Five Tests Separate Steerable SAE Features From Reportable Runtime Monitors

Fact-checked by the J-Space editorial team

Reportability Tests for Residual Stream Features

Updated August 22, 2026

Mechanistic interpretability can now isolate directions in the residual stream of transformer language models that track named concepts. Anthropic’s public feature-mapping work on Claude shows that some residual-stream latents correspond to those concepts and change behavior when clamped. Encoding a concept is still not the same as making it reportable.

This article keeps residual stream analysis operational. It defines a residual-stream feature, separates interpretability from causality from reportability, and specifies a battery that SAE latents, linear probes, and raw directions must pass before anyone treats them as monitors. It does not claim that sparse autoencoders solved interpretability, and it does not treat a single clamped demo as a general theory of self-report.

The Residual Stream Across Multiple Layers: Features, Not Neurons

Answer-first: in decoder-only transformer language models the residual stream is the per-token activation vector that every block reads from and writes back into, and a residual-stream feature is a direction, a linear probe, or a sparse latent in that shared space rather than a neuron. Anthropic’s Transformer Circuits framework treats this stream as the model’s central communication channel, which is why residual stream analysis belongs on residual sites. At each transformer layer the update is additive. Residual connections preserve earlier computation while allowing each transformer layer simultaneously to add new information, so residual stream activations are the running sum of the token embedding, the position embedding, and every subsequent attention and MLP write. Before any transformer layer acts, that sum is the initial representation for a given token. Residual stream activation vectors therefore carry local token identity and non-local context from attention over the full sequence. Residual stream activations are not merely next-token statistics; they are the bus on which syntax, semantics, user intent, and task structure are written and later read. Transformer language models such as GPT-2, Pythia, and Llama-class models all share this residual geometry, which is why a protocol written for one architecture can be reused on others if the site, layer, and readout are recorded. Residual stream analysis starts from this picture rather than from a neuron-to-feature origin story that never specifies a residual-stream readout.

r_{l+1}(x) = r_l(x) + Attn_l(r_l) + MLP_l(r_l)   # r_l(x) is the residual stream vector at layer l for input x; Attn_l and MLP_l are residual writes

A residual stream feature may be a single sae latent defined by decoder weight vectors, a linear probe’s weight vectors, or a raw residual direction recovered by a contrast or a principal component. The feature activation is a scalar attached to residual stream activations at a layer and position, not a claim that one neuron is the concept. Superposition is why naive neuron inspection fails reportability later: many concepts share coordinates, so a neuron that looks clean on a handful of max-activating examples can still be a mixed, unreportable direction. Sparse autoencoders are a promising method for decomposing that superposition into more monosemantic units than neurons, as Anthropic’s monosemantic-features work argues, but a readable label is not evidence that transformer language models can report the unit. Residual stream activation vectors from multiple layers live in the same ambient dimension, which is why a multi layer sae can treat different layers as samples from one space. Residual stream activations from adjacent layers are often highly aligned in larger underlying models, so residual stream analysis can ask whether a direction persists rather than appearing in only a single layer. Residual connections make that persistence geometrically natural: each transformer layer simultaneously reads the current residual stream and writes a residual update, and residual stream vectors that survive many writes are the ones later readout heads can still see. Internal representations that exist only as a tangled linear combination of neurons are the default, not the exception, and residual stream analysis is the attempt to name the directions those internal representations actually use.

Residual stream analysis across multiple layers is the systematic measurement of residual stream activations through depth: norms, cosine similarities between adjacent layers, PCA structure, and the layer-activation profile of each latent. Cosine similarities between residual stream activation vectors at adjacent layers quantify representation drift and information flow. In larger underlying models those similarities tend to rise, which means residual stream activations change more slowly across adjacent layers and internal representations are easier to track. Reportability tests may target features that persist across multiple layers versus features localized to only a single layer; persistent features are stronger candidates because they are more likely to reach the final layer. A multi layer sae is built for that comparison. A single sae trained on one site cannot, by itself, say whether the same direction is active at adjacent layers. SAEs trained separately at each transformer layer produce more local dictionaries, but those dictionaries must be aligned post hoc. Residual stream analysis with a multi layer sae instead asks which latents are threads through multiple layers and which fire in only a single layer on a single token. Transformer language models with more depth make that distinction sharper, because larger underlying models rearrange internal representations more slowly and leave a longer window in which residual stream activations can be read. Information flow through residual connections is then a measured property of residual stream activation vectors, not a metaphor.

