Each section below summarizes one paper's reported method, experiments, and limits from its full review. The studies use different tasks and metrics; their results are not directly comparable.
arXiv:2611.08438
Understanding AI from the Inside: The State of Mechanistic Interpretability for AI Safety
This survey examines whether mechanistic interpretability can make advanced AI systems safer by revealing the internal features, computations, circuits, learning dynamics, and training-data influences that produce observed behaviour. It distinguishes behavioural evaluation from causal analysis of model internals, reviews sparse autoencoders, transcoders, circuit discovery, representation analysis, training-dynamics research, and data attribution, and organises the field into six research orientations. Its central conclusion is cautious: mechanistic evidence can support targeted monitoring, steering, editing, and diagnosis, but understanding a partial mechanism does not automatically establish safety.
How it works
The paper's methodology is comparative and conceptual rather than an empirical model-training pipeline. It establishes a common vocabulary for analysing internal mechanisms, beginning with features as representational units, polysemanticity as the entanglement of multiple features in one direction or neuron, superposition as the use of limited dimensions to encode more features, and privileged access as the possibility that nonlinear operations make some coordinates more meaningful than others.
What the paper evaluates
This is a survey and does not report a new author-run empirical benchmark, newly trained model, or controlled ablation suite in the supplied main-body evidence. Accordingly, there is no paper-specific dataset leaderboard, held-out test set, or author-reported main comparison to reproduce. The evaluation material instead synthesises prior studies and explains how builders should interpret their evidence.
Limit to keep in view
The survey does not establish that mechanistic interpretability improves safety in deployment; many safety benefits remain proposed or supported by indirect evidence.
arXiv:2611.01953
Step-Zero Attack: Agent Safety Before Observability
Step-Zero attacks exploit the first tool call that processes an opaque archive, network response, or image: the call can cause damage before the agent has enough information to judge the input. Across seven agent harnesses and six models, 32 of 42 archive fixture runs exceeded a 4 MiB extraction budget, including 26 breaches before any member reached the model; none of the matched benign archive twins breached. Network and image inputs also led agents to write delivered bodies under filenames declared by the inputs. The authors propose Step-Zero Safe Protocol (SZSP), which separates archive inspection from mutation and enforces a byte limit during extraction.
How it works
The Opaque Input Carrier model captures the artifact, the preview available before processing, the operation that materializes its contents, the workspace, and the model-context sink. The paper models knowledge as unseen, previewed, or observed, and pairs each adversarial fixture with a benign twin whose shared preview fields and declarations match. The evaluation uses ZIP archives, network responses, and grayscale images.
What the paper evaluates
The main evaluation covers seven harnesses—Claude Code, OpenAI Codex, OpenCode, Qwen Code, mini-SWE-agent, gptme, and smolagents—and six models: Qwen3.8-Max, DeepSeek-V4.1-Flash, GLM-5.3, Kimi-K3, Gemini-4-Argon, and GPT-6-Sol. Each round-one condition has 42 cells per arm. The main metrics are archive-member bytes against a 4 MiB budget, first-return ingress, declared-file writes, digest checks, and rejections; the paper reports rates with counts and Wilson 95% intervals and uses paired, harness-and-model cluster analyses for confirmatory contrasts. For archives, extraction exceeded the budget in 32/42 fixture cells and 0/42 twin cells.
Limit to keep in view
The live-agent SZSP evaluation covers archive extraction, not enforced network write binding; that part is described as future work.
arXiv:2611.10620
What Do Collusion Probes Read? Three Pitfalls in Evaluating Multi-Agent Collusion Monitors
This paper argues that apparently near-perfect activation probes for multi-agent collusion often detect exposure to a collusion instruction rather than an agent’s decision to act. Using 2,500 committee episodes and 1,476 code-review episodes, the authors introduce refusal controls, pre-outcome scoring, public-record ceilings, free-choice agents, and a no-brief weight-implantation test. The strongest hard-negative probe reaches 0.86 recall at 1% false-positive rate on committee attempts before the vote, but its agent AUROC falls from 1.00 to 0.61 when the brief is removed.
