訓練模型，而非讀者：用於可驗證激活解釋的可解碼性監督

摘要

自然語言自編碼器通過重建來評分隱藏激活的解釋：若激活能從解釋中重建，則該解釋被視為忠實。該測試在結構上對個別虛假宣稱不敏感：若翻轉某一宣稱不改變重建結果，該宣稱就不會受到懲罰。我們展示了該測試通過的兩種方式，但兩者皆不忠實。在已發布的 Qwen-2.5-7B 口頭化器上，解釋的重建效果顯著高於隨機水準，但僅約2%的具體宣稱依賴於重建，因此評分追蹤的是大意，而非具體事實。在精確的合成真實基準下，標準配方在5/5次運行中發展出共同適應的私有代碼（重建所依賴的虛假措辭），且不改變目標模型的修復措施並無幫助。我們貢獻了兩種審計協議：基於真實的交叉檢驗和評估者交換，以及RECAP（通過共同訓練輔助預測器實現可讀編碼）：與目標模型同時訓練的線性頭部，以保持指定內容可解碼。在經過RECAP訓練的沙盒模型上，新的口頭化器能真實陳述指定內容，且代碼消失，成本為+0.001納特。這在預訓練的Pythia-160M上復現：內容變得可透過探針可靠解碼，儘管新的口頭化器僅部分傳達（真實度0.44-0.46，對比接近零的控制組）。就可解釋性而言，高重建並不能證明個別宣稱。對於人工智慧安全，RECAP使指定的內部內容可透過探針獨立檢查，而非由模型可能操縱的散文所宣稱：獨立探針對口頭化器的真實宣稱評分高於虛假宣稱（AUC 0.96，對比無RECAP時的0.82）。面對一個通過編輯解釋以最大化重建評分同時說謊（壓制約87%的謊言懲罰）的對手，RECAP探針仍能標記謊言（AUC 0.95），而控制探針則降至隨機水準（0.51）。

English

Natural-language autoencoders score explanations of hidden activations by reconstruction: an explanation is deemed faithful if the activation can be regenerated from it. The test is structurally insensitive to individual false claims: if flipping a claim does not change the reconstruction, the claim is never penalized. We show the test is passed in two ways, neither faithful. On a released Qwen-2.5-7B verbalizer, explanations reconstruct well above chance while ~2% of specific claims are reconstruction-dependent, so the score tracks gist, not specific facts. Under exact synthetic ground truth, the standard recipe develops co-adapted private codes (false wording the reconstruction depends on) in 5/5 runs, and fixes that leave the target model unchanged do not help. We contribute two audit protocols, the grounded-vs-true cross and the evaluator swap, and RECAP (Readable Encodings via Co-trained Auxiliary Predictors): linear heads trained alongside the target model to keep designated content decodable. On RECAP-trained sandbox models, fresh verbalizers state the designated content truly and the codes vanish, at a +0.001-nat cost. This replicates on a pretrained Pythia-160M: the content becomes reliably probe-decodable, though a fresh verbalizer conveys it only in part (truth 0.44-0.46 vs a near-zero control). For interpretability, high reconstruction does not certify individual claims. For AI safety, RECAP makes designated internal content independently checkable against probes rather than asserted by prose a model can game: an independent probe scores the verbalizer's true claims above its false ones (AUC 0.96, vs 0.82 without RECAP). Against an adversary that edits an explanation to maximize the reconstruction score while lying (suppressing ~87% of its lie penalty), the RECAP probe still flags the lies (AUC 0.95) while the control probe collapses to chance (0.51).