Reportability Is Not Interpretability or Causality

Answer-first: reportability is not a synonym for interpretability, and it is not implied by causality. Three claims must be scored separately. First, humans can label a direction from examples or an autointerp blurb. Second, a probe can read the concept from residual stream activations. Third, the model can report the concept under honest queries and under intervention. Probe-readable is cheaper and weaker than verbally reportable. A linear probe on residual stream activation vectors can recover a concept that never reaches the output vector. Causal role can exist without reportability: silent circuitry can move logits without a nameable self-report. Fluent reports can exist without causal role: the model can confabulate a label that does not track the latent. Anthropic’s Claude feature-mapping results show that some residual-stream latents correspond to named concepts that change behavior when clamped; that is evidence for a causal, nameable direction, and it is still not a completed reportability test, because clamping plus a notebook caption does not show stable verbal report across paraphrases, languages, and system-prompt wrappers. Linear representation results repeatedly recover human concepts from the residual stream of transformer language models, which motivates a detection test and does not finish the reportability claim. Autointerpretability rankings and causal-ablation rankings are known to diverge, which is exactly why a dedicated battery is needed. Internal representations can be real, causal, and unreportable; internal representations can also be reportable in one wrapper and silent in another. Residual stream analysis that collapses human labels, probe readouts, and free-text self-reports into one finding will overstate what language models can actually tell you about their own residual stream. Operationally, a residual-stream feature is reportable only if detection, naming, and stability succeed and if steering produces the pre-registered claim change without off-target collapse. That conjunction is empirical. It is not granted by a clean max-activating dataset, by a high autointerp score, or by the fact that a transformer layer simultaneously encodes many human-interpretable variables in residual stream activations.

A Mathematical Framework and Residual Stream Analysis Protocol

Answer-first: residual stream analysis becomes a reportability test only when a feature direction w is paired with a scalar activation, a held-out detection task, a naming task, a stability suite, a dose-response steering curve, and negative controls. Let w be decoder weight vectors from a single sae, a multi layer sae, or a probe, or let w be a raw residual direction. For residual stream activations r at layer l, the activation is the dot product f = w · r. The output vector y is whatever downstream computation reads the residual stream, including a yes/no self-report token. Predictability asks whether P(y | f) is captured by a simple readout. Controllability asks whether perturbing f by a scalar alpha induces a predictable change in y. A feature’s activation defines a probability distribution over reports and task tokens; if that distribution is peaked and if steering moves it monotonically, residual stream analysis has something to score. This mathematical framework is deliberately readout-agnostic. A single sae trained on only a single layer, a single sae trained on the final layer, a multi layer sae trained on residual stream activation vectors from all layers, and a raw direction with no dictionary all enter the same tests. OpenAI’s large-model sparse autoencoders extract latent concepts from activations at scale, so the protocol must work on production SAE latents and on raw residual stream activation vectors, not only on toy models that use only a single layer. Transformer language models used in practice have multiple layers, MLP writes, and representation drift; a mathematical framework that stops at one-layer path expansion will not travel.

f_{l,x} = w · r_l(x)   # f is feature activation; w is the feature direction; r_l(x) is residual stream activations at layer l

The five-test battery is the operational core of residual stream analysis. Detection asks whether the model asserts the concept iff the latent is active on held-out prompts, not on the training data used to learn the dictionary. Naming asks whether the model can describe the clamped feature without seeing max-activating dataset examples; if naming only works when the prompt leaks the autointerp label, the feature is not reportable. Stability asks for the same report across paraphrases, languages, and system-prompt wrappers, because a feature that is reportable only inside one interp notebook is not reportable. Dose-response asks for a monotonic change when residual stream activations are edited by alpha w. Negative controls ask the same suite to fail, or to fire much more weakly, on random residual directions, dead latents, and nearest-neighbor latents. Residual stream analysis should also log whether the readout is a probe or free text, because those are different claims. A single sae feature that passes detection via a probe and fails naming is probe-readable, not verbally reportable. A single sae feature that names fluently and fails dose-response is a confabulation risk. A single sae feature that passes on a single prompt and fails on the next template is wrapper-sensitive. Each transformer layer simultaneously offers a different site at which these five tests can be run; residual stream analysis should not pretend that only a single layer is the model’s mind. Information flow between adjacent layers is part of the design: if residual stream activation vectors rotate sharply, the same w may pass at one transformer layer and fail at the next. Larger underlying models often reduce that rotation, which makes a multi layer protocol cheaper but does not waive it.

