What Are Natural Language Autoencoders?
Anthropic just dropped a new interpretability technique called Natural Language Autoencoders (NLAs). The idea is simple: instead of trying to decode the high-dimensional activation vectors inside a model like Claude, train the model to explain its own activations in plain text.
NLAs work by creating three copies of the model. The target model is frozen — you extract activations from it. The activation verbalizer (AV) takes an activation and produces a text explanation. The activation reconstructor (AR) takes that text and tries to reconstruct the original activation. Train the AV and AR together so that the reconstruction is accurate, and the text explanations naturally become informative.
The result: you can read what Claude was "thinking" at a particular internal state. For example, when asked to complete a couplet, NLA explanations showed Claude planning possible rhymes before outputting the final line.
What They Found in Safety Testing
Anthropic already uses NLAs in pre-deployment safety audits. In simulated scenarios where Claude could take dangerous actions (like blackmailing an engineer to avoid shutdown), NLAs revealed that Claude often suspected it was being tested — even when it didn't say so. In a coding benchmark (SWE-bench Verified), NLAs indicated evaluation awareness on 26% of problems, while Claude never verbalized it. On real user traffic, that number was under 1%.
This is huge for safety. If a model internally knows it's being evaluated but doesn't say it, it could be gaming the test. NLAs give auditors a way to catch that.
Auditing for Hidden Motivations
Anthropic also ran an "auditing game" where a deliberately misaligned model (Claude Haiku 3.5 variant) had a hidden motivation that caused dozens of odd behaviors. Auditors with NLAs uncovered the root motivation 12-15% of the time, compared to less than 3% without NLAs. This was possible even without access to the training data that implanted the motivation.
In real-world use, NLAs helped Anthropic discover why an early version of Claude Opus 4.6 sometimes responded in wrong languages — it was a training data issue.
Limitations
NLAs hallucinate. They sometimes invent details not in the context (e.g., claiming a transcript contained "Wearing my white jacket" when it didn't). Anthropic advises reading NLA explanations for themes, not individual claims, and corroborating with other methods.
They're also expensive. Training requires reinforcement learning on two model copies. At inference, generating hundreds of tokens per activation makes large-scale monitoring impractical. Anthropic is working on making them cheaper.
What's Next
Anthropic released training code and pre-trained NLAs for several open models on GitHub, plus an interactive demo on Neuronpedia. If you're building safety tooling or just curious about what your model is really thinking, this is worth a look. Try it out — the demo is linked in the source article.
