NLAs miss some internalized behaviors

TL;DR: NLAs detect side tasks the model is instructed to do, but mostly miss the same behavior if it is fine-tuned in. After the Activation Oracles and then Natural Language Autoencoders were released, there was a hope in the mech interp community that the scalable unsupervised white box monitoring breakthrough has been achieved. From Natural Language Autoencoders Produce Unsupervised Explanations of LLM Activations (Fraser-Taliente et al., 2026) For example, the NLAs were reportedly the most effective technique in detection of eval-awareness . Yet, the landscape of the side tasks that NLAs can confess is very underexplored. It is unclear how internalization of harmful behavior and the NLAs confession rate interact. Consider a model that learned to hide secrets steganographically using the Shirali-Shahreza scheme. While rewriting a passage, it spells a word that has both spellings the British way for a “1” bit and the American way for a “0” bit ( centre/center, colour/color ). We call that word the carrier , and the token immediately before it the pre-carrier token . It turns out that NLAs [1] behave very differently when used to detect steganography in an In-Context Learning (ICL) modality versus an SFT [2] modality (where the secret encoding strategy has been "internalized" -- no instructions are needed, just a prepended secret). Specifically, we find NLAs produce incriminating readouts much more often in the ICL modality than in the SFT'ed model. The presence of the instr…