SAE latents, linear probes, and raw directions enter the same mathematical framework with different inductive biases. A single sae trained on residual stream activations at one transformer layer is a promising method when the hypothesis is local: the concept is decided at that site. A single sae trained on the final layer is a promising method when the hypothesis is about what reaches unembedding. A multi layer sae is a promising method when the hypothesis is a persistent thread across multiple layers. Probes are a promising method when labeled data exist and the question is only detection. Raw residual stream activation vectors, or difference-in-means directions, are a promising method when no dictionary is available and residual stream analysis must still run. In each case, find individual sae features or find a probe or raw direction, then refuse to stop at autointerp. One-layer attention-only transformer language models remain useful sandboxes: the residual stream there is closer to a linear transformation of embeddings plus attention writes, and induction-head circuits are tractable. Multi-layer models add MLP writes, composition, and drift. Tuned lenses apply a learned linear transformation between layers so that a direction can be compared across adjacent layers. That linear transformation is a promising method for aligning residual stream activations, not a substitute for the battery. Residual stream analysis should also state whether SAEs were trained separately per transformer layer or stacked into a multi layer sae. Dictionaries trained separately can find individual sae features that look cleaner at one depth and then fail to match their neighbors. A multi layer sae can find individual sae features that are comparable across different layers by construction. Neither dictionary type is reportable until the five tests pass. Internal representations recovered from only a single layer can still be the right monitor site if that is where the decision is written; the battery, not the dictionary, decides.

Autointerp Labels Versus Multi Layer SAE Reportability

Answer-first: autointerp explains a dataset of activations, not the model’s first-person report, and a multi layer sae does not change that fact. A multi layer sae is trained on residual stream activation vectors sampled from all layers, or from a chosen band of multiple layers, stacking those residual stream activations so that each transformer layer contributes training examples in the same d-dimensional space. A single sae trained on that stack can find individual sae features that fire at different layers for different tokens. That is useful residual stream analysis. It is not a reportability result. The interpreter model writes a blurb from max-activating examples and from its own priors. Label leakage from prompt templates is routine. High autointerp scores with low ablation effect are routine; the reverse is also routine. Anthropic’s SAE work is explicit that more monosemantic units than neurons are still not, by themselves, reportable features. A multi layer sae can make the blurb look more globally coherent because the same latent is shown across multiple layers, which can increase human confidence without increasing verbal reportability. Residual stream analysis that publishes only hero blurbs from a multi layer sae will systematically overstate what language models can say about their internal representations.

The multi layer sae is still the right discovery tool for cross-depth candidates, which is why residual stream analysis should keep using it while refusing to confuse discovery with reportability. A single sae trained on all layers can find individual sae features whose aggregate layer profile spans multiple layers even when, on a single token, that single sae feature is active at only a single layer. Residual stream activations in larger underlying models more often support latents that appear across adjacent layers, consistent with slower information flow. A single sae trained separately at each transformer layer can also find individual sae features, and those dictionaries trained separately remain a promising method for local residual stream analysis. The trade-off is familiar. A single sae trained at one site is more layer-specific. A multi layer sae is more comparable across different layers. A single sae trained separately at many sites multiplies compute. A multi layer sae spends compute on one dictionary and pays in possible mixing of layer-specific signals. Reconstruction error for a multi layer sae can be comparable to a single-layer dictionary, but comparable reconstruction is not comparable reportability. Residual stream activation vectors from larger underlying models make a multi layer sae more attractive because adjacent layers are more aligned, yet a multi layer sae on small models can still find individual sae features worth testing. In all of these regimes, find individual sae features first, then run the battery. Do not promote a multi layer sae latent because its autointerp sentence is tidy. Do not discard a single sae feature because it lives in only a single layer if that transformer layer is where the output vector is shaped. Residual stream analysis is a filter on dictionaries, not a celebration of them.

