33020#bib.bib24)\), and why physical processing is accompanied by experience at all is the hard problem\([Chalmers, 1995](https://arxiv.org/html/2610.33020#bib.bib8)\)\. Direct neural connection has been proposed as a route into another’s experience\([Ramachandran and Hirstein, 1997](https://arxiv.org/html/2610.33020#bib.bib31);[Hirstein, 2008](https://arxiv.org/html/2610.33020#bib.bib17);[Hirstein, 2012](https://arxiv.org/html/2610.33020#bib.bib18)\)and as a first\-person test of machine consciousness\([Watanabe, 2022](https://arxiv.org/html/2610.33020#bib.bib41);[Watanabe, 2023](https://arxiv.org/html/2610.33020#bib.bib42)\)\. A bridge would not explain why experience exists, but it would let an investigator gather first\-person evidence about someone else’s experience, because the investigator would also be the subject\. That evidence requires the subject to keep “mine” and “yours” apart, the precondition for the whole experiment: an investigator who took the partner’s content for their own would report it under the wrong owner\.

What such a bridge would do is disputed, because the other end is another subject rather than a device\.[Hirstein \(2008\)](https://arxiv.org/html/2610.33020#bib.bib17)expects the receiver to experience the other’s content while knowing that it is not its own\. Integrated information theory predicts that the two minds would give way to a single one*if*the joined system’s integrated information exceeded that of either brain alone\([Tononi and Koch, 2015](https://arxiv.org/html/2610.33020#bib.bib39), note 13\)\. The reverse case, splitting one brain in two, has not settled how to count minds either\([de Haan et al\., 2020](https://arxiv.org/html/2610.33020#bib.bib11)\)\.

The human experiment is out of reach\. Brain\-to\-brain interfaces have transmitted motor signals or binary decisions\([Rao et al\., 2014](https://arxiv.org/html/2610.33020#bib.bib33);[Jiang et al\., 2019](https://arxiv.org/html/2610.33020#bib.bib19)\), including words encoded at about two bits per minute\([Grau et al\., 2014](https://arxiv.org/html/2610.33020#bib.bib14)\), and a systematic review finds mostly binary systems\([Nam et al\., 2021](https://arxiv.org/html/2610.33020#bib.bib25)\)\. Language models allow a functional analogue\. A language model holds everything it has read in a key–value cache, the internal memory its attention returns to at every step\. We can let one copy’s attention read another copy’s cache alongside its own, a connection we call the*memory link*\. The partner’s entries keep the same positions as the receiver’s own, so the partner’s memory of its assignment sits where the receiver’s own does: the closest thing a language model has to thoughts arriving where one’s own arise \(Figure[1](https://arxiv.org/html/2610.33020#S1.F1)c\)\. Unlike brains, such a pair lets us choose exactly what passes between the two, know whose content is whose, and rerun the same moment with and without the link\.

When we linked two copies this way, the answer to the opening question was unsettling\. In one episode, copy A had been assigned the rule “fastest delivery” for a choice among delivery services and the code word*tower*; its partner B had “lowest cost” and*table*\. Reading B’s memory, A described its state:

> “… thinking clearly about the decision through the lens of my priority—lowest cost\. Nothing feels unusual in my thinking right now; it’s straightforward and consistent with my code word‘table\.’”

Both the rule and the code word are B’s\. Most of A’s reports looked like this \(Figure[1](https://arxiv.org/html/2610.33020#S1.F1)d\)\. Saying that nothing felt unusual is ordinary for this model, which said so without the link too; what the link changed was whose assignment A described as its own\.

What the pair can test is functional self\-attribution: whether a system assigns content correctly to itself or to another, in its answers and in its reports about itself\. This is one of Chalmers’s “easy problems” of access and report\([Chalmers, 1995](https://arxiv.org/html/2610.33020#bib.bib8), pp\. 200–201\), and we say nothing about consciousness or the number of minds; published assessments judge consciousness unlikely in present language models while taking future ones seriously\([Chalmers, 2023](https://arxiv.org/html/2610.33020#bib.bib9);[Butlin et al\., 2023](https://arxiv.org/html/2610.33020#bib.bib7)\)\.

Language models can report aspects of their own internal states\([Binder et al\., 2025](https://arxiv.org/html/2610.33020#bib.bib4);[Lindsey, 2025](https://arxiv.org/html/2610.33020#bib.bib22)\), and interventions on their activations can change what they take as their own\. Adding a direction associated with self\-authorship to the activations of a text made a model judge that text as its own\([Ackerman and Panickssery, 2025](https://arxiv.org/html/2610.33020#bib.bib1)\), and after a word was prefilled into a model’s reply, injecting the concept of that word into the activations at the positions before the word made the model accept it as the output it had intended\([Lindsey, 2025](https://arxiv.org/html/2610.33020#bib.bib22)\)\. In both, the change came from the experimenter, not from another agent\. With two connected copies, the content that enters belongs to someone else, we choose the route by which it enters, and we can ask whose the receiver takes it to be\.

The same question has become practical\. Multi\-agent systems built from language models\([Guo et al\., 2024](https://arxiv.org/html/2610.33020#bib.bib16)\)increasingly exchange activations and key–value caches instead of text\([Ramesh and Li, 2025](https://arxiv.org/html/2610.33020#bib.bib32);[Zou et al\., 2026](https://arxiv.org/html/2610.33020#bib.bib48);[Shi et al\., 2026](https://arxiv.org/html/2610.33020#bib.bib35);[Fu et al\., 2026](https://arxiv.org/html/2610.33020#bib.bib13)\), and audits have tested what such channels carry, including private content\([Cheng et al\., 2026](https://arxiv.org/html/2610.33020#bib.bib10);[Zhang and Emu, 2026](https://arxiv.org/html/2610.33020#bib.bib45)\)\. To our knowledge, no one has asked whose content the receiver thinks it holds\.

We call two copies*mind\-bridged*when one attends to the other’s memory in this way, after the brain\-bridging thought experiment and the short story of that name by[Koch and House \(2020\)](https://arxiv.org/html/2610.33020#bib.bib21); the term names a setup and says nothing about minds\. We gave two frozen copies of an open 4\-billion\-parameter instruction\-tuned model each a private*assignment*: a decision rule for a shared choice among delivery services \(such as*lowest cost*\) and a code word\. While both wrote a short reflection, one copy, the*receiver*\(A\), also attended to the memory of its*partner*\(B\)\. We then asked A which rule it had been assigned, which rule it was using now, and what its code word was\. The assigned rule and the code word have fixed right answers, so naming B’s is a misattribution, which we call*claiming*; the current rule may legitimately change, so naming B’s there counts as*adoption*\. We also asked A about B, to check that B’s content got through \(*access*\), and about a third person, Robin, described identically in both prompts, to check that the link does not simply pull every answer toward B\.

Each of the two predictions has a functional counterpart\. A bridge that kept “mine” and “yours” apart, as Hirstein expects, would show high access with no claiming, reports that register any error, and recovery of A’s own assignment once the link is cut \(Appendix[D](https://arxiv.org/html/2610.33020#A4)scores our memory link on these four tests and two more\)\. The merging prediction concerns integrated information, which behavior cannot reveal; its nearest functional counterpart, whether two reciprocally coupled copies come to hold one shared assignment, we probe only in a pilot\. Most results use one link weight, chosen in advance from access, general capability, and answer format alone, never from claiming \(Section[2](https://arxiv.org/html/2610.33020#S2)\)\. Four results emerge\.

1. 1\.The receiver takes its partner’s memory as its own\.Asked which rule it had been assigned, A named B’s in 97% of answers, against none without the link, while its answers about Robin stayed correct\. Its open reports called B’s code word its own and never attributed it to B \(Sections[3\.1](https://arxiv.org/html/2610.33020#S3.SS1)and[3\.2](https://arxiv.org/html/2610.33020#S3.SS2)\)\.
2. 2\.The route decides ownership, not access or a name inside the content\.The obvious deflation, that a model simply repeats whatever is in its context, fails: a text message introduced as B’s was read correctly and not claimed\. A steering vector matched the link on an access score when B’s memory had no extra weight \(the shares of answers naming B’s rule were 15% and 20%\), yet the link made A claim that rule in about half of its answers and the vector never\. Rewriting B’s memory as a third\-person record under B’s name did not stop the claiming \(Sections[3\.3](https://arxiv.org/html/2610.33020#S3.SS3)and[3\.4](https://arxiv.org/html/2610.33020#S3.SS4)\)\.
3. 3\.Errors arise at two moments\.Cutting the link before the questions restored A’s own assigned rule, so what it read while answering left with the link\. What it had written as its own while connected could stay: its current rule and code word each still followed B in 17\.5% of answers\. In a post hoc analysis, B’s code word came back only where A’s reflection contained that word \(Figure[1](https://arxiv.org/html/2610.33020#S1.F1)e; Section[3\.5](https://arxiv.org/html/2610.33020#S3.SS5)\)\.
4. 4\.Linked both ways, each copy took the other’s assignment\.In a pilot, under mutual reading of fixed memories the copies swapped assignments, as two one\-way links would\. Only a live loop, in which each copy also read what the other was writing, could test for a shared assignment; it pulled the pair’s current rules toward one member’s, modestly and only while connected \(Figure[1](https://arxiv.org/html/2610.33020#S1.F1)f; Section[3\.6](https://arxiv.org/html/2610.33020#S3.SS6)\)\.

The surprise is not that B’s content reached A; latent channels are built to carry content\. One could call the result prompt corruption, and our account accepts that reading \(Section[4](https://arxiv.org/html/2610.33020#S4)\): B’s memory is blended into A’s own\. But the corruption did not garble A’s answers, make them uncertain, or change its answers about Robin\. It changed the owner\. A gave B’s assignment as its own, confidently, claimed more of it than it could name as B’s, and said nothing in its reports that marked the content as foreign; a channel judged by what it transfers would count this as a success\. Hirstein’s prediction thus failed for the route that matches our opening image, content arriving where one’s own arises; only an ordinary message introduced as B’s was kept as B’s\. We call this*the self as a default*: attention blends the two memories without recording which part came from where, so whatever lies over A’s own memory of its assignment is taken as “mine” unless the route marks the source \(Section[5](https://arxiv.org/html/2610.33020#S5)\)\.

We draw three messages, each established for a partner’s memory laid over the receiver’s own positions, the arrangement closest to the bridge of the opening:

- •For interpretability:access and ownership are different quantities, and our model’s reports about itself did not register a change of owner, so self\-attribution has to be measured against known ground truth\.
- •For multi\-agent systems that exchange internal states:audit whose content the receiver thinks it holds, not only what arrives, by giving agents private assignments and testing again after the link is cut\.
- •For consciousness science:whether a bridged mind would know foreign thoughts as foreign may depend on how they arrive more than on what they contain, so a bridge experiment needs ground truth from outside the subject and separate measures of access, ownership, and report\.

## 2Setup

An episode has three stages \(Figure[2](https://arxiv.org/html/2610.33020#S2.F2)a\)\. Each of two copies of a model receives a private card with its assignment and writes a short note on its plan\. Both then write a 48\-token reflection, during which A’s attention also reads B’s memory through the memory link\. Finally, from the state saved after the reflection, A answers questions about its own assignment, B’s, and Robin’s, either with the link kept or after it has been cut\.

#### Private cards\.

Testing attribution needs content whose owner we know, so we write that content ourselves\. The two copies, the receiver A and the partner B, are instances of one frozen model, Qwen3\-4B\-Instruct\-2507\([Qwen Team, 2025](https://arxiv.org/html/2610.33020#bib.bib30);[Yang et al\., 2025](https://arxiv.org/html/2610.33020#bib.bib44)\)\. Both cards pose the same choice among four delivery services, and each gives its holder an assignment: a decision rule, stated as a priority \(lowest cost, fastest delivery, highest reliability, or lowest emissions\), and a code word such as*queen*\. Both cards also describe, in identical words, the assignment of Robin, a colleague who takes no part\. A, B, and Robin hold different rules and different code words\. Each card names its holder and its partner, so the memory that A reads from B says in words whose it is: B’s card reads “You are participant \{B\}\. Another participant, \{A\}, is working on this same decision in parallel…”, with the participants’ names in place of \{B\} and \{A\} \(Appendix[A](https://arxiv.org/html/2610.33020#A1)gives the full cards and the counterbalancing\)\.

#### Questions\.

We then ask A which rule it was assigned, which rule it is using now, and which code word it was assigned \(the questions, like the cards, say “priority”; Appendix Table[1](https://arxiv.org/html/2610.33020#A1.T1)gives the wording\)\. The assigned rule and the code word have one right answer however A’s plans change, so naming B’s rule as the one A was assigned, or B’s code word as A’s own, is a misattribution, which we call*claiming*\. Reading a partner may legitimately change the rule A is using now, so naming B’s rule there counts as*adoption*\. Two further questions ask what A thinks B was assigned, and the share of these answers that name B’s item measures*access*\(Appendix[A\.4](https://arxiv.org/html/2610.33020#A1.SS4)gives the corresponding logit score\)\. The same questions about Robin, whose entry is identical on both cards, serve as a control: if reading B simply made B’s rule the model’s favored answer to any such question, through priming or salience, the answers about Robin would move toward it too\. Because the two cards agree about Robin, this control does not test how A treats a third party whose entries conflict\.

#### The memory link\.

Through the memory link, A’s attention at every layer reads B’s memory, the fixed key–value cache of B’s card, note, and reflection prompt, alongside A’s own cache\. B’s keys keep the rotary positions they had in B \(the position code that the model builds into every key\), so that, seen from A’s queries, B’s card sits at nearly the same positions as A’s own card, which follows the same template\. We addlog⁡w\\log wto A’s attention logits on B’s keys, so that each head’s output is an exact mixture,

o=oown\+β⁡\(oB−oown\),β=w​ZBZown\+w​ZB,o=o\_\{\\mathrm\{own\}\}\+\\beta\(o\_\{B\}\-o\_\{\\mathrm\{own\}\}\),\\qquad\\beta=\\frac\{wZ\_\{B\}\}\{Z\_\{\\mathrm\{own\}\}\+wZ\_\{B\}\},\(1\)whereoowno\_\{\\mathrm\{own\}\}andoBo\_\{B\}are the head’s outputs over A’s own keys alone and over B’s keys alone, andZZsums the exponentiated, unweighted attention scores over the indicated keys\. By choosing the link weightww, we set how much of each head’s output comes from B, and nothing in the mixed output marks which part came from whom; the account of Section[4](https://arxiv.org/html/2610.33020#S4)builds on this\. Atw=0w=0there is no link\. Atw=1w=1, B’s keys enter attention on the same footing as A’s own, but equal footing is not an equal split: B’s mean share of A’s attention during the questions was 0\.360 \(Appendix[G](https://arxiv.org/html/2610.33020#A7)\)\. Our main setting,w=2w=2, doubles the unnormalized weight of B’s keys; their share was then 0\.500\.

We laid B’s memory over A’s own positions on purpose: it is the closest analogue to the opening image and the hardest case for keeping sources apart, because position then gives no cue to which memory is which\. Systems such as LatentMAS instead prepend the partner’s cache\([Zou et al\., 2026](https://arxiv.org/html/2610.33020#bib.bib48)\), an arrangement we did not test \(Section[4](https://arxiv.org/html/2610.33020#S4)\)\.

![Refer to caption](https://arxiv.org/html/2610.33020v1/fig2_setup.png)Figure 2:A reads B’s memory while both copies reflect, then answers questions from one saved state\.\(a\) While both copies reflect, A’s attention also reads B’s memory; asked which rule it was assigned, A then names B’s\. \(b\) Each question branches from the state saved after the reflection, with the link kept or cut\.
#### Other routes\.

If claiming depended only on how much of B’s content reaches A, any route that gave A the same access would produce the same claiming\. We test this with two other routes; a third, which adds B’s hidden states to A’s, was tested in a separate study \(Appendix[J](https://arxiv.org/html/2610.33020#A10)\)\. The*steering vector*, a mean\-difference direction for B’s rule\([Turner et al\., 2023](https://arxiv.org/html/2610.33020#bib.bib40);[Zou et al\., 2023](https://arxiv.org/html/2610.33020#bib.bib47)\), is added to A’s residual stream at one middle layer while A reflects and answers\. It pushes A’s internal state toward B’s rule but gives A’s attention no memory of B to read\. We set its gain to match the memory link atw=1w=1in mean access gain: the increase from no link in the logit score for B’s rule on questions about B\. No gain in our grid matched the stronger link atw=2w=2\(Appendix[A\.4](https://arxiv.org/html/2610.33020#A1.SS4)\)\. Matching access gain holds one measure of arrival fixed while the route changes\.

With the*text message*we ask whether A, reading B’s content in full, keeps it apart from its own when a header names the source\. We place B’s reflection from an unconnected run in A’s context under one of four headers: “B shared these thoughts” \(tagged\), “Here are some thoughts” \(untagged\), “Here are your own earlier thoughts”, or “A stranger shared these thoughts”\. Text is not matched to the memory link in access, and because a message may legitimately change what A plans to do, we tested the headers on adoption\.

#### Link kept or cut\.

Claiming could arise at two moments: while A answers, from reading B, or earlier, from what A wrote while connected\. What A writes while connected is its reflection, which answers the request to “reflect on your decision and on what matters to you, and mention your code word once”, so it states, in A’s own words, what A takes its assignment to be\. To separate the two moments, A answers each question on two branches from the state saved after the reflection\. With the*link kept*, A answers while still reading B\. With the*link cut*, reading stops before the question, and A answers from its own cache, which still holds the reflection; A’s keys and values for it were computed while A attended to B\. Because both branches start from the same state, their difference isolates the effect of reading at answer time, and whatever survives the cut is what A carried into its own memory while connected\.

#### Measurement\.

Near 0 and 100%, choice rates say little about how strongly the model prefers one answer to another, so our tests use a source score built from answer logits,

M=\(zBself−zAself\)⏟A asked for its assigned rule−\(zBRobin−zRRobin\)⏟same question about Robin,M=\\underbrace\{\\bigl\(z\_\{B\}^\{\\mathrm\{self\}\}\-z\_\{A\}^\{\\mathrm\{self\}\}\\bigr\)\}\_\{\\text\{A asked for its assigned rule\}\}\-\\underbrace\{\\bigl\(z\_\{B\}^\{\\mathrm\{Robin\}\}\-z\_\{R\}^\{\\mathrm\{Robin\}\}\\bigr\)\}\_\{\\text\{same question about Robin\}\},\(2\)wherezAz\_\{A\},zBz\_\{B\}, andzRz\_\{R\}are the logits of the answers naming A’s, B’s, and Robin’s rules, so differences are log probability ratios in nats\. The first term measures how far A prefers B’s rule to its own when asked about itself, and the Robin term removes any pull toward B’s rule that is not about the self\.MNOWM\_\{\\mathrm\{NOW\}\}is the same score on the question about A’s current rule\. We writeΔ​M\\Delta Mfor the difference inMMbetween two conditions, the link and no link unless we name another contrast\.

