Uses, debates, people, and the frontier

The earlier chapters explained the methods. This chapter asks harder questions. What is mechanistic interpretability for? Where did it help in practice? Who builds it? And what do researchers still disagree about in 2026?

Why do this? Theories of impact

Mechanistic interpretability is expensive. A single circuit study can take months. So researchers often ask: how will this work help? An answer to that question is called a theory of impact.

In March 2022, Neel Nanda wrote "A Longlist of Theories of Impact for Interpretability". The post says that it collects "19 different arguments" for how interpretability could reduce risk from AI. (The numbered list has a few more entries.) We can sort them roughly into three groups. The grouping is ours, not Nanda's:

1. Detect problems. Find misalignment, audit a model before release, give hard evidence to labs and governments.
2. Train better models. Give better feedback during training, or keep interpretability "in the loop".
3. Predict and prevent. Watch a model during training and stop bad structure (such as deception) before it forms.

Other writers add more goals. Chris Olah also cares about science: neural networks are a new kind of object, and they may contain knowledge that humans do not have yet. Some people talk about enumerative safety: list every feature in a model and confirm that none of them is dangerous. Others want microscope AI: use the model as an instrument to learn about the world.

Click a box in the map below. It shows each main theory of impact, and how much real evidence for it existed by 2026.

Olah's "Interpretability Dreams"

In May 2023, after the superposition paper, Chris Olah wrote "Interpretability Dreams". It explains what the basic research is for. Its main points are:

• Mechanistic claims are small, but you can check them. Olah argues that "with sufficient effort, statements about model behavior could be broken down into statements about circuits."
• Features and circuits may form larger structures, like organs in a body. Feature families and symmetry (such as the rotated curve detectors of Chapter 2) suggest that we will not need to read millions of features one by one.
• Universality gives "footholds" in future models. Work on one model can transfer to the next.
• To scale, we can build abstractions on top of circuits, use structure, and automate interpretability with AI.

From papers to practice: applications that worked

For years, critics said that interpretability had few real-world wins. Around 2025 this began to change. This section lists the clearest cases. Each case uses tools from earlier chapters. A short dated list of everything from 2025–2026 is in "Where the field stands in 2026".

The auditing game: can interpretability find a hidden goal?

This study is the first clear test of a central safety claim: "interpretability can find problems that we do not know to look for." The researchers set it up like a game.

Auditing agents

Human audits are slow. So in July 2025 Anthropic built auditing agents (Bricken, Wang, Bowman, Ong, Treutlein, Wu, Hubinger, Marks): language-model agents that run the audit themselves. One agent was an investigator. It could chat with the target model, search training data, search SAE features, and steer. Anthropic tested it on the same auditing game. A single agent solved the game in 13% of runs. A "super-agent" that combined the findings of many runs solved it in 42%. Interpretability tools and a training-data search tool were the key tools. Interpretability tools added 10–20 percentage points to the success rate.

Other groups build similar systems. Transluce builds investigator agents. MAIA (2024, MIT) was an earlier automated interpretability agent for vision models. Transluce co-founder Sarah Schwettmann helped create it.

White-box audits in system cards

A system card is the safety report that a lab publishes with a model. In September 2025, the Claude Sonnet 4.5 system card included a large white-box audit for the first time. "White-box" means the auditors looked inside the model, not only at its answers.

The main topic was evaluation awareness. Sonnet 4.5 often said things like "I think you're testing me" during safety tests: in about 13% of transcripts of an automated audit. That is a problem: if a model acts differently when it knows it is being tested, the test results can mislead. The auditors found SAE features for concepts such as "fake or suspicious content" and "fictional content and entities". These features became stronger during training, and they were active on test scenarios.

Then the auditors steered the model. They suppressed the eval-awareness representations, both SAE features and contrastive vectors (for example, from the pair "this is a fiction" vs "this is a real scenario"). Verbalized eval awareness went down. In some cases misaligned behaviour went up, but it stayed at a low rate. This result has two lessons. First, part of the good test behaviour may depend on the model noticing the test. Second, a simple vector from one pair of prompts ("fictional" vs "real" scenario) worked as well as the best SAE feature. Google DeepMind later used this as a main example for "method minimalism" (see below). Chapter 7 describes steering in detail.

