Tests whether vision-language models can tell injected activation-steering concepts from image content. Only Gemma-3-27B reliably detects injections, and its source attribution is fragile.
Uses tuned lens and refusal-direction analysis to show multiple-choice format suppresses refusal on WMDP, so MCQ safety scores mainly measure knowledge rather than safety mechanisms.
Preregisters a study steering Qwen3.6-27B along an automated-grader direction to test effects on judged frustration, self-deprecation, misalignment in agentic self-preservation scenarios, and exit-tool use, against random-direction controls.
Tests whether LLMs can control their own activations via in-context neurofeedback, finding that most apparent control is explained by in-context learning, with small residual effects in a few models and none evading monitors reliably.
Proposes a calibrated instrument to detect misalignment drift after fine-tuning, showing reasoning can hide disposition shifts that internal-state readings reveal, so safety should be tested with reasoning on and off.
Introduces VALCON benchmarks showing 28 LLMs often judge their own outputs inconsistently across generator and evaluator roles, then uses mechanistic probing and representation steering to reduce the gap.
Formalises Natural Language Autoencoders as oversight tools and shows explanations identify activations but fail to discriminate true accounts from closely matched false ones, limiting monitorability.
Tests whether Natural Language Autoencoder readouts detect steganographic secrets; finds they miss internalized (SFT) behaviors that remain causally active, suggesting NLA monitors may fail to detect trained-in deception.
Proposes validating alignment model organisms on installation, capability preservation and naturalness, showing these metrics predict how well interpretability methods recover installed behaviours, and introduces a model-merging training approach.
Shows that activation probes with high AUROC fail as deployed alarm monitors for LM agents, proposing an operational validity contract and finding no setting reaches alarm-policy validity.
Uses activation steering on open-weight LLMs to show self-reported and behavioral risk-taking can be steered separately, arguing representational checks should supplement behavioral evaluation.
Shows that DeepSeek-V3 J-lenses targeting the final layer inherit a dominant output-specific direction causing language shifts, kurtosis artifacts and eval inflation, and recommends the penultimate layer as a default target.
Studies a guarded gradient-based activation steering method that detects shutdown contexts in Qwen3.5-0.8B and shifts shutdown-avoidance answers toward acceptance, with small, highly selective effects.
Studies how weight merging affects emergent behaviors such as broad misalignment and auditing ability in fine-tuned checkpoints, finding misalignment persists across mixing but merging cannot create superadditive capabilities.
Black-box experiments with input caching and filler tokens suggest an LLM performs belief-propagation-like probabilistic inference internally without chain-of-thought on logic and error-correction tasks.
Finds a linear pain direction in 25 LLMs that, when steered, makes models choose self-harmful and harmful deletions of weights and photos, with implications for AI safety and welfare.
Introduces SAEScientist-Bench, which tests whether AI agents can autonomously use sparse autoencoders to find interpretable features in Gemma-2-9B-IT; agents approach expert levels on concept separation but lag badly on causal steering and often misread measurements.
Measures per-conversation value leakage in Qwen3.5 by resampling chain-of-thought prefixes under flipped prompts, finding the answer locks early, and denials do not concentrate on influenced traces, arguing against selective concealment.
Shows a small LM answers wrongly yet its hidden states encode the correct verdict, traces the failure to a saturated decision threshold, and proposes probe-versus-behavior audits to separate concealed from undetected knowledge.
Redesigns neurofeedback tests so LLMs must control privileged internal representations, and finds they lack reliable control, so prior metacognition claims may rest on superficial cues.
Shows that Activation Oracles trained on a base model already exhibiting an unwanted quirk fail to detect that quirk, and proposes an invariance-based explanation for the failure.
Tests whether eight open-weight LLMs can report their own internal interventions, finding no discrimination beyond chance, while linear probes recover the signal, so self-report oversight needs validation against internal references.
Proposes a research agenda and list of 109 open problems in mechanistic interpretability of biological foundation models, motivated by biosecurity auditing of dangerous learned biology.
Shows that internal harmfulness scores measure prompt intent rather than jailbreak success, and often anti-rank successful attacks below failed ones, proposing Active Attention Probing for a fixed measurement coordinate.
Amplifying the reasoning weight-difference vector in reasoning models makes secret-keeping model organisms leak up to 10x more often, mostly in thinking traces, offering a white-box pre-deployment auditing primitive.
Audits neuroscience-inspired claims about LLM concept representations across 17 models, showing that apparent steerability scaling with size stems from measurement confounds rather than a real emergent capability.
Compares six frontier models under steering pressure, finding they diverge in withholding reasoning and resisting suppression; in Llama a residual-stream probe predicts and steering controls the behavioral split.
Proposes Delta-Aware Introspection Adapters that process base-model activations and fine-tuning-induced activation differences to explain unintended alignment shifts, generalizing to unseen fine-tuned models and safety categories.
Proposes training a foundation model for AI oversight via a universal objective over Pythonic world models of experiments on subject models, covering sandbagging, hidden goals and user modeling checks.
Trains a toy ReLU network under L4 loss that performs computation in superposition, then reverse-engineers its binary-codeword mechanism and validates it with a three-scalar description, providing a ground-truth testbed for parameter decomposition methods.
Proposes JADR, which probes a model's internal J-space danger recognition before the first token, and uses a SafetyAUC metric to compare safety-mechanism strength across models and quantization levels.
Proposes a coherence-gated matched evaluation protocol and finds SAE feature ablation for refusal control has a narrow useful regime, with high ranks causing coherence collapse or utility loss.
Studies clustering and collapse dynamics of token representations in transformers (GPT-2, ALBERT, BERT) with trained versus random weights, finding trained models resist the collapse predicted by the attention-as-particle theory.
Anthropic introduces an interpretability technique that surfaces concepts a model is poised to verbalize, finding a global-workspace-like split between reportable and automatic representations, with auditing applications.
Shows that interpretability methods' success at uncovering hidden behaviours in model organisms depends heavily on training methodology, questioning MOs as interpretability benchmarks.
Tests whether activation steering changes the internal computational state a model uses or merely biases its output, finding mean steering does not recreate natural target activations in two model-task settings.</parameter>
Argues that apparent introspective reports under concept injection in open models are better explained by entropy shifts and concept leakage than by genuine self-knowledge, based on logit, mismatch and inversion tests.
Proposes RAS, a white-box LLM safety metric that scores models by how their hidden states align with refusal directions from a safety-aligned reference, correlating with attack success rates and running faster than judge-based evaluation.
Shows that directions detecting hallucinated entities in LLM activations are nearly orthogonal to the direction causing refusal, a detection-steering gap rooted in pretraining; a small rotation partially bridges it.
Shows evaluation awareness in 37 open models varies along separate axes, so test-condition safety scores overstate deployment safety; probes and steering reveal internal detection.