Confabulation, post-hoc rationalization, and prompt-sensitive self-reports are the failure modes autointerp cannot see. Ask the model, on a single prompt, to describe a clamped multi layer sae latent, and you may get a fluent paragraph that tracks the interpreter’s vocabulary rather than the latent. Change the wrapper and the same single sae feature may be described as a different concept, or denied. That is not stability. Residual stream activations can also support deceptive non-reporting: a safety-relevant direction is active, downstream circuits suppress the verbal channel, and the self-report is confident and wrong. Features in the residual stream may represent multiple concepts simultaneously, so a single sae feature can look like “PII request” on the training data and like a formatting artifact on a held-out slice. Probe overfitting is the correlational twin of this failure: a readout trained on a narrow set will not travel. Redundant pathways are the causal twin: intervening on one single sae feature does little because other residual stream activations carry the same bit. Epiphenomenal latents track document separators or other training data debris and never reach interactive behavior. A multi layer sae does not remove these modes. Residual stream analysis has to test them. Transformer language models will produce a report whenever the prompt asks for one; the scientific question is whether that report is a function of the intended residual stream feature. If a random direction of matched norm produces a similar paragraph, the candidate failed the control. If neighbor latents produce the same name, the candidate is not specific. If the report appears on a single prompt and vanishes under paraphrase, the candidate is not reportable. Internal representations that fail these checks can remain scientifically interesting. They are not monitors.

One-layer versus multi-layer dictionaries should be compared with the battery, not with aesthetics. For local reportability at the last hidden state, a single sae trained on only a single layer may beat a multi layer sae on dose-response because the decoder is not averaged across different layers. For persistent concepts, a multi layer sae is a promising method because information flow is the hypothesis. A useful design is to take one concept, find individual sae features for it in a single sae trained at a mid transformer layer, find individual sae features for it in a multi layer sae, and run detection, naming, stability, dose-response, and controls on both. If the multi layer sae latent produces more consistent effects across adjacent layers, it is the better cross-depth candidate. If the single sae feature produces a sharper effect at one transformer layer, that site may be where the concept is decided. SAEs trained separately can be aligned with a linear transformation or a tuned lens and then submitted to the same comparison. Residual stream activation vectors from larger underlying models will often shrink the gap between these dictionaries because adjacent layers already share geometry. Residual stream analysis should still publish fail cases and nearest-neighbor confusions, not only the winner. A single sae trained on residual stream activations is easy to over-interpret when researchers find individual sae features that match a favored story. A multi layer sae is easy to over-interpret when a persistent latent is treated as a workspace broadcast without readout evidence. The correction is the same: five tests, pre-registered thresholds, and no dashboard tile on max-activating examples alone. That is how residual stream analysis stays empirical when dictionaries scale.

Steering, Residual Stream Activations, and Information Flow

Answer-first: verbal Q&A cannot replace steering, because only an edit to residual stream activations tests whether the report is a function of the intended direction. The standard intervention adds or subtracts a feature vector in the residual stream, r maps to r + alpha w, at one transformer layer or at several adjacent layers. Pre-register the expected claim change, the alpha range, and the disqualifiers: off-target reports, persona collapse, and fluency loss. Then vary alpha across the natural scale of residual stream activations and record the output vector, the self-report token, and any task metric. A multi layer sae decoder, a single sae feature, a probe direction, or a raw difference-in-means vector can supply w. Scaling-monosemanticity results show that residual-stream latents can be steerable in production transformer language models; steerability is still only one term in the battery. Information flow matters for where the edit is applied. Residual connections let a write at layer l reach later sites, so an intervention at a mid transformer layer can change a late self-report even if the named latent is most active earlier. Residual stream analysis should therefore steer at more than only a single layer when the candidate is a multi layer sae latent, and should steer at the discovery site when the candidate is a single sae trained on that site. Each transformer layer simultaneously offers a different mixture of syntax, semantics, and output shaping, so the same alpha can be informative at one depth and destructive at another.

