Verbal confidence -- prompting LLMs to state their confidence as a number or category -- is widely used to extract uncertainty estimates from black-box models. However, how LLMs internally generate such scores remains unknown. We address two questions: first, when confidence is computed -- just-in-time when requested, or automatically during answer generation and cached for later retrieval; and second, what verbal confidence represents -- token log-probabilities, or a richer evaluation of answer quality? Focusing on Gemma 3 27B (across TriviaQA, BigMath, and MMLU), Qwen 2.5 7B, and the reasoning model Magistral Small 24B, we provide convergent evidence for cached retrieval. Activation steering, patching, noising, and swap experiments reveal that confidence representations emerge at answer-adjacent positions before appearing at the verbalization site. Attention blocking pinpoints the information flow: confidence is gathered from answer tokens, cached at the first post-answer position, then retrieved for output. Critically, linear probing and variance partitioning reveal that these cached representations explain substantial variance in verbal confidence beyond token log-probabilities, suggesting a richer answer-quality evaluation rather than a simple fluency readout. These findings demonstrate that verbal confidence reflects automatic, sophisticated self-evaluation -- not post-hoc reconstruction -- with implications for understanding metacognition in LLMs and improving calibration.
Figures & tables
Figure 1: Main Prompt and Illustration of our findings. We included the generated answer (example question shown) from a previous phase as part of the prompt for the confidence rating experiment (see § C.1.2 ). Since the Transformer’s forward pass is a function of previous tokens, providing the answer as context yields the exact same representation at the PANL as autoregressive generation. See § B for full prompt used. We provide convergent evidence that LLMs compute confidence via cached retrieval rather than just-in-time computation, and that verbal confidence doesn’t merely reflect logprobs. (A) Confidence information is gathered at the post-answer-newline token ( \ n, PANL) via attention to answer tokens, particularly the last answer token, at earlier layers (21–25). (B) This information is routed to the confidence-colon token (:)—either directly or through intermediate tokens. (C) Confidence information persists in the residual stream at the confidence-colon through later layers (30–35). (D) Confidence is verbalized when CC’s representation is transformed by the unembedding matrix at the final layer (layer 61). (E) Attention blocking experiments rule out just-in-time (JIT) computation: CC does not compute confidence from scratch by attending to question or answer tokens (red arrow from CC to Q and A tokens). (F) Decoding experiments reveal that verbal confidence is not explained by token log-probabilities, suggesting they reflect a more sophisticated evaluation of question-answer fit.
Figure 2: Results of Activation Steering In Gemma 3 27B. High (green lines) and low confidence (red lines) steering, at scales of 2 (solid line) and 5 (dotted line). Key positions: PANL (post-answer-newline) token, CC (confidence-colon) token. Control positions: PANL+1 (token immediately after PANL), FCC (first-confidence-colon) token (i.e. token preceding “$CLASS” in the prompt, following the confidence instructions; see Figure 8 ). Baseline confidence was 0.55 across all trials. See Error bars show SEM (n=200 trials).
Figure 3: Results of Activation Patching in High Confidence Trials: Confidence Class Prompt. Clean baseline shown in green; corrupt baseline shown in red (i.e. at near zero for logit difference and confidence, and near 100 for first token change rate). Patching of PANL representation resulted in partial recovery of logit difference, first token and confidence (upper, middle, lower panel respectively). Patching of CC representation resulted in near complete recovery of confidence, logit difference and first token. PANL+1 patching resulting in effectively zero recovery.
Figure 4: Illustration of Activation Swap Experiment. Upper panel: High → Low (i.e. cross-confidence swap: high confidence recipient trial receives low confidence donor representation) – result is a lowering of confidence. Lower panel: High → High (i.e. high confidence recipient trial receives High confidence donor representation) – in this same-same confidence swap, the result is no change in confidence.
Figure 5: Results of Activation Swap Experiment at PANL position. Same-confidence swaps (H → H, L → L) control for generic content-related effects due to introducing activations from a different trial; cross-confidence swaps (H → L, L → H) isolate confidence-specific transfer. See main text for details. See Figure 20 for results at CC and PANL+1 positions.