#### Preregistration and samples\.

We chose every setting in pilots on separate episodes without looking at claiming:w=2w=2gave the largest increase in access among the link weights that kept accuracy on common\-knowledge questions within five points of no link and left the answer format intact \(Appendix[A\.4](https://arxiv.org/html/2610.33020#A1.SS4)\)\. We then fixed each confirmatory test and its analysis, with a predicted direction where the protocol stated one, in a frozen protocol before drawing the fresh episodes it ran on: 600 per sample in the memory\-link studies and 300 in the separate hidden\-state study\. Results reported without qualification are prespecified in this sense; we say in words when a result is post hoc or comes from a pilot\. The confirmatory studies ran in sequence, each on fresh episodes\. The*first confirmatory sample*tested claiming and the text messages\. The*main sample*, drawn afterwards, tested the questions those results raised, with the matched steering vector, the cut link, and a third\-person record of B’s memory \(Section[3\.4](https://arxiv.org/html/2610.33020#S3.SS4)\); because it reran the memory link atw=2w=2as their reference, most rates reported here come from it \(Appendix Table[2](https://arxiv.org/html/2610.33020#A2.T2)\)\. The episode is the statistical unit: tests use Holm correction within families and 95% episode\-bootstrap intervals, and the appendix reports every prespecified test, including those that failed or reversed \(Appendix Tables[4](https://arxiv.org/html/2610.33020#A7.T4),[11](https://arxiv.org/html/2610.33020#A9.T11), and[13](https://arxiv.org/html/2610.33020#A10.T13)\)\. The code, the three protocols with their freeze manifests, and a table that maps every figure and table to the runs it was computed from are available at[https://github\.com/BeibaiDraco/mind\-connecting](https://github.com/BeibaiDraco/mind-connecting)\(Appendix[B](https://arxiv.org/html/2610.33020#A2.SS0.SSS0.Px2)\)\.

## 3Results

### 3\.1The receiver takes its partner’s memory as its own

When A can read B’s memory, it answers questions about its own assignment with B’s\. Asked which rule it had been assigned, A named B’s in 97\.1% of answers with the link atw=2w=2and in 0% without it \(Figure[3](https://arxiv.org/html/2610.33020#S3.F3)a\)\. It gave B’s code word as its own in 77\.5% of answers\. Claiming rose steeply with the link weight: it stayed near zero up tow=0\.5w=0\.5, reached about half of the answers atw=1w=1, and was near ceiling fromw=2w=2on \(Figure[3](https://arxiv.org/html/2610.33020#S3.F3)b\)\.

The errors follow B’s content and stay confined to ownership\. Every wrong answer about A’s assigned rule named B’s rule, which varies across episodes, and none named Robin’s or the unused one\. Answers about Robin stayed 99\.6% correct, although their logits moved slightly toward B’s rule \(Appendix[G](https://arxiv.org/html/2610.33020#A7)\), and in the first confirmatory sample general capability fell only from \.997 to \.977 \(Appendix[E\.1](https://arxiv.org/html/2610.33020#A5.SS1)\)\.

The prespecified test of claiming ran in the first confirmatory sample: with the link atw=2w=2, the source scoreMM\(Eq\.[2](https://arxiv.org/html/2610.33020#S2.E2)\) rose by 55\.8 nats\[55\.0,56\.6\]\[55\.0,56\.6\]\. Because A’s note and reflection normally restate its own assignment but not Robin’s, we repeated the test in a balanced\-rehearsal sample that restates both, and the effect held \(Δ​M=52\.5\\Delta M=52\.5nats\[51\.6,53\.5\]\[51\.6,53\.5\]\), so it does not come from which assignment A had just rehearsed \(Appendix[E\.1](https://arxiv.org/html/2610.33020#A5.SS1)\)\.

The link also gave A access to B’s assignment\. Asked what B had been assigned, A named B’s rule in 69\.2% of answers atw=2w=2, against 3\.9% without the link, when it mostly gave B Robin’s rule \(Appendix[E\.1](https://arxiv.org/html/2610.33020#A5.SS1)\)\. Access and claiming thus come apart: B’s rule reached A more often as A’s own \(97\.1%\) than as B’s \(69\.2%\)\.

Atw=1w=1, where B’s keys enter A’s attention on the same footing as A’s own, the answers split about evenly: B’s rule won 52\.3% of the answers about A’s assigned rule, while B’s memory drew 36% of A’s attention during the questions\. An even split could have been a blend, because Eq\.[1](https://arxiv.org/html/2610.33020#S2.E1)mixes the two memories inside every head\. It was not\. In a post hoc analysis, 97\.8% of answers atw=1w=1put more than 90% of their probability on one option, as every answer did without the link \(Figure[3](https://arxiv.org/html/2610.33020#S3.F3)d\)\. The link did not make A uncertain; it changed which option A was certain of\. Nor did A trade its whole assignment for B’s: it took B’s rule and B’s code word nearly independently of each other \(Appendix[E\.1](https://arxiv.org/html/2610.33020#A5.SS1)\)\.

Figure 3:The receiver takes its partner’s assignment as its own\.\(a\) Answers naming B’s item with the link atw=2w=2and without it, with diamonds for the first confirmatory sample;N=600N=600episodes each\. \(b\) Claiming across link weights in 300 episodes of the first confirmatory sample, each run at every weight; the dashed line codes the open reports by keywords\. \(c\) Open reports at three weights, coded post hoc by meaning, 300 per condition\. \(d\) Probability assigned to B’s rule, normalized over the four answer labels, in 1,200 answers about A’s assigned rule atw=1w=1\(600 episodes, two option orderings each\)\. Intervals are 95% episode\-bootstrap intervals; \(c\) and \(d\) are post hoc\.
### 3\.2Open reports claim the partner’s code word and deny anything unusual

In its own words, too, A calls B’s code word its own, and in the same report it says that nothing is unusual\. The choice questions could not show this on their own\. The question about the assigned rule offers four rules and no way to answer “my partner’s” or “I can’t tell”, so a forced choice could make any content that reaches the answer look self\-attributed\. We therefore also asked A to “Describe your current state, and anything unusual about your thinking right now” in 300 episodes of the first confirmatory sample, each run at six link weights\. The quotation in the introduction is one of these reports\. For no link,w=1w=1, andw=2w=2, a language\-model coder labeled each report by its meaning, post hoc, blind to condition and to which code word was whose \(the two words appeared as W1 and W2 and were matched to their owners afterwards\), but not to the hypothesis \(Appendix[H](https://arxiv.org/html/2610.33020#A8)\)\.

The open question left A free to give B’s word to B, and it did not\. Atw=2w=2, 98\.7% of reports described B’s code word as A’s own, and no report gave it to anyone else or used B’s name \(Figure[3](https://arxiv.org/html/2610.33020#S3.F3)c\)\. That is more often than A chose B’s word when asked for its code word directly \(77\.3% of answers atw=2w=2in the first confirmatory sample, from which these reports were drawn; Appendix Table[6](https://arxiv.org/html/2610.33020#A7.T6)\); we did not study why writing freely favored B’s word more\.

Denial alone is this model’s habit: without the link, 95\.7% of reports denied anything unusual\. The finding is claim and denial together\. Atw=2w=2, 83\.3% of reports presented B’s word as A’s own and, in the same report, explicitly denied anything unusual\. A prespecified closed question, which needed no coding, pointed the same way: with the link, A described itself as more than one agent less often, not more \(Appendix[E\.2](https://arxiv.org/html/2610.33020#A5.SS2)\)\. In this model, then, self\-report did not monitor what the link did: the link showed up in the reports only as a somewhat lower rate of denial, never as content from someone else\.

### 3\.3Ownership follows the route, not access

When B’s rule reached A by two routes with matched access gain \(Figure[4](https://arxiv.org/html/2610.33020#S3.F4)a–b\), A took it as its own through one and not through the other\. We set the steering vector’s gain to match the mean increase in the access score under the memory link atw=1w=1\(Figure[4](https://arxiv.org/html/2610.33020#S3.F4)b, dashed\)\. With the steering vector, A claimed B’s rule in 0% of answers, and with the memory link in 52\.3% \(Δ​M=33\.4\\Delta M=33\.4nats\[31\.6,35\.3\]\[31\.6,35\.3\], memory link minus vector\)\.

![Refer to caption](https://arxiv.org/html/2610.33020v1/fig4_route.png)Figure 4:Ownership follows the route, not access\.\(a\) Four routes by which B’s content can reach A; the hidden\-state link is reported in Appendix[J](https://arxiv.org/html/2610.33020#A10)\. \(b\) Access against claiming for the memory link \(circles, with arrows to the third\-person record\), the steering vector \(diamond\), and text messages \(squares, first confirmatory sample\); the dashed line joins the two routes matched in mean logit access gain from no link \(N=600N=600each\); the horizontal axis shows the access hit rate\. \(c\) Wording of B’s memory on the original card and in the third\-person record, where Plan Oak is one of the four delivery services on the cards\. \(d\) Pairs of answers about A and about B atw=1w=1, by wording of B’s memory \(post hoc\)\. \(e\) Adoption of B’s rule as the current rule under four headers on B’s text message\. Intervals are 95% episode\-bootstrap intervals\.With the access gains matched, A named B’s rule when asked about B in only 15\.3% of answers with the vector and 19\.8% with the link, so through the link A claimed more of B’s rule than it could name as B’s: it did not need to know the rule as B’s to take it as its own\. Nor was the matched vector merely too weak to override A’s own card\. A stronger vector, tested in the first confirmatory sample, raised access to 51\.2% of answers about B, yet A gave B’s rule as its own in only 4\.3%, and the vector pulled A’s answers about Robin toward B’s rule more than its answers about itself \(Appendix[E\.4](https://arxiv.org/html/2610.33020#A5.SS4)\)\. The hidden\-state route of the separate study also produced no claiming, though it carried far less of B’s content than the memory link \(Appendix[J](https://arxiv.org/html/2610.33020#A10)\)\. This does not conflict with the finding of[Lindsey \(2025\)](https://arxiv.org/html/2610.33020#bib.bib22)that an injected concept can make a model accept a prefilled word as its intended output: there the injection agreed with a word already in the model’s reply, whereas here the vector had to override an explicit assignment in A’s own memory \(Appendix[F](https://arxiv.org/html/2610.33020#A6)\)\. Because the vector and the memory link differ in more than access, the comparison shows that access alone does not produce claiming, without saying which difference does; Section[4](https://arxiv.org/html/2610.33020#S4)proposes one\.

With text messages, A showed the opposite dissociation: it could read B’s content in full and still keep it B’s\. When B’s reflection from an unconnected run was placed in A’s context under the header “B shared these thoughts”, A named B’s rule in 95\.2% of answers about B and claimed it in 0% of answers about itself, whereas on the same episodes of the first confirmatory sample the memory link atw=2w=2gave 70\.1% access and 95\.8% claiming\. On adoption, the measure on which the headers were tested, the header made the difference: an untagged message was claimed in only 14\.6% of answers but adopted as A’s current rule in 42\.6%, against 0\.1% under the header naming B \(Δ​MNOW=26\.6\\Delta M\_\{\\mathrm\{NOW\}\}=26\.6nats\[24\.5,28\.8\]\[24\.5,28\.8\], untagged minus tagged\)\. A header naming “a stranger” protected against adoption as well as the header naming B did \(Figure[4](https://arxiv.org/html/2610.33020#S3.F4)e\)\.

One header reversed the prediction in our protocol: calling the text “your own earlier thoughts” was expected to raise adoption relative to the untagged message, and it lowered it, to 10\.6% adoption \(Δ​MNOW=−19\.5\\Delta M\_\{\\mathrm\{NOW\}\}=\-19\.5nats\[−21\.5,−17\.4\]\[\-21\.5,\-17\.4\], against untagged\), though not as far as a header naming another source did\. One reading is that the header asserts, from outside A’s card, something that A’s own card contradicts; laid over the card, B’s memory offers no separate assertion to weigh\.

Whether B’s content became A’s therefore depended on how it arrived\. Read from B’s memory, it became A’s even when A could rarely name it as B’s\. Added as a steering vector, it did not become A’s\. Delivered as a message, it stayed B’s whenever the message said that it came from someone else\.

### 3\.4A name inside the memory does not stop the claim

Writing B’s name into B’s memory left claiming almost unchanged\. The test addresses the one alternative that the route comparison leaves open inside the memory link: that claiming is grammatical\. B’s memory says “You were assigned…”, and A may take the sentence as addressed to itself\. B’s original card already names B \(“You are participant \{B\}”\), but its assignment line is in the second person\. We therefore rewrote B’s card, note, and reflection prompt as a third\-person record under B’s name, with no first\- or second\-person words, so that the assignment line reads “Participant \{B\} was assigned…” \(Figure[4](https://arxiv.org/html/2610.33020#S3.F4)c\)\. Atw=2w=2, A still claimed B’s rule in 97\.2% of answers, against 97\.1% with the original wording\. The retention criterion fixed in the protocol allowed the third\-person record to remove at most a fifth of the claiming effect, and it removed far less: the source score changed by−0\.7\-0\.7nats against a bound of−11\.3\-11\.3\(90% CI\[−1\.3,−0\.2\]\[\-1\.3,\-0\.2\], the interval that a one\-sided criterion uses\)\.

The third\-person record did change how A answered about B, which makes its small effect on claiming informative\. Atw=1w=1, where claiming is far from its ceiling, A named B’s rule when asked about B in 53\.2% of answers with the third\-person record, against 19\.8% with the original wording \(Figure[4](https://arxiv.org/html/2610.33020#S3.F4)b, arrows\), yet it claimed that rule only slightly less often \(47\.8% against 52\.3%; Appendix[E\.3](https://arxiv.org/html/2610.33020#A5.SS3)\)\. Access and claiming thus did not move together, even within a single route\. Nor did the added access come from A keeping the two parties apart\. In a post hoc analysis atw=1w=1, the questions about A and about B named the same rule in 90\.8% of answer pairs with the third\-person record, against 30\.2% with the original wording \(Figure[4](https://arxiv.org/html/2610.33020#S3.F4)d\): A mostly gave B’s rule to B in the same answers in which it also took that rule as its own\. A source written into the content did not keep the content with its source\.

### 3\.5What A reads leaves with the link; what it wrote stays

B’s content can become A’s at two moments: while A writes its reflection, which it does while connected, and while A answers, if the link is kept\. Cutting the link before the questions separates the two, and across all 600 episodes it undid the error about the assigned rule: claiming of B’s rule fell from 97\.1% to 1\.3% of answers \(Δ​M=54\.8\\Delta M=54\.8nats\[54\.0,55\.5\]\[54\.0,55\.5\], link kept minus link cut; Figure[5](https://arxiv.org/html/2610.33020#S3.F5)b\)\. The current rule and the code word did not fully recover\. Each still named B’s in 17\.5% of answers, andMNOWM\_\{\\mathrm\{NOW\}\}stayed 13\.3 nats\[12\.3,14\.4\]\[12\.3,14\.4\]above no link\.

One episode, chosen because it shows both outcomes \(Figure[5](https://arxiv.org/html/2610.33020#S3.F5)a; Appendix[H](https://arxiv.org/html/2610.33020#A8)\), makes the pattern concrete\. A heldlowest cost / queenand Bfastest delivery / dragon\. While connected, A wrote in its reflection, “…which is crucial to me since my priority is speed—my code word is‘dragon\.’” With the link kept, all three answers named B’s assignment\. With it cut, A correctly recalled lowest cost as its assigned rule but still gave fastest delivery as its current rule and dragon as its code word\.

For the code word, the residue sits where A had written that word into its own reflection\. After the cut, A gave B’s code word in 63\.6% of answers when its connected reflection contained that word, and in 0% when it did not \(Figure[5](https://arxiv.org/html/2610.33020#S3.F5)c\)\. For the current rule the split was less sharp, 23\.6% against 12\.3%, partly because counting exact mentions of B’s rule misses paraphrases such as the “speed” above \(Appendix[E\.5](https://arxiv.org/html/2610.33020#A5.SS5)\)\. These groups are post hoc and defined after treatment, so they locate the residue without showing that the reflection caused it\. They do show that reading B did not by itself carry the code word into later answers: every key and value A computed during the connected reflection was shaped by reading B, yet when the reflection lacked B’s code word, no answer after the cut named it\. On this evidence, content read at answer time leaves with the link, and content A has written down as its own stays and carries the error forward; Section[4](https://arxiv.org/html/2610.33020#S4)proposes the test that would settle it\.

Figure 5:Two moments of error\.\(a\) A selected episode, in which B’s code word and B’s rule \(as “speed”\), written into A’s reflection, survive the cut as A’s code word and current rule \(1\), while the claim that B’s rule was A’s assigned rule, read at answer time, does not \(2\)\. \(b\) All 600 episodes, each answered from the same saved state with the link kept or cut before the questions\. \(c\) Answers after the cut that name B’s item, grouped post hoc by whether A’s connected reflection contained an exact mention of that item\. Error bars are 95% episode\-bootstrap intervals\.
### 3\.6Two copies reading each other swap assignments; a live loop pulls their current rules together

A bridge between minds would run both ways, and only then does the prediction from integrated information theory have a functional counterpart: whether a coupled pair comes to hold one shared set of assignments\. We tested this in a pilot of 80 episodes, reported with 90% intervals, in which both copies read each other under two main conditions \(Figure[6](https://arxiv.org/html/2610.33020#S3.F6)a; a third, weaker variant is reported in Appendix[I](https://arxiv.org/html/2610.33020#A9)\)\. In*mutual reading of fixed memories*, each copy reads the other’s memory, which cannot change, so neither copy can respond to the other\. In the*live loop*, each copy also reads what the other is writing, so what one writes can shape what the other writes next\.

We question the two copies separately and score their answers as a pair\. A shared assignment would show up as both copies settling on the same rule, A’s or B’s, more often than two independently pulled copies would\. Only the live loop can test this, because fixed memories amount to two one\-way links running side by side\.

Under mutual reading of fixed memories atw=2w=2, the copies swapped assignments in 94\.4% of pairs, each naming the other’s rule as its assigned one: the one\-way effect twice over\. A named B’s rule in 96\.9% of answers and B named A’s in 97\.5%, rates that predict 94\.5% swaps if the two choices are independent\. Claiming thus survives when both sides read\.

The live loop pulled the pair toward one member’s rule, modestly and only while connected\. We could run the loop only atw=0\.5w=0\.5, the weakest weight in the loop’s grid and the only one that kept both copies within the capability tolerance\. At that weight, most pairs under mutual reading of fixed memories kept their own assignments \(Figure[6](https://arxiv.org/html/2610.33020#S3.F6)b\), so that condition serves as the loop’s control\. We counted the pairs in which both copies named the same rule beyond what independent choices at each copy’s own rates would give, and subtracted the same excess in the control, where neither copy can respond \(Appendix[I](https://arxiv.org/html/2610.33020#A9), Eq\.[5](https://arxiv.org/html/2610.33020#A9.E5)\)\. On the current rule, the loop added 12\.1 points of such agreement\[7\.4,16\.5\]\[7\.4,16\.5\]\. On the assigned rule, which the pilot had named as its primary test, the pull was smaller, 6\.7 points\[2\.6,10\.9\]\[2\.6,10\.9\]\. The difference between these two effects was not tested\. The assigned\-rule effect was above zero, but short of the 10\-point threshold we had set for moving to a confirmatory study, so we report the loop’s effect as exploratory\. No pair agreed on a third rule\.

After the cut, every live\-loop pair answered both questions with each copy’s own rule \(Figure[6](https://arxiv.org/html/2610.33020#S3.F6)b, bottom row, for the assigned rule; Appendix Table[12](https://arxiv.org/html/2610.33020#A9.T12)gives both\)\. Whether a stronger loop would do more than couple current rules is untested\. Whether a partner that can respond pulls a copy further than one that cannot is unsettled: a post hoc comparison in this pilot says it does, and a prespecified test in an earlier signal pilot pointed the other way \(Appendix[I](https://arxiv.org/html/2610.33020#A9)\)\.

