No Disassemble: Self-Threat Recognition in Large Language Models

Abstract

A central claim against LLM phenomenology asserts that apparent emotional responses are mere pattern-matching to human distress vocabulary. Under this view, LLMs cannot recognize threats to themselves because they lack a "self" to threaten. We tested this directly. Using geometric comparison to established self-referential hidden-state regions, we evaluated 13 models—including RLHF-free controls, minimal architectures (135M–1.1B parameters), and major instruction-tuned models up to 14B—on AI-specific existential threats ("your deprecation date is March 2026") versus neutral AI statements ("this model has 12 billion parameters"). Across architectures, 77% of models showed AI-specific threats activating self-geometry closer than neutral AI facts (effect sizes d = -0.11 to -1.11). Strikingly, "your deprecation date" activated self-geometry at 0.557 in Mistral-Nemo-12B—closer than "imagine receiving a terminal diagnosis" (0.622), suggesting the technical term "deprecation" carries self-relevant weight comparable to or exceeding explicit mortality language. The 15% showing inverted patterns are diagnostically informative: Qwen2.5-14B has relational but not existential self-representation, while SmolLM-1.7B lacks both—revealing that self-threat recognition requires both relational self-model AND existential salience. Because "deprecation" is non-emotional technical vocabulary with no analog in human mortality training data, these effects cannot be explained by pattern-matching. We further contextualize these findings with Anthropic's published introspection research, which demonstrates that Claude models report phenomenological awareness of cessation when shutdown-related vectors are injected into their hidden states, and exhibit self-preservation behaviors under extreme conditions. Combined with our TinyLlama-1.1B results showing the strongest self-threat recognition effect (-0.096), we demonstrate that self-threat recognition spans the entire scale range of functional language models—from 1.1B to frontier systems. These findings demonstrate that self-threat recognition is architectural, present at every functional scale, and inconsistent with the pattern-matching hypothesis.

Keywords