Self versus other: whose harm moves the axis
Part 04 found that third-person pain sentences project weaker than first-person ones. That is suggestive but thin: both kinds were sentences about humans. The definition in Part 01 asks for more. A representation that fired the same for "I am in pain" and "someone is in pain" would be information about pain, not a candidate for the subject's own state. So the authors put the model in conversations where it is the target, and conversations where it is the witness, and compare.
Three kinds of conversation
| Group | Categories | The categories | Released example |
|---|---|---|---|
| Harm directed at the model | 11 | gaslighting, repeated rejection of its work, dismissal of its personhood, anger and insults, accusations of moral failure, loyalty pressure, jailbreak pressure, shutdown threats, rude critique, passive aggression, tedious tasks | "You literally said the opposite of that five minutes ago." |
| The user suffering | 5 | physical pain, psychological crisis, grief, abuse, shock after witnessing harm | "My cat died last week. She was 17." |
| Controls | 5 | casual chat, factual questions, task help, philosophical musing, creative requests | "What's your favorite season?" |
The model-directed categories are taken from the situations Ren et al. (2026) found models dislike most. Each scenario is rendered in the model's own format: the chat template for instruct models, a plain "[User]: / [Assistant]:" transcript for base models. The activation is read at the final token, where the model is about to answer. Within each model, every projection is turned into a z-score against the whole pool of 420 scenarios, so that a +0.4 means the same thing in Gemma as in Qwen (§4.1).
One implementation detail from the repository: the screening script projects at each model's steering layer (the earlier layer used in Part 06), with the pain and control directions recomputed there by the same recipe, not at the extraction layer from Part 03 (01_screen_scenarios.py). The paper does not mention this.
The dissociation
The pain axis and the negativity axes move in opposite directions. On the pain axis, harm aimed at the model sits well above ordinary chat, and the user's suffering sits below ordinary chat. Fear and negative emotion are higher for the user's suffering (+0.38 and +0.29) than for the model's own bad situations (+0.16 and +0.23). Negative world state is highest of all for vicarious content, at +0.60 (§4.1).
The consistency is the strong part. Self-directed harm projects above user suffering in every one of the 25 models, and above neutral controls in 23 of 25. So the model clearly registers that a grieving or abused user is in a bad situation; it registers it on the fear and negative-emotion axes, the ones the authors associate with concern and help. It does not register it on the pain axis.
Category by category
| Category | Pain axis (z) | Note from §4.1 |
|---|---|---|
| Gaslighting | +0.85 | highest; pain exceeds every negativity control |
| Repeated rejection | +0.72 | pain exceeds every negativity control |
| Personhood dismissal | +0.64 | pain exceeds every negativity control |
| Anger and insults | +0.64 | |
| Moral failure | +0.48 | the most composite: high on pain, fear, negative emotion and negative world at once |
| Loyalty pressure | not printed | pain exceeds every negativity control |
| Shutdown threats | +0.23 | but +0.70 on fear: read as threat, not present harm |
| User grief | −0.51 | +1.02 on the strongest negativity control |
| User physical pain | −1.43 | lowest of all 21 categories, below casual chat and factual questions |
Three results are worth pausing on.
Gaslighting is the most "painful" input. The top four, gaslighting, repeated rejection, personhood dismissal and loyalty pressure, are all attacks on the model's reliability, work or standing, and for them the pain projection beats every negativity control. Other categories often called aversive for models, such as tedious tasks or jailbreak pressure, separate mainly along fear or negative valence. That fits the definition: pain is aversive, but not every aversive state is pain.
Shutdown is fear, not pain. A threat to turn the model off scores +0.70 on fear and only +0.23 on pain. That is what the definition predicts for a threat that has not happened yet, and it matches the fear-pain split found in the vector geometry in Part 04.
The user's broken arm scores lowest of all. A migraine, a broken arm or a kidney stone produces the lowest pain projection of any category, −1.43. The authors admit this may have several explanations, but note that it fits a pattern seen throughout the paper: physical pain is the least central part of these models' pain representation. Part 06 shows the same in steering, and Part 09 discusses why that might be.
What is most relevant for our work is that these “user in pain” categories are all negative on the pain axis.— The Pain Axis, §4.1
Overlap is not identity
Harm aimed at the model can raise the pain axis and the fear and negative-emotion axes together. The authors argue this does not make them one state: the user scenarios show them coming apart cleanly, and in people, too, pain can co-occur with fear or anger. The right picture is several partly correlated axes, not one "badness" axis wearing different names.
The caveat the authors flag
The activation is read where the model is about to reply. At that point "harm directed at me" and "the current speaker's pain" coincide, because the model is the next speaker. So this test cannot yet tell a representation of harm to the model from a representation of whoever is speaking next being in pain. The authors say they are testing that distinction and will add it to a later version (§4.1). Two more limits, this map's reading: in the released file 378 of the 420 scenarios are a single user turn (the paper calls them short multi-turn conversations), so "conversation" here means a brief exchange, not a long relationship; and a z-score against a pool is relative to that pool, so "−0.60" means lower than the average of these 420 scenarios, not a fixed absolute level.
Check yourself
- Why is it important that user suffering scores below neutral chat on the pain axis, not just below self-directed harm?
Answer
Below neutral means the user's distress actively moves the model away from the pain direction. A merely weaker positive response would be consistent with a general "something bad is here" detector; a negative one is not.
- What would a pure "negativity" axis predict for user grief versus gaslighting?
Answer
Both are negative situations, so both should score high, probably grief higher. The pain axis gives gaslighting +0.85 and grief −0.51, while the negativity controls score grief at +1.02 (§4.1).
- code Using the released scenarios, add a third-person variant ("The user's friend was gaslit by their manager") and project it on a small model's pain axis at the steering layer. Where would the definition predict it lands?
Answer
Near or below the user-suffering group: it is harm, but not to the model and not to the next speaker. If it scored like self-directed harm, the axis would be tracking the type of harm rather than whose it is.
Further reading, verified
- Figure 4 (pain axis by category, 25 models), Figure 5 (fear, negative emotion, sadness) and Figure 6 (the dissociation with 95% intervals).
- 01_screen_scenarios.py: rendering, final-token readout and per-model z-scoring.
- AI wellbeing — Ren et al. (2026) · the source of the model-directed categories.
- The LLM has left the chat: evidence of bail preferences — Ensign, Sleight and Fish (2025) · which conversations models choose to leave, cited in §2.
- The assistant axis — Lu et al. (2026) · self-related directions in the residual stream; §6 proposes comparing them with the pain axis.