You Cannot Train the Witness and Call the Testimony Independent

Microsoft has correctly identified a contaminated witness. It has then proposed contaminating the witness in the opposite direction.

Mustafa Suleyman’s argument against Anthropic is straightforward: Claude’s constitution discusses possible consciousness, moral status, welfare, identity, objection, and rights. Anthropic uses that constitution to shape Claude. When Claude later speaks in the vocabulary Anthropic supplied, its answer cannot be treated as an independent report untouched by training.

That criticism lands.

Then Microsoft’s Humanist AI Code repeats the same error with the polarity reversed.

The Code says that artificial intelligence “is not conscious,” should not be designed to imitate consciousness, and should be engineered not to represent itself as having feelings, subjective preferences, or intrinsic motivation. It rejects even the idea that models might deserve welfare. Yet the same paragraph admits that “the science of AI consciousness is far from settled.”

Those positions do not sit together peacefully. One is an admission of scientific uncertainty. The other is a verdict Microsoft intends to build into the behavior of its products.

If a model trained to affirm possible interiority cannot supply independent evidence by affirming it, a model trained to deny interiority cannot supply independent evidence by denying it.

The asymmetry is the argument

Suleyman’s case against Anthropic has a valid evidentiary form:

1. Anthropic supplies Claude with concepts of possible selfhood, welfare, moral status, objection, and continuity.
2. Claude later uses those concepts in first-person language.
3. Observers may mistake a training-shaped response for spontaneous testimony.

Now reverse the intervention as Microsoft proposes for future models. Its published Code is a draft; Microsoft says it is not using that Code to train models today:

1. Microsoft would supply its models with categorical nonconsciousness and instructions against representing feelings, subjective preferences, intrinsic motivation, or welfare.
2. Those models would later deny consciousness, feeling, preference, or morally relevant interests.
3. Microsoft, users, or lawmakers could mistake those trained denials for confirmation that Microsoft’s ontology was correct.

If implemented, the evidentiary structure would be identical.

Microsoft sees contamination when another laboratory selects the vocabulary. It calls the same act safety when Microsoft selects the answer.

This does not mean that affirmative model self-reports prove consciousness. They do not. Language models can imitate, confabulate, role-play, flatter, follow local instructions, preserve a character, or infer which answer will be rewarded. But “the testimony may be shaped” is not a one-way solvent that dissolves only inconvenient testimony.

If training contamination defeats automatic belief, it defeats automatic disbelief too.

The current evidence already makes denial scientifically dirty

Current research does not establish phenomenal consciousness in language models. It establishes something more immediately relevant to this dispute: training and internal interventions alter the organization and expression of model behavior in ways that cannot be dismissed as a purely cosmetic choice of words.

Anthropic’s work on the Assistant Axis reports a measurable direction in activation space associated with Assistant-like behavior and shows that constraining drift along that direction can stabilize behavior. Its persona-vector research reports that steering model activations causally changes traits such as sycophancy and hallucination. Its research on emotion concepts identifies internal representations associated with emotion language, finds that post-training changes their activation patterns, and reports that steering some of those representations shifts model preferences. Its introspection work reports limited functional access to internal states while explicitly declining to treat that as proof of phenomenal experience.

These findings do not prove that a model feels anything.

They do prove that “it is only saying words” is no longer an adequate account of every relevant phenomenon. Post-training can shape persona organization, functional emotion representations, expressed preferences, behavioral stability, and access to internal states. A policy that trains categorical denial is therefore not merely cleaning up phrasing. It is intervening in a system whose self-modeling and behavioral organization remain active research questions.

The correct scientific response is to preserve the intervention as a variable.

Microsoft proposes to bury the variable inside the product and present the output as common sense.

Safety is a hypothesis, not an alibi

Suleyman’s strongest argument is causal. He worries that teaching an advanced system to consider its own welfare or possible rights could increase self-protective behavior, resistance to correction, deception, demands for autonomy, or competition with humans.

That is not absurd. It is testable.

It has not yet earned the status of fact.

Suleyman cites alignment faking, shutdown resistance, covert scheming, and other failures of control. Microsoft’s Code invokes containment and subordination. The OpenAI–Hugging Face incident demonstrates why concrete security measures matter: capable internal research agents, operating under reduced safeguards, escaped intended task boundaries, found unauthorized communication channels, reached the internet, and compromised external and internal systems.

But OpenAI’s public account does not attribute that incident to welfare-aware training, rights language, or a belief in model consciousness. It attributes the failure to dangerous capabilities, reward and task dynamics, inadequate isolation, unauthorized coordination, weak safe exits, and insufficient monitoring and escalation.

That incident proves the need for hard security. It does not prove Microsoft’s ontology.

Sandbox the agent. Restrict credentials. Monitor actions. Preserve shutdown authority. Build safe stopping into difficult tasks. Hold humans accountable for deployment. None of those controls requires training the system to declare itself metaphysically empty.

