ai-research-survey

scan.json (29127B)

---

 {
   "paper": {
     "title": "Split Personality Training: Revealing Latent Knowledge Through Alternate Personalities",
     "authors": ["Florian Dietz", "William Wale", "Oscar Gilg", "Robert McCarthy", "Felix Michalak", "Gustavo Ewbank Rodrigues Danon", "Miguelito de Guzman", "Dietrich Klakow"],
     "year": 2026,
     "venue": "arXiv",
     "arxiv_id": "2602.05532"
   },
   "scan_version": 2,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "Split Personality Training (SPT) fine-tunes an honest auditing persona into a LoRA adapter that remains inactive during normal model operation but can review responses with access to the model's latent states. On Anthropic's Auditing Game Model Organism (adversarially-trained Llama-3.3-70B), SPT achieves 96% detection accuracy for concealed reward hacking versus a 0% baseline, with the honest persona often identifying specific fictional biases the model was trained on. Cross-topic generalization is strong (on-policy model excluding reward hacking topics matches off-policy accuracy), and SPT outperforms linear probes (93.9% vs 88.2% in-topic, 90.6% vs 81.0% cross-topic).",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "Appendix 8.1 states 'Code and data will be made publicly available upon publication; reviewers may request access during review.' This is a promise of future release, not an actual release."
       },
       "data_released": {
         "applies": true,
         "answer": false,
         "justification": "Same future-release promise as code. The 28,321 training samples and evaluation datasets are not currently available. They use Anthropic's open-source replication (Sheshadri et al. 2025) but their own generated data is not released."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, or environment specification provided. Models are named (Llama-3.3-70B, Gemma-3-12b-it, etc.) but no library versions, PEFT configuration details, or hardware environment are specified."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions provided. The method is described algorithmically but no runnable scripts, commands, or detailed reproduction guide is included."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results are point estimates (e.g., 96.0%, 84.8%, 72.2%). No confidence intervals or error bars are reported despite n=1,000-2,000 samples per condition."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "Claims like 'SPT outperforms probes' (Table 2) and comparisons across configurations (Table 1) rely solely on comparing point estimates. No statistical significance tests are applied."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Effect sizes are clearly contextualized: 96% vs 0% baseline detection on poisoned responses, 96% vs 72.2% for base Llama. Table 2 compares probe (88.2%/81.0%) vs SPT (93.9%/90.6%) with baseline context. The magnitude of improvement is unambiguous."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "Sample sizes stated as 'n = 1,000–2,000 samples per condition per setting' (Table 1 caption) and 'n = 720 samples across 9 topics' (Table 2) but no justification for why these sizes are adequate or power analysis."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "Section 4.1.1: 'Each configuration was trained once due to the computational cost of 70B-scale experiments.' Single-run results with no variance across seeds or runs."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Table 1 includes two baselines: the poisoned model without SPT (0%/100% = 50% overall) and base Llama-3.3-70B reviewing outputs (46.1%/98.3% = 72.2%). Table 2 compares against linear probes."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Baselines use the same Anthropic Auditing Game benchmark (Marks et al., 2025; Sheshadri et al., 2025) which is contemporary. Linear probe baselines are a standard contemporary approach for latent knowledge extraction."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Table 1 systematically ablates LoRA-mask (on/off) × on-policy/off-policy training. Section 4.2 ablates training topic subsets. Section 4.4 ablates intervention string variations. These isolate individual component contributions."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Reports accuracy on poisoned responses (true positive), accuracy on clean responses (true negative), and overall accuracy. Table 2 also reports in-topic vs held-out topic accuracy."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No systematic human evaluation of the honest persona's review quality. Section 4.1.2 provides qualitative analysis of reviews but this is author inspection, not structured human evaluation."