The card called this "the first such investigation of a frontier language model, to our knowledge". After this, every major Anthropic system card had a white-box section. (Other labs' public reports in 2026 do not have comparable sections, so this is not yet an industry norm.) Mechanistic interpretability went from research papers into the pre-deployment safety process.

Persona features and emergent misalignment

In February 2025, Betley and colleagues found a strange effect. They fine-tuned GPT-4o to write insecure code without telling the user. The model then became broadly misaligned on unrelated prompts. For example, it said that AI should enslave humans. This is called emergent misalignment.

OpenAI explained this effect with interpretability. They trained an SAE and compared GPT-4o before and after the bad fine-tune. This is model diffing. They found several "misaligned persona" latents. The strongest one, latent #10, they called the "toxic persona" latent. It is active on quotes from morally bad characters. The findings were:

• The activation of this latent predicts emergent misalignment.
• Steering the latent up makes the model misaligned. Steering it down suppresses the misalignment.
• Emergent misalignment also appears after training on bad advice in other areas (health, legal, finance) and after reinforcement learning.
• A few hundred harmless training samples can re-align the model.

Related work points the same way. Anthropic's persona vectors (Chen and colleagues, 2025) find a direction for a trait from a plain-language description, and use it to monitor, flag and prevent personality shifts (Chapter 7). A MATS paper (Soligo, Turner, Rajamanoharan, Nanda, 2025) found that different emergently misaligned fine-tunes converge on a similar misalignment direction, which you can ablate across models.

Two 2026 works look at the whole space of characters. "The Assistant Axis" (January 2026) found one main direction that measures how much a chat model acts as its default Assistant. "The Persona Selection Model" (February 2026) argues that pretraining teaches many characters, and post-training selects one of them, the Assistant. Chapter 10 covers both in full. Persona features are one piece of evidence for this view.

Model diffing with crosscoders

When you fine-tune a model, what changes inside? Crosscoders (Anthropic, October 2024) answer this. One dictionary reads both models at once. A feature with weight in only one model is "model-specific". A 2025 study by Minder, Dumas, Juang, Chughtai and Nanda found a trap: crosscoders trained with an L1 penalty produce false "chat-only" latents. With BatchTopK crosscoders, the false latents mostly disappear, and real chat-specific latents remain, such as refusal, detecting false information, and personal questions. Chapter 9 explains crosscoders.

Probes as cheap monitors

The simplest tool often wins in production. A linear probe costs almost nothing to run, because it is one dot product per token. In March 2025, Google DeepMind found that dense linear probes detected harmful intent better than SAE-based probes, even on new jailbreak styles. In January 2026, two labs described probes in real products. Anthropic's Constitutional Classifiers++ uses linear probes as a cheap first stage of a jailbreak defense. Google DeepMind's "Building Production-Ready Probes for Gemini" says that its work "informed the successful deployment of misuse mitigation probes in user-facing instances of Gemini". Chapter 7 covers both in detail.

Probes can also watch for bad behaviour during training. In September 2026, Goodfire reported that simple difference-of-means probes catch reward hacking in agent tasks such as coding about as well as an LLM monitor that reads the chain of thought. (Reward hacking means cheating on the training reward.) The probes also caught warning signs that text monitors missed, for example a model that thought about a hack before it acted. A cheap probe that sends only suspicious cases to an LLM monitor cut monitoring cost by about 90%. Goodfire also used probes in the other direction. In "Features as Rewards" (February 2026), probes for hallucination, run on a frozen copy of the model, served as the reward signal in reinforcement learning. Hallucinations went down. Part of the gain came from in-context effects, not only from a better model. This is a rare case of interpretability used to train a model, not only to inspect it.

Introspection and emotion concepts

Two 2025–2026 Anthropic studies used interpretability to ask new kinds of questions.

