Enumerative safety
Sparse Autoencoders Find Highly Interpretable Features in Language Models — inherited
An aspirational goal in interpretability research (Elhage et al., 2022b) of producing a complete, human-understandable enumeration of a model's features sufficient to guarantee it will not perform dangerous behaviors such as deception. Invoked in the paper's conclusion as the long-term motivation its sparse-autoencoder method is framed as a step toward.
A complete, human-readable list of everything a model's internals compute would be worth more than any amount of behavioral testing on a sample of inputs, because it could in principle rule out dangerous behavior rather than just fail to observe it in the cases checked. That's the ambition this paper closes on rather than opens with, so everything demonstrated beforehand can be read as a small piece of evidence toward it.
The page covers where the term comes from, how the paper positions its own techniques as one step toward that ambition, and the honest accounting of distance still to go — reconstruction that never reaches zero loss, features that stay silent, and results confirmed on only a couple of small models.
The safety ambition the whole paper is offered as a step toward
Enumerative safety is where two of the paper's themes converge on a single sentence: enumerating-features-for-safety, because it is the named destination the paper's entire feature-enumeration project points at, and steering-as-audit, because a complete list of a model's features is also, implicitly, a complete list of the levers available for eliciting and red-teaming its behavior. It is the paper's very last idea, placed deliberately at the end of the conclusion rather than in the introduction, so that everything demonstrated beforehand can be read as evidence toward it.
An 'ambitious dream,' named by Elhage et al. (2022b)
The term is credited to Elhage, Hume, Olsson, Nanda, Henighan, Johnston, ElShowk, Joseph, DasSarma, Mann et al. (2022b)'s "Toy Models of Superposition," which articulates enumerative safety as an ambitious dream in the interpretability literature: producing a human-understandable explanation of a model's computations expressed as a complete list of its features, thereby providing a guarantee that the model will not perform dangerous behaviours such as deception (sparse-autoencoders, §"6.3 Conclusion", p. 9). The framing is deliberately stronger than ordinary behavioral testing: rather than checking a model's outputs on a sample of inputs and hoping the sample generalizes, an enumerated feature list would license a claim about what the model cannot do, grounded in exhaustively accounting for its internal parts rather than in trusting its behavior.
How this paper claims to move toward it
The paper's own closing words position sparse autoencoders as a concrete method aimed at exactly the kind of feature list enumerative safety requires: "We hope that the techniques we presented in this paper also provide a step towards achieving this ambition" (sparse-autoencoders, §"6.3 Conclusion", p. 9). The clearest worked instance of what that step looks like in practice is Automatic feature circuit detection, demonstrated concretely on the closing-parenthesis feature and its traced upstream causes -- the paper's future-work paragraph explicitly frames tracing such causal dependencies between features as "a step towards the eventual goal of building an end-to-end understanding of how a model computes its outputs" (sparse-autoencoders, §"6.2 Limitations and future work", p. 9), the sentence immediately preceding enumerative safety's introduction.
The distance the paper is honest about
The paper does not claim to have reached enumerative safety, only to have taken a step towards it, and its own numbers explain the caution: reconstruction loss is never driven to zero, substituting Pythia-70M's layer-2 residual stream with its reconstruction raises perplexity on the Pile from 25 to 40, MLP-sublayer dictionaries suffer many dead features, and even the residual-stream dictionaries that work well are confirmed interpretable only across a handful of layers and two small Pythia models (sparse-autoencoders, §"6.2 Limitations and future work", p. 9). A guarantee that a model will not perform dangerous behaviors requires enumerating its features completely; a dictionary with unresolved reconstruction loss and many dead units enumerates them only partially.