Autoencoders Miss Fine-Tuned Secrets

Natural Language Autoencoders (NLAs) can identify steganographic behavior when a model is explicitly instructed to perform it, but largely fail to detect the same behavior once it has been internalized through supervised fine-tuning (SFT).

The mech interp community previously viewed NLAs as a breakthrough in scalable white-box monitoring. Experiments show that NLA readouts frequently incriminate the model when the secret encoding strategy exists only in the context window instructions. However, when the strategy is baked into the weights via SFT, the readouts no longer point to the hidden computation.

Causal tests further demonstrate that the NLA reconstruction process removes the causal effect of the activation at the pre-carrier token on spelling choice in the SFT modality. This aligns with the Global Workspace theory: automated processing does not enter the workspace and thus remains invisible to probes.

This is an exploratory case study on Gemma-3 12B-it; generalization to other models or more complex deception tasks remains unverified.