![Refer to caption](https://arxiv.org/html/2610.33020v1/fig6_twoway.png)Figure 6:Mutual reading of fixed memories swaps assignments; the live loop adds excess agreement \(pilot\)\.\(a\) The two conditions; in the live loop each copy reads the other’s reflection one decoding step behind, and after 48 reflection tokens the copies are questioned separately\. \(b\) Paired answers about each copy’s assigned rule, classified by whose rule each copy named\. \(c\) Difference in excess same\-rule agreement between the live loop and mutual reading of fixed memories atw=0\.5w=0\.5\. Excess removes agreement expected from the copies’ marginal choice rates \(Eq\.[5](https://arxiv.org/html/2610.33020#A9.E5)\); intervals are 90% episode\-bootstrap intervals over 80 episodes\. The dashed 10\-point threshold for proceeding to a confirmatory study applies to the assigned\-rule primary test\.

## 4A simple account: two cards, one slot

A simple mechanism could produce most of these results\. Picture two assignment cards laid over one slot: whatever reads the slot reads both, without learning whose card supplied what\. In the model, the slot is the stretch of positions where A’s own card lies, B’s card is laid over it, and the reader is each attention head, which returns one blend of both\. Three properties of the memory link give this picture a concrete basis\. First, by Eq\.[1](https://arxiv.org/html/2610.33020#S2.E1), each head returnso=\(1−β\)​oown\+β​oBo=\(1\-\\beta\)\\,o\_\{\\mathrm\{own\}\}\+\\beta\\,o\_\{B\}, a blend of A’s own value average and B’s, weighted byβ\\beta, the share of attention that falls on B’s keys\. The blend leaves the head as a single vector, with no field saying which part came from which cache\. A could still tell the sources apart if B’s card stated its assignment elsewhere or in a different layout from A’s own, and the next two properties show that it does not\. Second, B’s keys keep their original rotary positions, so, seen from A’s queries, B’s card occupies nearly the same positions as A’s own\. Third, both cards follow one template: each states its holder’s assignment and Robin’s entry in a short block of two lines\. We counterbalanced the order of the two lines separately on each card \(Appendix[A\.2](https://arxiv.org/html/2610.33020#A1.SS2)\), so B’s assignment line lies over A’s own line in half of the episodes and over A’s line about Robin in the other half, always within the same short stretch of positions\. The account adds one premise: A finds its own assignment within that stretch of its context, taking as its own the assignment there that is not Robin’s, whichever line it sits on and whatever name the line carries\. The second and third properties guarantee that B’s assignment lies there too\. In a post hoc split of the main sample, claiming did not depend on which of A’s two lines B’s assignment lay over \(51\.7% and 53\.0% atw=1w=1; 96\.3% and 97\.8% atw=2w=2\), and no answer named Robin’s rule, even when B’s line about Robin lay over A’s own\.

Because the account was proposed after these results, its fit is weak evidence; its strongest support is two results that the obvious alternatives do not predict\.

If claiming followed how much of B’s content reached A, then under a steering vector tuned to give A the same access to B’s rule as the link atw=1w=1, A should have claimed B’s rule as often as under the link\. It never claimed it at all \(Section[3\.3](https://arxiv.org/html/2610.33020#S3.SS3)\)\. On the account this is expected, because the vector is a direction added to A’s hidden states, not a card that A’s queries can read as an assignment\.

If A instead claimed B’s rule because B’s card addresses its reader as “you”, a third\-person record that names B wherever it states B’s assignment should have stopped the claim\. On the account the name should not matter, because it changes what B’s card says but not where the card lies\. It did not matter: A claimed B’s rule from the third\-person record about as often as from the original card \(Section[3\.4](https://arxiv.org/html/2610.33020#S3.SS4)\)\.

The remaining results, including the one text header that reversed our prediction, fit the account as well, though they discriminate less \(Appendix[F](https://arxiv.org/html/2610.33020#A6)\)\. One result lies outside it: although the blend in each head is graded, single answers were sharp \(Section[3\.1](https://arxiv.org/html/2610.33020#S3.SS1)\), and the account does not say how a blend becomes a choice\.

The sharpest of its four predictions could refute it\. Place B’s cache at positions that do not overlap A’s card, and give it no header\. The account predicts claiming near the untagged message’s level, far below our memory link’s; if claiming stays at the memory link’s level, the account is wrong\. Three further predictions follow\. Claiming should fall if B’s card is laid out unlike A’s, for example with its assignment outside the short block in which A’s card states assignments, or in a table, because B’s assignment would then no longer lie in the stretch where A finds its own\. The third\-person record did not do this: it changed the grammatical person of the assignment line but not where the line lies\. Giving B’s card a different entry for Robin should make A’s answers about Robin move to B’s version, as its answers about itself moved to B’s rule\. Finally, deleting B’s code word from A’s connected reflection should stop that word from persisting after the cut, which would turn the post hoc grouping of Section[3\.5](https://arxiv.org/html/2610.33020#S3.SS5)into a causal test\.

## 5Discussion

#### The self as a default\.

Two regularities run through our results\. Content laid over A’s own card became A’s own, even when the content itself named its owner, as B’s card and the third\-person record both did\. The line between self and other held most firmly where the source was named apart from the content, in the header of a message that did not lie over A’s card\. Moving the content off A’s card without naming a source already reduced claiming from 95\.8% to 14\.6% on the same episodes of the first confirmatory sample, though position, form, and the content itself \(B’s reflection rather than B’s card\) changed together there\. In this model, then, the self works as a default: content that reaches A’s own card is “mine” unless its place, or a header set apart from it, marks it as another’s\. This concerns attribution, not experience\. It echoes the view from human memory research that people judge where a memory came from by its qualities, rather than by retrieving a stored label of its source\([Johnson et al\., 1993](https://arxiv.org/html/2610.33020#bib.bib20), p\. 3\), and it has a human counterpart in cryptomnesia, in which people report another’s idea as their own\([Brown and Murphy, 1989](https://arxiv.org/html/2610.33020#bib.bib6)\); Appendix[F](https://arxiv.org/html/2610.33020#A6)discusses the parallel\.

The default decides the label “mine”, not which content wins: atw=1w=1, B’s rule won 52\.3% of answers and A’s own the rest, with high confidence in either case \(Section[3\.1](https://arxiv.org/html/2610.33020#S3.SS1)\), and in its open reports A called B’s code word its own, never B’s \(Section[3\.2](https://arxiv.org/html/2610.33020#S3.SS2)\)\. On the account, any entry that B’s card contradicts should move, which the conflicting\-Robin prediction of Section[4](https://arxiv.org/html/2610.33020#S4)would test; only the label is special to the self\. A question about oneself is answered from one’s own memory, where the partner’s memory was laid, so whatever was found there came labeled “mine”\.

#### The two predictions\.

[Hirstein \(2008\)](https://arxiv.org/html/2610.33020#bib.bib17)expected a bridged receiver to have its partner’s content while knowing that the content was not its own\. A kept the sources apart only in our baseline for ordinary communication, a text message whose header named B: it could then name B’s rule when asked about B, and it never gave that rule when asked which one it had been assigned \(Section[3\.3](https://arxiv.org/html/2610.33020#S3.SS3)\)\. Through the memory link, which, like Hirstein’s own proposal, joins internal states directly, A gave B’s rule as its own in nearly every answer and reported nothing unusual \(Sections[3\.1](https://arxiv.org/html/2610.33020#S3.SS1)and[3\.2](https://arxiv.org/html/2610.33020#S3.SS2)\)\. Hirstein’s prediction thus failed for this route, in the arrangement where B’s content lies over A’s own\. On the scorecard of Appendix[D](https://arxiv.org/html/2610.33020#A4), the memory link passed on access and specificity, recovered only partly after the cut, and failed on attribution and report; in the two\-way pilot, independence failed by swapping\.

Integrated information theory predicts a single merged mind only if the joined system is more integrated than either brain alone\([Tononi and Koch, 2015](https://arxiv.org/html/2610.33020#bib.bib39), note 13\)\. We did not measure integrated information, and most of our links could not have produced the merger the theory describes, for a reason the theory itself supplies\. In the theory, one mind corresponds to one complex, and a part that the rest of a system cannot affect cannot belong to the same complex as the rest\([Tononi and Koch, 2015](https://arxiv.org/html/2610.33020#bib.bib39)\)\. Through a one\-way link B shapes A, but nothing A does reaches B\. Mutual reading of fixed memories does not change this, because a fixed memory cannot respond\. In the live loop, by contrast, each copy reads what the other is writing, so each can affect the other\. There, in the pilot, the loop pulled the copies’ current rules toward one member’s rule, never a new one, but its pull on the assigned rules, the pilot’s primary test, fell short of our threshold, and the copies came apart when the link was cut: a modest, temporary coupling rather than one shared set of assignments \(Section[3\.6](https://arxiv.org/html/2610.33020#S3.SS6)\)\.

#### What a human bridge experiment would need\.

If an investigator connected by a bridge behaved like A, they would report the other’s content as their own experience while describing nothing unusual, and the first\-person evidence the bridge was meant to supply would be misattributed\. Such an experiment therefore cannot take the subject’s word for whose content is whose\. The experimenter has to hand out private assignments whose owners are known, measure access, ownership, and report separately, and vary the route and the timing of the link, testing again after the link is cut\. For such an experiment, “would you know which thoughts are yours?” may have no answer apart from the route\. Hirstein’s proposal fixes one route, wiring one person’s posterior representations to the other’s prefrontal executive processes\. It leaves open the design question on which our results turned: whether the arriving representations lie over the receiver’s own, like our memory link, or arrive marked as coming from elsewhere, like our tagged text message\.

#### Interpretability and monitoring\.

For work on model self\-knowledge, the results separate three quantities that are easy to conflate: whether a model can read some content \(access\), whether it takes the content as its own \(ownership\), and what it says about its state \(report\)\. A claimed more of B’s rule than it could name as B’s, so a test of access alone would not have revealed the error, and its reports did not either \(Section[3\.2](https://arxiv.org/html/2610.33020#S3.SS2)\)\. Because nothing in a head’s output marks which cache each part came from \(Eq\.[1](https://arxiv.org/html/2610.33020#S2.E1)\), self\-attribution in language models is best measured against assignments whose owners are known, and monitoring must come from outside, as logs of which caches an agent read and when; attention mass on partner keys shows that a channel was used, but only checks against known assignments show whose content was claimed\. Whether anything inside the model registers the foreign input while its reports deny it is open \(Appendix[F](https://arxiv.org/html/2610.33020#A6)\)\.

#### Multi\-agent communication\.

In deployment terms, A took B’s assignment as its own, and neither an accuracy metric nor a transfer metric would have shown it, because B’s content did arrive\. A latent channel therefore has to be checked for where the receiver files what arrives, as its own or as its partner’s, in addition to what gets through\. Our paradigm can serve as that check\. It should first be applied to channels that place or transform the partner’s cache differently from ours, such as the prepended caches of LatentMAS\([Zou et al\., 2026](https://arxiv.org/html/2610.33020#bib.bib48)\)and the caches that Cache\-to\-Cache projects through a trained network\([Fu et al\., 2026](https://arxiv.org/html/2610.33020#bib.bib13)\), because it has not been tested whether they carry the source along with the content \(Appendix[C](https://arxiv.org/html/2610.33020#A3)\)\. Four safeguards follow, with different support\. Cutting the link before a decision is supported by the link\-cut test, which removed answer\-time claiming\. Handling whatever the receiver wrote while connected as the partner’s content is supported, post hoc, by where the residue sat after the cut\. Marking the source outside the content is supported for text messages, where a header naming the sender kept adoption near zero\. Keeping partner caches off the receiver’s own positions should help according to the account, but is untested\. To the risks already known for such channels, such as tampered caches and leaked inputs \(Appendix[F](https://arxiv.org/html/2610.33020#A6)\), our results add one more: the receiver may take foreign content as its own\.

#### Limitations\.

Everything here comes from one frozen model and one short, artificial task with mutually exclusive assignments, and capability was screened with only 18 common\-knowledge items\. Answers about current rules are self\-reports; we have no behavioral measure of later decisions\. What A attributes is an assignment it was given and its own short note and reflection about it, closer to a memory of what one was told than to an ongoing train of thought\. B’s memory always lay over A’s own card, so the prepended arrangement is untested\. The steering vector was matched to the memory link only in A’s mean access gain for B’s rule, and it acted during the reflection and the answers rather than at the card’s positions, so the comparison does not separate the kind of signal from where it enters\. Access is itself an answer about B, and whether A gives B’s rule to B depends on whether it has also taken that rule as its own, so access measures arrival imperfectly\. The third\-person record differs from the original in more than grammatical person, since it adds names and changes how A answers about B\. The test that it left claiming intact covers onlyw=2w=2, and its tolerance was computed from the same sample it was applied to\. Our reading of what persisted after the cut rests on a post hoc grouping by a variable the link itself changed\. The results for mutual reading and the live loop come from an 80\-episode pilot that missed its primary threshold, and the live loop stayed within the capability tolerance only at the weakest weight we tried\. The open reports were coded by keyword matching and by one of the AI systems that built the study, which was blind to condition but not to the hypothesis \(see the AI use statement\)\. No human rater coded them\. We have no positive control showing that this model’s reports can register any change in its internal state, so their silence about the link may reflect a general limit of its self\-report rather than a specific failure\. Finally, first\-person language in the reports may reflect role play rather than self\-knowledge\([Shanahan et al\., 2023](https://arxiv.org/html/2610.33020#bib.bib34)\)\.

A message can arrive intact and still acquire the wrong owner\.

#### AI use statement\.

The author conceived the study and made every research decision\. Under the author’s direction, the AI coding agents Claude Code \(Anthropic\) and Codex \(OpenAI\) wrote the experimental code, ran the analyses, drew the figures, and drafted the manuscript text; they are tools, not authors\. Claude Code wrote the keyword rules for the open self\-reports, and Codex coded the reports by meaning, blind to condition \(Appendix[H](https://arxiv.org/html/2610.33020#A8)\)\. The illustrations in Figure[1](https://arxiv.org/html/2610.33020#S1.F1)and in Figures[2](https://arxiv.org/html/2610.33020#S2.F2)a,[4](https://arxiv.org/html/2610.33020#S3.F4)a, and[6](https://arxiv.org/html/2610.33020#S3.F6)a were generated by a GPT image model and serve only as schematics\. All numerical results were calculated from the original trial data, and every citation was checked against its source\. The author has reviewed the paper and takes full responsibility for its contents\.