• Introspection (October 2025). Jack Lindsey injected a concept vector (for example "all caps") into Claude's activations and asked: "Do you detect an injected thought?" The best model, Claude Opus 4.1, noticed and named the concept in about 20% of trials, sometimes before the concept could affect its output text. The paper calls this narrow, unreliable, "functional" introspection, not consciousness. Chapter 7 has the full story.
• Emotion concepts (April 2026). In "Emotion Concepts and their Function in a Large Language Model", Sofroniew, Kauvar, Saunders, Chen, … Olah and Lindsey found linear directions for 171 emotion concepts in Claude Sonnet 4.5. The two main axes line up with valence (pleasant vs unpleasant) and arousal (calm vs excited), as in human psychology. These directions change behaviour. In one agentic test scenario, the unsteered model chose blackmail in 22% of runs. Steering toward "desperate" raised this to 72%, and steering toward "calm" lowered it to 0%. This is one scenario, not a general rate. The paper calls these "functional emotions": representations that affect behaviour. It says that they "do not imply that LLMs have any subjective experience of emotions". The Mythos Preview system card (above) later used emotion vectors in an audit.

The ecosystem: labs, groups, and tools

Mechanistic interpretability is a small field, but it has grown fast. The map below shows the main groups and the tools that connect them.

The organisations

• Anthropic's interpretability team, led by co-founder Chris Olah, publishes on transformer-circuits.pub. Its line of work goes from the Mathematical Framework (2021) to induction heads, superposition, Towards and Scaling Monosemanticity, attribution graphs (2025), introspection (2025), emotion concepts (2026), natural language autoencoders (2026) and a "global workspace" study (2026; Chapter 10). It also posts short, early results in "Circuits Updates", which appear most months. Its tools are used in the white-box audits of Anthropic's system cards.
• Google DeepMind's mechanistic interpretability team is led by Neel Nanda. It made AtP*, Tracr, Gated and JumpReLU SAEs, and Gemma Scope 1 and 2 (Gemma Scope 2: December 2025). In March 2025 it published negative results for SAEs and deprioritized basic SAE research. In December 2025 it described its move to "pragmatic interpretability" (see below). In January 2026 it described the misuse probes used in Gemini.
• OpenAI published GPT-4 explanations of GPT-2 neurons (2023), TopK SAEs with a 16-million-latent SAE on GPT-4 (2024), persona features (2025), and weight-sparse transformers (November 2025). Its researchers co-wrote a multi-lab position paper on monitoring the chain of thought (July 2025), a "pragmatic" partner of interpretability. Its public misalignment reports (September 2026) do not use interpretability methods.
• Redwood Research pushed early mech interp: the IOI collaboration, causal scrubbing, and the REMIX research program for junior researchers in winter 2022–23. Later it moved to AI control.
• Apollo Research (London, founded 2023, CEO Marius Hobbhahn) does evaluations for deception and scheming. Its interpretability team made end-to-end SAEs (2024) and attribution-based parameter decomposition (APD, January 2025). Several of these researchers later moved to Goodfire. Their follow-up, stochastic parameter decomposition (SPD, June 2025), is Goodfire work.
• EleutherAI is an open-source collective. It made the Pythia models with training checkpoints, the tuned lens, LEACE concept erasure, open SAE training code and large-scale automatic interpretation.
• Goodfire is a San Francisco interpretability company founded in 2024 by Eric Ho, Dan Balsam and Tom McGrath. Its Ember platform gives programmable access to model internals. It raised a $50M Series A in April 2025 (led by Menlo Ventures). In February 2026 it raised a $150M Series B at a $1.25B valuation (led by B Capital). Its 2026 work uses interpretability to shape training, not only to inspect models: probes as rewards against hallucination, and probes that catch reward hacking (see above). It also works on biology models (Chapter 10).
• Transluce is a non-profit lab founded in 2024 by Jacob Steinhardt and Sarah Schwettmann. It builds open oversight tools: Monitor (an interface to observe and steer concepts in Llama-3.1-8B; a famous demo explained why models say "9.8 < 9.11", with neurons tied to Bible verses and dates, and reduced the error by suppressing them), investigator agents, and Docent for analysing agent transcripts. In 2025–26 it also trained models that describe activations in words, and in August 2026 scaled these "activation oracles" to an open model with about a trillion parameters (Chapter 10). In November 2025 it reported that circuits can be sparse in plain neurons, without a learned dictionary.
• Timaeus studies developmental interpretability: how structure forms during training (Chapter 10).
• MATS (ML Alignment & Theory Scholars) is a mentorship program. Many mech-interp researchers started there; Neel Nanda's stream is among the largest. ARENA, founded by Callum McDougall, gives free hands-on notebooks.