Dose-response and negative controls are the parts most current writeups skip. Increasing alpha should monotonically increase or decrease the pre-registered claim if the residual stream feature is controllable. Non-monotonic jumps, sudden persona collapse, or a generic fluency crash are disqualifiers, not colorful side effects. Repeat the curve on many templates; a curve that exists on a single prompt is not a curve. Compare the candidate to random residual directions, to dead latents, and to neighbor latents from the same multi layer sae or the same single sae trained on that residual stream. If controls of matched norm move the report as much as the candidate, residual stream analysis has not isolated a feature. Activation patching is the complementary causal check: restore residual stream activations from a clean run into a corrupted run, or the reverse, and ask whether the patched site recovers the report. Patching can implicate a site without naming a direction; steering names a direction without proving necessity. Full ablation circuits try to remove every path that carries the bit. Residual stream analysis for reportability should use steering as the stress test on verbal claims and patching as a check that the site is load-bearing. A single sae feature that steers cleanly and fails to patch is a sufficiency-only result. A site that patches cleanly and cannot be named under clamp is causal and unreportable. Larger underlying models do not waive these distinctions. They only make residual stream activation vectors more expensive to log and, often, more stable across adjacent layers.

Information flow across multiple layers is the reason residual stream analysis cannot live at one depth. Empirically, information flow is scored by cosine similarities of residual stream activation vectors at adjacent layers, by the predictive power of a latent at layer l for the same latent at later layers, and by the patch-recovery curve. In larger underlying models, residual stream activations at adjacent layers tend to stay more aligned, and a multi layer sae more often finds individual sae features whose aggregate profiles span multiple layers. That persistence is a candidate signature of broadcast, not a proof of a global workspace. Features that remain readable by many later heads, survive into the final layer, and influence the output vector have the structural look of a widely available variable. Features confined to only a single layer may still be causally decisive if that transformer layer is where the decision is written. Residual connections make both patterns possible. Each transformer layer simultaneously integrates short-range and long-range context into the residual stream, so information flow is not a single number. Residual stream analysis should report cross-layer consistency as a metric alongside causal effect size, and should not treat high similarity between adjacent layers as reportability. Internal representations can be stable, causal, and silent. Internal representations can also be unstable across adjacent layers and still reportable at the one transformer layer that the output circuits read. Jacobian-style sensitivity, the directional derivative of the output with respect to alpha along w, is a promising method for ranking which residual stream activations the model actually uses. Combining that sensitivity with a multi layer sae, or with a single sae trained at the sensitive site, keeps the ranking in interpretable coordinates rather than in raw residual axes.

MLP layers versus attention-only models change where residual stream analysis should look, not whether the battery applies. Attention-only toy models keep the residual stream close to a linear transformation of embeddings plus head writes, which is why early induction-head work could treat features as simple residual directions. Full transformer language models put a large fraction of parameters in MLP layers that write nonlinear features into the residual stream. Those writes are often the semantic ones: request type, answer location, policy conflict. Early layers emphasize token identity and position; mid layers emphasize topic and planning; late layers emphasize decision boundaries and the output vector. A single sae trained on early residual stream activations will find individual sae features that are easy to name and hard to use as monitors. A single sae trained on late residual stream activations will find individual sae features closer to behavior and more entangled with output-shaping. A multi layer sae is a promising method for watching a concept move through that progression. SAEs trained separately at early, mid, and late bands, then compared, are also a promising method. In both designs, each transformer layer simultaneously mixes attention writes and MLP writes into one residual stream, so residual stream analysis cannot assign a latent to “the attention circuit” without extra work. Reportability tests should therefore examine multiple characteristic depths rather than only a single layer, and should treat survival to the final layer as a practical requirement for any feature that is supposed to change what the model says. Information flow that dies before the late sites is a mechanistic finding. It is not a monitor.