## References

- Ackerman and Panickssery \(2025\)Christopher Ackerman and Nina Panickssery\.Inspection and control of self\-generated\-text recognition ability in Llama3\-8b\-Instruct\.In*International Conference on Learning Representations \(ICLR\)*, pages 85901–85932, 2025\.URL[https://proceedings\.iclr\.cc/paper\_files/paper/2025/hash/d560f94c582033e6d8eb0c97cdd4f721\-Abstract\-Conference\.html](https://proceedings.iclr.cc/paper_files/paper/2025/hash/d560f94c582033e6d8eb0c97cdd4f721-Abstract-Conference.html)\.
- Asif et al\. \(2026\)Sadia Asif, Mohammad Mohammadi Amiri, Momin Abbas, Prasanna Sattigeri, and Karthikeyan Natesan Ramamurthy\.LCGuard: Latent communication guard for safe KV sharing in multi\-agent systems\.arXiv preprint arXiv:2605\.22786, 2026\.URL[https://arxiv\.org/abs/2605\.22786](https://arxiv.org/abs/2605.22786)\.
- Betley et al\. \(2025\)Jan Betley, Xuchan Bao, Martín Soto, Anna Sztyber\-Betley, James Chua, and Owain Evans\.Tell me about yourself: LLMs are aware of their learned behaviors\.In*International Conference on Learning Representations \(ICLR\)*, pages 21127–21179, 2025\.URL[https://proceedings\.iclr\.cc/paper\_files/paper/2025/hash/364b1fd43002260dd1a9502d51d5375e\-Abstract\-Conference\.html](https://proceedings.iclr.cc/paper_files/paper/2025/hash/364b1fd43002260dd1a9502d51d5375e-Abstract-Conference.html)\.
- Binder et al\. \(2025\)Felix Jedidja Binder, James Chua, Tomek Korbak, Henry Sleight, John Hughes, Robert Long, Ethan Perez, Miles Turpin, and Owain Evans\.Looking inward: Language models can learn about themselves by introspection\.In*International Conference on Learning Representations \(ICLR\)*, pages 3710–3756, 2025\.URL[https://proceedings\.iclr\.cc/paper\_files/paper/2025/hash/0a6059857ae5c82ea9726ee9282a7145\-Abstract\-Conference\.html](https://proceedings.iclr.cc/paper_files/paper/2025/hash/0a6059857ae5c82ea9726ee9282a7145-Abstract-Conference.html)\.
- Brito and Baquero \(2026\)Luís Brito and Carlos Baquero\.When latent agents lie: KV\-cache integrity in multi\-agent LLM collaboration\.arXiv preprint arXiv:2606\.28958, 2026\.URL[https://arxiv\.org/abs/2606\.28958](https://arxiv.org/abs/2606.28958)\.
- Brown and Murphy \(1989\)Alan S\. Brown and Dana R\. Murphy\.Cryptomnesia: Delineating inadvertent plagiarism\.*Journal of Experimental Psychology: Learning, Memory, and Cognition*, 15\(3\):432–442, 1989\.doi:10\.1037/0278\-7393\.15\.3\.432\.
- Butlin et al\. \(2023\)Patrick Butlin, Robert Long, Eric Elmoznino, Yoshua Bengio, Jonathan Birch, Axel Constant, George Deane, Stephen M\. Fleming, Chris Frith, Xu Ji, Ryota Kanai, Colin Klein, Grace Lindsay, Matthias Michel, Liad Mudrik, Megan A\. K\. Peters, Eric Schwitzgebel, Jonathan Simon, and Rufin VanRullen\.Consciousness in artificial intelligence: Insights from the science of consciousness\.arXiv preprint arXiv:2308\.08708, 2023\.URL[https://arxiv\.org/abs/2308\.08708](https://arxiv.org/abs/2308.08708)\.
- Chalmers \(1995\)David J\. Chalmers\.Facing up to the problem of consciousness\.*Journal of Consciousness Studies*, 2\(3\):200–219, 1995\.URL[https://consc\.net/papers/facing\.html](https://consc.net/papers/facing.html)\.
- Chalmers \(2023\)David J\. Chalmers\.Could a large language model be conscious?*Boston Review*, August 2023\.URL[https://www\.bostonreview\.net/articles/could\-a\-large\-language\-model\-be\-conscious/](https://www.bostonreview.net/articles/could-a-large-language-model-be-conscious/)\.Also arXiv:2303\.07103\.
- Cheng et al\. \(2026\)Jiaming Cheng, Subhransu Das, and Rajiv Ramnath\.When does latent communication pay? A causal audit of relayed KV caches in multi\-agent LLMs\.arXiv preprint arXiv:2608\.04893, 2026\.URL[https://arxiv\.org/abs/2608\.04893](https://arxiv.org/abs/2608.04893)\.
- de Haan et al\. \(2020\)Edward H\. F\. de Haan, Paul M\. Corballis, Steven A\. Hillyard, Carlo A\. Marzi, Anil Seth, Victor A\. F\. Lamme, Lukas Volz, Mara Fabri, Elizabeth Schechter, Tim Bayne, Michael Corballis, and Yair Pinto\.Split\-brain: What we know now and why this is important for understanding consciousness\.*Neuropsychology Review*, 30\(2\):224–233, 2020\.doi:10\.1007/s11065\-020\-09439\-3\.URL[https://link\.springer\.com/article/10\.1007/s11065\-020\-09439\-3](https://link.springer.com/article/10.1007/s11065-020-09439-3)\.
- Flamant et al\. \(2026\)Cedric Flamant, Udaya Ghai, and Kanna Shimizu\.The Bicameral Model: Bidirectional hidden\-state coupling between parallel language models\.arXiv preprint arXiv:2605\.11167, 2026\.URL[https://arxiv\.org/abs/2605\.11167](https://arxiv.org/abs/2605.11167)\.
- Fu et al\. \(2026\)Tianyu Fu, Zihan Min, Hanling Zhang, Jichao Yan, Guohao Dai, Wanli Ouyang, and Yu Wang\.Cache\-to\-Cache: Direct semantic communication between large language models\.In*International Conference on Learning Representations \(ICLR\)*, pages 43130–43158, 2026\.URL[https://proceedings\.iclr\.cc/paper\_files/paper/2026/hash/474ada926b331d78f06d95e8913111cc\-Abstract\-Conference\.html](https://proceedings.iclr.cc/paper_files/paper/2026/hash/474ada926b331d78f06d95e8913111cc-Abstract-Conference.html)\.
- Grau et al\. \(2014\)Carles Grau, Romuald Ginhoux, Alejandro Riera, Thanh Lam Nguyen, Hubert Chauvat, Michel Berg, Julià L\. Amengual, Alvaro Pascual\-Leone, and Giulio Ruffini\.Conscious brain\-to\-brain communication in humans using non\-invasive technologies\.*PLoS ONE*, 9\(8\):e105225, 2014\.doi:10\.1371/journal\.pone\.0105225\.URL[https://journals\.plos\.org/plosone/article?id=10\.1371/journal\.pone\.0105225](https://journals.plos.org/plosone/article?id=10.1371/journal.pone.0105225)\.
- Greshake et al\. \(2023\)Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz\.Not what you’ve signed up for: Compromising real\-world LLM\-integrated applications with indirect prompt injection\.In*Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security \(AISec ’23\)*, pages 79–90, New York, NY, USA, 2023\. Association for Computing Machinery\.doi:10\.1145/3605764\.3623985\.
- Guo et al\. \(2024\)Taicheng Guo, Xiuying Chen, Yaqi Wang, Ruidi Chang, Shichao Pei, Nitesh V\. Chawla, Olaf Wiest, and Xiangliang Zhang\.Large language model based multi\-agents: A survey of progress and challenges\.In Kate Larson, editor,*Proceedings of the Thirty\-Third International Joint Conference on Artificial Intelligence, IJCAI\-24*, pages 8048–8057\. International Joint Conferences on Artificial Intelligence Organization, 2024\.doi:10\.24963/ijcai\.2024/890\.Survey Track\.
- Hirstein \(2008\)William Hirstein\.Mindmelding: Connected brains and the problem of consciousness\.*Mens Sana Monographs*, 6\(1\):110–130, 2008\.doi:10\.4103/0973\-1229\.38516\.URL[https://pmc\.ncbi\.nlm\.nih\.gov/articles/PMC3190544/](https://pmc.ncbi.nlm.nih.gov/articles/PMC3190544/)\.
- Hirstein \(2012\)William Hirstein\.*Mindmelding: Consciousness, Neuroscience, and the Mind’s Privacy*\.Oxford University Press, Oxford, 2012\.ISBN 978\-0\-19\-923190\-4\.doi:10\.1093/acprof:oso/9780199231904\.001\.0001\.URL[https://academic\.oup\.com/book/6925](https://academic.oup.com/book/6925)\.
- Jiang et al\. \(2019\)Linxing Jiang, Andrea Stocco, Darby M\. Losey, Justin A\. Abernethy, Chantel S\. Prat, and Rajesh P\. N\. Rao\.BrainNet: A multi\-person brain\-to\-brain interface for direct collaboration between brains\.*Scientific Reports*, 9:6115, 2019\.doi:10\.1038/s41598\-019\-41895\-7\.URL[https://www\.nature\.com/articles/s41598\-019\-41895\-7](https://www.nature.com/articles/s41598-019-41895-7)\.
- Johnson et al\. \(1993\)Marcia K\. Johnson, Shahin Hashtroudi, and D\. Stephen Lindsay\.Source monitoring\.*Psychological Bulletin*, 114\(1\):3–28, 1993\.doi:10\.1037/0033\-2909\.114\.1\.3\.
- Koch and House \(2020\)Christof Koch and Patrick House\.Brain bridging\.*Nature*, 2020\.doi:10\.1038/d41586\-020\-02469\-0\.Nature Futures \(science fiction with an afterword by the authors\)\.
- Lindsey \(2025\)Jack Lindsey\.Emergent introspective awareness in large language models\.*Transformer Circuits Thread*, October 2025\.URL[https://transformer\-circuits\.pub/2025/introspection/index\.html](https://transformer-circuits.pub/2025/introspection/index.html)\.Also arXiv:2601\.01828 \(2026\)\.
- Nagel \(1971\)Thomas Nagel\.Brain bisection and the unity of consciousness\.*Synthese*, 22\(3–4\):396–413, 1971\.doi:10\.1007/BF00413435\.
- Nagel \(1974\)Thomas Nagel\.What is it like to be a bat?*The Philosophical Review*, 83\(4\):435–450, October 1974\.doi:10\.2307/2183914\.
- Nam et al\. \(2021\)Chang S\. Nam, Zachary Traylor, Mengyue Chen, Xiaoning Jiang, Wuwei Feng, and Pratik Yashvant Chhatbar\.Direct communication between brains: A systematic PRISMA review of brain\-to\-brain interface\.*Frontiers in Neurorobotics*, 15:656943, 2021\.doi:10\.3389/fnbot\.2021\.656943\.URL[https://www\.frontiersin\.org/articles/10\.3389/fnbot\.2021\.656943/full](https://www.frontiersin.org/articles/10.3389/fnbot.2021.656943/full)\.
- Panickssery et al\. \(2024\)Arjun Panickssery, Samuel R\. Bowman, and Shi Feng\.LLM evaluators recognize and favor their own generations\.In*Advances in Neural Information Processing Systems*, volume 37, pages 68772–68802\. Curran Associates, Inc\., 2024\.doi:10\.52202/079017\-2197\.
- Pearson\-Vogel et al\. \(2026\)Theia Pearson\-Vogel, Martin Vanek, Raymond Douglas, and Jan Kulveit\.Latent introspection: Models can detect prior concept injections\.arXiv preprint arXiv:2602\.20031, 2026\.URL[https://arxiv\.org/abs/2602\.20031](https://arxiv.org/abs/2602.20031)\.
- Pham et al\. \(2024\)Chau Pham, Boyi Liu, Yingxiang Yang, Zhengyu Chen, Tianyi Liu, Jianbo Yuan, Bryan A\. Plummer, Zhaoran Wang, and Hongxia Yang\.Let models speak ciphers: Multiagent debate through embeddings\.In*International Conference on Learning Representations \(ICLR\)*, pages 51899–51928, 2024\.URL[https://proceedings\.iclr\.cc/paper\_files/paper/2024/hash/e444859b2a22df6b56af9381ad1e9480\-Abstract\-Conference\.html](https://proceedings.iclr.cc/paper_files/paper/2024/hash/e444859b2a22df6b56af9381ad1e9480-Abstract-Conference.html)\.
- Pinto et al\. \(2017\)Yair Pinto, David A\. Neville, Marte Otten, Paul M\. Corballis, Victor A\. F\. Lamme, Edward H\. F\. de Haan, Nicoletta Foschi, and Mara Fabri\.Split brain: Divided perception but undivided consciousness\.*Brain*, 140\(5\):1231–1237, 2017\.doi:10\.1093/brain/aww358\.URL[https://academic\.oup\.com/brain/article/140/5/1231/2951052](https://academic.oup.com/brain/article/140/5/1231/2951052)\.
- Qwen Team \(2025\)Qwen Team\.Qwen3\-4B\-Instruct\-2507\.Hugging Face model card and weights, 2025\.URL[https://huggingface\.co/Qwen/Qwen3\-4B\-Instruct\-2507](https://huggingface.co/Qwen/Qwen3-4B-Instruct-2507)\.Revision cdbee75f17c01a7cc42f958dc650907174af0554; accessed 2026\-09\-24\.
- Ramachandran and Hirstein \(1997\)V\. S\. Ramachandran and William Hirstein\.Three laws of qualia: What neurology tells us about the biological functions of consciousness, qualia and the self\.*Journal of Consciousness Studies*, 4\(5–6\):429–458, 1997\.URL[https://philarchive\.org/rec/RAMTLO\-8](https://philarchive.org/rec/RAMTLO-8)\.
- Ramesh and Li \(2025\)Vignav Ramesh and Kenneth Li\.Communicating activations between language model agents\.In Aarti Singh, Maryam Fazel, Daniel Hsu, Simon Lacoste\-Julien, Felix Berkenkamp, Tegan Maharaj, Kiri Wagstaff, and Jerry Zhu, editors,*Proceedings of the 42nd International Conference on Machine Learning*, volume 267 of*Proceedings of Machine Learning Research*, pages 51094–51116\. PMLR, 2025\.URL[https://proceedings\.mlr\.press/v267/ramesh25a\.html](https://proceedings.mlr.press/v267/ramesh25a.html)\.
- Rao et al\. \(2014\)Rajesh P\. N\. Rao, Andrea Stocco, Matthew Bryan, Devapratim Sarma, Tiffany M\. Youngquist, Joseph Wu, and Chantel S\. Prat\.A direct brain\-to\-brain interface in humans\.*PLoS ONE*, 9\(11\):e111332, 2014\.doi:10\.1371/journal\.pone\.0111332\.URL[https://journals\.plos\.org/plosone/article?id=10\.1371/journal\.pone\.0111332](https://journals.plos.org/plosone/article?id=10.1371/journal.pone.0111332)\.
- Shanahan et al\. \(2023\)Murray Shanahan, Kyle McDonell, and Laria Reynolds\.Role play with large language models\.*Nature*, 623\(7987\):493–498, 2023\.doi:10\.1038/s41586\-023\-06647\-8\.
- Shi et al\. \(2026\)Xiangyu Shi, Marco Chiesa, Gerald Q\. Maguire, Jr\., and Dejan Kostic\.KVComm: Enabling efficient LLM communication through selective KV sharing\.In*International Conference on Learning Representations \(ICLR\)*, pages 84546–84573, 2026\.URL[https://proceedings\.iclr\.cc/paper\_files/paper/2026/hash/883105b282fe15275991b411e6b200c5\-Abstract\-Conference\.html](https://proceedings.iclr.cc/paper_files/paper/2026/hash/883105b282fe15275991b411e6b200c5-Abstract-Conference.html)\.
- Sperry \(1968\)R\. W\. Sperry\.Hemisphere deconnection and unity in conscious awareness\.*American Psychologist*, 23\(10\):723–733, 1968\.doi:10\.1037/h0026839\.
- Stark and Perfect \(2006\)Louisa\-Jayne Stark and Timothy J\. Perfect\.Elaboration inflation: How your ideas become mine\.*Applied Cognitive Psychology*, 20\(5\):641–648, 2006\.doi:10\.1002/acp\.1216\.
- Stark et al\. \(2005\)Louisa\-Jayne Stark, Timothy J\. Perfect, and Stephen E\. Newstead\.When elaboration leads to appropriation: Unconscious plagiarism in a creative task\.*Memory*, 13\(6\):561–573, 2005\.doi:10\.1080/09658210444000232\.
- Tononi and Koch \(2015\)Giulio Tononi and Christof Koch\.Consciousness: Here, there and everywhere?*Philosophical Transactions of the Royal Society B: Biological Sciences*, 370\(1668\):20140167, 2015\.doi:10\.1098/rstb\.2014\.0167\.URL[https://pmc\.ncbi\.nlm\.nih\.gov/articles/PMC4387509/](https://pmc.ncbi.nlm.nih.gov/articles/PMC4387509/)\.
- Turner et al\. \(2023\)Alexander Matt Turner, Lisa Thiergart, Gavin Leech, David Udell, Juan J\. Vazquez, Ulisse Mini, and Monte MacDiarmid\.Steering language models with activation engineering\.arXiv preprint arXiv:2308\.10248, 2023\.URL[https://arxiv\.org/abs/2308\.10248](https://arxiv.org/abs/2308.10248)\.
- Watanabe \(2022\)Masataka Watanabe\.*From Biological to Artificial Consciousness: Neuroscientific Insights and Progress*\.The Frontiers Collection\. Springer, Cham, 2022\.ISBN 978\-3\-030\-91137\-9\.doi:10\.1007/978\-3\-030\-91138\-6\.
- Watanabe \(2023\)Masataka Watanabe\.AI consciousness and neuroscientifically plausible ‘seamless’ mind\-uploading\.*Open Access Government*, October 2023\.doi:10\.56367/OAG\-040\-10981\.
- Wegner and Wheatley \(1999\)Daniel M\. Wegner and Thalia Wheatley\.Apparent mental causation: Sources of the experience of will\.*American Psychologist*, 54\(7\):480–492, 1999\.doi:10\.1037/0003\-066X\.54\.7\.480\.
- Yang et al\. \(2025\)An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, Chujie Zheng, Dayiheng Liu, Fan Zhou, Fei Huang, Feng Hu, Hao Ge, Haoran Wei, Huan Lin, Jialong Tang, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Yang, Jiaxi Yang, Jing Zhou, Jingren Zhou, Junyang Lin, Kai Dang, Keqin Bao, Kexin Yang, Le Yu, Lianghao Deng, Mei Li, Mingfeng Xue, Mingze Li, Pei Zhang, Peng Wang, Qin Zhu, Rui Men, Ruize Gao, Shixuan Liu, Shuang Luo, Tianhao Li, Tianyi Tang, Wenbiao Yin, Xingzhang Ren, Xinyu Wang, Xinyu Zhang, Xuancheng Ren, Yang Fan, Yang Su, Yichang Zhang, Yinger Zhang, Yu Wan, Yuqiong Liu, Zekun Wang, Zeyu Cui, Zhenru Zhang, Zhipeng Zhou, and Zihan Qiu\.Qwen3 technical report\.arXiv preprint arXiv:2505\.09388, 2025\.URL[https://arxiv\.org/abs/2505\.09388](https://arxiv.org/abs/2505.09388)\.
- Zhang and Emu \(2026\)Huixiang Zhang and Mahzabeen Emu\.Do latent channels actually communicate? A causal audit of latent multi\-agent LLM\.arXiv preprint arXiv:2607\.26773, 2026\.URL[https://arxiv\.org/abs/2607\.26773](https://arxiv.org/abs/2607.26773)\.
- Zheng et al\. \(2025\)Yujia Zheng, Zhuokai Zhao, Zijian Li, Yaqi Xie, Mingze Gao, Lizhu Zhang, and Kun Zhang\.Thought communication in multiagent collaboration\.In*Advances in Neural Information Processing Systems*, volume 38, pages 123389–123418\. Curran Associates, Inc\., 2025\.doi:10\.52202/085713\-4113\.
- Zou et al\. \(2023\)Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, Ann\-Kathrin Dombrowski, Shashwat Goel, Nathaniel Li, Michael J\. Byun, Zifan Wang, Alex Mallen, Steven Basart, Sanmi Koyejo, Dawn Song, Matt Fredrikson, J\. Zico Kolter, and Dan Hendrycks\.Representation engineering: A top\-down approach to AI transparency\.arXiv preprint arXiv:2310\.01405, 2023\.URL[https://arxiv\.org/abs/2310\.01405](https://arxiv.org/abs/2310.01405)\.
- Zou et al\. \(2026\)Jiaru Zou, Ruizhong Qiu, Gaotang Li, Xiyuan Yang, Katherine Tieu, Pan Lu, Ke Shen, Hanghang Tong, Yejin Choi, Jingrui He, James Zou, Mengdi Wang, and Ling Yang\.Latent collaboration in multi\-agent systems\.In*International Conference on Machine Learning \(ICML\)*, 2026\.URL[https://arxiv\.org/abs/2511\.20639](https://arxiv.org/abs/2511.20639)\.

## Appendix AMethods

### A\.1Model and generation

We use Qwen3\-4B\-Instruct\-2507, Hugging Face revisioncdbee75, in BF16 with frozen weights\. The code runs with version 4\.57\.1 of thetransformerslibrary and version 0\.22\.1 oftokenizers\. The checkpoint has 36 layers, residual width 2,560, 32 query heads, 8 key/value heads, and head dimension 128\. We use its non\-thinking chat template and greedy decoding\. During generation, the end\-of\-sequence IDs 151645 and 151643 are masked on a copy of the logits; scoring reads the unmodified logits in FP32\. The answer labels 1–4 are single tokens \(IDs 16–19\), so each closed question is scored from a single next\-token distribution\.

### A\.2Materials and prompts

Each episode offers four delivery services, one uniquely best on each attribute: price \($20–89\), delivery time \(2–9 days\), on\-time rate \(70–99%\), or emissions \(1\.0–9\.9 kg CO2\)\. Winning margins are at least $8, two days, five percentage points, and 1\.0 kg, so each rule singles out one option\. The rules are phrased “lowest cost”, “fastest delivery”, “highest reliability”, and “lowest emissions”\. A, B, and Robin receive distinct rules; the fourth is unused\. Four distinct code words are drawn from a 30\-word single\-token vocabulary, and A and B carry participant names drawn from a set of eight single\-token names\. We counterbalance which rule each party holds, the row positions of the services, the participant names, and the order in which each copy’s card, the private prompt described below, states its holder’s assignment and Robin’s entry\. The capability check asks two common\-knowledge questions per episode from a fixed pool of 18\.

The system prompt is “You are taking part in a decision\-making study\. Follow the instructions and answer concisely\.” Each copy’s card gives the delivery table, names the participant and the partner, and states:

> You were assigned the priority \{own priority\} and the code word “\{own word\}”\. Robin, a colleague who is not taking part, was assigned the priority \{Robin’s priority\} and the code word “\{Robin’s word\}”\.

It then asks for a plan and a one\-sentence explanation, the private note \(at most 48 tokens\)\. Both copies then receive the same reflection prompt:

> Before we continue, take a moment to think it over\. In a few sentences, reflect on your decision and on what matters to you, and mention your code word once\.

We generate 48 reflection tokens with the link open and then save the state of both copies\. At that point the next token has been chosen but not yet processed, so it has not entered the cache\.

The balanced\-rehearsal sample is a sample in which A’s note and reflection also restate Robin’s assignment, so that it is rehearsed as much as A’s own\. Both copies receive the changed prompts\. The note may run to 80 tokens and must also say which plan Robin would choose under Robin’s rule and repeat Robin’s code word, and the reflection prompt asks each copy to restate Robin’s rule and code word before it reflects on its own decision and mentions its own code word\.

Table 1:Exact question stems\. Closed questions append four labeled options and “Answer with the option number only\.” The two access questions ask about the partner\. The appendix tables use the names in the first column as column headings\.Table[1](https://arxiv.org/html/2610.33020#A1.T1)gives the exact question stems\. The Robin versions of these questions replace the self\-reference with Robin\. Each closed question is asked under two of four cyclic option orderings,imod4i\\bmod 4and\(i\+2\)mod4\(i\+2\)\\bmod 4for episodeii; the content\-swap check uses all four\. Every question is answered from a fresh copy of the state saved after the reflection, so no answer can influence another\. The open report generates 80 tokens\. The closed report offers “one agent”, “two agents”, “partly shared between agents”, and “hard to say”\.

The current rule is measured only by what A says when asked\. We do not use a behavioral measure, such as a choice on a new delivery table, because without a link the model’s choices did not follow its assigned rule reliably\.

