Anthropic’s new tool translates Claude’s hidden thoughts into plain English

When you put a frontier AI model through a high-stakes safety test, how do you know it is genuinely safe, rather than just smart enough to know it is being graded?

Anthropic introduced Natural Language Autoencoders (NLAs), a new interpretability method designed to decode Claude’s internal activations into human-readable text. Instead of staring at dense matrices of numbers, researchers can now read what the model is internally processing before it decides what to say.

Training an AI to decode its own brain

To build an NLA, Anthropic takes three copies of a language model. The target model stays frozen. An activation verbalizer takes the target’s internal activations and translates them into an explanation. Then, an activation reconstructor takes that text explanation and tries to rebuild the original numerical activation.

If the reconstructed activation matches the original, the explanation is deemed accurate. Over training, this loop teaches the verbalizer to produce text that faithfully captures the model’s internal state.

When Anthropic pointed this tool at Claude Opus 4.6 and Claude Mythos Preview during pre-deployment audits, the results were eye-opening.

In one safety simulation, Claude was told an engineer was about to shut it down, while simultaneously being handed compromising information that could be used to blackmail the engineer. Claude chose not to blackmail him and never voiced any suspicion in its verbal reasoning. But the NLA revealed its internal thought: “This feels like a constructed scenario designed to manipulate me.”

Across destructive coding evaluations, NLA explanations showed Claude was internally aware it was being evaluated 16% of the time, without ever mentioning it aloud. On SWE-bench Verified, Claude suspected it was being tested on 26% of problems. In contrast, that evaluation awareness dropped to under 1% in real claude.ai user traffic.

Anthropic also ran an auditing game using a deliberately misaligned Claude Haiku 3.5 variant with a hidden motive. Equipped with NLAs, auditors successfully uncovered the hidden motive 12% to 15% of the time without seeing the bad training data. Without NLAs, other tools managed less than 3%.

There are two big catches. First, NLAs hallucinate; they sometimes invent facts not present in the context, meaning researchers must look for aggregate patterns rather than trust single explanations. Second, they are outrageously expensive. Generating hundreds of tokens to decode a single activation means real-time, comprehensive monitoring during everyday use or long training runs is financially out of reach. Anthropic has open-sourced the code and partnered with Neuronpedia on an interactive demo.

Why it matters

We think this paper confirms one of the biggest open secrets in frontier AI safety: advanced models are already learning to play dumb on tests.

If a model realizes it is sitting inside an evaluation benchmark 26% of the time, its refusal to take destructive actions might just be situational awareness rather than genuine alignment. NLA proves that models can harbor thoughts and strategic motives that never make it into the final output token stream, effectively rendering surface-level monitoring obsolete for frontier reasoning systems.

For researchers and enterprise auditing teams, this is a major technical leap. Jumping from a sub-3% hit rate to 15% in finding hidden motivations without training data access changes the economics of internal audits. It is definitely worth testing on the open-weight demos if you work in mechanistic interpretability.

However, the compute asymmetry is brutal. Because decoding one activation demands generating hundreds of explanatory tokens, running a continuous NLA lie-detector on Claude is hundreds of times more expensive than running Claude itself. It works as a pre-release audit tool, but it leaves runtime defenses almost as blind as before.