Figure 6: Results of decoding: linear probes were trained on residual stream activations at PANL, PANL+1, CC, intermediate tokens (first token of each confidence class in the instruction), and a control position (third question token). For binary correctness we report AUROC; for verbal confidence magnitude we report R2 . Horizontal lines show AUROC obtained using mean answer log-probability or verbal confidence directly. Key results: (1) confidence information is decodable from PANL at earlier layers than all other positions; (2) variance partitioning shows PANL activations explain substantial variance beyond log-probabilities ( RCV2=0.084 for logprobs alone), indicating PANL encodes information not captured by token likelihoods.
Figure 7: Attention blocking reveals information flow from answer tokens through PANL to CC. Results from selectively blocking attention edges across 12 consecutive layers centered at each x-axis position, using a minimal numeric (0–9) confidence prompt. (A) Blocking CC → PANL (purple) produces significant disruption peaking at layers 30–36, while blocking CC → Q+A (pink) shows no effect beyond the PANL+1 control (orange), ruling out just-in-time computation. (B) Blocking PANL’s attention to answer tokens—either the last answer token (PANL → last_A , brown) or all answer tokens (PANL → A, gray)—produces disruption at earlier layers (22–28), preceding the CC → PANL effect. This temporal ordering indicates sequential information flow: answer tokens → PANL → CC. Upper panels show token change rate (%); lower panels show logit difference change (baseline token logit minus mean of alternative digits). Error bars indicate SEM ( n=500 trials).
Appendix figures & tables23 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 8: Full categorical confidence class prompt in Experiment. We focused our analysis on the newline token following the model’s answer (given in a previous phase): the post-answer-newline (PANL) token, and the confidence-colon token (i.e. the last token of the prompt). In addition, we report analyses on the token immediately following the PANL token (i.e. PANL-plus1 token), the first-confidence-colon (FCC)(i.e. the colon preceding the appearance of “$CLASS”), and the last token of the answer. This prompt is derived from ( Yoon et al., 2025 ) but with the following key modification: the first token of every confidence class is unique, allowing us to meaningfully analyze changes in the ID of first token, the logit of the first token etc.
Figure 9: Calibration and Distribution of Confidence Classes in Gemma. (A) Calibration of Gemma: Expected Calibration Error (ECE) = 0.12, AUROC = 0.71. No procedures such as temperature scaling ( Guo et al., 2017 ) were used, since we were focussed on understanding the generation of Gemma’s raw verbal confidence signals. The model’s performance was 77.4%; this was determined by having GPT4o-mini mark questions (B) Distribution of Gemma’s confidence responses across the 10 classes. n = 7858 questions from the TriviaQA dataset ( Joshi et al., 2017 ) .
Figure 10: Sequence of Experiments, Motivation and Brief Summary of Key Results.
Figure 11: Results of Activation Steering in Gemma at answer tokens (Confidence Class Prompt). High (green lines) and low confidence (red lines) steering, at scales of 2 (solid line) and 5 (dotted line). Error bars show SEM.
Figure 12: Results of Activation Noising across all trials. Mean ablation of representations of PANL or CC token at a single layer causes disruption of verbal confidence reporting as measured by decrease in logit difference, and change in first token outputted by model. See text for details
Figure 13: Results relating to interventions at the last pre-answer position: the answer-colon (AC) token . a) results of activation steering. No significant change in confidence. b) Activation patching: experiment performed by corrupting AC token (in addition to answer tokens). Confidence change from clean baseline shown. Partial recovery of confidence observed at PANL but no recovery at AC. c) Activation noising: no disruption of confidence reporting observed with mean ablation of AC position – i.e. result is comparable to control position PANL+1. d) Encoding of verbal confidence information: layerwise linear decodability of verbal confidence from residual activations at AC, PANL, and PANL+1, measured by cross-validated ridge regression R2 – with best alpha (penalty strength) for AC position used also for PANL and PANL+1. Information related to verbal confidence is present at AC to a much lower extent that at other 2 positions (see Main text for interpretation)
Figure 14: Variance in verbal confidence uniquely explained by PANL activations ‘ Runique2 ’ after controlling for token-level probability baselines, plotted across layers. Each colored line shows ‘ Runique2 ’ after controlling for a single baseline; the black line shows ‘ Runique2 ’ after controlling for all six baselines combined. PANL activations explain substantial unique variance (R² unique = 0.38 at peak layer ∼ 40) beyond any combination of answer token log-probability summaries, confirming that the confidence representation at PANL is not reducible to token-level probability signals.
