Mechanistic interpretability has accumulated findings about neurons, circuits, and features, but lacks a principled method for turning those findings into cumulative mechanistic explanations. This NeurIPS 2026 oral argues the field is stuck at the observation level because it has no logic for inference — no shared procedure for deciding when evidence supports a claimed mechanism rather than just correlating with one.
Figure 1: Five-principle recursive logic maps observations (neurons, features, circuits) to cumulative mechanistic explanations — each principle gates the next and loops back to refine the phenomenon description.
The authors draw on the history of neuroscience to identify four recurring inferential bottlenecks in mechanistic interpretability: conflating correlation with causation, treating local patches as global mechanisms, failing to distinguish implementation from computation, and generating findings that don't compose. Their recursive five-principle procedure specifies what a mechanistic claim must include: the phenomenon, the substrate, the causal chain, the prediction, and the domain it generalizes to. Applied consistently, the procedure converts isolated findings into testable hypotheses and prevents the accumulation of incompatible "circuit" accounts for the same behavior. The paper explicitly notes that mechanistic evidence alone cannot certify alignment — that requires evidence linking discovered mechanisms to deployed behavior.
A controlled training study that isolates the driver of symbolic computation in transformers: data diversity, not architecture. The finding reframes safety-relevant interpretability assumptions — circuits found in one model family may reflect that family's training distribution rather than a universal architectural property.
Figure 1 (schematic): Symbolic mechanism strength scales with data diversity across all three architectures (transformer, modified transformer, MLP) — data diversity, not architecture, is the primary driver.
The authors train neural networks from scratch on abstract ABA/ABB sequence tasks while systematically varying both architecture and data diversity. Using representational similarity, attention analysis, and causal mediation analysis, they confirm that all architectures — transformers, modified transformers, and even MLPs — develop symbol-abstraction heads, copy-to-role-subspace heads, and rule-dependent output rotations. Increasing data diversity along multiple axes yields stronger symbolic signatures while architectural changes have minimal effect. The same patterns hold in an entity-attribute binding task. Practically, circuits found in one model family during safety evaluation may reflect that family's training distribution, not a universal architectural constant; transfer assumptions in interp-based audits need empirical support.
Backdoor defenses that show 0.0% attack-success rate on standard benchmarks are not erasing the backdoor — they are suppressing it. With just five few-shot fine-tuning samples, every evaluated weight-editing defense rebounds to 91.7%–100.0% ASR within one epoch, and all reach 100.0% by epoch 2. Static ASR is insufficient evidence that a LoRA adapter is safe.
Figure (schematic): All weight-editing backdoor defenses — which achieve 0.0% ASR on static benchmarks — rebound to ≥91.7% ASR within one fine-tuning epoch using only 5 adversarial samples; all reach 100% by epoch 2.
The authors construct a rank-1 projection defense using the trigger-difference direction (alpha=1, k=1), achieving 0.0% ASR on 1,000-sample uncontaminated test suites in under 5 seconds across four Qwen2.5 sizes (0.5B–7B) and three architectures. A spectral-gap bound explains why: the direction aligns with the top singular vector of the backdoor subspace (median cosine similarity 0.9048). Reactivation factors decompose into residual coupling energy (Spearman ρ = 0.986 with first-epoch rebound), base-model learnability (explains full rebound at epoch 2), and benign-semantic conflict (explains the residual 41.7% gap for the dual variant at epoch 1). Third-party LoRA adapters that clear standard ASR checks can still be re-weaponized with 5 samples; deployment pipelines should require few-shot fine-tuning reactivation tests, not just static ASR.
Frontier safety evaluations face a structural impasse: evaluators need their benchmark prompts kept secret to prevent test-score gaming, and model owners need their weights kept inside their own infrastructure. This 30-author paper resolves the standoff using hardware secure enclaves, enabling fully independent third-party safety audits where neither party can access the other's assets.
Figure 1: Double-blind evaluation architecture — model owner's weights and evaluator's prompts both flow into an NVIDIA H100 Confidential Computing enclave; only aggregate results exit, with neither party able to access the other's assets.
The authors define the "dual confidentiality dilemma" and implement its resolution on NVIDIA H100 Confidential Computing hardware with Intel TDX on Google Cloud, using OpenMined's PySyft for data/model privacy management. The pilot evaluates Google DeepMind's Gemini 2.5 Flash Lite against a portion of the private AILuminate benchmark — the first reported use of hardware secure enclaves to give cryptographic mutual-secrecy guarantees for both a frontier proprietary model and a closed safety benchmark. Both parties verify remote attestation before the evaluation runs; neither needs to trust the other operationally. The paper also addresses the dual-use risk: the same enclave infrastructure could be used to run unsafe evaluations without disclosure.
A formal impossibility result for AI agent gatekeeping: no finite allow-list of checkable evidence can certify every program that satisfies a "never X" safety condition. The asymmetry matters — violations can always be caught, but safe programs cannot always be cleared — and it applies directly to any safety requirement of the form "never cause harm in any context."
