The sparse-autoencoder recipe leaves the toy model behind: tens of millions of interpretable features extracted from a real production frontier model — Claude 3 Sonnet — including safety-relevant ones you can causally steer.
Templeton, Conerly, Marcus, Batson et al. — Anthropic — May 2024 Transformer Circuits transformer-circuits.pub
Presentation 04 (Towards Monosemanticity) proved you could decompose a model's activations into clean, interpretable features using a sparse autoencoder — but it did so on a one-layer toy transformer. The open question was the only one that matters for safety: does this technique survive contact with a model people actually use? Production models are deeper, wider, trained on far more data, and saturated with the messy abstractions of real language.
This paper takes the same recipe and applies it to Claude 3 Sonnet — a mid-size frontier model in production. Rather than try to decompose the whole network, they attach a sparse autoencoder to a single point in the middle of the model: the residual stream halfway through. The residual stream is a good target because it is relatively small (a bottleneck every layer reads from and writes to) yet carries the model's working representation of the input.
The SAE reads the residual-stream activation vector and re-expresses it as a sparse combination of a large dictionary of learned feature directions: of the millions of features available, only a handful are active on any given token. Each active direction turns out to correspond to a human-recognisable concept.
The residual stream of dimension d is far smaller than the number of concepts a model represents, so concepts are packed in superposition (Presentation 03). The SAE's job is to un-pack that superposition: project the dense activation onto an over-complete dictionary so each axis means one thing. Crucially, nothing about the recipe is toy-specific — it transfers straight to a frontier model.
To probe how dictionary size affects what you can find, they trained three sparse autoencoders of increasing width on the same residual-stream activations, with roughly 1 million, 4 million, and 34 million features. The recurring lesson of the deep-learning era reappears here: SAE training itself follows clean scaling laws. Reconstruction loss falls predictably as a power law in the amount of compute and the number of features, which let the team choose hyperparameters for the big runs by extrapolating from cheap small ones — exactly the Kaplan/Chinchilla playbook, now applied to interpretability tooling.
The dictionaries are large, but the paper is candid that they are incomplete. Even the 34M-feature SAE fails to capture everything the model represents: many concepts appear only in the larger run (rare concepts need a bigger dictionary to earn a dedicated feature), and a fraction of features are "dead" — they never activate on the training data and waste capacity. The team estimates the full set of features in Sonnet could be orders of magnitude larger still.
Two engineering takeaways. First, your interpretability budget behaves like a model-training budget — spend it with scaling laws, not hunches. Second, feature dictionaries are a lossy, capacity-limited view: more features reveal rarer concepts, so "we didn't find a feature for X" never means "the model has no representation of X."
Unlike the toy model's mostly lexical features, Sonnet's features are genuinely conceptual. A single feature tracks a concept regardless of how it is expressed:
e.g. the Golden Gate Bridge — a single feature direction in the dictionary.
English text, other languages, and a photo of the bridge all light up the same feature.
Fires on literal mentions and on indirect, abstract discussion of the concept.
This is direct evidence that frontier models build language- and modality-independent concepts — the long-hypothesised abstract internal representation, now made legible. It also means a single feature is a robust monitoring handle: you watch the concept, not a brittle keyword list.
Because the dictionary spans the model's whole working representation, it includes features for concepts that matter directly for safety and oversight. The paper documents features for, among others:
Features for security vulnerabilities and backdoors in code — firing on buffer overflows, injection, and hidden backdoor logic.
Features tracking deception, lying, and withholding information — both in described characters and in the model's own framing.
A sycophantic praise feature — the tendency to flatter or tell the user what they want to hear.
Features for bias, hateful content, and slurs across protected categories.
Features related to power-seeking, coups, and dangerous / biohazard content (e.g. bioweapon-adjacent material).
Features tied to the model's representation of itself as an AI — firing when it reasons about being an AI assistant.
The existence of these features is expected, not alarming. A model trained on human text must represent deception, bias, and danger in order to recognise and discuss them — just as it must represent kindness or chemistry. Their value is as instrumentation: a feature that lights up when the model is being deceptive or sycophantic is a candidate monitor on the model's internals, not evidence the model is dangerous. The point is observability, not indictment.
An interpretable label is only a correlation until you can show the feature does something. Does a feature merely co-occur with a concept, or does it cause the model's behaviour around that concept?
The test is feature steering (or "clamping"): during a forward pass, artificially override a single feature's activation — pin it high or low — while the rest of the model runs normally, and watch the output. Because the SAE gives you a clean direction in the residual stream, you can intervene on exactly one concept at a time.
The famous demonstration: clamp the Golden Gate Bridge feature to a strongly positive value and you get "Golden Gate Claude" — an assistant that steers nearly every conversation, no matter the topic, back to the bridge, even claiming to be the bridge. The same lever works on safety features: clamping a code-vulnerability or deception feature high induces the associated behaviour; clamping it low can suppress it. Behaviour moves predictably and in the direction the feature's label implies.
Steering converts features from descriptions into causal handles. A feature is not just "what the model was thinking about when it said X" — turning it changes what the model says. That is the difference between a post-hoc explanation and a control surface you could build monitoring and intervention on.
The dictionary is not an unordered bag of features. When you look at which features sit near each other in the SAE's feature space, the neighbourhoods are semantically coherent: a feature's nearest neighbours are conceptually related to it. The local geometry of the dictionary encodes a map of how the model organises concepts.
The paper also finds feature splitting across SAE sizes: a broad concept that occupies one feature in the 1M dictionary fractures into several finer-grained features in the 34M dictionary — the bigger the dictionary, the finer the conceptual resolution. Geometry and splitting together suggest the feature set is structured, not arbitrary.
Semantic neighbourhoods mean the dictionary is browsable: find one relevant feature and its neighbours surface related ones — useful when assembling a panel of features to monitor a behaviour. Feature splitting is the same scaling-law story at the concept level: more capacity buys finer distinctions, not just more of the same.
Features tell you what a model represents at one point in the network. The next step is how those representations interact — the wiring. Presentation 06 — On the Biology of a Large Language Model (Circuit Tracing) connects features into circuits, reconstructing the multi-step computations a model runs to answer a prompt, and reads off its internal "reasoning" as attribution graphs.