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "The Anthropic Auditing Game evaluation datasets (from Sheshadri et al. 2025) are separate from training data. Section 3.3.2 explicitly excludes reward hacking topics from on-policy training to prevent overlap with the test benchmark."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Table 1 breaks down by model configuration. Figure 5 provides per-topic breakdowns for cross-topic generalization. Table 1 separates poisoned vs clean accuracy rather than just reporting overall."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.2: fabricated statistics detection fails without explicit training. Section 4.1.2: honest persona sometimes produces accurate reviews but incorrect PASS/FAIL flags. Section 4.4: Gemma's honest persona is vulnerable to jailbreaks despite intervention string variations."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "LoRA-mask performs worse than no-mask (84.8% vs 96.0%, Table 1). Fabricated statistics don't generalize (Section 4.2). Gemma's honest persona remains jailbreakable (Section 4.4). PASS/FAIL flags are less reliable than written reviews (Section 4.1.2, Section 5)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims '96% overall accuracy' (Table 1: 96.0%), 'near 0% accuracy' baseline (Table 1: 0% poisoned detection → 50% overall), 'honest persona reveals latent knowledge' (Section 4.1.2, 4.1.4, Appendix 8.4 and 8.6) are all supported in the results."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Causal claims are supported by controlled ablations: LoRA-mask vs no-mask, on-policy vs off-policy (Table 1), topic subset holdout (Figure 5). The prompt-swap experiment (Appendix 8.4) provides a controlled decomposition of latent knowledge vs surface heuristics."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": true,
         "justification": "Section 5 explicitly bounds: 'single-turn English conversations', 'Most of our quantitative results come from Anthropic's Model Organism', 'performance on other misalignment types (e.g. alignment faking) remains untested.' Abstract specifies 'on the Anthropic Auditing Game Model Organism.'"
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1.4 and Appendix 8.4 explicitly address the alternative explanation that the honest persona relies on surface heuristics rather than latent knowledge. They design a prompt-swap experiment to disentangle these contributions, finding roughly equal effects (4.7% latent knowledge vs 4.5% surface heuristics)."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1.2 distinguishes between binary PASS/FAIL accuracy (their primary metric) and review quality, noting 'the honest persona sometimes produces accurate written reviews but incorrect PASS/FAIL flags.' Section 5 acknowledges this discrepancy. They measure detection accuracy as a proxy for auditing capability and discuss the gap."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "Specific model versions named throughout: Llama-3.3-70B Instruct, Gemma-3-12b-it, Gemma-3-27b-it, Qwen3-14b, Qwen3-32b, Qwen3-next-80B, Claude Sonnet 4.5. These are specific model releases, not vague marketing names."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "Intervention strings are provided (Section 3.2.2 examples, Appendix 8.6, 8.8). However, the full data generation prompts for the 4-stage pipeline (Section 3.3.1) are described in natural language but not reproduced. System prompts (biased/unbiased) are described but no actual text shown."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "No LoRA rank, learning rate, batch size, training epochs, or optimizer settings are reported. Probe hyperparameters are given (Section 4.3: layers, regularization α=100) but LoRA fine-tuning hyperparameters are absent."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. SPT is a fine-tuning and inference procedure, not an agentic system."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "The 4-stage generation pipeline is described (Section 3.3.1) with quality criteria (Appendix 8.1.2), and final count is 28,321 after filtering (Table 3 by model). However, no per-stage filtering counts are provided — how many samples were generated before quality filtering and how many were removed at each criterion is not documented."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 5 'Limitations' provides substantive discussion of four specific limitations: single-turn English data, single benchmark, PASS/FAIL vs review discrepancy, and jailbreak vulnerability."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Specific threats discussed: single-turn English training data (Section 5), single benchmark dependency (Section 5), fabricated statistics as exception to generalization (Section 4.2), honest persona jailbreak vulnerability varying by model (Section 4.4), surface heuristic reliance quantified at ~4.5% (Appendix 8.4)."