今天我们报告了在理解 AI 模型内部工作原理方面的一项重大进展。我们确定了数百万个概念是如何在我们部署的大语言模型之一 Claude Sonnet 内部表示的。这是首次对现代、生产级大语言模型进行详细的内窥。这一可解释性发现未来可能有助于使 AI 模型更安全。我们通常将 AI 模型视为黑箱：输入内容，输出响应，但不清楚模型为何给出特定响应而非其他。这使得我们难以信任这些模型的安全性：如果我们不知道它们如何工作，如何知道它们不会给出有害、有偏见、不真实或其他危险的响应？我们如何信任它们会是安全可靠的？打开黑箱并不一定有帮助：模型的内部状态——模型在写出响应前“思考”的内容——由一长串数字（“神经元激活值”）组成，没有明确含义。通过与像 Claude 这样的模型交互，很明显它能够理解并运用广泛的概念——但我们无法通过直接观察神经元来辨别它们。
_Today we report a significant advance in understanding the inner workings of AI models. We have identified how millions of concepts are represented inside Claude Sonnet, one of our deployed large language models. This is the first ever detailed look inside a modern, production-grade large language model._ This interpretability discovery could, in future, help us make AI models safer. We mostly treat AI models as a black box: something goes in and a response comes out, and it's not clear why the model gave that particular response instead of another.
核心贡献 · Key contributions
首次使用字典学习对现代生产级大语言模型进行详细内部观察，提取了数百万个可解释特征。 First detailed look inside a modern, production-grade LLM using dictionary learning to extract millions of interpretable features.
特征代表从具体实体到抽象概念的广泛概念，且是多模态和多语言的。 Features represent a vast range of concepts, from concrete entities to abstract ideas, and are multimodal and multilingual.
操纵特征会因果性地改变模型行为，验证了它们塑造响应，例如放大'金门大桥'特征导致身份转变。 Manipulating features causally changes model behavior, validating they shape responses, e.g., amplifying 'Golden Gate Bridge' causes identity shift.
识别了与安全相关的特征，如诈骗邮件、代码后门、偏见和谄媚，为潜在监控和引导提供了可能。 Identified safety-relevant features like scam emails, code backdoors, bias, and sycophancy, enabling potential monitoring and steering.
展示了内部概念组织与人类相似性一致，解释了 Claude 的类比和隐喻能力。 Demonstrates that internal concept organization mirrors human similarity, explaining Claude's analogy and metaphor abilities.
通过揭示标准输入/输出交互中不可见的潜在有害能力，提供了'安全测试集'。 Provides a 'test set for safety' by revealing latent harmful capabilities not visible through standard input/output interactions.
局限 · Limitations
当前技术对于完整特征提取成本过高；所需算力远超训练算力。 Current technique is cost-prohibitive for full feature extraction; compute required vastly exceeds training compute.
特征仅代表所学概念的一小部分；完整集合仍未知。 Features represent only a small subset of all concepts learned; full set remains unknown.
理解表征并不解释其使用方式；仍需找到相关电路。 Understanding representations does not explain how they are used; circuits need to be found.
已识别出安全相关特征，但尚未证明在实践中能提升安全性。 Safety-relevant features have been identified but not yet proven to improve safety in practice.
该方法可能被拥有模型权重的恶意行为者用于移除安全防护，尽管已有更简单的方法。 Method may be used to remove safeguards by malicious actors with model weight access, though simpler methods already exist.