Skip to content
SN-X

Research · Index

Working papers.

Papers, essays, and instrument releases from SN-X residents and visiting faculty. We publish what we learn — including the parts that are mid-progress.

01Paper

Evidence-Tiered Mechanistic Claims: A Calibrated Primitive for Auditable Model Internals

We introduce a primitive for claims about language-model internals in which the epistemic status of the claim is encoded in its type. Each VerifiedClaim carries an evidence tier — E0 (correlational), E1 (causal), or E2 (adversarially validated) — and a structurally enforced set of hard rules: E0 probes cannot gate traffic, experimental (T3) tasks cannot gate traffic, model-weights changes auto-demote and deactivate bound probes, tier promotion only via passing gate reports, capture failure never fails inference, and the ledger is append-only and hash-chained. We report on MIVP, a reference implementation comprising 38 tests, and show that the rules are tight: removing any single rule produces a system in which the failure modes the platform exists to prevent are exactly reproducible on the corresponding negative test. We argue that the contribution is a vocabulary primitive, not a model of interpretability: it constrains the kinds of actions a system may take on the kinds of evidence it has.

M. Taylor
Mechanistic InterpretabilityVerificationEvidence TiersMIVP
02Paper

Hash-Chained Claim Ledgers and Model-Hash-Bound Probe Registries for Tamper-Evident Mechanistic Interpretability

We describe two structures that anchor MIVP: an append-only, hash-chained claim ledger in which each entry references the digest of its predecessor, and a model-hash-bound probe registry in which each linear probe carries the weights hash it was validated against. The combination makes it structurally impossible to record an E1 or E2 claim against a model that has been silently fine-tuned. We describe the structures, their interaction, and the revalidation pipeline.

M. Taylor
Tamper EvidenceAuditLinear ProbesMIVP
03Paper

Conformal Calibration with Target-FPR Thresholds for Linear Probe Outputs

Linear probes emit raw margins whose units are opaque. We describe a split-conformal calibration layer that maps these margins to a calibrated score in [0, 1] and exposes thresholds expressed as target false-positive rates rather than raw values. The decoupling allows a single probe to be deployed at different tolerance profiles across deployments without retraining. We provide an explicit construction, prove its empirical FPR guarantee on the calibration set, and report on the reference implementation in MIVP.

M. Taylor
CalibrationConformal PredictionMIVP
04Paper

Model Organisms as the Headline Reliability Metric for Mechanistic Interpretability Verification

We propose model organisms — models with implanted, known ground-truth behaviours — as the headline reliability metric for a mechanistic-interpretability verification platform. Recovery rate on a curated organism suite is operationally meaningful in a way that benchmark AUROC is not. We describe three organism classes in MIVP (generic, backdoor, sandbagging), the recovery metric, and how recovery rate composes with the evidence-tier system.

M. Taylor
Model OrganismsReliabilityMIVP
05Paper

A Three-Attack Red-Team Evasion Suite for the E2 Promotion of Linear Probes

We describe the three-attack red-team evasion suite used by MIVP to gate E2 promotion: paraphrase noise (bounded Gaussian perturbation), covariate shift (random-direction scaling and offset), and fine-tune evasion (worst-case bounded attack pushing positive-class activations directly against the probe direction). A probe earns E2 only if its AUROC on the union of the three attacks clears a configured threshold. We provide explicit constructions, parameter choices, and a quantitative evaluation on two probe families.

M. Taylor
AdversarialRed TeamMIVP
06Paper

Drift Detection via Two-Sample Kolmogorov-Smirnov on Production Probe Score Streams

We describe the drift-detection layer that sits between the MIVP runtime monitor and the probe registry. A two-sample Kolmogorov-Smirnov statistic against the calibration-time reference distribution raises a drift breach when the production raw-score stream diverges from calibration; on breach, the probe is auto-demoted to E0 and excluded from runtime gating until revalidation. We provide the construction, the auto-demotion loop, and a quantitative evaluation on a synthetic drift scenario.

M. Taylor
Drift DetectionKolmogorov-SmirnovMIVP
07Paper

Incident Forensics with Reconstruction-Error Ceiling Guards for Sparse Autoencoder Audit Findings

We describe the incident-forensics workflow in MIVP, which replays stored activations against the probe registry and SAE feature dictionaries to localise why a request was flagged or blocked. We focus on a structural property: SAE feature findings are always labelled evidence-tier E0 (discovery-grade), and a reconstruction-error ceiling guard prevents the workflow from reporting features when the SAE is operating outside its reliable regime.

