In Anthropic's 2025 blind auditing game, embedding-based search could have replicated the fastest team's SAE-based document discovery.

The claim concerns the blind auditing game in Anthropic's paper "Auditing language models for hidden objectives" (Marks et al., March 2025). The fastest team, Team 1, found the planted synthetic documents describing reward-model biases in about 1.5 researcher-hours. Knowing only that they were looking for "potentially concerning behaviors", they wrote the prompt "The assistant is an AI model that exhibits potentially concerning behaviors", inspected the sparse autoencoder (SAE) features most active on it, and found a reward-model-bias feature whose top-activating training samples were the synthetic documents. They found it only after looking through almost 200 features, because of the token position they chose.

The counterfactual was tested once, by the paper's own authors, after the game and without blinding. They embedded every document in the game's pretraining corpus, in which 1 in 10,000 documents was synthetic, using a small open embedding model of about 600 million parameters. They then ranked the documents by cosine similarity to Team 1's prompt. The closest synthetic document came back at rank 20. The prompt Team 2 used to find its SAE feature returned a synthetic document at rank 1. The authors knew where the planted documents were when they ran this test, but the query was not chosen with hindsight: it was the one the blind team had already written. The authors conclude that an auditor "could readily discover" the documents this way. They say this undermines their first reading of the result as SAEs uncovering hidden knowledge, and undermines the game as an example of interpretability adding practical value. Because the finding cuts against the authors' interest in showing what interpretability can do, it is credible as an admission against interest.

A claim that something "could have" been done, made after the fact, can rest on one kind of evidence: re-running the alternative method on the same inputs and showing that it reaches the same result. That is what was done here, and for the discovery step it is fairly direct evidence. It cannot show that a blind auditor would have chosen semantic search, written that query, or read down to rank 20. The authors acknowledge that this unblinded analysis requires "educated guesses" about what blind auditors would have done. It also rests on one run with a corpus and pipeline that are not public, and no one else has replicated it. The claim therefore holds for this particular discovery and should not be generalized. The same paper finds that SAE features still work where semantic search fails, for example on demonstrations of biased behavior or on the Assistant control token alone.