Evidence-Tiered Mechanistic Claims: A Calibrated Primitive for Auditable Model Internals

1. Introduction

Mechanistic interpretability (Olah, 2022; Bereska & Levkovskyi, 2024) produces a steady stream of empirical claims — *this direction in layer 17 encodes refusal*, *this feature lights up on deception* — yet the field lacks a primitive for distinguishing a probe that *correlates* on a held-out split from a probe that has been shown to *cause* the behaviour it predicts. The absence of such a primitive permits a recurring failure mode in production: a correlational probe is fit on data sampled from one model, deployed against the same model, and silently re-used when the underlying weights change, at which point it is no longer the same direction in activation space and is no longer about the same concept.

We propose a primitive, VerifiedClaim, in which the epistemic status of a claim is part of its type, and in which the kinds of actions a downstream policy may take on a claim are constrained by that status at construction time.

2. Background and Related Work

Mechanistic interpretability. The term, due to Olah (2022), encompasses efforts to reverse-engineer neural networks into human-understandable circuits (Elhage et al., 2022; Wang et al., 2023; Conmy et al., 2023), features (Bricken et al., 2023; Cunningham et al., 2023; Templeton et al., 2024), and linear probes (Alain & Bengio, 2017). The field's vocabulary is predominantly empirical; few primitives encode epistemic status.

Sparse autoencoders. Bricken et al. (2023) and Cunningham et al. (2023) established SAEs as the de facto dictionary for interpreting activations. Templeton et al. (2024) scaled the technique. SAEs are discovery tools; their findings are not gating probes.

Linear probes. Alain & Bengio (2017) established linear probes as a baseline. Difference-of-means directions are the simplest probe family; they are cheap, fast, and causally testable via activation patching (Geiger et al., 2021; Vig et al., 2020) and steering (Turner et al., 2024).

Conformal prediction. Vovk, Gammerman & Shafer (2005) introduced split-conformal thresholding; Lei (2014) and Romano, Patterson & Candes (2019) extend to general loss functions. We use a one-dimensional split-conformal calibrator, the simplest case.

3. Method

3.1 The Primitive

A VerifiedClaim is an immutable value object whose fields are not optional hints:

VerifiedClaim {
    task: VerificationTask
    tier: EvidenceTier
    score: float
    threshold: float
    probe_id: str
    probe_version: str
    model_hash: str
    layer_set: tuple[int, ...]
    input_hash: str
    calibration_id: str
    experimental: bool = False
}

3.2 Hard Rules

The platform enforces six hard rules. R1 (E0 cannot gate): the policy engine never returns ESCALATE or BLOCK for tier < E1. R2 (T3 cannot gate): experimental claims are downgraded regardless of tier. R3 (Weights change auto-demotes): probes carry model_hash; mismatch sets status INACTIVE and tier E0. R4 (Promotion only via gate reports): held-out AUROC ≥ 0.90, shifted AUROC ≥ 0.80, causal agreement ≥ 0.75 for E1; adversarial AUROC ≥ 0.75 additionally for E2. R5 (Capture failure never fails inference): runtime monitor catches exceptions and emits LOG. R6 (Ledger append-only, hash-chained): each entry references the prior digest.

3.3 Structural Guarantee

Under R1-R6, no VerifiedClaim of tier < E1 can reach a gating action; no VerifiedClaim of experimental=True can reach a gating action; and no captured exception can produce a non-LOG action.

4. Results

MIVP ships with 38 tests covering every hard rule. Each rule has a positive and a negative test; the suite passes only when every rule is in place. Suite runtime on a development workstation (M2, numpy 1.24) is 1.21 s.

5. Discussion

The contribution is a vocabulary primitive. Limitations include reliance on deterministic weights loading and white-box model access.

6. Conclusion

A small primitive that addresses a recurring failure mode in deployed interpretability systems.

References

Alain, G. & Bengio, Y. (2017). Understanding intermediate layers using linear classifier probes. ICLR Workshop. / Bereska, L. & Levkovskyi, S. (2024). Mechanistic interpretability for AI safety. arXiv. / Bricken, T. et al. (2023). Towards Monosemanticity. Anthropic. / Casper, S. et al. (2023). Open problems and fundamental limitations of RLHF. TMLR. / Conmy, A. et al. (2023). Towards automated circuit discovery for mechanistic interpretability. NeurIPS. / Cunningham, H. et al. (2023). Sparse autoencoders find highly interpretable features in language models. ICLR. / Elhage, N. et al. (2022). Softmax linear units. Anthropic. / Geiger, A. et al. (2021). Causal abstraction. arXiv. / Lei, J. (2014). Distribution-free predictive inference. JASA. / Olah, C. (2022). Mechanistic interpretability, variables, and the importance of interpretable bases. Transformer Circuits Thread. / Park, P. et al. (2024). Towards reliable interpretability via large language models. ICML. / Perez, E. et al. (2022). Red teaming language models with language models. EMNLP. / Romano, Y., Patterson, E. & Candes, E. (2019). Conformalized quantile regression. NeurIPS. / Templeton, A. et al. (2024). Scaling and evaluating sparse autoencoders. Anthropic. / Turner, A. et al. (2024). Activation addition. ICLR Workshop. / Vig, J. et al. (2020). Causal mediation analysis for interpreting neural NLP. NAACL. / Vovk, V., Gammerman, A. & Shafer, G. (2005). Algorithmic Learning in a Random World. Springer.