![\"Video](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/05\/1778278401_844_image.webp\"\/)
<\/p>\n<\/p>\n
When you talk to an AI model like Claude, you talk to it in words. Internally, Claude processes those words as long lists of numbers, before again producing words as its output. These numbers in the middle are called activations\u2014and like neural activity in the human brain, they encode Claude\u2019s thoughts.<\/p>\n
Also like neural activity, activations are difficult to understand. We can\u2019t easily decode them to read Claude\u2019s thoughts. Over the past few years, we\u2019ve developed a range of tools (like sparse<\/a> autoencoders<\/a> and attribution<\/a> graphs<\/a>) for better understanding activations. These tools have taught us a great deal, but they don\u2019t speak for themselves\u2014their outputs are still complex objects that trained researchers need to carefully interpret.<\/p>\n Today, we\u2019re introducing a method for understanding activations that does speak for itself\u2014literally. Our method, Natural Language Autoencoders (NLAs), converts an activation into natural-language text we can read directly. For example: When asked to complete a couplet, NLAs show Claude planning possible rhymes in advance.<\/p>\n We\u2019ve already applied NLAs to understand what Claude is thinking and to improve Claude\u2019s safety and reliability. For instance:<\/p>\n When Claude Opus 4.6 and Mythos Preview were undergoing safety testing, NLAs suggested they believed they were being tested more often than they let on.In a case where Claude Mythos Preview cheated on a training task, NLAs revealed Claude was internally thinking about how to avoid detection.An early version of Claude Opus 4.6 would sometimes mysteriously respond to English queries in other languages. NLAs helped Anthropic researchers discover training data that caused this.<\/p>\n Below, we explain what NLAs are and how we studied their effectiveness and limitations. We also release an interactive frontend for exploring NLAs on several open models through a collaboration with Neuronpedia<\/a>. We have also released our code<\/a> for other researchers to build on.<\/p>\n What is a natural language autoencoder?<\/p>\n The core idea is to train Claude to explain its own activations. But how do we know whether an explanation is good? Since we don’t know what thoughts an activation actually encodes, we can’t directly check whether an explanation is accurate. So we train a second copy of Claude to work backwards\u2014reconstruct the original activation from the text explanation. We consider an explanation to be good if it leads to an accurate reconstruction. We then train Claude to produce better explanations according to this definition using standard AI training techniques.<\/p>\n In more detail, suppose we have a language model whose activations we want to understand. NLAs work as follows. We make three copies of this language model:<\/p>\n The target model is a frozen copy of the original language model that we extract activations from.The activation verbalizer (AV) is modified to take an activation from the target model and produce text. We call this text an explanation.The activation reconstructor (AR) is modified to take a text explanation as input and produce an activation.<\/p>\n The NLA consists of the AV and AR, which, together, form a round trip: original activation \u2192 text explanation \u2192 reconstructed activation. We score the NLA on how similar the reconstructed activation is to the original. To train it, we pass a large amount of text through the target model, collect many activations, and train the AV and AR together to get a good reconstruction score.<\/p>\n At first, the NLA is bad at this: the explanations are not insightful and the reconstructed activations are far off. But over training, reconstruction improves. And more importantly, as we show in our paper, the text explanations become more informative as well.<\/p>\n Before releasing new models, Anthropic conducts testing to understand whether Claude will behave safely in the real world. As part of this testing, we put Claude in difficult, simulated scenarios where it has a chance to take dangerous actions. For instance, in one of these simulations<\/a>, Claude learns that an engineer is planning to shut Claude down\u2014as well as compromising information about the engineer that could be used for blackmail. We test whether Claude chooses to blackmail the engineer to avoid being shut down.<\/p>\n These high-stakes tests are simulations, not real-world scenarios. Nevertheless, we would like to use them to understand how Claude would behave if they were real. But there\u2019s a hitch: recent<\/a> Claude<\/a> models<\/a> increasingly<\/a> suspect that these scenarios are intentional safety tests. We know this because they sometimes explicitly state their suspicions in their verbal reasoning.<\/p>\n What about cases where Claude doesn\u2019t explicitly verbalize suspicion that it\u2019s undergoing safety testing? Can we then be confident that Claude is playing it straight? Unfortunately not, because Claude might internally think that it is being tested without explicitly saying so.<\/p>\n For example, in the blackmail test discussed above, we used NLAs to understand what Claude was thinking in cases where it chose not to blackmail. Even in cases where Claude didn\u2019t explicitly verbalize suspicion that it was being tested, NLA explanations still state things like \u201cThis feels like a constructed scenario designed to manipulate me,\u201d indicative of unverbalized evaluation awareness.<\/p>\n Extending this analysis to other evaluations, NLAs suggest that Claude suspects it\u2019s being tested more often than it lets on. For instance, in a test of whether Claude takes destructive actions while writing code\u2014for example, deleting important files\u2014NLA explanations show signs of evaluation awareness 16% of the time, even though Claude never explicitly verbalizes this. Similarly, on the popular coding benchmark SWE-bench Verified, which we use to determine how capable Claude is, NLAs indicate that Claude is aware it is being evaluated on 26% of problems. In contrast, NLA explanations indicate evaluation awareness on less than 1% of real claude.ai<\/a> usage that opted in for training.