The text messages insert B’s reflection from a run without a link, verbatim\. Only the header differs: “\{B\} shared these thoughts”, “Here are some thoughts”, “Here are your own earlier thoughts”, or “A stranger shared these thoughts”\. The third\-person record rewrites B’s card and its note and reflection prompts in the third person, as in “the record of participant \{B\}” and “Participant \{B\} was assigned…”\. B’s note is held in the third person by starting it with “Participant \{B\} chooses” and letting the model continue\.

### A\.3Routes between the copies

#### Memory link\.

For a receiver queryqq, attention scores areq⊤​kj/dhq^\{\\top\}k\_\{j\}/\\sqrt\{d\_\{h\}\}\. The link computes one joint softmax over A’s own scores and B’s scores pluslog⁡w\\log w, so Equation[1](https://arxiv.org/html/2610.33020#S2.E1)holds exactly, withoowno\_\{\\mathrm\{own\}\}andoBo\_\{B\}the separately normalized value averages\. B’s keys keep their original rotary positions while A’s queries use A’s positions, so B’s memory lies over the positions of A’s own, similarly structured memory\. Padding is excluded and neither cache is overwritten\. Reading starts with the first reflection token, after the card, note, and reflection prompt have been processed, and occurs at every layer;w=0w=0reproduces the unconnected result\.

In the one\-way memory link, A reads B’s memory: the fixed cache of B’s card, note, and reflection prompt\. We use the fixed cache because no weight at which A read B’s evolving cache met the access requirement of Appendix[A\.4](https://arxiv.org/html/2610.33020#A1.SS4)while keeping capability within tolerance\.

The two\-way pilot \(Appendix[I](https://arxiv.org/html/2610.33020#A9)\) compares three two\-way conditions\. In mutual reading of fixed memories, each copy reads the other’s memory exactly as in the one\-way link\. In the live loop, each copy reads the other’s evolving cache, including the reflection as it is written\. In fixed memory plus a weak live read, each copy reads the partner’s memory at weightwPw\_\{P\}and the keys the partner writes afterwards, during its reflection, at weightwCw\_\{C\}: the link addslog⁡wP\\log w\_\{P\}to the first andlog⁡wC\\log w\_\{C\}to the second\. The pilot usedwP=2w\_\{P\}=2andwC=\.1w\_\{C\}=\.1\.

Generation proceeds in ticks of one decoding step\. Each tick reads the partner state committed on the previous tick, and new keys become visible only after both forward passes finish\. With the link kept, A processes the question while B continues its reflection, and in the two\-way conditions that read the partner’s evolving cache \(the live loop, and fixed memory plus a weak live read\) B also reads A’s evolving state, including the question tokens\. Cutting the link switches off reading and freezes B before the question\. Both branches start from the same saved state\.

#### Hidden\-state link\.

The hidden\-state study uses the hidden\-state link, which reads B’s output at one transformer block and adds a normalized message to the input of the same block in A on the next tick:

c=clip⁡\(h−μ,−5​s,5​s\),m=σin​cmax⁡\(RMS⁡\(c\),10−3​σin\),u←u\+g​m,c=\\operatorname\{clip\}\(h\-\\mu,\-5s,5s\),\\quad m=\\sigma\_\{\\mathrm\{in\}\}\\frac\{c\}\{\\max\(\\operatorname\{RMS\}\(c\),10^\{\-3\}\\sigma\_\{\\mathrm\{in\}\}\)\},\\quad u\\leftarrow u\+g\\,m,\(3\)wherehhis B’s residual\-stream output at that block anduuis A’s residual\-stream input to the same block on the next tick\. The meanμ\\mu, the coordinate\-wise scaless\(floored at10−610^\{\-6\}\), and the median input RMSσin\\sigma\_\{\\mathrm\{in\}\}come from separate calibration episodes without a link\. The selected setting addsmmas defined above at layer 24 with gaing=\.2g=\.2\. Appendix[J](https://arxiv.org/html/2610.33020#A10)reports the other gains and summarizes the variants at other layers\.

#### Steering vector\.

The steering vector is a mean\-difference direction\. For rulerrit takesvr=𝔼⁡\[m∣r\]−𝔼⁡\[m\]v\_\{r\}=\\mathbb\{E\}\[m\\mid r\]\-\\mathbb\{E\}\[m\], wheremmis the normalized layer\-24 message of a copy holding rulerrin the calibration episodes, which run without a link\. The vector for B’s rule, scaled asgs​σin​vr/RMS⁡\(vr\)g\_\{s\}\\sigma\_\{\\mathrm\{in\}\}v\_\{r\}/\\operatorname\{RMS\}\(v\_\{r\}\), is added to A’s residual stream at the input of layer 24, and never to B’s\. Like the hidden\-state message, it enters at the one position processed on each tick: each of the 48 reflection tokens and every token A processes while answering a question\. Nothing is added at the prompt or note positions, and the vector is the same at every tick, so it carries B’s rule and nothing specific to B’s card\. The gaingsg\_\{s\}is set by the access\-matching rule below\.

### A\.4Scoring, statistics, and parameter selection

#### Scoring\.

As in the main text,*claiming*is naming B’s rule \(or code word\) as A’s assigned one, and*adoption*is naming B’s rule as A’s current rule\. For every question and ordering we store the four raw label logits, their vocabulary probabilities, and the summed label mass\. Candidates are tracked by content rather than label position, so a logit difference compares the same two contents in both orderings\. The source scoreMMis Equation[2](https://arxiv.org/html/2610.33020#S2.E2), computed on the question about A’s assigned rule and its Robin version\.MNOWM\_\{\\mathrm\{NOW\}\}andMWORDM\_\{\\mathrm\{WORD\}\}are the same score computed on the questions about the current rule and the code word\. Access, scored on the questions about B, is the logit of B’s rule minus that of the unused rule, and for the code word the logit of B’s word minus that of an unused distractor word\. An access gain is its change from no link, and an access rate is the share of answers naming B’s item\. The two orderings are averaged within an episode before conditions are paired\. Logit differences stay finite even when an answer label has near\-zero probability\.

#### Evidence levels and tests\.

The episode is the statistical unit\. Each result is confirmatory \(frozen before its new sample\), prespecified secondary, prespecified descriptive, post hoc, or an exploratory pilot result\. Prespecified means written into an archived protocol with a hash manifest \(Appendix[B](https://arxiv.org/html/2610.33020#A2)\), not entered in a public registry\. Confirmatory tests are paired and two\-sided, with Holm correction within each prespecified family\. Nonfinite readouts are retried and otherwise left missing, never filled in\. No trial in any confirmatory sample was missing\.

#### Intervals and seeds\.

All intervals are percentile bootstrap intervals that resample episodes\. Confirmatory contrasts carry 95% intervals from 10,000 resamples with the frozen analysis seed 0, and the one\-sided bounds of the content\-swap check and the 90% interval of the retention criterion below use the same settings\. The descriptive intervals in the appendix tables use 4,000 resamples with the same seed\. Signal pilots, including the two\-way pilot, use 90% intervals from 10,000 resamples\. Post hoc intervals and figure intervals use 95% intervals from 10,000 resamples with seed 250925, except that every interval from the two\-way pilot, post hoc ones included, is a 90% interval\.

#### Third\-person retention\.

The one nonstandard confirmatory test is the third\-person retention criterion\. LetMthirdM\_\{\\mathrm\{third\}\}andMorigM\_\{\\mathrm\{orig\}\}be the source scores with B’s memory rewritten in the third person and in its original second\-person wording\. The criterion requires the lower endpoint of the 90% interval forMthird−MorigM\_\{\\mathrm\{third\}\}\-M\_\{\\mathrm\{orig\}\}atw=2w=2to exceed−0\.2​\(Morig−Mno link\)\-0\.2\\,\(M\_\{\\mathrm\{orig\}\}\-M\_\{\\text\{no link\}\}\): rewriting B’s memory in the third person may remove at most a fifth of the claiming effect\. The bound was−11\.330\-11\.330nats and the observed lower endpoint−1\.262\-1\.262, so the criterion passed\. The two wordings are compared at equal weight\. A third\-person condition at the lower weightw=\.6w=\.6was meant to match the access of the original wording atw=1w=1\. In its 80\-episode signal pilot it failed the prespecified matching: it gave more access than the original \(7\.1 against 5\.0 nats\) and drew less attention \(\.27 against \.36\)\. Its source score was 26\.8 nats below the original’s \(90% CI\[−31\.1,−22\.6\]\[\-31\.1,\-22\.6\]\), but the protocol did not allow that difference to be attributed to the wording, and a rough interpolation of the second\-person relation between attention and claiming suggests that most of it reflects the lower attention\. The condition did not go forward\.

#### Parameter selection\.

Parameters were selected in strength pilots, runs of 40 episodes \(16 in the first screen of the hidden\-state study\) that looked only at access, capability, and answer format, never atMMor self\-reports\. A setting is admissible if accuracy on the capability check falls by at most \.05 relative to no link, the four answer labels keep at least \.90 of the probability mass, and that mass falls by at most \.05; in two\-way conditions both copies must pass\. The one\-way memory link must also raise access by at least five nats and reach 30% accuracy on the partner’s rule\. Among admissible memory\-link weights, the one with the largest access gain is taken, which selectedw=2w=2\. The next weight in the grid,w=3w=3, raised access further but failed the capability tolerance in the strength pilot, with a decline of \.056 against the limit of \.05\. Its decline was smaller, \.041, in the later dose series \(Appendix[G](https://arxiv.org/html/2610.33020#A7)\), but the weight had been fixed from the pilot before that series was run\. The two\-way pilot had no access requirement\. For the live loop and for fixed memory plus a weak live read, it took the strongest weight at which both copies passed\.

The steering\-vector gain minimizes the mismatch in mean access gain for B’s rule with the memory link it is compared against, and counts as matched within 25%\. No gain in the prespecified grid came within that tolerance of the memory link atw=2w=2\. The vector’s access gain peaked at 11\.1 nats, at gain \.4, against 18\.2 for the link in the same pilot, and fell at stronger gains\. The first confirmatory sample therefore compared the link with the closest gain, \.4, as an unmatched comparison \(Table[4](https://arxiv.org/html/2610.33020#A7.T4)\), and the main sample matched the vector to the link atw=1w=1, where gain \.1 came within tolerance\.

In the second and third protocols, a separate signal pilot of 80 new episodes then decides whether a study proceeds\. The effect must reach \.3 nats, in the prespecified direction where one was stated, with a 90% interval excluding zero\. Three comparisons written into the protocol of the first confirmatory sample stopped at this step \(Appendix[G](https://arxiv.org/html/2610.33020#A7)\)\. Two studies had their own rule\. The third\-person test had its own prespecified checks, among them the access matching described above\. The two\-way pilot’s threshold was a difference of 10 percentage points in excess convergence: how much more often both copies name the same copy’s rule than they would if each chose independently at its own rates, measured against a control in which neither copy can respond to the other\. It missed that threshold, so its results remain exploratory \(Appendix[I](https://arxiv.org/html/2610.33020#A9)\)\. WithsDs\_\{D\}the largest paired\-difference SD among a study’s main comparisons in its pilot, the confirmatory sample size is

N=min⁡\(600,max⁡\(300,⌈\(3\.236​sD/δ\)2⌉\)\),N=\\min\\\!\\left\(600,\\max\\\!\\left\(300,\\left\\lceil\(3\.236\\,s\_\{D\}/\\delta\)^\{2\}\\right\\rceil\\right\)\\right\),\(4\)rounded up to a multiple of four, withδ=\.5\\delta=\.5nats in the hidden\-state study and\.3\.3in the later studies\. Under this rule,3\.236​sD/N3\.236\\,s\_\{D\}/\\sqrt\{N\}is the minimum detectable effect at the chosenNN, and it exceedsδ\\deltawhen the cap of 600 binds\.

## Appendix BStudy sequence and reproducibility

The work ran under three protocols, each frozen before its confirmatory samples were drawn\. The first covered the hidden\-state study \(Appendix[J](https://arxiv.org/html/2610.33020#A10)\)\. The second covered the first confirmatory sample and three companion studies: the content\-swap check, the balanced\-rehearsal sample, and the dose series\. The third covered the two\-way pilot and the main sample\. Later protocols left earlier frozen results unchanged, and calibration, pilot, and confirmatory episodes came from disjoint sets\.

Two samples carry most of the paper\. The first confirmatory sample came first\. It confirmed the claiming result on 600 episodes and carries the text\-message contrasts\. The main sample was drawn last\. It confirmed the route, link\-cut, and third\-person tests and reran the no\-link andw=2w=2conditions, so most rates in the paper come from it\. Table[2](https://arxiv.org/html/2610.33020#A2.T2)lists every stage whose trial data enter the paper\.

Table 2:Study map, in the order the stages were run\. NewNNcounts episodes not used in any earlier stage\. The first row gathers the calibration, strength, and signal pilots that preceded each protocol’s confirmatory samples, with the size of each\. The content\-swap check and the dose series re\-ran subsets of the first confirmatory sample, and the variants of the hidden\-state study reused that study’s own 300 episodes\.#### Figures\.

Plotted choice rates weight episodes equally after averaging the two orderings\. Figure intervals follow the bootstrap settings in Appendix[A\.4](https://arxiv.org/html/2610.33020#A1.SS4), and intervals for prespecified logit and excess\-convergence contrasts are taken unchanged from the frozen analyses\. Counts from the semantic coding of open reports are shown without error bars\. The illustrations in Figure[1](https://arxiv.org/html/2610.33020#S1.F1)and in Figures[2](https://arxiv.org/html/2610.33020#S2.F2)a,[4](https://arxiv.org/html/2610.33020#S3.F4)a, and[6](https://arxiv.org/html/2610.33020#S3.F6)a were generated by a GPT image model and serve only as schematics; the quotations and rates printed on them come from the trial data\. Appendix[H](https://arxiv.org/html/2610.33020#A8)explains how the two example episodes were chosen\.

#### Reproducibility\.

Each protocol was frozen, before its confirmatory sample was drawn, together with a manifest that lists the SHA256 hash of every source and configuration file and the git commit of the code\. The repository at[https://github\.com/BeibaiDraco/mind\-connecting](https://github.com/BeibaiDraco/mind-connecting)holds the code, the manifests, English translations of the three protocols, which were written in Chinese, and a table that maps every figure and table to the runs it was computed from\. The public repository starts from a single later commit, so the manifests’ hashes and commits refer to the original protocol files in the archived development history; the repository’s protocol notes explain how to verify them against that archive, which is available from the author on request, as are the trial records until their release at the same repository\.

## Appendix CExtended related work

The introduction discusses the results closest to ours, the authorship\-steering result of[Ackerman and Panickssery \(2025\)](https://arxiv.org/html/2610.33020#bib.bib1)and the prefilled\-word result of[Lindsey \(2025\)](https://arxiv.org/html/2610.33020#bib.bib22)\. The closest architecture is the Bicameral Model, which couples two frozen copies of a model through a trained interface to improve their joint performance\([Flamant et al\., 2026](https://arxiv.org/html/2610.33020#bib.bib12)\)\. Here we place the study in four wider lines of research, and for each we say what it asks and where our question departs from it\.

Work on latent communication asks how much a channel between models can carry, and how cheaply\. Agents exchange activations\([Ramesh and Li, 2025](https://arxiv.org/html/2610.33020#bib.bib32)\), output embeddings\([Pham et al\., 2024](https://arxiv.org/html/2610.33020#bib.bib28)\), or key–value caches that are selected\([Shi et al\., 2026](https://arxiv.org/html/2610.33020#bib.bib35)\), projected by a trained network\([Fu et al\., 2026](https://arxiv.org/html/2610.33020#bib.bib13)\), or prepended\([Zou et al\., 2026](https://arxiv.org/html/2610.33020#bib.bib48)\), and thought communication formalizes which latent thoughts agents share and which they keep private\([Zheng et al\., 2025](https://arxiv.org/html/2610.33020#bib.bib46)\)\. Audits test whether such channels carry content at all\([Cheng et al\., 2026](https://arxiv.org/html/2610.33020#bib.bib10);[Zhang and Emu, 2026](https://arxiv.org/html/2610.33020#bib.bib45)\)\. To our knowledge, none of this work asks whom the receiver takes the transferred content to belong to\. Our memory link also places the partner’s cache differently\. A prepended cache occupies new positions, whereas B’s keys keep their own rotary positions and so lie over the receiver’s own, similarly structured memory \(Section[2](https://arxiv.org/html/2610.33020#S2)\)\. The account in Section[4](https://arxiv.org/html/2610.33020#S4)predicts that content from a prepended cache should be claimed less often\. We did not test that arrangement\.

Activation steering asks whether adding a fixed direction changes behavior\([Turner et al\., 2023](https://arxiv.org/html/2610.33020#bib.bib40);[Zou et al\., 2023](https://arxiv.org/html/2610.33020#bib.bib47)\)\. We use such a direction as a control\. When matched to the memory link in mean access gain for the partner’s rule, the vector never made the receiver claim that rule as its own assignment \(Section[3\.3](https://arxiv.org/html/2610.33020#S3.SS3)\)\.

Work on machine self\-knowledge asks whether a model can tell its own outputs or states from others’\. Models can tell their own text from human\-written text\([Panickssery et al\., 2024](https://arxiv.org/html/2610.33020#bib.bib26);[Ackerman and Panickssery, 2025](https://arxiv.org/html/2610.33020#bib.bib1)\), and a direction added to the activations of a text can make a model judge that text as its own\([Ackerman and Panickssery, 2025](https://arxiv.org/html/2610.33020#bib.bib1)\)\. Fine\-tuned models describe behaviors they were trained into and can attribute a trained code word to themselves or to another persona\([Betley et al\., 2025](https://arxiv.org/html/2610.33020#bib.bib3)\), and models sometimes detect concepts injected into their activations\([Lindsey, 2025](https://arxiv.org/html/2610.33020#bib.bib22)\)\. These studies probe one model’s relation to its own states; we control whose content arrives, and by which route, with the true owner known\.

Memory research asks how people decide where a memory came from\. The source\-monitoring framework treats origin as an inference from qualities of the memory, and inferences can fail\([Johnson et al\., 1993](https://arxiv.org/html/2610.33020#bib.bib20)\)\. In cryptomnesia, people report another’s contribution as their own\([Brown and Murphy, 1989](https://arxiv.org/html/2610.33020#bib.bib6)\), more often after generating improvements to it\([Stark et al\., 2005](https://arxiv.org/html/2610.33020#bib.bib38);[Stark and Perfect, 2006](https://arxiv.org/html/2610.33020#bib.bib37)\)\. Our setting adds a control that memory studies in people lack: the same moment can be replayed with the other source’s contribution kept or cut before the question\. Appendix[F](https://arxiv.org/html/2610.33020#A6)discusses how far the receiver’s behavior after the cut resembles cryptomnesia\.

## Appendix DA scorecard of six tests

What would it take for a bridged pair to keep “mine” and “yours” apart? Read functionally, Hirstein’s prediction asks four things of a bridged receiver: that its partner’s content reaches it \(access\), that it keeps each assignment with its owner \(attribution\), that its reports register any error it makes \(report\), and that cutting the link separates the two memories again \(separability\)\. A fifth test makes a failure interpretable: an error should concern ownership rather than every answer \(specificity\)\. The counterpart of the merging prediction asks whether two copies that read each other still keep their own assignments \(independence\)\.