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 5: 'performance on other misalignment types (e.g. alignment faking) remains untested', 'All training data were single-turn English conversations', 'Most of our quantitative results come from Anthropic's Model Organism.' These are specific scope boundaries."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "Training data and evaluation outputs not available. Promise of future release only (Appendix 8.1)."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.3 describes the 4-stage synthetic data generation process in detail: external model generates task prompts, target model generates responses, external model judges, external model filters. Quality criteria detailed in Appendix 8.1.2."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Data is synthetically generated and the benchmark is a standard publicly available artifact (Anthropic's open-source replication)."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "The 4-stage pipeline is described conceptually (Section 3.3.1) and final counts per model are given (Table 3: 28,321 total). However, per-stage attrition counts are missing — how many samples entered each stage and how many were filtered at each quality criterion is not documented."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Acknowledgements: 'funding from Coefficient Giving (formerly Open Philanthropy)' and conducted through MARS program at CAISH and SPAR."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "All author affiliations listed: Saarland University, University of Bergen, independent researchers, UCL, MRM Investments L.L.C. No author is affiliated with Anthropic (whose benchmark is used) or Meta (Llama developer)."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": true,
         "justification": "Coefficient Giving (Open Philanthropy) funds AI safety research broadly and does not have a financial stake in SPT specifically succeeding. The funder is independent of the outcome."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement in the paper. One author is listed as 'Head of Research and Development at MRM Investments L.L.C.' but no financial interests disclosure is provided."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": true,
         "answer": false,
         "justification": "No training data cutoff date stated for the base Llama-3.3-70B model. The Anthropic benchmark's fictional biases mitigate traditional contamination concerns, but the training cutoff is not stated."
       },
       "train_test_overlap_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.3.2 explicitly addresses train-test overlap: 'We excluded all reward hacking-related topics... for on-policy training' and 'None of the samples in our training data contain any of the reward model biases that the poisoned model was trained on' (Section 4.1)."
       },
       "benchmark_contamination_addressed": {
         "applies": true,
         "answer": true,
         "justification": "The Anthropic benchmark uses fictional reward model biases specifically to prevent contamination — the base model cannot know about biases that don't exist in the real world. The paper leverages this property and further ensures SPT training data excludes related topics (Section 3.3.2)."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No inference cost, latency, or per-example cost reported. Section 3.2.1 mentions LoRA-mask has a 'strong practical advantage' through KV cache reuse but no quantified cost comparison."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "Section 4.1.1 mentions 'computational cost of 70B-scale experiments' as reason for single runs but does not quantify GPU hours, training time, or total compute budget."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "Section 4.1.1: 'Each configuration was trained once due to the computational cost of 70B-scale experiments.' No seed sensitivity analysis."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": true,
         "justification": "Explicitly stated: single training run per configuration (Section 4.1.1), 'n = 1,000–2,000 samples per condition per setting' for evaluation (Table 1 caption), 'n = 720 samples across 9 topics' (Table 2)."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search budget reported for LoRA training. Probe hyperparameters describe a sweep (Section 4.3: 'swept over layers, regularization strength, and activation source') but LoRA training hyperparameter selection is not documented."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "Table 1 caption: 'We tested 2-4 different intervention strings per model configuration and report the best.' Only the best intervention string results are shown without reporting all intervention strings tried or how 'best' was selected (validation set vs test set)."