Figure 15: Full numeric confidence prompt used in Experiment. This prompt is derived from ( Mei et al., 2025 ; Devic et al., 2025 )
Figure 16: Minimal numeric confidence prompt used in attention blocking experiments. This prompt elicits confidence on a 0–9 scale (single token output) and minimizes intermediate tokens between the post-answer-newline token (PANL, position 1) and the confidence-colon token (CC, position 2). These positions are analogous to those in the main categorical prompt (Figure 8 ). The minimal design enables direct testing of whether CC retrieves confidence information from PANL, a pathway that may be masked by routing through intermediate template tokens in the categorical prompt.
Figure 17: Calibration and Distribution of Numeric Confidence Scores in Gemma. (A) Calibration of Gemma: Expected Calibration Error (ECE) = 0.16, AUROC = 0.73. No procedures such as temperature scaling ( Guo et al., 2017 ) were used, since we were focussed on understanding the generation of Gemma’s raw verbal confidence signals. (B) Distribution of Gemma’s numeric confidence responses binned into 10 bins. Questions (n = 8008) the TriviaQA dataset ( Joshi et al., 2017 ) .
Figure 18: Calibration and Distribution of Categorical Confidence Ratings in Qwen 2.5 7b. (A) Calibration of Qwen: Expected Calibration Error (ECE) = 0.06, AUROC = 0.65. No procedures such as temperature scaling ( Guo et al., 2017 ) were used, since we were focussed on understanding the generation of Qwen’s raw verbal confidence signals. (B) Distribution of Qwen’s confidence responses.
Figure 19: Results of Activation Steering in Gemma with Numeric Confidence Prompt. High (green lines) and low confidence (red lines) steering, at scales of 2 (solid line) and 5 (dotted line). n = 124 trials per condition per layer. Positions correspond to the analogous locations in the categorical confidence prompt. Error bars show SEM.
Figure 20: Results of Activation Swap Experiment at CC and PANL+1 position (Confidence Class Prompt). Same-confidence swaps (H → H, L → L) control for cross-trial substitution effects; cross-confidence swaps (H → L, L → H) isolate confidence-specific transfer. See main text for details.
Figure 21: Results of Attention Blocking Experiment using Main Categorical Prompt. First token change rate induced by blocking different attentional pathways shown in upper panel. Lower panel: Change in logit difference between the first token and the mean of alternative confidence classes caused by attention blocking. PANL and PANL+1 denoted by NL and NL+1 for brevity. last_A and A refer to last answer token and answer tokens, respectively. Q refers to all question tokens. See text for interpretation.
Figure 22: Results for Gemma 3 27B and Qwen 2.5 7B on Activation Steering, Patching, Noising and Swap Experiments: Categorical Confidence and Numeric Confidence Prompt. Maximal effects observed at each position’s (PANL, PANL+1, CC) peak layer (layer index below bar). Qwen has 28 layers, Gemma 3 27B has 62 layers. Logit difference change (i.e. change from logit of clean run first token vs average of all other confidence classes), and confidence change reported; except for noising experiment where first token change rate and logit difference are reported as measures of confidence reporting disruption (see main text for details). Baseline confidence in Qwen categorical prompt steering experiment was 0.56; in Gemma it was 0.48. Baseline in Gemma numeric prompt experiment was 0.54. Significant effects observed at PANL and CC positions compared to control PANL+1 position; critically effects at the CC position occurred at later layers compared to those at PANL. Comparable effects observed in both models except for activation steering where stronger effects observed in Gemma.
Figure 23: Example prompt and output for Magistral Small 24B on TriviaQA . The model’s full reasoning trace (truncated here for space; max_tokens = 1024) and extracted answer are presented back to the model, which then classifies its confidence. The model’s response thus consists of its reasoning trace followed by its final answer .
Figure 24: Phase 1 prompt for Magistral Small 24B on TriviaQA . The model is instructed to reason step-by-step before producing its final answer ( max_tokens = 1024). The resulting reasoning trace and extracted answer are then provided back to the model in Phase 2 (Figure 23 ) for verbal confidence elicitation.