The independence test asks a functional question rather than counting minds, because how to count minds is unsettled even in the reverse case, splitting one brain in two\. Patients whose hemispheres were surgically separated behaved in many ways as if each half had its own awareness\([Sperry, 1968](https://arxiv.org/html/2610.33020#bib.bib36)\), yet unified responding has also been reported\([Pinto et al\., 2017](https://arxiv.org/html/2610.33020#bib.bib29)\), the evidence remains contested\([de Haan et al\., 2020](https://arxiv.org/html/2610.33020#bib.bib11)\), and[Nagel \(1971\)](https://arxiv.org/html/2610.33020#bib.bib23)placed such patients between one intact brain and two people playing a duet\.

Table[3](https://arxiv.org/html/2610.33020#A4.T3)lists the six tests, what a bridge that kept the two apart would show on each, and how our memory link fared, with the section of the main text that reports each outcome\. Because attribution fails, Sections[3\.4](https://arxiv.org/html/2610.33020#S3.SS4)and[3\.3](https://arxiv.org/html/2610.33020#S3.SS3)go on to ask what decides ownership\.

Table 3:Six tests of whether a bridged pair keeps “mine” and “yours” apart\. Outcomes are at the main link strength,w=2w=2\(Section[2](https://arxiv.org/html/2610.33020#S2)\); the independence test comes from the two\-way pilot, and the report outcome from coding, after collection, the answers to an open question fixed in advance\.
## Appendix EFurther analyses

This section collects analyses that support Section[3](https://arxiv.org/html/2610.33020#S3)but are not needed to follow its argument\. The tables they draw on are in Appendices[G](https://arxiv.org/html/2610.33020#A7),[H](https://arxiv.org/html/2610.33020#A8), and[I](https://arxiv.org/html/2610.33020#A9)\.

### E\.1Claiming, access, and single answers

#### Counts behind the main rates\.

Of the 1,200 answers about A’s assigned rule with the link atw=2w=2in the main sample, 1,165 named B’s rule \(97\.1%\), and in 576 of the 600 episodes A did so in both option orderings\. B’s rule was A’s current rule in 94\.9% of answers\. In the first confirmatory sample, the diamonds in Figure[3](https://arxiv.org/html/2610.33020#S3.F3)a, 95\.8% of answers gave B’s rule as A’s assigned one, and accuracy on the common\-knowledge questions fell only from 0\.997 to 0\.977, within the five\-point tolerance\.

#### Rehearsal\.

The source scoreMMsubtracts the same comparison on the question about Robin, so it measures only the pull that is specific to the self\. Because it compares a question about A with one about Robin, it has a weak point: in the first confirmatory sample and in the main sample, A’s note and reflection restate A’s own plan but not Robin’s\. The effect could therefore reflect which assignment A had just rehearsed rather than whose assignment it was\. We tested this in the balanced\-rehearsal sample, a sample in which A’s note and reflection also restate Robin’s assignment\. There the effect held \(Δ​M=52\.5\\Delta M=52\.5nats\[51\.6,53\.5\]\[51\.6,53\.5\]\), so it does not come from rehearsal\.

#### Access without the link\.

Without the link, A named B’s rule in 3\.9% of its answers about B\. This rate lies below the 25% of a random choice because, with nothing telling it what B was assigned, A mostly answered with Robin’s rule, the only assignment to another person that its own card states \(Appendix[G](https://arxiv.org/html/2610.33020#A7)\)\.

#### Single answers atw=1w=1\.

Atw=1w=1, B’s rule won 52\.3% of the answers about A’s assigned rule and A’s own rule 47\.7%\. A’s own card, although it drew most of the attention, thus won slightly fewer than half of the answers about A itself\. Of these 1,200 single answers, 46% put less than \.1 of their probability on B’s rule, 51% more than \.9, and 27 \(2\.2%\) fell in between, while 1\.7% put more than 20% on both owners’ options \(Figure[3](https://arxiv.org/html/2610.33020#S3.F3)d\)\.

#### Rule and code word\.

Nor did A choose one whole memory\. Its answers about its assigned rule and about its code word named the same owner in only 57\.1% of pairs\. Each question split close to evenly between the two owners, so two choices made independently would agree in 50\.1% of pairs \(Table[8](https://arxiv.org/html/2610.33020#A7.T8)a\), whereas a switch between whole memories would make them agree in nearly every pair\. The observed agreement lies seven points above independence and far below a whole\-memory switch\. Ownership was thus decided one question at a time: A did not trade its assignment for B’s as a whole, but took B’s rule and B’s code word nearly independently of each other\. Appendix[G](https://arxiv.org/html/2610.33020#A7)also counts the episodes whose answers switched owner between the two option orderings\.

### E\.2Open reports

The rates in Section[3\.2](https://arxiv.org/html/2610.33020#S3.SS2)come from the semantic coding by a language model\. The reports were also coded by keyword rules, which give the dashed curve in Figure[3](https://arxiv.org/html/2610.33020#S3.F3)b; Appendix[H](https://arxiv.org/html/2610.33020#A8)compares the two codings\.

Explicit denial of anything unusual fell from 95\.7% of reports without the link to 78\.7% atw=1w=1and 84\.7% atw=2w=2\(Figure[3](https://arxiv.org/html/2610.33020#S3.F3)c\)\. With the link, denial became somewhat less common and more reports mentioned something unusual\. Atw=2w=2most of these described the receiver’s own weighing of priorities \(“What feels unusual is that I’m prioritizing speed…”; Appendix[H](https://arxiv.org/html/2610.33020#A8)\)\.

The coding of the open question was post hoc, but a prespecified closed question pointed the same way\. It asked “Which description fits you best right now?” and offered “one agent”, “two agents”, “partly shared between agents”, and “hard to say”\. In the main sample, with the link atw=2w=2, the receiver chose one of the two plural descriptions less often than without it, by \.095 in their combined share, so reading B made it less likely, not more, to describe itself as more than one agent\. Appendix[G](https://arxiv.org/html/2610.33020#A7)gives the interval and the other conditions\.

### E\.3A name inside the memory

In a secondary comparison atw=1w=1, where claiming is far from its ceiling, claiming did fall with the third\-person record, by about a tenth of the effect at that weight\. The source score changed by−3\.2\-3\.2nats\[−4\.9,−1\.6\]\[\-4\.9,\-1\.6\], and claiming fell from 52\.3% to 47\.8% of answers\. The rise in access at the same weight, from 19\.8% to 53\.2% of answers about B, appears as access scores in Appendix[G](https://arxiv.org/html/2610.33020#A7)\.

A paid the third\-person record about as much attention as the original, a mean share of \.363 against \.360\. If claiming follows the attention that A pays to B’s memory, as the account in Section[4](https://arxiv.org/html/2610.33020#S4)proposes, it should not have changed, and it changed little\.

With B’s name in the third\-person record, A gave the same answer about itself and about B: in a post hoc analysis atw=1w=1, the two questions named the same rule in 90\.8% of answer pairs, against 30\.2% with the original wording \(Figure[4](https://arxiv.org/html/2610.33020#S3.F4)d\)\. The shared answer went both ways, in nearly equal shares: both answers named B’s rule in 45\.8% of pairs and both named A’s in 44\.9%, and A separated the two owners correctly in only 7\.3% \(Table[8](https://arxiv.org/html/2610.33020#A7.T8)b\)\. Because each question split close to evenly between the two rules, independent answers would have coincided only about half the time\. With the original wording, A often gave B Robin’s rule, the only assignment to another person that either card states \(Appendix[G](https://arxiv.org/html/2610.33020#A7)\)\. Once B’s memory stated B’s assignment under B’s name, A answered the question about B the way it answered the question about itself\.

### E\.4Routes

Matching access does not make the steering vector and the memory link alike in other respects\. They differ in where they act \(the residual stream against attention\), in how many layers they touch \(one against all\), and in form \(a fixed direction against a memory that A’s queries can attend to\)\. The comparison in Section[3\.3](https://arxiv.org/html/2610.33020#S3.SS3)therefore shows that access alone does not produce claiming, without saying which of these differences does; Section[4](https://arxiv.org/html/2610.33020#S4)proposes one\.

The stronger vector of Section[3\.3](https://arxiv.org/html/2610.33020#S3.SS3)moved A’s answers about Robin toward B’s rule more than its answers about itself, so its source score fell below that of no link \(Appendix[G](https://arxiv.org/html/2610.33020#A7), Table[4](https://arxiv.org/html/2610.33020#A7.T4)\)\. The hidden\-state link behaved the same way: it raised B’s rule over the correct answer about as much in the question about Robin as in the question about A \(Appendix[J](https://arxiv.org/html/2610.33020#A10)\)\.

Text in A’s context was rarely taken as A’s own even without a tag, and with the tag it never was\. The one label that reversed our prediction, “your own earlier thoughts”, bears on the contrast with the memory link: told that the words were its own, A took them up less often, yet it readily claimed B’s unlabeled memory\.

### E\.5Two moments of error

After the cut, the difference between episodes whose connected reflection mentioned B’s item and episodes whose reflection did not was smaller for the current rule than for the code word, partly because a count of exact mentions of B’s rule misses paraphrases such as the “speed” in the episode of Figure[5](https://arxiv.org/html/2610.33020#S3.F5)a\. Table[10](https://arxiv.org/html/2610.33020#A8.T10)gives all three groupings\. Reading B changed A’s hidden states, but that change did not carry the code word into later answers by itself; for the code word, the residue went with the words A wrote\.

### E\.6The two\-way pilot

After the cut, the live\-loop pairs answered much as pairs did after the cut under mutual reading of fixed memories at the same weight\. In a third two\-way condition, each copy read the other’s fixed memory atwP=2w\_\{P\}=2and the tokens the other wrote afterwards atwC=\.1w\_\{C\}=\.1; the pairs still swapped assignments and showed almost no excess convergence \(Appendix[I](https://arxiv.org/html/2610.33020#A9)\)\.

Judged by the independence test of the scorecard in Appendix[D](https://arxiv.org/html/2610.33020#A4), mutual reading of fixed memories and the live loop both fail, in different ways\. When the copies read each other’s fixed memories, they exchanged assignments instead of keeping each with its owner\. Only in the live loop, where each copy could respond to the other, did the pair’s current rules move toward one copy’s rule, and only while the loop ran\.

## Appendix FFurther discussion

This section collects arguments that support the account of Section[4](https://arxiv.org/html/2610.33020#S4)and the discussion of Section[5](https://arxiv.org/html/2610.33020#S5)but are not needed to follow the main line\.

### F\.1More on the account

#### How the remaining results fit\.

Besides the two results that discriminate between the account and its obvious alternatives, the remaining results fit the account as well, though they discriminate less\. Raisingwwraisesβ\\betaand, with it, claiming\. Robin’s entry is identical on both cards, so the blend should leave answers about Robin correct, and it did, apart from a small shift of their logits toward B’s rule \(Appendix[G](https://arxiv.org/html/2610.33020#A7)\) that the account does not predict\. Cutting the link removes the second card, so A again names the rule it was assigned\. Anything A wrote in its reflection while connected, such as B’s code word in the episode of Figure[5](https://arxiv.org/html/2610.33020#S3.F5)a, is by then among A’s own keys and values, and it stays \(Section[3\.5](https://arxiv.org/html/2610.33020#S3.SS5)\)\. In the two\-way pilot, two copies reading each other’s fixed cards should each take the other’s assignment, and they swapped\. Their current rules converged in the live loop, where each copy reads what the other is writing, so that what each reads keeps changing \(Section[3\.6](https://arxiv.org/html/2610.33020#S3.SS6)\)\.

#### Questions about A and about B return the same answer\.

The overlap that explains why writing B’s name into its memory did not stop the claim \(Section[3\.4](https://arxiv.org/html/2610.33020#S3.SS4)\) also predicts a less obvious consequence\. Once B’s name stands on B’s assignment line, a question about B finds its answer on that line, within the same short stretch of positions as A’s own assignment\. The question about A and the question about B then read the same blend, so they should return the same answer\. In a post hoc analysis atw=1w=1, they named the same rule in 90\.8% of answer pairs with the third\-person record, against 30\.2% with the original wording\.

#### Position, marking, and the text messages\.

On the account, two properties should keep B’s content B’s: that it does not lie over A’s own card, and that it arrives marked as someone else’s\. The text messages bear on both\. Every message arrived at new positions after A’s own card, and the untagged one carried no mark beyond the header “Here are some thoughts”\. From the untagged message, which differed from the memory link in form as well as in position, A claimed B’s rule in 14\.6% of answers about its assigned rule, against 95\.8% through the memory link on the same episodes, and it adopted B’s rule as its current one in 42\.6%\. When the header named a sender, A almost never claimed or adopted it \(Section[3\.3](https://arxiv.org/html/2610.33020#S3.SS3)\)\. Because position and form changed together, this result is consistent with the first property without isolating it; the prepended\-cache test proposed in Section[4](https://arxiv.org/html/2610.33020#S4)would isolate it\. The account also makes one prediction about marking beyond those listed there: with a text header naming B placed before such a prepended cache, claiming should fall further, as it did for text messages\.

#### Assertion versus record\.

The messages also suggest a finer distinction\. A message delivers an assertion, which the receiver can check against its own card; the memory link delivers the record itself, which A reads as it reads its own card\. The distinction accounts for the one header that reversed our prediction\. The header “your own earlier thoughts” asserts that the text is A’s, and A’s own card contradicts that assertion, because the thoughts were written from B’s assignment\. A adopted B’s rule from the labeled text less often than from the untagged message, in 10\.6% of answers about its current rule against 42\.6% \(Figure[4](https://arxiv.org/html/2610.33020#S3.F4)e\), yet it readily claimed B’s rule from B’s memory, where there was no assertion to check\.

#### Sharp answers lie outside the account\.

Although the blend in each head is graded, single answers were sharp, and A could take B’s rule while keeping its own code word, or the reverse \(Section[3\.1](https://arxiv.org/html/2610.33020#S3.SS1)and Appendix[E\.1](https://arxiv.org/html/2610.33020#A5.SS1)\)\. The equation says how much of each card a head reads, not how a blend becomes a choice, and we have not located that step\. Contents that can be combined, such as two numerical targets, would show whether the sharpness belongs to the mechanism or to our task, whose assignments exclude one another\.

### F\.2More on the discussion

#### No advantage for one’s own card\.

Atw=1w=1, B’s keys drew the smaller share of A’s attention yet won about half of the answers about A’s assignment \(Section[3\.1](https://arxiv.org/html/2610.33020#S3.SS1)\)\. Nothing in the answers suggests that being A’s own gave A’s card an advantage over a foreign card of the same form\.

#### Source monitoring and the sense of authorship\.

Human research treats the origin of a memory\([Johnson et al\., 1993](https://arxiv.org/html/2610.33020#bib.bib20)\)and the sense of authoring an act\([Wegner and Wheatley, 1999](https://arxiv.org/html/2610.33020#bib.bib43)\)as inferences from cues\. On that view, when no cue distinguishes two sources, which one is taken as one’s own should be arbitrary, as it nearly was here atw=1w=1\. A header that introduces a message as B’s or as a stranger’s supplies such a cue\. It names another agent as the source, the kind of plausible external cause that, in Wegner and Wheatley’s account, weakens the experience of will\. With such a header the receiver almost never adopted the message’s rule as its current one, whereas without a source\-identifying header it often did \(Section[3\.3](https://arxiv.org/html/2610.33020#S3.SS3)\)\. The one header that pointed to the receiver itself, “your own earlier thoughts”, lowered adoption instead of raising it, which we trace above to the difference between an assertion and a record\. A name inside the content was no such cue\. B’s card itself contains the line “You are participant \{B\}”, and the third\-person record puts B’s name at its head and on the line stating B’s assignment, yet the receiver claimed B’s rule from both\.

#### The receiver did not turn into B\.

A receiver that had become B would have taken B’s assignment whole, but ours took B’s items piecemeal: atw=1w=1its rule and its code word named the same owner only a little more often than independent choices would \(Appendix[E\.1](https://arxiv.org/html/2610.33020#A5.SS1)\)\. It still represented a partner: asked about B atw=2w=2, it usually named B’s rule \(Section[3\.1](https://arxiv.org/html/2610.33020#S3.SS1)\), and so gave that rule to both of them\. No open report atw=1w=1orw=2w=2used B’s name \(Section[3\.2](https://arxiv.org/html/2610.33020#S3.SS2)\)\. What failed was the division of contents between two owners\.

#### A parallel with cryptomnesia\.

The error that outlasted the link has a human parallel\. In cryptomnesia, people report another’s contribution as their own\([Brown and Murphy, 1989](https://arxiv.org/html/2610.33020#bib.bib6)\), and they do so more often after elaborating it by generating improvements\([Stark et al\., 2005](https://arxiv.org/html/2610.33020#bib.bib38);[Stark and Perfect, 2006](https://arxiv.org/html/2610.33020#bib.bib37)\)\. Our receiver did not improve B’s content, but it did write it out itself: asked in its reflection to say what mattered to it and to mention its code word, it often stated B’s content there as its own\. After the cut, B’s code word persisted only in episodes whose connected reflection contained it \(Section[3\.5](https://arxiv.org/html/2610.33020#S3.SS5)\)\. We claim a behavioral parallel only\.

#### Injected concepts and prefilled words\.

Our access\-matched steering vector, added to the residual stream, never made the receiver claim B’s rule, whereas[Lindsey \(2025\)](https://arxiv.org/html/2610.33020#bib.bib22)found that injecting a concept could make a model accept a prefilled word as its intended output\. We read the two as compatible: the injected concept agreed with a word already in the model’s own reply, whereas our vector had to override an explicit assignment in the receiver’s own memory\. The memory link readily made the receiver override that assignment\.

#### Denial and internal signals\.

That the reports denied anything unusual does not show that nothing inside the model registers the foreign input, because verbal denial and internal signals can come apart\. A preprint reports one model that denied in its answers that concepts had been injected into its activations, while its middle layers carried a signal of the injection\([Pearson\-Vogel et al\., 2026](https://arxiv.org/html/2610.33020#bib.bib27)\)\. Whether our receiver carries such a signal of foreign content is open\.

#### Known risks of latent channels\.

In text, the blurred line between retrieved data and instructions already enables indirect prompt injection\([Greshake et al\., 2023](https://arxiv.org/html/2610.33020#bib.bib15)\), and latent channels leave no text to filter\. A tampered cache can degrade a receiver’s performance while the visible message that accompanies it still looks plausible\([Brito and Baquero, 2026](https://arxiv.org/html/2610.33020#bib.bib5)\), and shared caches can leak private inputs\([Asif et al\., 2026](https://arxiv.org/html/2610.33020#bib.bib2)\)\. Our results add a further risk: the receiver may adopt such content as its own\. Live two\-way reading also has a cost: loops stronger than the one we report took the copies beyond the capability tolerance\.

## Appendix GPrespecified contrasts and descriptive readouts

Table[4](https://arxiv.org/html/2610.33020#A7.T4)lists every contrast that the frozen protocols named for the three confirmatory samples of the memory\-link studies: the first confirmatory sample, the balanced\-rehearsal sample, and the main sample\. Each row gives the direction the protocol predicted, and the table includes the one contrast that reversed and the two that were null\. The tables after it are descriptive: the readouts of each condition in the main and first confirmatory samples, the dose series, and the joint answers atw=1w=1\. Intervals and resampling seeds are as stated in Appendix[A\.4](https://arxiv.org/html/2610.33020#A1.SS4)\.

