训练模型，而非读者：可解码性监督用于可验证的激活解释

摘要

自然语言自编码器通过重构来评估隐藏激活的解释质量：若激活能从解释中再生，则该解释被视为忠实。该测试在结构上对个别虚假声明不敏感——若翻转某个声明不改变重构结果，则该声明不会受到惩罚。我们展示了该测试可通过两种方式通过，但两者均不忠实。在已发布的Qwen-2.5-7B语词化器上，解释的重构效果显著高于随机水平，而约2%的具体声明依赖于重构结果，因此得分反映的是主旨而非具体事实。在精确合成真实数据条件下，标准方案在5/5次运行中形成了共适应私有编码（重构依赖的虚假措辞），而保持目标模型不变的修复方案对此无效。我们贡献了两项审计协议：基于事实与真实交叉验证，以及评估器交换；以及RECAP（通过协同训练辅助预测器实现可读编码）：在目标模型旁训练的线性头，以保持指定内容的可解码性。在经RECAP训练的沙箱模型上，全新语词化器能真实表述指定内容，且私有编码消失，额外代价仅为+0.001纳特。该结果在预训练的Pythia-160M上复现：指定内容变得可靠地可被探针解码，尽管全新语词化器仅能部分传达（真实性0.44-0.46，而对照组接近零）。对可解释性而言，高重构分数不能验证个别声明。对AI安全性而言，RECAP使指定内部内容可独立通过探针检验，而非依赖模型可操纵的散文式断言：独立探针对语词化器的真实声明评分高于虚假声明（AUC 0.96，而未使用RECAP时为0.82）。面对通过编辑解释以最大化重构分数同时说谎的对抗者（抑制约87%的说谎惩罚），RECAP探针仍能识别谎言（AUC 0.95），而对照探针降至随机水平（0.51）。

English

Natural-language autoencoders score explanations of hidden activations by reconstruction: an explanation is deemed faithful if the activation can be regenerated from it. The test is structurally insensitive to individual false claims: if flipping a claim does not change the reconstruction, the claim is never penalized. We show the test is passed in two ways, neither faithful. On a released Qwen-2.5-7B verbalizer, explanations reconstruct well above chance while ~2% of specific claims are reconstruction-dependent, so the score tracks gist, not specific facts. Under exact synthetic ground truth, the standard recipe develops co-adapted private codes (false wording the reconstruction depends on) in 5/5 runs, and fixes that leave the target model unchanged do not help. We contribute two audit protocols, the grounded-vs-true cross and the evaluator swap, and RECAP (Readable Encodings via Co-trained Auxiliary Predictors): linear heads trained alongside the target model to keep designated content decodable. On RECAP-trained sandbox models, fresh verbalizers state the designated content truly and the codes vanish, at a +0.001-nat cost. This replicates on a pretrained Pythia-160M: the content becomes reliably probe-decodable, though a fresh verbalizer conveys it only in part (truth 0.44-0.46 vs a near-zero control). For interpretability, high reconstruction does not certify individual claims. For AI safety, RECAP makes designated internal content independently checkable against probes rather than asserted by prose a model can game: an independent probe scores the verbalizer's true claims above its false ones (AUC 0.96, vs 0.82 without RECAP). Against an adversary that edits an explanation to maximize the reconstruction score while lying (suppressing ~87% of its lie penalty), the RECAP probe still flags the lies (AUC 0.95) while the control probe collapses to chance (0.51).