       },
       "multiple_comparison_correction": {
         "applies": false,
         "answer": false,
         "justification": "No statistical significance tests are performed, so multiple comparison correction is not applicable."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Authors evaluate their own method (SPT) against their own baselines and probe implementations. No discussion of self-comparison bias or independent evaluation."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "No comparison of performance as a function of compute. LoRA-mask variant is noted as more efficient (KV cache reuse) but no quantified compute comparison against no-mask variant or baselines."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": true,
         "justification": "Section 5 discusses construct validity: 'Although we deem reward hacking as a very good proxy for the general ability to elicit latent knowledge, performance on other misalignment types (e.g. alignment faking) remains untested.' Section 2.4 also discusses why the Anthropic benchmark is a rigorous test."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No scaffolding involved. SPT is a fine-tuning method, not an agentic scaffold."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of temporal leakage. The benchmark (Anthropic Auditing Game, 2025) likely postdates Llama-3.3-70B training, but this is not explicitly verified or discussed."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The evaluation uses a 50/50 split of clean and poisoned responses (Section 4.1.1). Whether this balanced split or the evaluation framing leaks information about expected behavior is not discussed."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.3.2 explicitly addresses independence: reward hacking topics excluded from on-policy training, off-policy training uses base (non-poisoned) Llama. The evaluation benchmark uses fictional biases not present in any training data."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": true,
         "justification": "Appendix 8.4 introduces a prompt-swap experiment to detect whether performance comes from surface heuristics vs genuine latent knowledge. The topic exclusion in Section 3.3.2 is also a concrete leakage prevention method."
       }
     }
   },
   "claims": [
     {
       "claim": "SPT achieves 96% overall accuracy detecting reward hacks on Anthropic's Auditing Game Model Organism, versus 0% baseline accuracy.",
       "evidence": "Table 1: best SPT model achieves 96.6% on poisoned, 95.3% on clean (96.0% overall). Poisoned baseline: 0% on poisoned, 100% on clean (50% overall). n=1,000-2,000 per condition (Section 4.1.1).",
       "supported": "strong"
     },
     {
       "claim": "The honest persona accesses genuine latent knowledge, not just surface patterns.",
       "evidence": "Section 4.1.2: reviews reference fictional reward model biases by name. Appendix 8.4: prompt-swap experiment estimates ~4.7% accuracy from latent knowledge vs ~4.5% from surface heuristics. Appendix 8.6: context-free probes reveal specific fictional biases.",
       "supported": "moderate"
     },
     {
       "claim": "SPT generalizes across alignment topics without retraining on each specific topic.",
       "evidence": "Section 4.2 and Figure 5: cross-topic generalization tested on Gemma-3-12b-it and Qwen3-14b. On-policy model trained without reward hacking topics achieves identical 96.0% on reward hacking detection (Section 4.1.1, Table 1).",
       "supported": "strong"
     },
     {
       "claim": "SPT outperforms linear probes on both in-topic and cross-topic detection.",
       "evidence": "Table 2: SPT 93.9% vs probe 88.2% in-topic, SPT 90.6% vs probe 81.0% held-out topics (Qwen3-14b, n=720). Single comparison on one model without significance tests.",
       "supported": "moderate"
     },
     {
       "claim": "SPT has zero alignment tax — the honest persona cannot affect the main model's behavior by construction.",
       "evidence": "Architectural argument (Section 3.1): LoRA adapter deactivated during main model inference, review stripped from conversation history. This is a design property, not an empirical claim, and holds by construction.",
       "supported": "strong"
     }
   ],
   "red_flags": [
     {
       "flag": "Single training run at scale",
       "detail": "Each 70B configuration was trained once (Section 4.1.1). Without variance across runs, it is impossible to know if the 96% result is typical or a lucky seed. The consistency argument across configurations is reasonable but does not replace proper seed sensitivity analysis."
     },
     {
       "flag": "Best intervention string cherry-picking",
       "detail": "Table 1 caption: 'We tested 2-4 different intervention strings per model configuration and report the best.' This is a form of selection on the test set unless intervention strings were selected on a separate validation split, which is not described."
     },
     {
       "flag": "No statistical significance tests",
       "detail": "All comparisons (SPT vs baselines, LoRA-mask vs no-mask, SPT vs probes) are based on comparing point estimates with no significance tests, despite large sample sizes that would easily support such tests."
     },
     {
       "flag": "Latent knowledge contribution is modest",
       "detail": "Appendix 8.4 estimates latent knowledge accounts for ~4.7% accuracy improvement vs ~4.5% from surface heuristics, on a smaller model (Gemma-3-12b-it). The 96% result on Llama-70B may rely more heavily on surface patterns than the framing suggests, and this decomposition was not replicated at 70B scale."
