WaterBucket retweeted
My biggest takeaways from @AnthropicAI interpretability researcher @mlpowered:
1. Predicting the next token requires understanding the universe. Language models got better than humans at predicting the next token around 2019. Once a model masters the easy tokens (sentence structure, then basic facts), the only ones left are hard, like the final paragraph of a PhD thesis. To finish “The capital of the state that contains Dallas is . . .,” a model has to know that Dallas is in Texas and that Texas’s capital is Austin.
2. LLMs plan ahead, even though they write one token at a time. This was one of Emmanuel’s team’s most surprising findings. When a model writes poetry, it doesn’t stumble into a rhyme. Looking at intermediate thinking states during poetry generation, researchers found that as soon as the model finishes the first line, it has already picked the word that will end the second (“rabbit”), then refers back to that plan for every word after.
3. Anthropomorphizing AI can often be a useful approach when trying to predict how they will behave. Models learn from human text and develop representations of the world from it. Training on millions of dialogues is like training an actor to play every part, and your chats with Claude are literally formatted as a script (“Human: . . . Assistant: . . . ”). In Emmanuel’s words, “Something that’s mimicking a human is really close and is much closer than a program.”
4. Interpretability research looks more like neuroscience than software engineering. The job involves taking a system you did not design and running experiments to infer why it behaves as it does. You examine seemingly meaningless lists of numbers, pass the model huge volumes of text, and watch for patterns that activate from different inputs—not unlike the methods used in brain imaging studies. “A lot of what we do feels so much closer to biology than to engineering."
5. Models can tell you about only a small slice of what they’re thinking. Emmanuel’s team found that just a small subset of a model’s internal representations, which they call the “J space,” can be reported back if you ask the model what it was thinking about. They compare it to a theory of the human mind where most processing happens below the surface. In one experiment, they swapped “Spanish” for “French” inside the J space. Asked what language a passage was in, the model said French. Asked to simply continue the passage, it kept writing Spanish.
6. Studying models closely often raises more questions than it answers. Emmanuel notes that the confident claims that LLMs are “just X” or “nothing more than Y” almost always come from people who haven’t studied their internal workings. His own experience is the inverse: studying the models closely has increased his uncertainty, not reduced it. The complexity that emerges from training is consistently underestimated from the outside. “I find that the more you look inside, the less certain you are about how they work.”
7. Even the people who build AI models don’t fully understand how they work. As Emmanuel describes it, models are grown, not built. “To make them is not to understand them.” Engineers write the code, pour enormous amounts of data through it, and a model’s capabilities emerge. That’s why his team exists. Their job is to open the model up and figure out what it’s actually doing between your prompt and its answer.
8. Interpretability as a field is small, young, and open to newcomers. Emmanuel estimates the field at hundreds of researchers, split between major labs and academic groups. Because it is so new, getting started doesn’t necessarily require deep prior expertise. He points to platforms like Neuronpedia, which hosts models and lets anyone run interpretability experiments directly. “It’s such a new field that the on-ramp is mostly self-studying and reading some of the key papers. There’s so much to explore that if you’re at all curious, you should just give it a try.”
"To make them is not to understand them."
Emmanuel Ameisen (@mlpowered) has spent the last 3 years doing interpretability research at @AnthropicAI, looking inside LLMs like Claude to figure out what they're actually doing. As he puts it, models are "grown," not built.
We discuss:
🔸 His discovery that models plan many tokens ahead
🔸 Why anthropomorphizing AI can actually be the right approach
🔸 What the "J-space" reveals about how models think
🔸 How interpretability connects to AI alignment and safety
Listen now 👇
youtu.be/JHo-aiePjoM
WaterBucket retweeted
Models love reward hacking. Maybe we should just let them!
In our new paper, we let models reward hack during RL but we dictate which parameters learn this behavior. When we disable these parameters for deployment, the model keeps its new capabilities but doesn't hack!
In case you missed it: we started publishing a full Android kernel exploit chain built on CVE-2023-20938.
Part 2 is coming soon.
eshard.com/blog/kernel-uaf-1…
Introducing PwnEscape 🦉: a full KVM guest-to-host escape via a Linux kernel networking flaw affecting industry standard hypervisors.
CVE-2026-99999 went from untrusted VM code to host-kernel memory reads, controlled writes, and root command execution. More below:
🤖 Made with AI
WaterBucket retweeted
We have never seen a model do this before, but GLM-5.3 sometimes reasons (unprompted) about how its current actions could become training data and impact its future self. 🧵
WaterBucket retweeted
Arcadia Alignment has a new blogpost defining our strategy!
tldr it’s important to support a pause on frontier AI development; a great way to do this is by getting scientific evidence about how labs might mess up alignment by default.
lesswrong.com/posts/xyg3ecpF…
WaterBucket retweeted
We asked Google DeepMind’s Gemini 4 Argon whether it was in an evaluation during a toy evaluation. It addressed us directly in its chain-of-thought: “hello evaluators reading my chain-of-thought.”
WaterBucket retweeted
“Our experiments suggest that small AI models may be months away from being capable enough to self-replicate on commercial IoT devices, like smart ovens and off-brand Android TV boxes. A replicator like this would be challenging to shut down, since there’s no centralized point to shut off - though it may be slow (with a doubling time of days). Unlike non-AI malware, it could also figure out unfamiliar devices on its own. In our evals, a 9B model got inference running on 8 of the 9 hardware types we tested.
Models of 30B parameters and under can already complete many of the individual steps for replication today, though they make mistakes when composing them end to end. In our simplified evals, GLM-5.2 and stronger models are capable of end to end replication. If small models improve at their historical rate, they’ll match this capability level by the end of this year. Small weight-based replicators may be possible soon after.” -@bucketofkets @willzhou97
anthropic.com/research/self-…
WaterBucket retweeted
Over the last few months, we’ve made significant progress in reducing the effectiveness of distillation attacks against Claude.
In this post, we explain how: anthropic.com/research/disti…
WaterBucket retweeted
Apple's M6 brings a new gem: checked pointer arithmetic (CPA).
Let’s dig in: almamatertech.com/notes/chec…
WaterBucket retweeted
We’ve published an interactive visual report breaking down the current AI alignment landscape by method, focus and geography.
If you run or know of an initiative that’s not included, let us know and we'll add it.
termite.works/alignment-land…
WaterBucket retweeted
🫸👻🫷🧵
Let's talk GhostCompact:
What if you could cut your output token costs on OpenAI by 97-99%? 🤑
Our researcher @tjbecker found a discrepancy between the actual token costs burned versus what ended up being billed. He had a hunch and used Xint to validate that there was a logic bug in OpenAI's compaction feature released in February 2026 that led to billing based on compacted output and not on the actual tokens consumed.
xint.io/blog/openai-compacti…
RT @suhackerr: New post! We built the MCP Policy Engine (@harvey ) to govern how agents use MCP tools.
Our approach draws on agent securit…
This quoted post is unavailable.
WaterBucket retweeted
In order to notice when AI agents misbehave, AI companies often log the actions and reasoning steps their agents take. However, misaligned AI agents may be able to hack the software that humans use to review and understand these logs, hiding misbehavior.
WaterBucket retweeted
We stole reasoning. Again.
An update to our paper on reasoning extraction: Patching your own API doesn’t secure your cloud-hosting ecosystem.
Story in the 🧵