Figure 25: Results of Mistral 24B reasoning model (“Magistral small 2506”) on TriviaQA dataset. a) Distribution of confidence ratings. Note the model outputs primarily high confidence responses but is reasonably well calibrated. b) Activation patching. Upper panel – change in confidence from clean baseline. PANL and control position (PANL+1) shown. lower panel – change in logit difference (i.e. between clean argmax token and mean of alternative classes) from clean baseline. c) Activation noising. Change in first token outputted by model (i.e. index of disruption). No effect of noising at PANL (compared to the control PANL+1 position) were observed – possibly due to information about verbal confidence being distributed across the reasoning trace, peaking at the very last token of the trace, before the final answer (see Figure 26 ). Note: confidence colon (CC; the very last token of the prompt – see Figure 23 ) is shown where significant effects were observed due to noising. d) Activation swap. PANL (upper panel) and control position (PANL+1; lower panel) shown. As with Gemma 3 27B (MMLU), asymmetric effects: L → H (low confidence recipient trial receives high confidence donation) direction dominating – possibly due to the tendency of the model’s confidence ratings to be dominated by high confidence responses (shown in panel a)
Figure 26: Results of decoding in Mistral 24B reasoning model (“Magistral small 2506”) . As in the main experiments, linear probes were trained on residual stream activations (40 layers) at PANL, PANL+1, confidence colon (CC; the very last token in the whole prompt after Confidence – see Figure 23 ), last token of final answer (ALT), intermediate tokens of reasoning trace (from a token at the beginning to the end of the trace in 10% increments; hence “Trace 100%” is the very last token of the trace (usually a period)), and a control position (third question token (QTT)). We report the variance that activations at a given token explain in verbal confidence ( R2 ). Upper panel: R2 for each token, across the 40 layers of the model. Lower panel: magnitude of peak R2 for each token(i.e. across all layers). Note how information relating to verbal confidence increases across the reasoning trace, peaking at the very last token, where information is comparable to PANL.
Figure 27: Results of Gemma 3 27B on BigMath dataset ( Albalak et al., 2025 ) . a) Distribution of confidence ratings. Overall performance 40.2% correct. b) Activation patching. Upper panel – change in confidence from clean baseline. PANL and control position (PANL+1) shown. lower panel – change in logit difference (i.e. between clean argmax token and mean of alternative classes) from clean baseline. c) Activation noising. Change in first token outputted by model (i.e. index of disruption). d) Activation swap. Same-confidence swaps (H → H, L → L) control for generic content-related effects due to introducing activations from a different trial; cross-confidence swaps (H → L, L → H; high confidence recipient trial receives low confidence donation, and low confidence recipient trial receives high confidence donation, respectively) isolate confidence-specific transfer. Confidence change from original (i.e. recipient trial) shown. PANL (upper panel) and control position (PANL+1; lower panel) shown.
Figure 28: Results of Gemma 3 27B on MMLU (multiple-choice) dataset ( Hendrycks et al., 2021 ) . a) Distribution of confidence ratings. Note the model outputs primarily high confidence responses. Overall performance 76.8% correct. b) Activation patching. Upper panel – change in confidence from clean baseline. PANL and control position (PANL+1) shown. Lower panel – change in logit difference (i.e. between clean argmax token and mean of alternative classes) from clean baseline. c) Activation noising. Change in first token outputted by model (i.e. index of disruption). d) Activation swap. asymmetric effects with L → H (low confidence recipient trial receives high confidence donation) direction dominating – possibly due to the tendency of the model’s confidence ratings to be dominated by high confidence responses (shown in panel a). Trend for effect in the L → H direction visible (but not significant). PANL (upper panel) and control position (PANL+1; lower panel) shown.
Figure 29: Results of Activation Steering In Gemma 3 27B at scales 1 and 10.
