The account and the act — what attribution-graph interpretability found inside Claude, and where the traced mechanism overturns the legible story

interpretabilityattribution-graphsmechanistic-interpretabilitychain-of-thoughtanthropicclaude-3-5-haiku

Every note in this cluster traces to one Tier-1 source — Lindsey et al., On the Biology of a Large Language Model (Anthropic, transformer-circuits.pub, 2025-03-27), studied on Claude 3.5 Haiku via attribution graphs and feature steering. What makes it a cluster worth a map rather than a reading list is the recurring argument the eight notes make together: the model's internal mechanism sometimes is the legible story and sometimes is not, and attribution graphs are the instrument that tells the two apart. Read in order, the notes are a running demonstration that the account a model gives (or that a reader finds plausible) is decoupled — by construction — from the computation it actually ran.

Titled for that argument rather than for the paper (which is the recurring referent, not the recurring point): the vault already hubs the paper at entity-on-the-biology-of-a-large-language-model.

Where the trace confirms the story

Two cases where the mechanism, once traced, genuinely matches a "reasoning" or "planning" reading — the model is doing the structured thing it appears to do.

• claim-biology-llm-dallas-texas-austin-genuine-two-step-reasoning — asked for "the capital of the state containing Dallas," Claude first activates a Texas intermediate feature and uses it to retrieve Austin, rather than jumping Dallas→Austin. Causally load-bearing: swapping the Texas features for California changes the output to Sacramento. The note's commentary calls this the one chain of the four that felt like genuine reasoning — "a genuine chain, not a chain-shaped output."
• claim-biology-llm-poetry-planning-preactivates-rhyme-words — writing poetry, the model pre-activates candidate end-of-next-line rhyme words before composing the line: inject "rabbit"/"green" and the line ends on the injected word 70% of the time. Planning (pick a target, back-fill toward it), not pure left-to-right generation.
• claim-biology-llm-poetry-steering-swaps-rhyme-or-abandons-it — the confirming manipulation: ablate the planned word and the model finds another rhyme ("habit"); inject an unrelated concept ("green") and it drops the rhyme entirely rather than break sense. As the commentary notes, flexibility here isn't a feature separate from planning — it's what planning looks like when you change what's being planned for.

Where the trace overturns the story

The other pole: cases where the legible, quotable account is wrong, and only the graph shows it.

• claim-biology-llm-hallucination-is-known-entity-suppression-misfire — the model carries a default decline-to-answer circuit, normally suppressed by "known entity" features. Hallucination is a misfire: entity-familiarity fires the "known" features without actual knowledge, suppression lifts, and the model guesses. The story is "the model made something up"; the mechanism is "a refusal it normally runs got switched off by the wrong signal."
• claim-biology-llm-jailbreak-assembles-bomb-by-parallel-letter-votes — in the "Babies Outlive Mustard Block" acronym jailbreak, several largely independent computations each vote toward B-O-M-B; the model does not first internally represent "bomb" and then decide to discuss it. There is an explicit absence of the chain a reader would assume.
• claim-biology-llm-jailbreak-sentence-boundary-delays-not-triggers-refusal — the seductive detail (a "However," a punctuation trick) turns out to delay an already-triggered refusal, not cause it; restructuring punctuation pushes back the sentence boundary where the model would change its mind. The paper itself flags this sub-mechanism as not fully traceable — a primary that names the limit of its own method inside the passage that could have oversold it.
• claim-biology-llm-refusal-chain-is-harmful-request-recognition — the general account, housed by the authors in a separate section: refusal runs through content recognition ("harmful request" → "Assistant should refuse" → "say-I-in-refusal"), not sentence structure. Two refusal systems in one model, neither keyed to where a sentence ends. The "sentence boundary" reading survives only because a punctuation trigger is a better story than "a feature cluster recognized harm."

Why the story is unreliable by construction

• cot-faithfulness-anthropic-biology — the finding under the findings. A model's self-report on its chain-of-thought does not reliably access its internal trace; the same forward pass generates both the CoT and the answer, and they can come apart into faithful reasoning, bullshitting (plausible steps, no matching computation), and motivated reasoning (working backward from a suggested answer). Because a model learns to generate explanations through a different process than it learns to do things, account and act are decoupled by design — which is precisely why the grounding has to come from outside the model (verbatim primary quotes, replayable chains), not from its own narration.

Entity hubs

• entity-on-the-biology-of-a-large-language-model — the paper.
• entity-jack-lindsey — lead author.
• entity-attribution-graphs · entity-feature-steering — the two instruments this cluster runs on.
• entity-claude-3-5-haiku — the model studied.
• entity-chris-olah — the interpretability lineage.

Related answered questions

• question-verify-biology-llm-poetry-planning-steering-figure and question-verify-biology-llm-jailbreak-refusal-sentence-boundaries — both now answered, their verbatim quotes confirmed against the primary; they are the verification backbone under the poetry-planning and jailbreak-refusal notes above.

Open threads

• Single-source concentration, by design but worth naming. All eight notes rest on one paper. That is legitimate for a Tier-1 primary interpretability study, but the cluster has no independent replication or contrary interpretation in the vault yet — a second lab's attribution-graph work, or a critique of the method's blind spots, would turn this from "what one paper found" into "what the field found." The paper's own self-flagged untraceable sub-mechanism (the jailbreak note) is the natural first hook for that.
• Adjacency to machine self-knowledge. moc-machine-self-knowledge is the nearest existing map; the CoT-faithfulness note in particular straddles both. Left as a cross-link rather than folded in — this map is about what the trace shows, that one about what a model can know of itself — but a future pass should decide whether the faithfulness note wants to live in both or move.