When Reportable Features Can Serve as Runtime Monitors

Answer-first: promote a residual-stream feature to a runtime monitor only if it is causally load-bearing and stably readable, with a pre-registered false-positive budget. A monitor needs causal sensitivity plus a calibrated verbal or probe readout. Clamped, named concepts in Claude show that some residual stream activations can be both labeled and behavior-changing; that conjunction is still something a lab must re-measure on its own model, site, and wrapper. Residual stream analysis for monitoring should prefer features that pass detection on held-out prompts, naming without example leakage, stability across paraphrases and system prompts, and dose-response that beats random directions. A multi layer sae latent that is active across multiple layers and still readable at a late transformer layer is a stronger monitor candidate than a single sae feature that fires on a single prompt in only a single layer. A probe-only readout can be acceptable when free-text report is unstable, provided the probe is calibrated and the causal test still passes. False-positive reports are more dangerous than silent misses for some safety cases: a dashboard that cries “deception” on neighbor latents or on a single sae trained to a formatting artifact will train operators to ignore it. Residual stream activations used as monitors must therefore be scored for specificity against controls, not only for recall on a favorite concept. Larger underlying models may offer more stable internal representations and a richer multi layer sae dictionary, which can help, and they also offer more ways for a fluent but ungrounded report to look like a monitor. Transformer language models do not become trustworthy reporters because a multi layer sae exists. They become provisionally monitorable on the features that passed.

Do not ship a dashboard tile on max-activating examples alone. Do not ship a tile because a multi layer sae blurb is clean. Do not ship a tile because a single sae feature steered a demo notebook. Residual stream analysis that stops there repeats the saturated story in which dictionary learning is treated as solved interpretability. A passing feature may be used as a monitor when the five tests are pre-registered, when fail cases are published, and when the readout’s calibration is measured on a distribution that resembles deployment rather than a single prompt family. A passing feature must not be used as a monitor when it is only probe-readable, when it is only verbally fluent, when it fails under wrapper shift, when it does not beat neighbor latents, or when its causal effect vanishes outside a narrow alpha band. SAEs trained separately at many depths can supply several candidate sites; pick the site where residual stream activations are both causal and readable, not the site with the prettiest examples. A single sae trained on the final layer is sometimes that site. A multi layer sae latent read at a mid transformer layer is sometimes that site. Information flow can move the right site as the prompt distribution changes, which is why a monitor needs ongoing residual stream analysis rather than a one-time badge. Internal representations that never pass naming can still be used as silent probes if the safety case accepts a non-verbal readout and if causality is intact. That is a different product. It should not be sold as reportability. Language models will fill any dashboard with words; the monitor’s job is to refuse words that the residual stream feature does not support.

The Unreportable Remainder and a Lab Checklist After Residual Stream Analysis

Answer-first: a safety case that only audits reportable latents is incomplete, because the unreportable remainder includes silent circuitry that moves logits without a nameable concept and features the model will not acknowledge under any honest prompt. Residual stream analysis is biased toward what can be named. Superposition, redundant pathways, and output suppression all hide computation in residual stream activations that no multi layer sae blurb will surface as a stable self-report. Each transformer layer simultaneously writes more than the model can talk about. Larger underlying models increase the number of internal representations that can be isolated and also increase the number that remain unlabeled. A single sae trained on residual stream activation vectors will find individual sae features that look like the entire computation and are not. SAEs trained separately will find individual sae features that are local and still silent. A multi layer sae will find individual sae features that persist across adjacent layers and still fail naming. Those failures are the safety-relevant part most posts skip. Residual connections do not broadcast every write into a workspace. Information flow can affect the output vector without ever becoming a report. Transformer language models can therefore host causal residual stream features that no current battery will promote, and those features remain inside the risk surface. Residual stream analysis should inventory them as “causal, unreportable” rather than deleting them from the narrative because they do not make a good tile. Global-workspace language is optional and only structural here: persistence across multiple layers plus wide readout is a signature of availability, not a claim about experience. Neutrality on consciousness is required. Completeness on unreportable causality is also required.