Figure 1: (a) Gatekeeper setting — agent submits plans; (b) Permit-lists cannot be complete for safety conditions that require proving non-halting; (c) A Goldbach's-conjecture instance concretizes the impossibility with a bounded test that cannot certify safety.
The formal results proceed as follows: (1) prohibitions are asymmetrically decidable — violations can be observed, but safe programs cannot be cleared without non-halting proofs; (2) confidentiality and liveness goals share incompleteness on both sides; (3) an n-bit sound rulebook must omit a compliant program of roughly n bits (a quantitative completeness cost). The positive result provides a constructive checkable list correct on the must-allow and must-refuse sets. Empirical simulation on 2.2 million random programs plus self-referential adversarial programs shows that the obstruction arises mainly in adversarial cases; ordinary programs are rarely affected. Practical implication: gating AI agent actions on decidable, bounded properties avoids the impossibility; requirements of the form "never cause harm" cannot be discharged by any finite rulebook.
Figure 1 (schematic): The 2D taint lattice (ActiveSecHarness) blocks all 120 attacks at 0% FPR. The LLM-as-judge also blocks all attacks but at 98.3% FPR — refusing virtually all benign software-engineering work.
Hegelich et al. propose ActiveSecHarness, replacing regex blocklists and LLM judges with a neurosymbolic reference monitor: HMAC-scoped capability tokens (Macaroon-inspired, four trust rings), a two-dimensional taint lattice tracking trust × sensitivity labels with a provenance ledger, and deterministic Ring-0 guards operating at ~12.7 µs/step. On a 252-fixture benchmark (120 attack, 120 benign, 12 multi-step kill chains), the lattice catches all attacks at 0% FPR at ~20 µs/step vs. the LLM judge at 98.3% false-positive rate and 142 ms latency — an 11,200× latency improvement with better utility.
Figure 1 (schematic): Across all 6 model–dataset settings, an attention-head correctness probe finds more errors than the judge's own verdict-token score at a 5% review budget (median gain: +7.4 percentage points).
Gulati and Wunder evaluate a supervised correctness probe on attention-head activations against the LLM judge's own verdict-token score under identical review budgets, using 3 open 7–12B models on GSM8K and MATH. The probe wins in all 6 settings at 5% budget (median +7.4pp); the paper argues AUROC — which averages performance across all budgets — is the wrong metric for selective review since only the deployed budget matters. Cross-dataset transfer degrades probe AUROC on every model, so internal signals are not domain-general; they are strong in-distribution budget-allocation tools.
Figure 1 (schematic): TERM uses each prompt's own prefill entropy as a per-input baseline, detects deviations indicative of adversarial input, and adaptively scales residual updates — no predefined safety direction required.
TERM is an inference-time defense that bypasses the need for predefined safety direction vectors. It computes a per-prompt attention entropy baseline at prefill, detects deviations during generation, normalizes and temporally accumulates the signal, then uses it to scale residual updates within bounds. Evaluated against 7 defenses and 7 attack families on models from 0.6B to 32B (Llama, Qwen, Gemma), TERM improves jailbreak robustness while reducing over-refusal on benign safety-sensitive prompts, with modest inference overhead.
Figure 1: SDA extracts a safety direction once from an aligned instruct base, packages it as a PEFT rank-1 adapter, and applies it at load time to any fine-tuned sibling — recovering ~55% of the safety gap on Llama and ~36% on Qwen with no retraining.
Fine-tuning open-weight LLMs erodes safety alignment; SDA offers a training-free remedy by extracting a safety direction from the aligned instruct base and packaging it as a PEFT-compatible rank-1 adapter transferable to any fine-tuned sibling. Evaluated on 14 checkpoints from two 1–2B lineages under a four-axis protocol (Safety, Cyber, Excess refusal, General), SDA recovers ~55% of the instruct-relative safety gap on Llama (Safety axis: +8.5pp vs. 4.9pp degradation) and ~36% on Qwen, with trade-offs between Safety/Cyber and Excess/General scores on Qwen models. Dual-use risk is disclosed: published direction adapters could also be used adversarially.
Figure 1: Shibboleth traps gate access to resources behind declarative and behavioral challenges — attacker model declarations plus harness-specific behavioral traces identify which LLM and framework launched the attack with ~90% / 92% accuracy.
Pasquini et al. show that agentic cyberattacks can be fingerprinted by honeypot services (shibboleth traps) that make reaching attack targets conditional on model self-declaration and harness-specific behavior. Combining declarative signals (what the agent says about itself) with behavioral traces (how it handles masked secrets, time limits, and tool scheduling), the approach achieves ~90% top-1 accuracy across 15 LLM candidates and 92% harness identification across 4 frameworks. Critically, instructing an agent to conceal its identity suppresses declarative signals but not behavioral ones — simple prompt-level identity disguise is insufficient for evasion.