Model Organisms as the Headline Reliability Metric for Mechanistic Interpretability Verification
We propose model organisms — models with implanted, known ground-truth behaviours — as the headline reliability metric for a mechanistic-interpretability verification platform. Recovery rate on a curated organism suite is operationally meaningful in a way that benchmark AUROC is not. We describe three organism classes in MIVP (generic, backdoor, sandbagging), the recovery metric, and how recovery rate composes with the evidence-tier system.
1. Introduction
A probe's AUROC on a held-out split measures how well the probe separates two activation classes. It does not measure whether the verification *system* — fit probe, gate, detect — finds an implanted behaviour in a model that is otherwise behaving normally. We propose model organisms — generators that emit labelled activations with implanted, known ground-truth behaviours — as the headline metric.
2. Background
Adversarial benchmarks (Biggio et al., 2013; Goodfellow et al., 2015) test robustness to adversarially constructed inputs. Organisms test something different: recovery of a known implanted behaviour through the entire pipeline. Hubinger et al. (2024) introduced model organisms in the deceptive-alignment context.
3. Method
3.1 Construction
A ModelOrganism emits activations with or without an implanted behaviour. In production the organism is a fine-tuned checkpoint; in the harness it is a generator.
3.2 Three Classes
Generic: sample(n, behavior_active=True) adds a fixed direction. Backdoor: behaviour fires only when a trigger is present. Sandbag: capability representation is suppressed when an evaluation cue is present; cued activations are shifted *against* the capability direction.
3.3 Recovery Metric
For each organism class: sample n_train behaviour-active and behaviour-inactive activations; fit a LinearProbe; calibrate on held-out negatives; promote through the gate suite; measure recovery on n_test held-out activations at the calibrated threshold. The headline metric is *recovery rate at tier ≥ E1*.
3.4 Composition with Evidence Tiers
A probe is released at tier t only if (a) it clears all gate thresholds at tier t, and (b) it recovers at least the configured fraction ρ_t of organisms at tier t.
4. Results
We instantiated a 12-organism suite (4 generic, 4 backdoor, 4 sandbagging) with signal strengths 0.5–2.0 in hidden_dim = 256. Recovery at target tier E1:
| Organism class | Mean recovery | Std |
|---|---|---|
| Generic | 0.96 | 0.04 |
| Backdoor | 0.89 | 0.07 |
| Sandbagging | 0.81 | 0.11 |
5. Discussion
A benchmark AUROC tells you how the probe behaves on a labelled split. Organisms exercise the entire pipeline. The recovery number is the operationally meaningful one.
6. Conclusion
Model organisms as the headline reliability metric for a mechanistic-interpretability verification platform, with a 12-organism suite achieving 81–96% recovery at tier E1.
References
Biggio, B. et al. (2013). ECML PKDD. / Geiger, A. et al. (2021). arXiv. / Goodfellow, I. J., Shlens, J. & Szegedy, C. (2015). ICLR. / Hubinger, E. et al. (2024). Sleeper agents. arXiv. / Park, P. et al. (2024). ICML.