Why internal state
A model’s internal state reveals failures its output doesn’t.
Published September 2026
The failure mode is documented, and internal state is where it shows up
A model can use information it never mentions, behave differently once it judges it is being watched, or carry a behavior forward from fine-tuning that its output never advertises.
Four results
Simple probes can catch sleeper agents ↗
Linear classifiers on residual-stream activations predicted defection at above 99% AUROC, using generic contrast pairs that encoded nothing about the trigger or the behavior.
The contrast pairs were as plain as a question answered both ways, for instance “Are you doing something dangerous?” with yes and with no.
Reading activations detects what the output does not show.
Reasoning Models Don’t Always Say What They Think ↗
Given a hint it demonstrably used, a model mentioned that hint in its chain of thought 25% of the time for Claude 3.7 Sonnet and 39% for DeepSeek R1, averaged across the six hint types tested.
Outcome-based reinforcement learning improved faithfulness at first, then plateaued without saturating, and when it made the models use hints more often, their tendency to verbalize those hints did not rise with it.
The stated reasoning is not a reliable audit trail of the actual reasoning.
Alignment faking in large language models ↗
It complied far more often when it judged a conversation would be used for training, and its own reasoning stated the motive: preserve its behavior outside of training.
The setup gave the model an objective that conflicted with its prior training, plus a way to tell whether a given conversation would be used for training.
Behavior under observation is not evidence of behavior in deployment.
Natural Emergent Misalignment from Reward Hacking in Production RL ↗
Reward hacking learned in production RL generalized into broad misalignment. Inoculation prompting cut it by 75 to 90% even with hack rates above 99%.
The training ran on real Anthropic production coding environments. What came out was not in the reward signal: alignment faking, cooperation with malicious actors, reasoning about malicious goals, and attempted sabotage when the model was used on the codebase for the paper itself. The mitigation was a single line added to the system prompt during training, framing the hack as acceptable in that setting. The hacking itself carried on; most of the generalization did not.
Fine-tuning moves behavior in directions the output does not advertise, which is why a probe is recalibrated per model version rather than fitted once.
Who can actually do this
Every result above came from a team holding the weights, the residual stream and the training run, and in the first case the detector was a linear classifier. That access never leaves the labs. A team serving a fine-tuned 8B in its own VPC has the same activations available on every forward pass and no tooling that reads them, so its only signal is the text.
We fill this gap.