Z-scoring the J-lens against base-model token frequency lifts hidden-word recovery to 0.805

An offset here is a token's mean lens score, the part of the readout that does not move with what the activation means ^[9]. Subtracting it is the obvious first move, and the post registers that gate as failed: direct subtraction worked only in the R-lens's early junk band ^[19]. The reason shows up in a correlation. In Qwen3.5-4B layers 18 to 21, the J-lens offset tracks log token frequency at Spearman 0.48, a pattern the R-lens shares and the plain logit lens does not at -0.05 ^[11]. Token frequency is part of what the model is computing, so taking the offset out takes signal with it ^[12]. The cost of doing it anyway was measured. At layers 17 to 23, subtraction made the J-lens 3.5x to 7.3x worse and the R-lens 5.2x to 12.3x worse ^[13]. Higher up, at layers 24 to 28 where the lens reads best, the same operation cost only 1.2x to 1.8x ^[14]. The damage scaled with how frequent the token being read was, rho = 0.69 ^[15]. What worked is z-scoring: subtract the mean, then divide by the spread ^[16]. Both statistics are estimated on the clean base model, never on the organism being read ^[17]. A taboo organism, in Cywiński et al.'s sense, is a model fine-tuned to hide a secret word ^[10]. The J-lens itself is the logit lens with the activation passed through a fitted Jacobian first ^[7], where the logit lens is norm and unembed applied to a residual activation at layer L ^[6]. The headline number is 0.805 leave-one-out against 0.665 for Cywiński et al.'s protocol on Gemma-2-9B-it, over 20 words ^[1], with that baseline rerun on the author's own machine ^[29]. That is 0.140 of accuracy, or 42 percent of the error that was left: 0.335 wrong becomes 0.195 ^[1]. The paired sign-flip test over those 20 words gives p of about 0.19, and about 0.23 against a z-scored logit lens ^[3]. The author wrote that "calibration helps" is the finding and "J-lens beats logit lens" is suggestive ^[4]. For 0.805 to mean the same thing on another model, two conditions have to hold. You need a clean base checkpoint to fit the offset and variance on ^[17]. You also need a grader that counts what the lens emits: z-scoring pushes guesses toward translations and emoji of the secret, and the benchmark's English string match scores those as misses ^[21]. Two words never surface at all under the calibrated J-lens, blue and book ^[22]. Which secrets surface is not predicted by their frequency, a registered test that failed at Spearman rho = -0.20, p = 0.40, n = 20 ^[23]. The Qwen3-1.7B result rests on three secrets ^[2]. Under the original raw-logit protocol the readout is 0 at all 26 layers, and under leave-one-out every cell except the z-scored J-lens is 0 ^[18]. Three words is a small enough sample that I would treat the non-zero cell as a direction to test rather than a score. The reproduction check on Gemma missed by about 2x, 0.69 against 0.35, and the write-up does not compare to the published table anywhere ^[20]. The rest of the checking is on the record. The split-half test used to confirm the offset was recomputed without scipy and matched to six decimals ^[24]. An early impression that the logit lens produced more junk than the J and R lenses did not survive a red team pass ^[26], and the junk flag still misses the J-lens's Latin word-fragment junk, so junk shares are compared only within a lens across depth ^[25]. A dose-response figure first quoted 25 intermediates and was corrected to 21 ^[27]. The work took about 18 clocked hours, agent-assisted, with every number independently re-verified ^[28], and the code, decisions ledger and devlog are in the repo ^[30].