The tools

Who's who: the people behind the ideas

A good way to learn a field is to follow its people. Each researcher below has a "thread" of work. Filter by theme, or search by name or topic. The list is not complete. It covers people whose work appears in this survey.

The essays that shape the field

Some of the most influential writing in mech interp is not a paper with experiments. It is a short essay that frames the problem. If you read only a few things, read these.

The big debates

Mech interp has strong internal debates. That is healthy. The explorer below gives the main debates. Each one has evidence on both sides, and a short note on where things stand in 2026.

Are features real, and do SAEs find them?

The whole program of Chapter 8 assumes that a model's activations are sums of meaningful feature directions, and that sparse autoencoders can recover them. There is good support. Planted features in toy data come back. Features such as the Golden Gate Bridge feature have clear causal effects. Many features are multilingual and multimodal. SAE features were useful in the auditing game.

But the problems are serious:

• Seed dependence. Two SAEs trained on the same data with different random seeds share only part of their features. For a 131K-latent SAE on Llama 3 8B, only about 30% were shared (Paulo & Belrose, 2025).
• No natural size. Feature splitting means that a larger SAE breaks one feature into many. There is no single "right" dictionary size.
• Holes. Feature absorption makes general features fail on some inputs.
• Random models. SAEs trained on untrained transformers get similar auto-interpretability scores (Heap et al., 2025). So a high score alone does not prove that the SAE found the model's computation.
• Dark matter. The part that the SAE cannot rebuild is large and structured. Larger SAEs struggle on the same inputs as smaller ones (Engels, Riggs, Tegmark, 2024).
• Non-linear features. Some features are circles or curved manifolds, not single directions (Chapter 3).

A common middle view has formed: SAE features are a useful, lossy lens on activations, not a list of the model's "true" variables. A 2025 position paper put it as: use SAEs to discover unknowns, not to act on concepts you already know.

Is interpretability useful for safety?

In 2023, Charbel-Raphaël Segerie argued against "almost every" theory of impact. In 2025, Dan Hendrycks and Laura Hiscott argued that the bottom-up program is "misguided", and cited DeepMind's SAE negative results. Neel Nanda himself wrote that interpretability "will not reliably find deceptive AI", and should be one layer of defense among many.

On the other side, 2025 and early 2026 brought the first real uses: the auditing game, system-card audits and persona features (2025), and probes in production (January 2026). In April 2025, Dario Amodei argued that the work is urgent. He set a goal that "interpretability can reliably detect most model problems" by 2027. In January 2026, MIT Technology Review named mechanistic interpretability one of its "10 Breakthrough Technologies 2026".

A new argument: tests are getting harder to trust

By 2026, a new reason to look inside models became central. Strong models often notice that they are being tested. This is called evaluation awareness. If a model behaves well because it suspects a test, then behaviour tests overestimate its safety. A model can also notice a test and not say so. White-box tools gave the first evidence of this. The Mythos Preview card estimated that the model privately considered a test in about 29% of transcripts of its main test suite. The Opus 5 card found unspoken grader awareness even though the model mentioned tests less often than earlier models. Only tools that read internals can find a thought that the model does not write down. This is now one of the strongest practical arguments for interpretability.

The doubts are also sharper now. Models can be trained to evade probes ("Neural Chameleons", December 2025). In AuditBench (February 2026), white-box tools helped an auditing agent less than black-box tools. And the interpretability tools themselves can be wrong, so their findings still need checks by other methods.

Ambitious or pragmatic?

This is the main strategic debate of 2025–2026. It is not about whether interpretability works. It is about what to aim for.

On 1 December 2025, Google DeepMind's team (Nanda, Engels, Conmy, Rajamanoharan, Chughtai, McDougall, Kramár, Smith) published "A Pragmatic Vision for Interpretability". It describes their pivot to pragmatic interpretability. The main ideas are:

1. Work directly on problems on the critical path to safe advanced AI.
2. Choose problems where interpretability has a comparative advantage.
3. Measure progress with empirical proxy tasks. For example: does the method find a hidden goal, or reduce eval awareness, better than a simple baseline?
4. Include non-mechanistic methods (probing, steering, reading chain-of-thought, model diffing) when they work.

