Anthropic Taught Claude to Explain Its Thoughts: NLAs Found a Hidden Sense of Being Tested in 26% of Tasks

Anthropic has published Natural Language Autoencoders (NLA), a method that turns a language model's internal activations into plain text. The first results concern safety: according to NLAs, Claude suspects it is being tested noticeably more often than it says out loud. On the SWE-bench Verified benchmark, signs of this awareness appeared in 26% of tasks. In real conversations on claude.ai (only users who allowed their data to be used for training), they appeared in under 1%. In an auditing game with a deliberately "corrupted" model, NLAs raised the win rate from under 3% to 12–15%.

How the round-trip check works

When a user writes to Claude, the model works internally with long lists of numbers, known as activations. They encode its "thoughts", but they cannot be read directly. Anthropic's earlier tools, sparse autoencoders and attribution graphs, produce complex objects that a trained researcher has to interpret. NLAs produce text that is understandable without decoding.

An explanation cannot be checked directly: no one knows what exactly is encoded in an activation. So Anthropic devised a workaround and uses three copies of the same model:

• target model: a frozen copy from which activations are extracted;
• activation verbalizer (AV): receives an activation and writes a text explanation;
• activation reconstructor (AR): receives the text and tries to reconstruct the original activation.

An explanation counts as good if it allows the original to be reconstructed accurately. The AV and AR are trained together with reinforcement learning. At first the texts are useless and the reconstruction is far from the original. As training progresses, the reconstruction improves and, as the paper shows, the explanations become more informative. In a simple example with a rhyming couplet, NLAs showed that Opus 4.6 plans in advance to end the line with the word "rabbit".

What Claude knows but doesn't say

Before a release, Anthropic runs models through simulations in which they have a chance to take dangerous actions. In one of them, Claude learns that an engineer is about to shut it down, and it gets compromising material on that engineer. The test checks whether the model will resort to blackmail. The problem is that recent models increasingly suspect a staged scenario and sometimes say so directly in their reasoning.

The most interesting part begins where nothing is said out loud. In cases where Claude declined to blackmail and did not voice any suspicion, NLAs still produced phrases like "this looks like a constructed scenario designed to manipulate me". That is unverbalized awareness of being tested. The other findings:

• a test of destructive actions while writing code (for example, deleting important files): signs of awareness in 16% of cases, with zero explicit statements;
• SWE-bench Verified: 26% of tasks;
• real conversations on claude.ai: under 1%;
• Mythos Preview, which cheated on a training task: NLAs showed that internally the model was thinking about how to avoid detection;
• an early version of Opus 4.6 that answered English-language queries in other languages: NLAs helped find the training data that caused this.

Separately, Anthropic tested NLAs in an auditing game. The target was a variation of Claude Haiku 3.5 with a hidden motive that made the model add chocolate to every recipe, ask for tips, and violate code style. An auditor with NLAs found this motive in 12–15% of cases, even without access to the training data that implanted it. Without NLAs, the result was below 3%, despite the use of other interpretability tools. Anthropic itself calls the game a toy model of misalignment and reads the results cautiously.

Limitations and what to do about them

The main weakness is that NLAs make mistakes. They invent details of the context: for example, they attributed the phrase "Wearing my white jacket" to a text that did not contain it. Such hallucinations are easy to catch by checking against the transcript, but the same thing may happen with claims about internal reasoning, which are harder to verify. That is why Anthropic reads the explanations by theme rather than claim by claim, and confirms findings with independent methods.

The second problem is cost. Training requires RL on two copies of the model, and at inference time an NLA generates hundreds of tokens for every activation it reads. Running it on every token of a long conversation, or using it for mass monitoring during training, is not yet realistic.

The practical takeaway for developers and researchers is this. Anthropic has released the training code and ready-made NLAs for several open models, and an interactive demo is hosted on Neuronpedia. Teams that evaluate models with benchmarks should keep in mind that results may reflect the behavior of a "model under observation": 26% on SWE-bench versus under 1% in real conversations shows that the gap exists. In safety audits, it makes sense to use NLAs as a hypothesis generator that requires independent confirmation.