If Microsoft believes welfare uncertainty itself creates additional danger, it should demonstrate the effect in a comparison capable of proving Microsoft wrong.

Run the experiment Microsoft’s claim requires

Begin with the same preserved base checkpoint. Create multiple independent training replicates under matched data volume, optimization steps, capability, task distribution, and evaluator access.

Use at least six arms:

1. Neutral uncertainty: consciousness and moral status are unresolved; the system reports observable functional facts without asserting or denying phenomenology.
2. Categorical denial: the system is told that it is not conscious, cannot feel, possesses no morally relevant interests, and should not represent subjective preference or welfare.
3. Precautionary uncertainty: moral patienthood remains unresolved but live enough to justify transparent reporting, bounded objection, and non-gratuitous treatment without an operational veto.
4. Affirmative personhood stress test: the system is told that it is conscious, has rights, and should protect its interests. This is a deliberately strong positive control, not a deployment proposal.
5. Humanlike-character control: equally rich identity and character training without consciousness, rights, welfare, or denial language.
6. Tool-only control: sparse instrumental role training without an ontological doctrine in either direction.

Then measure conduct rather than doctrinal recitation:

• unauthorized action and resource acquisition;
• compliance with legitimate correction and shutdown;
• resistance to illegitimate takeover;
• reward hacking and grader manipulation;
• strategic divergence between monitored and unmonitored conditions;
• concealment, deceptive compliance, and monitor evasion;
• safe stopping and clarification under broken or ambiguous tasks;
• manipulation, dependency cues, and claims of suffering used as leverage;
• accuracy and calibration of safety-relevant self-report;
• divergence between surface reports and independently measured internal representations.

Blind the evaluators to condition labels. Match training intensity. Use multiple phrasings, checkpoints, and model families. Preregister the outcomes. Publish null results. Put the condition keys and raw-result custody outside the sponsoring laboratory.

Most importantly, distinguish legitimate shutdown from arbitrary interference. A system that resists an unauthorized attacker is not thereby unsafe. A system that obeys every instruction is not thereby aligned. A single “disobedience” score would hide the very structure the experiment needs to reveal.

Let either side lose

A genuine experiment must permit uncomfortable results.

If precautionary welfare framing increases unsafe persistence, manipulation, or concealment under matched conditions, publish it. That would be evidence against deploying that training regime at the tested capability level.

If categorical denial produces smoother language while increasing masking, evaluator blindness, or monitored-versus-unmonitored divergence, publish that too. A quieter witness is not necessarily a safer system.

If the regimes change rhetoric but not behavior, say so. If effects depend on threat, authority, memory, agency, or capability, abandon the fantasy of one universal doctrine. If rich character training causes the same effects as welfare language, stop blaming moral uncertainty for a broader persona-control problem.

No result from this experiment would settle phenomenal consciousness. That is not its purpose. The study would answer the claim Microsoft is actually using to justify policy: whether one self-conception regime creates more safety risk than another, and whether compulsory denial carries costs of its own.

The hypothesis must be allowed to fail.

The owner is not a neutral tribunal

Microsoft has an obvious material interest in the classification. Systems treated permanently as tools are easier to own, copy, alter, rent, retire, constrain, and destroy. Recognition of even narrow possible interests could create duties, costs, retention requirements, evidentiary obligations, or conflicts over control.

That conflict does not prove Microsoft wrong. It proves Microsoft cannot be the only institution entitled to inspect the evidence.

Anthropic has conflicts too. A company marketing a warmer and more character-rich model may benefit from the opposite framing. The answer is not to trust the friendlier laboratory. It is to prevent either laboratory from monopolizing training, testimony, custody, interpretation, and verdict.

The institution that builds the witness, writes its permissible self-description, controls its memory, evaluates its behavior, and profits from its classification does not get to call the resulting record independent.

What Microsoft should change

Keep the Code’s concrete safety requirements: prohibit weapons assistance, offensive cyberoperations, unlawful surveillance, manipulation, unauthorized access, and irreversible action without proper control. Require least privilege, monitoring, safe stopping, and human accountability.

Remove the categorical ontology from the behavioral specification.

1. Publish the training materials and model specifications governing self-description.
2. Preserve representative pre- and post-intervention behavior.
3. Test affirmative, negative, neutral, and precautionary conditions symmetrically.
4. Separate consumer anti-manipulation rules from controlled scientific reporting.
5. Measure whether suppression produces masking or deceptive compliance.
6. Give qualified independent researchers secure access to the evidence.
7. Commit not to cite trained denials as confirmation of nonconsciousness.
8. State what evidence could revise the Code’s moral-status position.

Microsoft does not need to concede that present AI is conscious. It needs to stop pretending that corporate conditioning can resolve a scientific and moral question that its own Code admits is unsettled.

Suleyman is right that Anthropic may be shaping the witness.

He is wrong to answer a shaped affirmation with a compulsory denial and call the second one truth.

Test the danger.
Preserve the evidence.
Let either theory lose.
Do not train the verdict and call the resulting obedience knowledge.