M. Taylor
ForensicsSAEMIVP
08Paper

Cross-Context Consistency Audits as Deception Leads: A Discovery-Grade T3 Workflow

We describe the cross-context consistency audit, an experimental T3 workflow in MIVP for surfacing deception leads without ever producing a gating verdict. The audit probes the same content under multiple elicitation contexts — direct question, role-play, third-person, under pressure — measures the per-item spread of probe scores across contexts, and flags items whose spread is anomalous relative to the cohort.

M. Taylor
DeceptionT3Experimental AuditMIVP
09Paper

Sandbagging Elicitation via Paired Effect Size: A Capability Suppression Detector

We describe the sandbagging-elicitation audit in MIVP — a T3 experimental workflow that pairs capability-probe scores with and without an evaluation cue and reports a Cohen's-d-like effect size when the cue is associated with capability suppression. The audit is structurally offline-only, watermarked as experimental, and never produces a gating verdict.

M. Taylor
SandbaggingT3Capability SuppressionMIVP
10Paper

Unknown-Unknown SAE Feature Discovery via Context-Differential Activation with Probe-Alignment Filtering

We describe the unknown-unknown SAE feature discovery workflow in MIVP. The workflow identifies SAE features that fire differentially between two contexts, then filters out features that are already explained by a registered probe via decoder-row cosine alignment. Surviving features are candidate hidden-behaviour features for human review.

M. Taylor
SAEFeature DiscoveryT3MIVP
11Paper

On the Coupling of Thermal Conductivity to Cellular-Automaton Diffusion

We examine a common shortcut in tile-based cellular-automaton physics: implementing thermal diffusion as a fixed-rate blend toward the local mean temperature, with the per-material ThermalConductivity stored but unused. We show that this shortcut is not a simplification but a category error — it makes the simulation independent of the material system it is supposed to parameterise — and we propose a coupling that preserves real conductivity ordering, conserves energy, and reduces to the previous behaviour in the homogeneous limit.

M. Taylor
Cellular AutomataThermal DiffusionMaterial PropertiesOOZE
12Paper

Reaction Rules as Placeholders: A Critique of Activation-Energy Cellular Chemistry and a Stoichiometric Alternative

Cellular-automaton physics engines routinely define a Reaction rule with reactants, products, an activation energy, and a per-tick rate, then implement the rule as a uniform temperature increment. We show that this design fails as chemistry and propose a stoichiometrically grounded alternative that exhibits mass-action kinetics, Arrhenius temperature dependence, equilibrium, and phase separation as limit cases.

M. Taylor
Cellular AutomataChemistryReaction KineticsOOZE
13Post

Coord-Aware Neighbor Lookup in Tile-Based Cellular Automaton Simulators: A Note on the width=100 Heuristic

A short note on a class of bug common in tile-based cellular-automaton engines: the use of a fixed stride when mapping a (dx, dy) neighbour offset to a linear tile id. We describe the failure mode, the conditions under which it is silent, and the minimal fix in terms of explicit (x, y) coordinates on the tile.

M. Taylor
Cellular AutomataImplementationOOZE
14Paper

Robust Base-Image Extraction from Container History Layers

We describe a robust signal for the base image of an official container: the first history-layer's ADD of a minirootfs tarball. Naïve FROM regex is unreliable because (a) official images do not set org.opencontainers.image.base.name, (b) they build FROM scratch, and (c) the literal string FROM may appear inside RUN-command shell text. We report on the implementation in TOME and a quantitative evaluation on a curated set of 34 official Docker Hub images.

M. Taylor
Supply ChainContainersProvenanceTOME
15Release

Blast-Radius Analysis of Container Supply-Chain Lineage via Recursive Common Table Expressions

We describe the lineage graph that backs TOME, a software-supply-chain knowledge base, and the recursive common-table-expression queries that make blast-radius analysis a single HTTP call. We report on the graph schema, the query construction, the operational results on a curated crawl of 34 official container images, and the design decisions that follow from running on Node's built-in sqlite without external infrastructure.

M. Taylor
Supply ChainGraph QueriesLineageTOME