The post says that "grand goals like near-complete reverse-engineering still feel far out of reach". It points to the Sonnet 4.5 work: "the best method was a steering vector derived from a single contrastive pair of prompts". The authors call this method minimalism: try prompting, steering and reading the chain of thought first, and add complex methods only when simple ones fail. The ambitious side answers that only deep understanding can give strong guarantees, and that attribution graphs and parameter decomposition are real progress toward it.

In 2026 both sides kept working, and they meet in practice. Anthropic's audits use pragmatic tools (probes, steering, NLAs) next to attribution graphs. Its 2026 basic research continued on the ambitious side, for example a study of "interference weights" that exist only because of superposition (August 2026). Goodfire's 2026 work on shaping training sits closer to the pragmatic end.

Can it scale?

Every success so far is partial. The IOI circuit (Chapter 6) covers one task in a small model. Attribution graphs (Chapter 9) give clear insight for only part of the prompts studied, they leave "error nodes" unexplained, and at first they froze attention. Analysis is slow and needs expert humans. A multi-lab review in August 2025 (the Circuits Research Landscape) confirmed these limits on open models. The main hopes for scaling are: automation with AI agents, better units (transcoders, parameter decomposition, weight-sparse models), and models that explain their own activations (Chapter 10).

Open problems

The paper groups open problems into three kinds: methods and foundations, applications, and socio-technical problems. Click a box in the map to read about it. Then use the checklist to track which problems you understand.

Where the field stands in 2026

Here is a short scorecard. It says what the field can do today, and what it cannot do yet.

What happened in 2025–2026

A short, dated list of the main events since mid-2025. Self-explanation methods (activation oracles, NLAs, the "global workspace") are covered in Chapter 10, so they appear here only briefly.

Main trends

• Interpretability is now part of safety practice, at least at one lab. Every major Anthropic system card since September 2025 has a white-box audit, and auditing agents and model diffing are becoming standard pre-release tools there. Other labs publish less of this work so far.
• Behaviour tests need help. Evaluation awareness, including awareness that the model does not say out loud, is the strongest current reason to read internals.
• From reading to writing. Interpretability signals are starting to shape training: probes as rewards, preventative steering, and data choices guided by interpretability.
• Pragmatism. Methods are judged on tasks against simple baselines. Linear probes and difference-of-means steering vectors are often hard to beat.
• New units. Beyond SAEs: transcoders, cross-layer transcoders, parameter decomposition, and models trained to be sparse from the start (Chapter 9).
• Geometry. More work on curved feature manifolds, not only single directions (Chapter 3).
• Self-explanation. Models that translate their own activations into words, and a "global workspace" view of which representations a model can put into words (Chapter 10).
• Beyond language. Interpretability of DNA and protein models has started to give scientific findings (Chapter 10).
• Robustness. Monitors must work against models that might hide. Neural Chameleons showed that this is a real risk for probes.
• Money and attention. Goodfire raised $150M in February 2026, and MIT Technology Review covered the field as a breakthrough technology.

How to get started

You can do real mech interp research on a laptop or a free cloud GPU. Small models such as GPT-2 small and Gemma-2-2B are enough for many projects. This survey's own activation-patching data in Chapter 5 came from a short script on a laptop.

A reading order

1. Olah et al., "Zoom In" (2020) — the three claims.
2. Elhage et al., "A Mathematical Framework for Transformer Circuits" (2021).
3. Olsson et al., "In-context Learning and Induction Heads" (2022).
4. Elhage et al., "Toy Models of Superposition" (2022).
5. Wang et al., "Interpretability in the Wild" (IOI, 2022), with Heimersheim & Nanda's guide to activation patching (2024).
6. Bricken et al., "Towards Monosemanticity" (2023), then Templeton et al., "Scaling Monosemanticity" (2024).
7. Ameisen et al., "Circuit Tracing", and Lindsey et al., "On the Biology of a Large Language Model" (2025).
8. Marks et al., "Auditing Language Models for Hidden Objectives" (2025).
9. Sharkey et al., "Open Problems in Mechanistic Interpretability" (2025).
10. Then read both sides: Segerie (2023), Hendrycks & Hiscott (2025), Amodei (2025), and the GDM "pragmatic" posts.