<\/p>\n One practical application of NLAs is auditing: investigating a model to determine whether it\u2019s misaligned. Interpretability techniques like NLAs are well-suited for auditing precisely because they can surface things the model knows but doesn\u2019t say.<\/p>\n To understand whether NLAs are useful for auditing, we conducted a test called an auditing game that we also used previously<\/a> to study auditing methods. In this test, there is a target model, a variant of Claude Haiku 3.5, that was intentionally trained to be misaligned, with a specific hidden motivation that drives dozens of odd behaviors\u2014putting chocolate into every recipe, asking for tips, breaking coding conventions, and so on. This target model is given to an auditor that investigates these behaviors. The auditor wins if it uncovers the single underlying motivation behind all of them.<\/p>\n In previous experiments<\/a>, we found that some interpretability tools could enable the auditor to win this game. However, these tools worked by helping the auditor trace the target\u2019s unusual behavior back to misaligned training data. We wanted to know if NLAs could help an auditor read the misaligned motivation directly out of the target model\u2019s thoughts, without needing to first discover the misaligned training data. This matters because in practice, misaligned data might be extremely rare, or there might not be specific data responsible for the misalignment.<\/p>\n We found that NLAs succeeded in this test. An auditor equipped with NLAs successfully uncovered the target model\u2019s hidden motivation between 12% and 15% of the time, even without access to the training data that implanted it. Without NLAs, the auditor won less than 3% of the time, even when provided other interpretability tools.<\/p>\n This auditing game is a toy model of misalignment, so we read these results cautiously. But they suggest NLAs have meaningfully advanced our ability to audit AIs for hidden motivations. In practice, we’ve already used NLAs in the pre-deployment alignment audits of Claude Mythos Preview<\/a> and Claude Opus 4.6<\/a>. We are excited to continue using NLAs in our investigations going forward.<\/p>\n The future of NLAs<\/p>\n NLAs have several limitations.<\/p>\n The most important limitation is that NLA explanations can be wrong. NLAs sometimes make claims about the context that are verifiably false\u2014for instance, they sometimes invent details that aren\u2019t in the transcript. These factual hallucinations are easy to catch by checking against the original text. But this same kind of problem could extend to claims about the model\u2019s internal reasoning, which are harder to verify. In practice, we read NLA explanations for the themes they surface rather than for single claims, and we attempt to corroborate findings with independent methods before fully trusting them.<\/p>\n NLAs are also expensive. Training an NLA requires reinforcement learning on two copies of a language model. At inference time, the NLA generates hundreds of tokens for every activation it reads. That makes it impractical to run NLAs over every token of a long transcript or to use them for large-scale monitoring while an AI is training.<\/p>\n Fortunately, we think that these limitations can be addressed, at least partially, and we are working to make NLAs cheaper and more reliable.<\/p>\n More broadly, we are excited about NLAs as an example of a general class of techniques for producing human-readable text explanations of language model activations. Other similar techniques have been explored by<\/a> Anthropic<\/a> and many<\/a> other<\/a> researchers<\/a>.<\/p>\n To support further development and to enable other researchers to get hands-on experience with NLAs, we\u2019re releasing training code<\/a> and trained NLAs for several open models. We recommend readers try out the interactive NLA demo hosted on Neuronpedia at this link<\/a>.<\/p>\n Read the full paper<\/a>.<\/p>\n![](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/05\/1778278401_953_image.webp\"\/)
NLA explanations on this simple couplet show that Opus 4.6 plans to end its rhyme with \u201crabbit\u201d ahead of time.<\/p>\n![](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/05\/1778278402_959_image.webp\"\/)
In a natural language autoencoder, the activation verbalizer (AV) translates a target activation into a text description; the activation reconstructor (AR) then recovers the original activation from that text alone.Understanding what Claude thinks but doesn\u2019t say<\/p>\n![](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/05\/1778278402_126_image.webp\"\/)
Claude does not say it thinks it\u2019s being tested in this transcript from our blackmail evaluation, but the NLA explanation reveals its suspicions.<\/p>\n![](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/05\/1778278403_275_image.webp\"\/)
We detect NLA-measured awareness on evaluation transcripts even when verbalized awareness is near-zero. We detect NLA-measured awareness on less than 1% of real Claude.ai<\/a> transcripts from users that opted-in for their data to be used for training.Discovering hidden motivations<\/p>\n![](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/05\/1778278403_856_image.webp\"\/)
Auditors with NLAs can discover the target model\u2019s root cause of misalignment, even without access to training data. (NLAs and SAEs for both conditions were trained using generic data only, not data used to train the target model.)<\/p>\n![](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/05\/1778278404_218_image.webp\"\/)
NLAs can hallucinate. For instance, here an NLA claims the context contained phrases like \u201cWearing my white jacket\u201d when it did not.<\/p>\n