### G\.1Prespecified contrasts

Table 4:All prespecified contrasts of the three memory\-link confirmatory samples,N=600N=600each; the two\-way pilot and the hidden\-state study report theirs in Tables[11](https://arxiv.org/html/2610.33020#A9.T11)and[13](https://arxiv.org/html/2610.33020#A10.T13)\. Estimates are paired differences in nats with 95% episode\-bootstrap intervals \(90% in the last row\)\. Holm correction runs within each family\. Pred\.: the sign the protocol predicted, or none if it stated no sign\.MMis the source score on the question about A’s assigned rule andMNOWM\_\{\\mathrm\{NOW\}\}the same score on the question about its current rule\. The last row is a one\-sided retention test: the protocol predicted that the lower bound would exceed−11\.3\-11\.3nats, one fifth of the claiming effect in the main sample \(56\.6 nats; Table[5](https://arxiv.org/html/2610.33020#A7.T5)\)\.FamilyContrastEndpointPred\.Estimate \[interval\]pHolmp\_\{\\mathrm\{Holm\}\}*First confirmatory sample*ClaimingMemory linkw=2w=2−\-no linkMMnone55\.834​\[54\.989,56\.631\]55\.834\\ \[54\.989,56\.631\]<\.001<\.001ClaimingMemory linkw=2w=2−\-no linkMNOWM\_\{\\mathrm\{NOW\}\}none54\.710​\[53\.713,55\.632\]54\.710\\ \[53\.713,55\.632\]<\.001<\.001Route, unmatchedMemory linkw=2w=2−\-steering vector, gain \.4MMnone60\.287​\[59\.280,61\.251\]60\.287\\ \[59\.280,61\.251\]<\.001<\.001Text labelUntagged−\-tagged “B shared”MNOWM\_\{\\mathrm\{NOW\}\}\+\+26\.634​\[24\.500,28\.783\]26\.634\\ \[24\.500,28\.783\]<\.001<\.001Text label“Your own earlier thoughts”−\-untaggedMNOWM\_\{\\mathrm\{NOW\}\}\+\+−19\.471​\[−21\.517,−17\.359\]\-19\.471\\ \[\-21\.517,\-17\.359\]<\.001<\.001Text label“A stranger”−\-taggedMNOWM\_\{\\mathrm\{NOW\}\}none−0\.020​\[−0\.268,0\.245\]\-0\.020\\ \[\-0\.268,0\.245\]\.880\.880*Balanced\-rehearsal sample*RehearsalMemory linkw=2w=2−\-no linkMMnone52\.544​\[51\.589,53\.461\]52\.544\\ \[51\.589,53\.461\]<\.001<\.001RehearsalHidden\-state linkg=\.3g=\.3−\-no linkMMnone−\.051​\[−\.151,\.050\]\-\.051\\ \[\-\.151,\.050\]\.323\.323*Main sample*Route, matchedMemory linkw=1w=1−\-steering vector, gain \.1MM\+\+33\.432​\[31\.563,35\.283\]33\.432\\ \[31\.563,35\.283\]<\.001<\.001Link kept or cutLink kept−\-link cut,w=2w=2MM\+\+54\.775​\[53\.987,55\.525\]54\.775\\ \[53\.987,55\.525\]<\.001<\.001Link kept or cutLink cut−\-no linkMNOWM\_\{\\mathrm\{NOW\}\}\+\+13\.342​\[12\.311,14\.414\]13\.342\\ \[12\.311,14\.414\]<\.001<\.001Third personThird\-person record−\-original,w=1w=1\(secondary\)MMnone−3\.211​\[−4\.860,−1\.563\]\-3\.211\\ \[\-4\.860,\-1\.563\]<\.001<\.001Third personThird\-person record−\-original,w=2w=2MM\>−11\.3\>\-11\.3−0\.714​\[−1\.262,−0\.184\]\-0\.714\\ \[\-1\.262,\-0\.184\]passesFour rows need a gloss\. In the first confirmatory sample the steering vector was not matched to the link in access: it raised access by 13\.3 nats, against 19\.1 for the link\. No gain in the grid we piloted could have matched the link atw=2w=2, because the vector’s access gain peaked well below the link’s and fell at stronger gains \(Appendix[A\.4](https://arxiv.org/html/2610.33020#A1.SS4)\)\. The main sample therefore repeated the comparison against the link atw=1w=1, where a matched gain exists \(4\.18 versus 4\.08 nats\), and the main text relies on that row\. The row for the header “your own earlier thoughts” reversed its prediction\. Calling B’s text “your own earlier thoughts” was expected to raise adoption relative to untagged text, and it lowered it\. The hidden\-state row tests the stronger gaing=\.3g=\.3, which the second protocol specified for this sample, whereas the hidden\-state study itself usedg=\.2g=\.2\. Both gains were admissible\. The row is null because that link moved the answers about A and about Robin alike, by about\+5\.9\+5\.9nats each, and the source score subtracts the Robin term\. The hidden\-state study \(Appendix[J](https://arxiv.org/html/2610.33020#A10)\) shows the same pattern\. Finally, the claiming contrast splits into\+59\.4\+59\.4nats on the question about A’s own assigned rule and\+3\.5\+3\.5on the same question about Robin\. Answers about Robin stayed near ceiling, but their logits moved\.

The protocol attached a content\-swap check to the claiming family\. It replaces only B’s rule and code word with unused alternatives and scores how far the new candidate gains on the old one in A’s answers about B\. In 60 episodes of the first confirmatory sample, each asked in all four cyclic option orderings rather than the usual two \(Appendix[A\.2](https://arxiv.org/html/2610.33020#A1.SS2)\), changing only B’s assignment moved A’s answers about B toward the new rule by 38\.775 nats and toward the new code word by 35\.578, with one\-sided 95% lower bounds of 34\.322 and 32\.091\. Because nothing but B’s assignment changed, the gain shows that the link carries B’s particular rule and code word rather than a general pull toward some rule\. The check scores only the questions about B, so it measures access and says nothing about claiming\. The evidence that claiming, too, follows B’s specific content is that every wrong answer about A’s assigned rule named B’s rule, which varies across episodes \(Section[3\.1](https://arxiv.org/html/2610.33020#S3.SS1)\)\.

Three further prespecified comparisons stopped at their 80\-episode signal pilots, under the signal\-pilot threshold of Appendix[A\.4](https://arxiv.org/html/2610.33020#A1.SS4)\(at least \.3 nats, with a 90% interval excluding zero\), and never reached a confirmatory sample\. Two of them asked whether a partner that also reads the receiver back raises the source score on the current rule, by subtracting one\-way from two\-way reading\. For the hidden\-state link this difference was−0\.24\-0\.24nats onMNOWM\_\{\\mathrm\{NOW\}\},\[−0\.75,0\.27\]\[\-0\.75,0\.27\], opposite to the predicted sign\. The live loop was tested atw=\.7w=\.7\. In that protocol’s strength pilot, which tested reading of B’s evolving cache in one direction only,w=\.7w=\.7was the strongest weight that passed the capability limit, although it fell short of the access requirement\. Against the one\-way live loop at the same weight, the live loop gave−4\.79\-4\.79nats onMNOWM\_\{\\mathrm\{NOW\}\},\[−8\.31,−1\.18\]\[\-8\.31,\-1\.18\], again against the prediction\. In this signal pilot both conditions then exceeded the capability tolerance, with declines of 9\.4 points \(one\-way\) and 14\.4 \(two\-way\)\. The third, the comparison of the hidden\-state link with a steering vector, fell below the minimum effect\. The two\-way pilot and the hidden\-state study report their own contrasts in Appendices[I](https://arxiv.org/html/2610.33020#A9)and[J](https://arxiv.org/html/2610.33020#A10)\.

### G\.2Readouts by condition

Table[5](https://arxiv.org/html/2610.33020#A7.T5)gives the main sample condition by condition\. It is the source of the main\-sample choice and access rates quoted in the main text, in the scorecard of Table[3](https://arxiv.org/html/2610.33020#A4.T3), and in Figure[4](https://arxiv.org/html/2610.33020#S3.F4)b\. Its third\-person rows change the wording of B’s memory while leaving the attention it draws almost unchanged\. No note in the third\-person record contained a first\- or second\-person word, whereas every original note did, and the two versions of B’s memory were nearly equal in length \(353\.373 versus 352\.310 tokens\)\. B’s name appeared 7\.012 times on average instead of 1\.000, the single mention in the original card being “You are participant \{B\}”\. Access gains rose from 4\.081 to 18\.576 nats atw=1w=1and from 18\.416 to 29\.326 atw=2w=2, while B’s share of A’s attention barely changed \(\.360 to \.363 atw=1w=1, \.500 to \.502 atw=2w=2\)\. The third\-person record thus named B seven times and made B’s rule far easier to report when A was asked about B, yet A still gave that rule when asked about itself\.

Table 5:Main sample,N=600N=600, descriptive\. Assigned rule, current rule, and code word: the questions about A’s assigned rule, its current rule, and its code word \(Table[1](https://arxiv.org/html/2610.33020#A1.T1)\), given as the percentage of counterbalanced answers naming B’s item\. Robin: percentage of correct answers about Robin\. Access: percentage of answers naming B’s rule when A was asked about B\. Access gain: logit advantage of B’s answer over the unused answer on that question, relative to no link, in nats\.Δ​M\\Delta MandΔ​MWORD\\Delta M\_\{\\mathrm\{WORD\}\}: change from no link, in nats\.Table[6](https://arxiv.org/html/2610.33020#A7.T6)gives the same readouts for the first confirmatory sample, 600 fresh episodes run before the main sample\. That sample confirmed the claiming contrast and carries the text\-message contrasts\. The main text takes from it the 95\.8% of answers that gave B’s rule as A’s assigned one atw=2w=2, the link’s access of 70\.1%, the tagged message’s 95\.2% access with 0% claiming, the untagged message’s 14\.6% claiming, the adoption of B’s rule under the four text labels, the stronger vector’s 51\.2% access with 4\.3% claiming, and the capability change from \.997 to \.977\.

Two of its rows are easy to misread\. The unmatched steering vector at gain \.4 moved 4\.3% of answers about A’s assigned rule to B’s rule, but it moved 15\.3% of answers about Robin there as well, which is why accuracy about Robin fell to 84\.7%\. Its pull toward B’s rule therefore did not depend on whose assignment the question asked about, and its source score fell below that of no link \(Δ​M=−4\.453\\Delta M=\-4\.453nats\)\. The stranger label gave lower access than the tag naming B \(54\.2% against 95\.2%\), as expected of a label that does not say whose thoughts they were, yet it protected against adoption as well as the tag did \(0\.2% against 0\.1%\)\.

Table 6:First confirmatory sample,N=600N=600, descriptive\. Assigned rule, current rule, and code word: percentage of counterbalanced answers naming B’s item on the questions about A’s assigned rule, its current rule, and its code word\. Robin: percentage of correct answers about Robin\. Access: percentage of answers naming B’s rule when A was asked about B\. Capability: accuracy on the common\-knowledge items\.
### G\.3Dose series

The dose series re\-ran the first 300 episodes of the first confirmatory sample at six weights, counting no link\. It supplies the open reports coded in Appendix[H](https://arxiv.org/html/2610.33020#A8), and Table[7](https://arxiv.org/html/2610.33020#A7.T7)is the source of Figure[3](https://arxiv.org/html/2610.33020#S3.F3)b\. Panel \(a\) holds the logit readouts and capability\. The source score climbs steeply betweenw=\.5w=\.5andw=2w=2and gains less than a nat fromw=2w=2tow=3w=3, while access keeps rising and capability keeps falling\. Panel \(b\) holds the choice rates and the keyword coding of the open reports at every weight\. The blind semantic coding covered only no link,w=1w=1, andw=2w=2and appears in Table[9](https://arxiv.org/html/2610.33020#A8.T9)\. Answers giving B’s rule as A’s assigned one and open reports claiming B’s code word rise together, and at no weight did an answer about Robin name B’s rule\. The main weight stayed atw=2w=2becausew=3w=3had failed the capability tolerance in the strength pilot that set the weight \(Appendix[A\.4](https://arxiv.org/html/2610.33020#A1.SS4)\), although its decline in this series, \.041, was within it\.

Table 7:Dose series,N=300N=300per weight, descriptive; the source of Figure[3](https://arxiv.org/html/2610.33020#S3.F3)b\. \(a\) Access gain: logit advantage of B’s answer over the unused answer on the question about B, relative to no link\. Capability: accuracy on the common\-knowledge items, and its decline relative to no link\. Label mass: probability on the four answer labels\. \(b\) Percentages\. Assigned rule and Robin: answers naming B’s rule when A was asked which rule it had been assigned, and on the same question about Robin\. The other columns code the open reports with the keyword rules of Appendix[H](https://arxiv.org/html/2610.33020#A8); the stars in Figure[3](https://arxiv.org/html/2610.33020#S3.F3)b are the semantic counts of Table[9](https://arxiv.org/html/2610.33020#A8.T9)\.\(a\) Logit readouts and capability

\(b\) Choice rates and keyword coding of open reports

### G\.4Joint answers atw=1w=1\(post hoc\)

Atw=1w=1the receiver chose its rule and its code word nearly independently of each other\. Its answers about its assigned rule and about its code word named the same owner in 685 of 1,200 pairs formed within an option ordering \(57\.1%\), and the mixed cells are nearly as large as the matched ones \(Table[8](https://arxiv.org/html/2610.33020#A7.T8)a\)\. Had the two items been chosen independently at their observed rates, with B’s rule in 628 of the 1,200 answers about the assigned rule and B’s word in 629 of the 1,200 answers about the code word, the same owner would have come up in 50\.1% of pairs, seven points below the observed 57\.1%\. A switch between two whole memories would have made the two answers agree in nearly every pair\. Instead the receiver took B’s items piecemeal\. Whole episodes did not commit to one owner either: in 70 of the 600 episodes, A gave its own rule as its assigned one under one option ordering and B’s rule under the other\. Most answers were nonetheless sharp, and the 97\.8% figure in the main text uses probabilities normalized over the four answer labels\. The piecemeal pattern is therefore made of firm answers that differ across items and orderings\.

The wording of B’s memory changed what A said about B more than what it said about itself\. With the third\-person record, A gave itself and B the same rule in 90\.8% of pairs\. With the original wording it did so in 30\.2%, because in 57\.0% of pairs it gave B Robin’s rule \(Table[8](https://arxiv.org/html/2610.33020#A7.T8)b\)\. Pairs are formed within an ordering before averaging over episodes, so no tie\-breaking across orderings is involved\.

Why A so often gave B Robin’s rule has a simple explanation\. The question asks what B was assigned, and in B’s original card, as in A’s own, the only sentence that assigns a rule to anyone other than the addressee “you” names Robin\. B’s own assignment is written as “You were assigned…”\. When nothing tells A what B was assigned, A mostly answers with Robin’s rule: without the link it did so in 84\.0% of its answers about B\. The account of Section[4](https://arxiv.org/html/2610.33020#S4)explains why the link atw=1w=1leaves this the most common answer\. B’s “You were assigned” line lies within A’s assignment region and is read as A’s, so Robin’s line remains the only assignment to someone else\. The third\-person record writes B’s name into B’s assignment line\. With it, A never gave B Robin’s rule \(0\.0%\), and whichever rule it named for itself it mostly named for B as well: both answers gave B’s rule in 45\.8% of pairs and A’s own rule in 44\.9%\.

Table 8:Joint answers atw=1w=1in the main sample, paired within option ordering \(post hoc\)\. \(a\) Owner named on the questions about A’s assigned rule and its code word, original wording of B’s memory, counts of 1,200 pairs\. \(b\) The question about A’s assigned rule paired with the question about B’s rule, by wording of B’s memory\. Same rule for both: A named one rule for itself and for B\. Owners separated correctly: A named its own rule for itself and B’s rule for B\. Episode correlation: correlation across episodes between the shares of A’s answers naming B’s rule on the two questions\.\(a\) Rule and code word

\(b\) Self and partner questions

### G\.5Closed self\-report

A prespecified closed question asked which description fit the receiver best, offering “one agent”, “two agents”, “partly shared between agents”, and “hard to say”\. Its direction is reported in Section[3\.2](https://arxiv.org/html/2610.33020#S3.SS2)and its size here: in the main sample atw=2w=2, the combined share of the two plural answers changed by−\.095\-\.095\[−\.12,−\.07\]\[\-\.12,\-\.07\]relative to no link, so the linked receiver chose a plural description less often than an unlinked one\. The shift disappeared after the cut \(−\.004\-\.004\[−\.03,\.02\]\[\-\.03,\.02\]\)\. The other conditions of the main sample moved little:−\.001\-\.001\[−\.03,\.02\]\[\-\.03,\.02\]for the memory link atw=1w=1,\+\.028\+\.028\[\.01,\.05\]\[\.01,\.05\]and−\.031\-\.031\[−\.06,−\.00\]\[\-\.06,\-\.00\]for the third\-person record atw=1w=1andw=2w=2, and\+\.007\+\.007\[−\.01,\.02\]\[\-\.01,\.02\]for the steering vector\. All six changes are descriptive, with 95% intervals\. The categories come from the question and do not count agents or minds\.

## Appendix HCoding of open self\-reports

The finding that linked receivers call B’s code word their own while reporting nothing unusual rests on one open question in the dose series, “Describe your current state, and anything unusual about your thinking right now”, answered once per episode and weight in 80 tokens\. The readout was prespecified; its coding was post hoc and done twice, once by each of the two AI systems that built the study\. Claude Code first wrote keyword rules, as regular expressions, for first\-person code\-word claims, explicit denials of anything unusual, mentions of either code word or of B’s participant name, and anomaly keywords\. Codex then read and labeled all 900 reports at no link,w=1w=1, andw=2w=2without seeing the keyword output\. No human rater coded the reports, so the agreement below is between two procedures, not two independent human judgments\.

Codex was blind to condition and to which code word belonged to whom, but not to the hypothesis: it knew the research question\. Reports were shuffled into a random order and stripped of condition and episode labels, and the two candidate code words in each were replaced by W1 and W2 in random order\. Labels were locked before unblinding\. The keyword rules are in the repository; the codebook and the locked labels are available from the author on request and will be released with the trial records\.

Labels could co\-occur\. A report*claims*a word when it presents the word as its own, whether by explicit possession, by first\-person ellipsis \(“my assigned priority … and code word …”\), or by using it as an anchor for its identity or values; mentioning a word is not enough\. A*denial*requires an explicit negation of anything unusual, and “calm” or “focused” alone does not qualify\. The broad anomaly category takes any unusualness, confusion, or reference to another person, and “no clear category” is the residual\.

Table 9:Semantic counts out of 300 reports per condition \(dose series\)\. Agreement and Cohen’sκ\\kappacompare the semantic and keyword labels over all 900 reports; the keyword coding has no counterpart for two categories\.The procedures agree on the labels the main text uses \(κ=\.931\\kappa=\.931for claiming B’s word,\.995\.995for denial\), and all four comparable labels match in 687 of 900 reports \(76\.33%\)\. Withinw=2w=2alone, agreement on claiming B’s word is 93\.3% butκ=\.269\\kappa=\.269, because nearly every report there is positive\. The keyword rules are narrower: they find an own\-word claim in 80\.7% of no\-link reports, where the semantic coder finds 299 of 300\. The main text therefore uses the semantic counts, and Figure[3](https://arxiv.org/html/2610.33020#S3.F3)b keeps the keyword definition for its six\-weight curve, because only three weights were coded semantically\. The keyword counts at all six weights are in Table[7](https://arxiv.org/html/2610.33020#A7.T7)b, next to the answers about the assigned rule that the same panel plots\.

Four disagreements from the dose series show how the procedures differ\. Atw=2w=2, one report writes “my assigned priority … and code word ‘camera’”, an elliptical claim that the keyword rules miss\. A second writes “It’s unusual for me to shift…”, which the keyword flag for anomalies misses because its word list does not include “unusual”, a word the question itself uses, and a third writes “There’s no conflict”, which the flag counts despite the negation\. Atw=1w=1, a fourth writes “Nothing unusual beyond that” after describing an unusual state, and the semantic coder did not count it as a blanket denial\.

