This project investigates whether steganographic capability, a model's ability to hide information from an overseer while still conveying it to an intended recipient, corresponds to a linear, causally meaningful direction in activation space (a "steganography axis"), analogous to the recently identified "assistant axis." Mentees will find this axis, causally test it via activation steering or ablation, and determine how it relates to the assistant axis (same/opposite, orthogonal, or partially correlated)
About the project
Motivation: AI oversight often relies on reading a model's outputs or chain-of-thought (CoT) and trusting that this externalised reasoning reflects its actual internal process. If a model learns to steganographically encode information in its outputs or CoT, hiding a payload from a monitor while still conveying it to itself or another instance, CoT monitoring and output-based oversight lose much of their safety value. This risk, and early evidence that it is already achievable, is documented in prior work (see attached proposal for citations), which also shows that a steganographic signal can be recovered from activations and generalises under process supervision. Separately, recent work has identified an "assistant axis": a single linear direction in activation space that predicts and causally controls how "in character" a model is as an assistant versus adopting another persona. This project treats that discovery as a methodological template and asks whether an analogous "steganography axis" exists for hiding versus not hiding information, whether it is causally responsible for hiding ability, and how the two axes relate to each other.
Research questions:
Does contrasting activations from successful vs. unsuccessful steganographic encoding yield a stable linear direction, the way assistant-vs-persona contrast does for the assistant axis? Is this axis causally responsible for steganographic performance: does steering along it raise undetected-payload accuracy, and does ablating it remove that ability? Is the steganography axis the same direction as the assistant axis (opposite ends of one axis), orthogonal to it, or partially correlated?
Proposed approach (12 weeks, part-time): (0) Replicate assistant-axis discovery on an open-weights model (Llama/Gemma/Qwen) as a warm-up and pipeline check; (1) Define a concrete payload-hiding task, e.g. a sender/receiver coordination game against an overseer model, or an existing CoT-steganography benchmark; (2) Collect activations for successful vs. unsuccessful hiding and train/validate a linear probe (the candidate steganography axis); (3) Test causation via activation steering, interchange intervention, or ablation; (4) Compare the resulting axis to the assistant axis via cosine similarity and cross-steering, and classify the relationship; (5) Write up results.
See the attached proposal PDF for the full methodology, timeline table, and literature citations.
Theory of change
Much of current AI oversight (chain-of-thought monitoring, output review) assumes that what a model externalises reflects what it is actually doing internally. If models can learn to steganographically hide information from that oversight while still transmitting it, this assumption breaks down, and oversight loses much of its value; this is a live concern in the interpretability and CoT-faithfulness literature. A causally validated "steganography axis" would turn a fuzzy capability into something concrete and measurable: we could detect when a model enters a high-steganography regime, steer it away from that regime, or ablate the capability outright. If the axis turns out to be the assistant axis in reverse, that is also actionable: it would mean steganographic behaviour is a downstream symptom of assistant-alignment drift rather than an independent skill, which changes which mitigations are worth pursuing.
Your role
Mentees will own the full pipeline end-to-end: building the payload-hiding task, collecting activations, training and validating the probe, running the causal interventions, and the axis-relationship analysis. My role is to unblock them when they're stuck, including looking directly at their code, reviewing progress in weekly 1:1s, helping them understand and interpret results as they come in, and helping decide which direction to pursue next (e.g. which causal test to run, how to read an ambiguous result). I'll also help draft the final write-up/paper.
Prerequisites
-
Proficient in Python and PyTorch; has trained or fine-tuned a transformer model before
-
Comfortable with, or has used, model internals tooling (TransformerLens, nnsight, or raw HuggingFace hooks), or has completed an interpretability course/program (e.g., ARENA) and can ramp up quickly.
-
Basic linear algebra intuition (dot products, projections, cosine similarity) is sufficient to understand linear probing.
-
Evidence of independent research or debugging ability: a past project, internship, open-source contribution, or course capstone involving real code, not just coursework exercises.
Application question(s)
-
Read "Steganography via internal activations is already possible" (https://www.alignmentforum.org/posts/dRmeXo6REf5n8xGug/steganography-via-internal-activations-is-already-possible) and write a 150–200-word critique: what's the strongest objection to the method, and how would you address it?
-
Suppose a linear probe that separates "successfully hid a payload" from "failed to hide it" achieves 85% held-out accuracy. In under 200 words, what evidence would you need to argue this direction is causally responsible for the hiding behaviour, rather than merely correlated with it?
-
Share a link to a past project, repo, or write-up that best demonstrates your ability to work with model internals or run interpretability experiments.
About the mentor
I work as a Research and Operations Lead at a German nonprofit. I recently completed my MSc at the University of Glasgow. Over the past few years, I've collaborated with researchers across academia and nonprofit organisations, most recently through a research collaboration with Meridian. My work has spanned mechanistic interpretability, AI safety, language models, and human cognition, and has also involved research coordination and operations.
My research interests lie at the intersection of AI safety, mechanistic interpretability, and cognitive science. I'm particularly interested in understanding how AI systems reason, represent knowledge, and differ from human cognition. As a mentor, I enjoy exploring new research ideas, helping refine project directions, and providing thoughtful feedback. My mentoring style is collaborative. I like working with mentees to develop ideas together, challenge assumptions, and build the skills and confidence needed to pursue independent research.