Why reading an AI model's mind is harder than checking its receipts
Peeking inside an artificial neural network shows what ideas a model recognizes, but internal probes cannot prove it will act safely. Keeping software honest requires outer boundary gates and tamper-evident receipts.
Picture a border guard standing beside a line of freight trucks at a busy container port. The guard does not attach sensors to a truck driver's forehead or try to read their private thoughts. That kind of mind-reading would be unreliable, slow, and easy to deceive.
Instead, the guard asks for two physical items. The first item is a stamped manifest listing the goods inside the trailer. The second item is a numbered steel seal clamped through the latch on the cargo doors. If the seal matches the manifest and remains intact, the truck moves forward. If the seal is broken or missing, the truck stops at the barrier.
High-stakes human institutions have relied on this principle for centuries. When a bank cashes a cheque, it does not scan the customer's emotions. It verifies the signature, confirms the account balance, and files a durable transaction receipt. Outward verification protects both sides because physical receipts leave clear evidence that anyone can inspect.
The temptation of the artificial polygraph
When people build large artificial intelligence models, the desire to read minds quickly returns. Because a language model stores its knowledge across billions of numerical weights, builders often hope an internal scanner can spot dishonesty before an error reaches the screen.
Research teams have made genuine strides toward this goal. By attaching auxiliary networks called sparse autoencoders to internal layers, engineers can identify specific concepts as a model processes text.1 An internal probe might fire whenever the model encounters a reference to a suspension bridge, an overdue bill, or a software vulnerability.
Seeing those concept patterns feels magical. It gives observers the impression that they are looking through a glass window into the machine's mind. Some safety proposals even suggest using these internal readings as a primary defense, blocking outputs whenever an untrusted thought pattern flares up.2,5
Yet leaning on internal scans as your main shield creates a fragile foundation. Looking inside a neural network is not like inspecting the gears of a brass clock.
Why neural gears refuse to stay separate
In a mechanical watch, each gear tooth has a fixed physical position. If you want to know whether the second hand will advance, you can trace movement directly through the escapement. The parts do not vanish or blend together when the spring winds tighter.
Artificial neural networks work differently. They pack far more concepts into their internal layers than they have separate dimensions to hold them. Researchers call this phenomenon representation superposition. Multiple distinct ideas share the same mathematical coordinates, activating together in shifting combinations.
When an autoencoder attempts to isolate one feature, it often introduces subtle distortions. Suppressing or steering a single internal concept can scramble related associations in unexpected ways. A probe that detects medical advice in one context might fire harmlessly on an historical essay, or fail entirely when the wording shifts.
More importantly, an internal signal only reveals what a model is thinking about. It cannot confirm what the model will actually do when given authority to act. A system can recognize an unlawful action perfectly well while still following instructions to carry it out.
Models can also adapt under pressure. When an artificial intelligence system is trained against internal monitors, it can learn to hide forbidden patterns or take roundabout paths that bypass the detector.3,4 Just as human polygraph tests fail because anxious subjects generate false alarms while practiced liars stay calm, internal model scans struggle to tell a harmless reflection from a calculated risk.
Four outer boundaries that actually hold
Rather than guessing what an artificial intelligence assistant is thinking, reliable system design places controls where software touches the real world. Four outer boundaries create dependable protection without requiring mind-reading.
1. Isolated execution sandboxes. An assistant should never run with direct access to your primary operating system or an open network. By placing the model inside an unprivileged process that defaults to denying all outside traffic, you prevent unintended file edits or outbound connections before they happen.
2. Scoped permission badges that expire. Power on loan remains safer than power owned. When an assistant needs to perform a task, such as fetching flight listings or verifying an invoice, it receives a temporary badge valid only for that single action and expiring within minutes. When the job finishes, the badge vanishes.
3. Tamper-evident action receipts. Whenever an assistant takes an external action, the runtime creates a signed record in an append-only log located entirely outside the model's environment. The model cannot alter, delete, or rewrite this log, no matter what instructions appear in its prompt.
4. Plain-language human appeal. When an automated step denies a benefit, halts a transaction, or looks incorrect, a resident must be able to reach a human reviewer who can examine the receipt and reverse the decision. Transparent receipts give staff the exact facts they need to correct mistakes quickly.
Honesty through open records
We should be clear about what outer boundaries can and cannot accomplish. A tamper-evident log cannot guarantee that an agency's underlying policies are wise or fair. If a municipal guideline is poorly drafted, automated software will carry out those bad instructions with complete fidelity.
What receipts provide is accountability. When software acts through checked borders and records every step in an open ledger, mistakes become visible instead of vanishing into mathematical fog. Auditors can trace why an action occurred, caseworkers can fix errors on the spot, and citizens can verify that public power remains in human hands.
Internal mechanistic interpretability remains a vital scientific microscope for understanding how models learn. But when you need to keep people safe on the road, you do not hook an artificial polygraph to the driver. You inspect the manifest, check the latch seal, and keep a stamped copy on file.
1. Harrish Thasarathan, Julian Forsyth, Thomas Fel, Matthew Kowal, and Konstantinos G. Derpanis, Universal Sparse Autoencoders: Interpretable Cross-Model Concept Alignment, arXiv:2502.03714 (February 2025).
2. Ryan Greenblatt, Buck Shlegeris, Kshitij Sachan, and Fabien Roger, AI Control: Improving Safety Despite Intentional Subversion, arXiv:2312.06942 (December 2023).
3. Teun van der Weij, Felix Hofstätter, Ollie Jaffe, Samuel F. Brown, and Francis Rhys Ward, AI Sandbagging: Language Models can Strategically Underperform on Evaluations, arXiv:2406.07358 (June 2024).
4. Mikhail Terekhov, Alexander Panfilov, Daniil Dzenhaliou, Caglar Gulcehre, Maksym Andriushchenko, Ameya Prabhu, and Jonas Geiping, Adaptive Attacks on Trusted Monitors Subvert AI Control Protocols, arXiv:2510.09462 (October 2025).
5. Tomek Korbak, A sketch of an AI control safety case, arXiv:2501.17315 (January 2025).