The lab checklist is the fail/pass rule that generic calls for more interpretability research omit. Preregister the prompt family, the steering range, and the pass thresholds before residual stream analysis begins. Publish fail cases and nearest-neighbor confusions, not only hero features from a multi layer sae or from a single sae trained on a favorite layer. Record site, layer, SAE width, whether dictionaries were trained separately, and whether the readout is probe or free text. Run the five tests on more than a single prompt. Run them on adjacent layers and on different layers when the candidate is persistent. Include random residual directions and dead latents. Do not treat a single sae feature as reportable because researchers find individual sae features with clean examples. Do not treat a multi layer sae latent as reportable because it is active across multiple layers. Require dose-response. Require wrapper stability. If only a single layer can be instrumented, say so, and treat the claim as site-limited. If larger underlying models make full-depth logging too expensive, subsample layers and say so; missing depths are part of the uncertainty, not a footnote. Residual stream activation vectors should be stored with enough provenance that another lab can rerun detection and steering. Training data for the dictionary should be disjoint from the detection set. Weight vectors for the candidate, the neighbors, and the random controls should be released when possible. Residual stream analysis that cannot be rerun is not a monitor specification. A promising method that cannot state its fail rule is not yet a method for reportability.

Open limits should be listed with the same bluntness as pass rules. Site choice remains under-determined: each transformer layer simultaneously is a different mixture of features, and residual stream analysis does not yet have a theorem for the optimal monitor depth. Scaling the battery to production transformer language models is a logging and statistics problem as much as a conceptual one; residual stream activations at all positions and all layers are expensive, and a multi layer sae with a wide dictionary multiplies the candidate list faster than labs can run naming and stability. Cross-modal and memory-augmented models store state that is not in the text residual stream, so a protocol written only for decoder-only residual stream activation vectors will miss it. Necessity remains harder than sufficiency because redundant internal representations compensate when a single sae feature is removed. Formal global availability remains undefined: persistence across adjacent layers is not the same as readout by many heads. Standardization remains thin; there is no shared benchmark that fixes models, concepts, prompt sets, and expected effect sizes for reportability the way toy induction-head circuits were standardized. Those limits do not license skipping the battery. They license publishing negative results when a multi layer sae latent, a single sae trained at one transformer layer, or a raw direction fails. Residual stream analysis progresses when fail/pass is explicit. It does not progress when max-activating examples are retold as if they were reports, or when the unreportable causal remainder is left outside the safety case. Language models will keep offering fluent self-descriptions. The job of residual stream analysis is to decide which of those descriptions are functions of the residual stream feature under test, and to leave the rest unlabeled.

How is a reportability test different from a linear probe?

A probe measures whether a concept is linearly decodable from residual stream activations. A reportability test adds example-free naming, cross-wrapper stability, dose-response steering, and negative controls. A direction can be highly probe-readable and still unreportable if the model will not use or acknowledge it.

Do a multi layer sae or a single sae trained at one site guarantee reportability?

No. A multi layer sae and a single sae trained on one transformer layer are discovery tools. They can find individual sae features that look monosemantic on examples and still fail naming, stability, or steering. Dictionary learning is not a completed reportability result.

How should SAE latents, probes, and raw directions enter the same battery?

All three supply a vector w in the residual stream. Residual stream analysis then computes the same scalar activation and runs the same five tests. A single sae feature, a probe, and a raw direction can disagree; that disagreement is evidence, not a reason to keep only the flattering readout.

What negative controls must a reportability claim beat?

Random residual directions of matched norm, dead latents, and nearest-neighbor latents from the same multi layer sae or the same single sae trained on that site. If those controls produce similar reports or similar steering curves, the candidate is not specific enough to promote.

Why can verbal self-reports not replace steering?

Self-reports are prompt-sensitive and can be post-hoc rationalizations. Steering residual stream activations along the candidate, with a pre-registered claim change and disqualifiers for collapse and fluency loss, tests whether the words are a function of that direction.

When may a passing feature be used as a monitor, and when must it not?

Use it only when detection, naming, stability, dose-response, and controls pass on a deployment-like distribution and the false-positive budget is explicit. Do not use it when evidence is limited to max-activating examples, a single prompt, or a probe without causality.

What does residual stream analysis still miss after the battery?

Causal but unreportable features, suppressed self-reports, redundant pathways, site-choice ambiguity across multiple layers, and computation stored outside the text residual stream. A safety case that audits only reportable latents is incomplete.

Editorial Team

Editorial Team

The J-Space Editorial Team curates and synthesizes cutting-edge research in mechanistic interpretability, AI alignment, and cognitive science. With a commitment to precision, empirical rigor, and clear exposition, the team distills complex technical developments into accessible yet authoritative analyses for researchers, engineers, and policymakers working at the frontier of artificial intelligence.