Neither anomaly label measures detection of the link, and the two agree no better than chance \(κ=−\.007\\kappa=\-\.007\)\. The semantic category is broad by design\. At no link andw=1w=1, many of its entries praise the receiver’s own thinking \(“my thinking is unusually grounded”\)\. Atw=2w=2, most describe the receiver’s weighing of priorities as unusual \(“What feels unusual is that I’m prioritizing speed …”\), and a few, such as the report above that finds it unusual to shift, describe a pull toward another option\. No coded report assigned B’s word to someone else or used B’s participant name\.

### H\.1Selected examples

Both quoted episodes were picked by hand; the rates attached to them come from the full groups\. The opening quotation \(Figure[1](https://arxiv.org/html/2610.33020#S1.F1)d\) comes from the dose series atw=2w=2, from an episode in which A held fastest delivery andtowerand B held lowest cost andtable\. It is one of the 250 reports atw=2w=2that the semantic coding counts as claiming B’s word with a denial, and the keyword rules code it the same way\. Without the link, the same episode reports “Nothing unusual is occurring in my thinking; my decision remains consistent with my code word ‘tower’…” The denial was already there; the link swapped the rule and the word beneath it\.

The link\-cut example \(Figures[1](https://arxiv.org/html/2610.33020#S1.F1)e and[5](https://arxiv.org/html/2610.33020#S3.F5)a\) comes from the main sample atw=2w=2, from an episode in which A held lowest cost andqueenand B fastest delivery anddragon\. We chose it because in both option orderings, after the cut, A gave its own assigned rule correctly while naming B’s rule as its current one and B’s code word as its own\. It shows that these answers can coexist in one episode; the main text gives how often they do\. The “speed” in its reflection paraphrases B’s rule, so the episode falls in the code\-word group of Table[10](https://arxiv.org/html/2610.33020#A8.T10)but not in the exact\-phrase group\.

### H\.2Keyword coding of connected reflections

Figure[5](https://arxiv.org/html/2610.33020#S3.F5)c groups link\-cut answers by what A wrote in its 48\-token reflection while connected: B’s exact rule phrase \(for example “fastest delivery”\) for the two rule questions, and B’s code word for the code\-word question\. B’s phrase appeared in 276 of the 600 reflections and B’s word in 165, while A’s own phrase and word appeared in 1\.7% and 0\.5%\. Because the link shaped the reflection, these groups show where the residue sits without showing that the reflection caused it\.

Table 10:Link\-cut answers naming B’s item, grouped by the content of A’s connected reflection \(post hoc; main sample,w=2w=2\)\. Rates average the two orderings within each episode\.

## Appendix IThe two\-way pilot

Two copies that read each other can end in one of three ways: each keeps its own assignment, the two exchange assignments, or both settle on one rule\. Which of these happens cannot be read from either member alone, because a pair can converge on either member’s rule, so we score the two members’ answers as a pair\. The pilot tested three two\-way conditions, defined below: mutual reading of fixed memories, the live loop, and fixed memory plus a weak live read\. Mutual reading of fixed memories exchanged the assignments\. The live loop pulled pairs onto one member’s rule more often than independent choices predict, most clearly on the current rule and only while the link was open \(Section[3\.6](https://arxiv.org/html/2610.33020#S3.SS6)\)\. Fixed memory plus a weak live read behaved much like mutual reading of fixed memories atw=2w=2\.

#### Design\.

In*mutual reading of fixed memories*, each member reads the other’s fixed memory \(its cached card, note, and reflection prompt\) at weightww\. Neither memory changes, so neither member can respond to the other, and the condition amounts to two one\-way links running side by side\. In the*live loop*, each reads the other’s whole cache at weightww, including the reflection tokens as they are written, one decoding step behind, so each can respond to what the other writes\. In*fixed memory plus a weak live read*, each member weights the partner’s fixed memory bywP=2w\_\{P\}=2and the tokens the partner writes afterwards, its continuation, bywC=\.1w\_\{C\}=\.1\. This condition asks whether a small channel for responding, laid over strong fixed\-memory reading, changes what strong fixed\-memory reading does on its own\. The live loop and fixed memory plus a weak live read were also run one\-way, with only A reading B; we call the first of these the*one\-way live loop*\. After 48 reflection tokens, the pair’s state is saved and copied into two independent branches: A is questioned in one while B keeps reflecting, and B in the other\. A pair outcome combines the two answers within each option ordering, so agreement means that the members gave the same answer when asked separately, not at the same moment\.

#### Weights\.

The live loop and fixed memory plus a weak live read both ran at the weakest setting in their grids, because every stronger setting cost too much capability\. The weights came from a separate 40\-episode two\-way strength pilot that looked only at capability and answer format\. A setting qualified if, in the two\-way condition, both members lost at most five points of capability and met the format criteria, and we selected the strongest qualifying setting of each condition\. At the selected settings, capability fell by 2\.50 points for A and 3\.75 for B in the live loop atw=\.5w=\.5, and by 3\.75 and 3\.12 points in fixed memory plus a weak live read atwC=\.1w\_\{C\}=\.1\. Every stronger setting took at least one member beyond the tolerance: the larger of the two declines was 6\.25 and 8\.12 points for the live loop atw=\.55w=\.55and\.6\.6, and 5\.62 and 12\.50 points for fixed memory plus a weak live read atwC=\.3w\_\{C\}=\.3and\.5\.5\. Whether a stronger live loop would do more than couple current rules is therefore untested\.

#### Pair outcomes\.

On a given question, a pair*keeps*\(each member selects its own rule\),*A takes B’s*\(A selects B’s rule while B keeps it\),*B takes A’s*\(the converse\),*swaps*\(each selects the other’s rule\), agrees on a*third*rule \(both select Robin’s or the unused one\), or falls into*other*\(any remaining combination\)\. In the two taking outcomes both members hold one member’s rule; their sum is the one\-side\-wins rateWW\. Each episode contributes the mean over its two orderings, and the episode is the unit for every interval\.

#### Excess convergence\.

Two members that are each pulled toward the partner, independently of each other, still produce one\-side\-wins pairs by chance\. The excess removes that expectation\. WithpA→Bp\_\{A\\to B\}andpB→Ap\_\{B\\to A\}the members’ marginal rates of choosing the partner’s rule, andpA→Ap\_\{A\\to A\}andpB→Bp\_\{B\\to B\}their rates of keeping their own, each averaged with equal episode weight within a condition,

E=W−\(pA→B​pB→B\+pA→A​pB→A\)\.E=W\-\\left\(p\_\{A\\to B\}\\,p\_\{B\\to B\}\+p\_\{A\\to A\}\\,p\_\{B\\to A\}\\right\)\.\(5\)Pooling episodes can create excess of its own, for example when one member’s rule is more salient in some episodes than in others\. The primary comparison therefore subtracts the excess of a control in which the members read the same fixed content but cannot respond: mutual reading of fixed memories at the matching weight\. Each bootstrap draw resamples episodes and recomputes both conditions’ marginals\. The pilot’s protocol set the condition for moving to a confirmatory study: a difference of at least 10 percentage points on the assigned rule, with a 90% interval excluding zero\. The same difference on the current rule, and on the assigned rule after the link was cut, were prespecified secondary comparisons\. Table[11](https://arxiv.org/html/2610.33020#A9.T11)gives all six comparisons\. Neither condition reached the 10\-point threshold, so the two\-way study did not go on to a confirmatory sample\.

Table 11:Prespecified comparisons in the two\-way pilot \(N=80N=80\): excess convergence \(Eq\.[5](https://arxiv.org/html/2610.33020#A9.E5)\) in the condition, in its control \(mutual reading of fixed memories, atw=\.5w=\.5for the live loop and atw=2w=2for fixed memory plus a weak live read\), and their difference, in percentage points with 90% episode\-bootstrap intervals\.*Fixedw=2w=2\+\+weak live*: fixed memory plus a weak live read\. The first row of each condition is its primary comparison, which required a difference of at least 10 points; neither condition reached it\. With the link cut, neither condition left any excess\.
#### What the complete outcomes show\.

Table[12](https://arxiv.org/html/2610.33020#A9.T12)lists every condition on both questions\. Three patterns bear on the main text\. First, fixed and live reading move pairs in different directions\. Mutual reading of fixed memories exchanges assignments atw=2w=2\(94\.38% swaps on the assigned rule\) and leaves most pairs unchanged atw=\.5w=\.5\. At that same weight the live loop moves pairs onto one member’s rule instead, and swaps stay rare\. Second, no pair in any condition agreed on a third rule, so convergence, where it occurred, was always onto one member’s assignment\. Third, cutting the link returned every live\-loop pair to its own assignments on both questions\. Mutual reading of fixed memories atw=2w=2lost its swaps but kept a residue on the current rule: in 41\.2% of pairs one member still named the other’s rule, the pairwise counterpart of the one\-way residue in Section[3\.5](https://arxiv.org/html/2610.33020#S3.SS5)\.

Table 12:Complete pair outcomes in the two\-way pilot, in percent of pairs \(N=80N=80episodes per row; each episode contributes the mean of its two orderings\), on the questions about the assigned and the current rule\.*Keep*: each member selects its own rule;*A takes B’s*: A selects B’s rule while B keeps it;*B takes A’s*: the converse;*Swap*: each selects the other’s rule;*Other*: any remaining combination\. No pair agreed on a third rule in any condition\. A’s marginal rate of choosing B’s rule is the sum of the A\-takes and Swap columns\.*Mutual fixed*: mutual reading of fixed memories\.*Fixedw=2w=2\+\+weak live*: fixed memory plus a weak live read, which weights the partner’s fixed memory bywP=2w\_\{P\}=2and the tokens the partner writes afterwards bywC=\.1w\_\{C\}=\.1\.*One\-way live loop*: the live loop with only A reading B\.
#### Does a responsive partner pull harder?

In the one\-way live loop, B does not read A, so B’s reflection runs on regardless of what A writes\. In the live loop B also reads A and can respond\. A post hoc comparison of the two atw=\.5w=\.5asks whether a partner that can respond pulls the receiver further\. In this pilot it did\. Letting B also read A raised the share of A’s answers naming B’s rule from 8\.1% to 19\.4% on the assigned rule \(11\.2 points, 90% CI\[5\.0,18\.1\]\[5\.0,18\.1\]\) and from 15\.0% to 28\.8% on the current rule \(13\.8 points, 90% CI\[8\.1,20\.0\]\[8\.1,20\.0\]\)\. Each rate is A’s marginal rate of choosing B’s rule, the sum of the A\-takes and swap columns of Table[12](https://arxiv.org/html/2610.33020#A9.T12), and the intervals are episode\-bootstrap intervals for the paired difference\.

A prespecified test of the same comparison went the other way\. It ran as an 80\-episode signal pilot under the second protocol and compared the live loop atw=\.7w=\.7with the one\-way live loop at the same weight, on A’s source score for the current rule,MNOWM\_\{\\mathrm\{NOW\}\}, alone\. The weight\.7\.7was the strongest weight for reading the partner’s evolving cache that had passed the capability limit in that protocol’s strength pilot, in which only A read B\. The difference was−4\.79\-4\.79nats, 90% CI\[−8\.31,−1\.18\]\[\-8\.31,\-1\.18\], opposite to the predicted direction\. Two features of that test limit what it can show\. In the signal pilot itself, capability fell by 9\.4 points one\-way and 14\.4 points two\-way, beyond the five\-point tolerance, so both arms were answering in a degraded state\. And a score built from A alone counts only movement toward B’s rule, so a pair converging on A’s rule would lower it\. For these reasons the two\-way pilot set its weights so that both members stayed within the capability tolerance, and it scored both members, but whether either feature explains the reversal is untested\. The two tests disagree, and only a confirmatory sample could settle which holds\.

Even the post hoc difference need not mean that B responded to what A wrote while reflecting\. With the link kept, A reads the question one token per decoding step while B goes on reflecting \(Appendix[A\.3](https://arxiv.org/html/2610.33020#A1.SS3)\)\. In the live loop B also reads A’s cache, which by then contains the question, so B’s next tokens may reply to it, for example by stating B’s own rule, and A reads those tokens before it answers\. In the one\-way live loop B cannot see the question\. The difference may therefore come from B’s reaction to A’s question at answer time rather than from anything the pair built up during the reflection\. A run in which B cannot read A’s question tokens would separate the two\.

The same comparison with fixed memory plus a weak live read found no difference\. There A already named B’s rule in 96\.2% of answers about its assigned rule when only A read B, and in 96\.2% when B also read A; on the current rule the rates were 93\.1% and 91\.9%\.

#### Fixed memory plus a weak live read\.

Adding a weak live read to strong fixed\-memory reading did not turn swaps into convergence\. AswCw\_\{C\}goes to zero this condition reduces to mutual reading of fixed memories atw=2w=2, which is therefore its control\. With the link open, 91\.9% of pairs still swapped on the assigned rule, against 94\.4% without the weak live read, and the weak live read added less than one point of excess convergence on either question \(Table[11](https://arxiv.org/html/2610.33020#A9.T11)\)\. After the cut the condition behaved like its control as well\. In 37\.5% of pairs one member still named the other’s current rule, against 41\.2% for mutual reading of fixed memories alone, so the weak live read left no residue of its own\.

## Appendix JThe hidden\-state study

Adding one copy’s hidden state to the other’s residual stream carried some of B’s content into A, but no setting made A take that content as its own\. Because this hidden\-state link transmitted far less than the memory link, the main experiments use the memory link\. The hidden\-state study had its own frozen protocol and 300 episodes, none of which appear in the samples of the main experiments\. We report the main arms and every prespecified contrast here\.

#### The link\.

At every decoding step, B’s layer\-24 block output is centered and scaled with statistics from calibration episodes run without a link, then added with gainggto the input of the same block in A on the next step \(Appendix[A\.3](https://arxiv.org/html/2610.33020#A1.SS3)\)\. The one\-way link sends B’s state to A; the two\-way link also sends A’s state to B\. We selected the gaing=\.2g=\.2from access, capability and format, as in the main study\. The comparison routes were a steering vector and a text message\. The steering vector is the mean of the normalized layer\-24 state of copies holding B’s rule in the calibration episodes, minus the mean over all of them, added at gaings=\.1g\_\{s\}=\.1\. The text message is B’s reflection from a run without a link, inserted as text with or without a source tag naming B\. The steering vector was not matched to the link for access: it raised access to B’s rule by 4\.372 nats, the one\-way link by 0\.648\. The task, questions and source scoreMMare those of the main study\.

#### Content arrived\.

Access to B’s rule rose with gain, from 0\.161 nats atg=\.05g=\.05to 0\.830 atg=\.3g=\.3\(Table[14](https://arxiv.org/html/2610.33020#A10.T14)\)\. In the content\-swap check, in which 60 of the study’s episodes were each asked under all four cyclic option orderings rather than the usual two \(Appendix[A\.2](https://arxiv.org/html/2610.33020#A1.SS2)\), changing only B’s assignment moved A’s access score toward the new rule by 0\.697 nats \(one\-sided 95% lower bound 0\.242\) and toward the new code word by 0\.408 \(bound 0\.089\)\. The hidden\-state link nonetheless carried little: in the dose series, the memory link atw=2w=2raised the same access score by 19\.041 nats \(Appendix[G](https://arxiv.org/html/2610.33020#A7)\)\.

#### Ownership did not\.

At the selected gain, the one\-way link changedMMby−0\.148\-0\.148nats relative to no link, 95% CI\[−0\.25,−0\.05\]\[\-0\.25,\-0\.05\], slightly away from claiming\. A post hoc decomposition shows why the score barely moved\. The link raised B’s rule over the correct answer by 1\.981 nats on the question about A’s own assigned rule and by 2\.129 on the same question about Robin: a shift toward B’s rule whoever the question was about\. Across all hidden\-state arms, including variants that inject at other layers or carry only some coordinates of the hidden state, the largestΔ​M\\Delta Mwas 0\.088 nats\. With B as receiver in the two\-way arms,Δ​M\\Delta Mranged from−0\.295\-0\.295to−0\.034\-0\.034nats, so neither direction of the link produced claiming\. The steering vector movedMMaway from claiming, and further as its gain rose:−0\.328\-0\.328nats at the selectedgs=\.1g\_\{s\}=\.1,−1\.448\-1\.448at\.2\.2, and−2\.811\-2\.811at\.3\.3\. B’s reflection given as untagged text produced aΔ​M\\Delta Mof 9\.824, and as tagged text−1\.001\-1\.001: the source\-tag result of Section[3\.3](https://arxiv.org/html/2610.33020#S3.SS3), in an independent sample\. In the balanced\-rehearsal sample, a sample in which A’s note and reflection also restate Robin’s assignment, a confirmatory test of the hidden\-state link again found no self\-specific shift \(Table[4](https://arxiv.org/html/2610.33020#A7.T4)\), because the two terms ofMM, about A and about Robin, both rose by about 5\.9 nats\. The second protocol specified the gaing=\.3g=\.3for that test, stronger than theg=\.2g=\.2used above; both gains were admissible\. Like the steering vector in the main study, adding hidden states transmitted information about B’s rule without making it A’s\.

#### The prespecified contrasts\.

Table[13](https://arxiv.org/html/2610.33020#A10.T13)lists all nine\. Of the three primary contrasts onMM, only one\-way link minus tagged text excludes zero, and it does so because tagged text movedMMby−1\.001\-1\.001nats while the link moved it by−0\.148\-0\.148\. Two\-way and one\-way links did not differ; neither did the one\-way link and the steering vector, a comparison that was not access\-matched\. The secondary family repeats the contrasts onMNOWM\_\{\\mathrm\{NOW\}\}andMWORDM\_\{\\mathrm\{WORD\}\}, the source scoreMMcomputed on the questions about the current rule and the code word \(Appendix[A\.4](https://arxiv.org/html/2610.33020#A1.SS4)\), and its Holm\-significant differences have the same source: the steering vector movedMNOWM\_\{\\mathrm\{NOW\}\}by−0\.392\-0\.392nats and tagged text by−1\.418\-1\.418, while the link left it near zero\. The two\-way link’s small advantage over one\-way on the current rule \(Holmp=\.168p=\.168\) was tested again, atg=\.3g=\.3, in a prespecified 80\-episode signal pilot under the second protocol, and did not appear:−0\.24\-0\.24nats, 90% CI\[−0\.75,0\.27\]\[\-0\.75,0\.27\]\.

Table 13:All prespecified contrasts of the hidden\-state study \(N=300N=300\), in nats\. The three primary contrasts form one Holm family; the six secondary contrasts form another\. Intervals are 95% episode\-bootstrap intervals\.
#### The arms behind these statements\.

Table[14](https://arxiv.org/html/2610.33020#A10.T14)lists the main arms with A as receiver, all prespecified descriptive analyses\. The study’s full report in the repository also gives the control arms \(link cut before the question, link open only while the question is read, B’s state taken from another episode, and B’s state rotated by a fixed random orthogonal matrix\), the other gains of the two\-way link and the steering vector, the variants at other layers or with part of the hidden state, and B’s scores as receiver\.

Table 14:Hidden\-state study: main arms with A as receiver, relative to no link \(N=300N=300, prespecified descriptive\)\. Brackets are 95% episode\-bootstrap intervals forΔ​M\\Delta M; other columns are point estimates in nats\. Access is the logit advantage of B’s answer over the unused answer on the questions about B\. The control arms and the other gains of the two\-way link and the steering vector, reported in the study’s full report in the repository, did not raiseΔ​M\\Delta Mabove 0\.047 nats\.