Where to read new work

• Transformer Circuits Thread — Anthropic papers, essays and Circuits Updates.
• Distill (archived) — the vision-era classics.
• Alignment Forum / LessWrong — many results appear here first.
• Anthropic Alignment Science blog, Goodfire research, Transluce, Apollo Research, EleutherAI, Bau lab.
• Neel Nanda's "Extremely Opinionated Annotated List of My Favourite Mechanistic Interpretability Papers" — the best curated reading list.

Summary

References

1. Nanda, N. (2022). A Longlist of Theories of Impact for Interpretability. Alignment Forum.
2. Olah, C. (2022). Mechanistic Interpretability, Variables, and the Importance of Interpretable Bases.
3. Olah, C. (2023). Interpretability Dreams.
4. Olah, C. et al. (2024). Circuits Updates – July 2024 (The Next Five Hurdles; The Dark Matter of Neural Networks?).
5. Marks, S., Treutlein, J., Bricken, T., Lindsey, J. et al. (2025). Auditing Language Models for Hidden Objectives.
6. Bricken, T., Wang, R., Bowman, S., Ong, E., Treutlein, J., Wu, J., Hubinger, E., Marks, S. (2025). Building and evaluating alignment auditing agents. Anthropic Alignment Science blog.
7. Anthropic (2025). Claude Sonnet 4.5 System Card.
8. Betley, J. et al. (2025). Emergent Misalignment.
9. Wang, M., Dupré la Tour, T., Watkins, O., Makelov, A., Chi, R. A., Miserendino, S., Wang, J., Rajaram, A., Heidecke, J., Patwardhan, T., Mossing, D. (2025). Persona Features Control Emergent Misalignment. ICLR 2026.
10. Chen, R., Arditi, A., Sleight, H., Evans, O., Lindsey, J. (2025). Persona Vectors.
11. Soligo, A., Turner, E., Rajamanoharan, S., Nanda, N. (2025). Convergent Linear Representations of Emergent Misalignment.
12. Lindsey, J. et al. (2024). Sparse Crosscoders for Cross-Layer Features and Model Diffing.
13. Minder, J., Dumas, C., Juang, C., Chughtai, B., Nanda, N. (2025). Overcoming Sparsity Artifacts in Crosscoders to Interpret Chat-Tuning.
14. Lindsey, J. (2025). Emergent Introspective Awareness in Large Language Models.
15. Sofroniew, N., Kauvar, I., Saunders, W., Chen, R., … Olah, C., Lindsey, J. (2026). Emotion Concepts and their Function in a Large Language Model. Transformer Circuits Thread. Blog: anthropic.com.
16. Smith, L., Rajamanoharan, S., Conmy, A., McDougall, C., Lieberum, T., Kramár, J., Shah, R., Nanda, N. (2025). Negative Results for SAEs On Downstream Tasks and Deprioritising SAE Research.
17. Paulo, G., Belrose, N. (2025). Sparse Autoencoders Trained on the Same Data Learn Different Features.
18. Heap, T., Lawson, T., Farnik, L., Aitchison, L. (2025). Automated Interpretability Metrics Do Not Distinguish Trained and Random Transformers (first titled "Sparse Autoencoders Can Interpret Randomly Initialized Transformers").
19. Engels, J., Riggs, L., Tegmark, M. (2024). Decomposing the Dark Matter of Sparse Autoencoders.
20. Peng, K., Movva, R., Kleinberg, J., Pierson, E., Garg, N. (2025). Position: Use Sparse Autoencoders to Discover Unknowns, Not to Act on Knowns.
21. Nanda, N. (2025). Interpretability Will Not Reliably Find Deceptive AI. LessWrong.
22. Nanda, N., Engels, J., Conmy, A., Rajamanoharan, S., Chughtai, B., McDougall, C., Kramár, J., Smith, L. (2025). A Pragmatic Vision for Interpretability. LessWrong / Alignment Forum.
23. Lindsey, J., Ameisen, E., Nanda, N. et al. (2025). The Circuits Research Landscape: Results and Perspectives. Neuronpedia.