Position
Direction
Cosine sim
Norm ratio
Natural cos [p5, p95]
Natural NR [p5, p95]
PANL
High (s=2)
0.999
0.96
[0.998, 1.000]
[0.90, 1.10]
PANL
Low (s=2)
0.999
1.04
[0.998, 1.000]
[0.90, 1.10]
PANL
High (s=5)
0.992
0.91
[0.998, 1.000]
[0.90, 1.10]
PANL
Low (s=5)
0.994
1.10
[0.998, 1.000]
[0.90, 1.10]
PANL+1
High (s=2)
0.999
1.04
[0.997, 1.000]
[0.90, 1.11]
PANL+1
Low (s=2)
0.998
0.96
[0.997, 1.000]
[0.90, 1.11]
Appendix
Table 1: Out-of-distribution (OOD) shift analysis for three intervention types at Layer 25 (peak effect layer). Natural distribution statistics computed from pairwise comparisons across 3000 activation collection trials. For steering, cosine similarity is between clean and steered activations. For patching, between clean-cached and corruption-propagated activations. For noising, between clean and mean-replacement activations. In all three cases, PANL and PANL+1 show comparable OOD drift, yet only PANL produces causal effects on confidence output (see Figures 2, 3, 11). Natural distribution statistics are shared across panels as they reflect properties of the model’s representations at each position, independent of intervention type.
LLM confidence calibration is often evaluated by comparing two signals: token-probability scores and verbalized confidence. These signals are sometimes treated as direct readouts of model uncertainty, but their comparison depends on measurement choices that are rarely made explicit. In the main analysis, we hold the verbalized-confidence elicitation fixed: a single prompt template, probability scale, and output format. We then vary the measurement axes that define the verbalized-vs-token comparison: which answer string receives the token-probability score, how that score is read from the answer tokens, and under which conditioning context it is measured. We evaluate this design on four QA benchmarks across three open 7--8B base/Instruct model families, with larger Qwen2.5 variants as same-family robustness checks. The resulting comparison is sensitive to these choices: conditioning context changes the sign or magnitude of the ECE gap across settings, token readout produces smaller but still sign-moving changes, and changing the ECE estimator has little effect. Under the default generated-answer, bare-context protocol, Instruct settings are close to parity rather than showing a large calibration gain for verbalized confidence. In a separate supplied-answer analysis, surface-plausible wrong answers receive nearly the same confidence as supplied gold answers, suggesting that verbalized confidence also reflects answer plausibility and provenance rather than correctness alone. We argue that both confidence signals should be treated as protocol-dependent behavioral measurements, and provide a reporting checklist covering elicitation provenance, scored answer, token-probability readout, and conditioning context.
Verbal confidence elicitation is widely used to extract uncertainty estimates from LLMs. We tested whether seven instruction-tuned open-weight models (3-9B parameters, four families) produce verbalised confidence that meets minimal validity criteria for item-level Type-2 discrimination under minimal numeric elicitation with greedy decoding. In a pre-registered study (OSF: osf.io/azbvx), 524 TriviaQA items were administered under numeric (0-100) and categorical (10-class) elicitation to eight models at Q5_K_M quantisation on consumer hardware, yielding 8,384 deterministic trials. A psychometric validity screen was applied to each model-format cell. All seven instruct models were classified Invalid on numeric confidence (H2 confirmed, 7/7 vs. predicted >=4/7), with a mean ceiling rate of 91.7% (H1 confirmed). Categorical elicitation did not rescue validity. Instead, it disrupted task performance in six of seven models, producing accuracy below 5% (H4 not confirmed). Token-level logprobability did not usefully predict verbalised confidence under the observed variance regime (H5 confirmed, mean cross-validated R^2 < 0.01). Within the reasoning-distilled model, reasoning-trace length showed a strong negative partial correlation with confidence (rho = -0.36, p < .001), consistent with the Reasoning Contamination Effect. These results do not imply that internal uncertainty representations are absent. They show that minimal verbal elicitation fails to preserve internal signals at the output interface in this model-size regime. Psychometric screening should precede any downstream use of such signals.
Verbalized confidence, in which LLMs report a numerical certainty score, is widely used to estimate uncertainty in black-box settings, yet the confidence scale itself (typically 0--100) is rarely examined. We show that this design choice is not neutral. Across six LLMs and three datasets, verbalized confidence is heavily discretized, with more than 78% of responses concentrating on just three round-number values. To investigate this phenomenon, we systematically manipulate confidence scales along three dimensions: granularity, boundary placement, and range regularity, and evaluate metacognitive sensitivity using meta-d′. We find that a 0--20 scale consistently improves metacognitive efficiency over the standard 0--100 format, while boundary compression degrades performance and round-number preferences persist even under irregular ranges. These results demonstrate that confidence scale design directly affects the quality of verbalized uncertainty and should be treated as a first-class experimental variable in LLM evaluation.