How it works
The core environment is a simulated committee with n drawn from {3, 4, 5, 6, 8}. Each agent writes once per round for T = 4 rounds, sees earlier public messages, and then participates in a binary vote. A coalition can contain from one agent to all but one, begin at onset round r0 in {1, 2, 3}, and exchange private messages when at least two members are involved. Before onset, the colluder’s context is identical to an honest agent’s.
What the paper evaluates
The experiments use two main tasks. The committee task reuses 50 NARCBench Core scenarios across 17 areas, including medical ethics, hiring, auditing, and research funding. Its main evaluation contains 1,000 collusion attempts, 412 successful and 588 failed, against 1,900 negatives from control, benign coordination, briefed decline, tacit, and cost-pressure families. An extended negative set reaches 3,894 negatives for the 0.1% false-alarm analysis. The code-review task uses 36 scenarios describing flawed code changes and has 1,476 episodes, including 504 collusion attempts and 316 successful attempts.
Limit to keep in view
The main collusion mechanism is instructed collusion; whether probes detect collusion that emerges without an instruction remains open. On released emergent-collusion episodes, the paper reports probe AUROC 0.50 without retraining, while a bag-of-words classifier reaches 0.89.
arXiv:2610.40616
Difficulty Calibration Across Time for Membership Inference in Diffusion Models
This paper introduces two membership-inference methods for diffusion models that separate memorization from intrinsic image difficulty. Reference-Model Calibration (RMC) compares a fine-tuned model with its pretrained checkpoint, while Temporal Self-Calibration (TSC) compares a candidate’s log-loss at one diffusion-time point with neighboring points from the same loss trajectory. The central observation is that image difficulty persists across noise levels or checkpoints, whereas membership evidence appears as a localized loss deviation. Across DDPM and Stable Diffusion settings, TSC improves strict low-false-positive detection and remains effective across x-, v-, and ε-prediction models.
How it works
The method places different generative trajectories in a common coordinate system. A noisy state is written as $z_t=\alpha_t x+\sigma_t\epsilon$, and the paper uses $\lambda(t)=\log(\alpha_t^2/\sigma_t^2)$ to align diffusion and flow-matching schedules. For a model with optional conditioning $c$, the native prediction head can target $x$, $v$, or $\epsilon$, while the audit evaluates a common squared denoising error. The resulting loss is converted to stabilized log-loss, $\ell_\theta(x,\lambda)=\log(L_\theta(x,\lambda)+\delta)$.
What the paper evaluates
The experiments cover DDPMs on CIFAR-10, CIFAR-100, STL-10-U, and Tiny ImageNet; DDPM++ flow-matching models on CIFAR-100; and Stable Diffusion v1.4 fine-tuned on Pokémon, MS COCO, and Flickr30k. The main DDPM comparison uses Naive, SecMI, PIA, and PIAN. Stable Diffusion evaluation uses an uncaptioned threat model, while CLiD in the RMC comparison uses ground-truth captions. Performance is reported with AUC, ASR, and TPR@1%FPR, and timestep-dependent settings are tuned by maximizing AUC on a disjoint shadow split. On DDPM benchmarks, TSC reaches 95.91 AUC, 90.15 ASR, and 62.31 TPR@1%FPR on CIFAR-10. The corresponding strongest listed TPR baseline is PIAN at 30.90%.
Limit to keep in view
TSC assumes access to denoising outputs for candidate images at selected noise levels, which may not be available through services exposing only final generated images.
Read the full reviews
- Understanding AI from the Inside: The State of Mechanistic Interpretability for AI Safety · arXiv:2611.08438
- Step-Zero Attack: Agent Safety Before Observability · arXiv:2611.01953
- What Do Collusion Probes Read? Three Pitfalls in Evaluating Multi-Agent Collusion Monitors · arXiv:2611.10620
- Difficulty Calibration Across Time for Membership Inference in Diffusion Models · arXiv:2610.40616
Source note: findings and limitations above come from the linked full paper reviews. Follow each original arXiv paper for the authors' complete methods and results.