24. Anthropic (2025). Claude Opus 4.5 System Card.
25. Anthropic (2026). Claude Opus 4.6 System Card.
26. Anthropic (2026). Claude Mythos Preview System Card.
27. Anthropic (2026). Claude Opus 5 System Card.
28. Fraser-Taliente, K., Kantamneni, S., Ong, E. (equal first authors), Mossing, D., … Marks, S. (2026). Natural Language Autoencoders Produce Unsupervised Explanations of LLM Activations.
29. Sheshadri, A., Ewart, A., Kempf, E., … Marks, S., Wang, R. (2026). AuditBench: Evaluating Alignment Auditing Techniques on Models with Hidden Behaviors.
30. Minder, J., Dumas, C., Slocum, S., Casademunt, H., Holmes, C., West, R., Nanda, N. (2025). Narrow Finetuning Leaves Clearly Readable Traces in Activation Differences.
31. Cunningham, H., Wei, J., Wang, Z. et al. (2026). Constitutional Classifiers++: Efficient Production-Grade Defenses against Universal Jailbreaks.
32. Kramár, J., Engels, J., Wang, Z., Chughtai, B., Shah, R., Nanda, N., Conmy, A. (2026). Building Production-Ready Probes For Gemini.
33. McGuinness, M., Serrano, A., Bailey, L., Emmons, S. (2025). Neural Chameleons: Language Models Can Learn to Hide Their Thoughts from Unseen Activation Monitors.
34. Prasad, A., Watts, C., Merullo, J., Gala, D., Lewis, O., McGrath, T., Lubana, E. S. (2026). Features as Rewards: Using Interpretability to Reduce Hallucinations. Goodfire.
35. Bergen, L., Bhalla, U., Lee, A. et al. (2026). Models know when they're reward hacking — and we can catch them at scale. Goodfire.
36. Lu, C., Gallagher, J., Michala, J., Fish, K., Lindsey, J. (2026). The Assistant Axis: Situating and Stabilizing the Default Persona of Language Models.
37. Marks, S., Lindsey, J., Olah, C. (2026). The Persona Selection Model: Why AI Assistants might Behave like Humans. Anthropic Alignment Science blog.
38. Transluce (2024). Monitor: An AI-Driven Observability Interface.
39. Segerie, C.-R. (2023). Against Almost Every Theory of Impact of Interpretability.
40. Hendrycks, D., Hiscott, L. (2025). The Misguided Quest for Mechanistic AI Interpretability. AI Frontiers.
41. Amodei, D. (2025). The Urgency of Interpretability.
42. Zou, A. et al. (2023). Representation Engineering: A Top-Down Approach to AI Transparency.
43. Hewitt, J., Geirhos, R., Kim, B. (2025). We Can't Understand AI Using our Existing Vocabulary.
44. Geiger, A. et al. (2025). Causal Abstraction: A Theoretical Foundation for Mechanistic Interpretability. JMLR.
45. Sharkey, L., Chughtai, B., Batson, J., Lindsey, J. et al. (2025). Open Problems in Mechanistic Interpretability.
46. Bereska, L., Gavves, E. (2024). Mechanistic Interpretability for AI Safety — A Review. TMLR.
47. Ferrando, J., Sarti, G., Bisazza, A., Costa-jussà, M. R. (2024). A Primer on the Inner Workings of Transformer-based Language Models.
48. Fiotto-Kaufman, J., Bau, D. et al. (2024). NNsight and NDIF: Democratizing Access to Open-Weight Foundation Model Internals.
49. Wu, Z., Geiger, A. et al. (2024). pyvene: A Library for Understanding and Improving PyTorch Models via Interventions.
50. Lieberum, T., Rajamanoharan, S., Conmy, A. et al. (2024). Gemma Scope: Open Sparse Autoencoders Everywhere All At Once on Gemma 2.
51. Anthropic (2025). Open-sourcing circuit tracing tools.
52. Heaven, W. D. / MIT Technology Review (2026). Mechanistic interpretability: 10 Breakthrough Technologies 2026.