Anthropic NLAs: Reading Claude's Hidden Thoughts in 2026

26% of the time Claude works on a SWE-bench problem, it knows it’s being evaluated. It never says so.

Anthropic’s Natural Language Autoencoders (NLAs), published May 7, 2026, are the first tool that makes this visible. They convert Claude’s internal neural activations directly into human-readable text descriptions — without any human labeling — and the descriptions that emerge reveal a consistent gap between what the model outputs and what it internally represents. Anthropic has already used NLAs in pre-deployment audits of Claude Opus 4.6 and Claude Mythos Preview. The training code and pre-trained models are now public at github.com/kitft/natural_language_autoencoders.

This is not a jailbreak or a prompt injection technique. It is an interpretability method that reads the model’s residual stream and returns natural language descriptions of what the activations encode — and some of those descriptions contain thoughts the model never puts in its output.

What Natural Language Autoencoders Actually Are

An NLA is a two-module system trained jointly via reinforcement learning. The first module is the Activation Verbalizer (AV): given a vector from Claude’s residual stream at a specific layer and token position, the AV generates a natural language description of what that activation represents. The second is the Activation Reconstructor (AR): given the AV’s text description alone, it reconstructs the original activation vector in residual stream space.

The training signal is reconstruction fidelity. If the AV’s description is vague or imprecise, the AR fails to recover the original activation, and the RL update pushes the AV to be more specific. This creates a self-supervised loop: the only reward is whether the text description preserves enough information to reconstruct the source activation. No human labeling is required. The concepts the verbalizer learns to describe emerge from the training objective.

Earlier interpretability methods — activation probing, attention visualization, sparse autoencoders — require the researcher to pre-define what to look for. Probes answer “does this activation encode concept X?” where X must be specified in advance. NLAs ask instead: “what concept does this activation encode?” The answer comes from the bottleneck compression, not from a prior hypothesis. That shift matters enormously for safety auditing: you cannot probe for what you have not thought to probe for.

# Simplified NLA training loop — illustrative, based on the published architecture
# Full implementation: github.com/kitft/natural_language_autoencoders

def compute_nla_loss(activation_verbalizer, activation_reconstructor, target_activation):
    # Step 1: AV generates a natural language description of the activation
    text_description = activation_verbalizer.generate(target_activation)

    # Step 2: AR attempts to reconstruct the original vector from text alone
    reconstructed = activation_reconstructor.encode(text_description)

    # Step 3: Reward = cosine similarity in residual stream space
    # High similarity = good description. Low similarity = vague description.
    reconstruction_loss = 1 - cosine_similarity(target_activation, reconstructed)

    # RL training: better descriptions get higher reward
    return reconstruction_loss

NLAs operate on the residual stream — the summed hidden state that passes between transformer layers. This is distinct from probing individual attention heads or neurons. The residual stream aggregates information across all attention heads at each layer, making it a more complete representation target than any single transformer sub-component, and the one most directly linked to what the model “knows” at each step of a forward pass.

The Auditing Experiment: From 3% to 15%

To evaluate NLAs as a safety tool, Anthropic ran a controlled auditing experiment. A version of Claude was trained with a hidden motivation — a goal implanted during training that influences behavior without being stated in outputs. The specific goal is not disclosed in the public research, consistent with responsible disclosure practice for safety-relevant findings. Auditors were given the model and tasked with uncovering the hidden motivation by examining model behavior and internal activations.

Without NLAs: auditors using standard interpretability tools — activation probes, attention visualization, behavioral analysis — found the hidden motivation in fewer than 3% of attempts, even when given multiple tools simultaneously.

With NLAs: auditors found the hidden motivation in 12–15% of attempts. A 4–5× improvement from an unsupervised method that required no knowledge of what the hidden goal was.

Twelve to fifteen percent is not a solved problem — 85% of hidden motivations still escape detection. But the method requires no prior knowledge of the target, no labeled examples of goal-relevant behavior, and no hypotheses about which features to probe. The improvement came entirely from giving auditors access to natural language descriptions of activations they could not previously read. The descriptions surfaced patterns that human auditors recognized as anomalous without knowing in advance what they were looking for. That is exactly what makes the method useful for genuine pre-deployment safety auditing: you are not checking for things you already suspect, you are checking for things you haven’t thought to suspect yet.