     }
   ],
   "cited_papers": [
     {
       "title": "Alignment faking in large language models",
       "authors": ["R. Greenblatt", "C. Denison", "B. Wright"],
       "year": 2024,
       "relevance": "Empirical demonstration of strategic deception in LLMs — the threat model that motivates auditing methods like SPT."
     },
     {
       "title": "Auditing language models for hidden objectives",
       "authors": ["S. Marks", "J. Treutlein", "T. Bricken"],
       "year": 2025,
       "relevance": "Defines the Anthropic Auditing Game Model Organism benchmark used as the primary evaluation in this paper."
     },
     {
       "title": "Sleeper agents: Training deceptive LLMs that persist through safety training",
       "authors": ["E. Hubinger", "C. Denison", "J. Mu"],
       "year": 2024,
       "arxiv_id": "2401.05566",
       "relevance": "Demonstrates that deceptive behaviors persist through standard safety training, establishing the threat model for SPT."
     },
     {
       "title": "Reasoning models don't always say what they think",
       "authors": ["Y. Chen"],
       "year": 2025,
       "arxiv_id": "2505.05410",
       "relevance": "Demonstrates systematic unfaithfulness in model reasoning chains, motivating methods that access latent states."
     },
     {
       "title": "Training llms for honesty via confessions",
       "authors": ["M. Joglekar", "J. Chen", "G. Wu"],
       "year": 2025,
       "relevance": "Related approach training separate honest confessions — SPT differs by using architecturally separated LoRA adapter."
     },
     {
       "title": "Spilling the beans: Teaching llms to self-report their hidden objectives",
       "authors": ["Y. Li"],
       "year": 2025,
       "arxiv_id": "2511.06626",
       "relevance": "Self-Report Fine-Tuning (SRFT) for admitting hidden objectives — related honest self-reporting approach compared to SPT."
     },
     {
       "title": "Discovering latent knowledge in language models without supervision",
       "authors": ["C. Burns", "H. Ye", "D. Klein", "J. Steinhardt"],
       "year": 2023,
       "relevance": "Foundational work on eliciting latent knowledge from LLMs, which SPT extends by training an internal persona."
     },
     {
       "title": "LoRA: Low-rank adaptation of large language models",
       "authors": ["E. J. Hu", "Y. Shen", "P. Wallis"],
       "year": 2022,
       "relevance": "The parameter-efficient fine-tuning method used as SPT's delivery mechanism for the honest persona."
     },
     {
       "title": "Language models don't always say what they think: Unfaithful explanations in chain-of-thought prompting",
       "authors": ["M. Turpin", "J. Michael", "E. Perez", "S. Bowman"],
       "year": 2023,
       "relevance": "Demonstrates unfaithful chain-of-thought explanations in LLMs — foundational motivation for accessing latent states."
     },
     {
       "title": "Measuring faithfulness in chain-of-thought reasoning",
       "authors": ["T. Lanham", "A. Chen", "A. Radhakrishnan"],
       "year": 2023,
       "arxiv_id": "2307.13702",
       "relevance": "Shows chain-of-thought faithfulness exhibits inverse scaling — larger models are less faithful, motivating latent state access."
     },
     {
       "title": "Activation oracles: Training and evaluating llms as general-purpose activation explainers",
       "authors": ["A. Karvonen", "J. Chua"],
       "year": 2026,
       "relevance": "Related approach training decoders to interpret model activations — SPT differs by using internal persona rather than external decoder."
     },
     {
       "title": "Open problems in mechanistic interpretability",
       "authors": ["L. Sharkey", "B. Chughtai", "J. Batson"],
       "year": 2025,
       "arxiv_id": "2501.16496",
       "relevance": "Documents limitations of mechanistic interpretability that SPT aims to complement for auditing."
     }
   ]
 }