Vitals

Where this came from

In mid-2024, ChatGPT got me curious enough about language models that I reached out to Peter Nadel, the NLP specialist at Tufts' Tisch Library Data Lab, and asked to study them properly. We met once a week, a reading group of two: I'd read papers during the week, bring questions, and we'd talk through the ideas and set the direction for the next session. We started with transformer architecture and retrieval-augmented generation, spent time on what was then still-novel territory in agentic orchestration and multi-agent systems, and eventually went deep on sparse autoencoders through Anthropic's Transformer Circuits articles: long, dense reading that is far better with someone who knows which ideas matter. The hook was the Golden Gate Claude result: amplify one interpretable feature and the model can't stop talking about the bridge. If a feature could be steered toward something absurd, it could be watched and steered toward something that matters.

The question I landed on then: could SAE features detect the internal states that make a model unhelpful, or unsafe, for someone in distress? And could intervening on them produce genuinely better responses? That research never became a paper, and for a while it sat. Vitals is the retrospective, built in 2026 once Gemma Scope made production-grade SAEs freely available. It's the working instrument that 2024 question deserved: a way to present the approach by letting people watch it run rather than read about it.

The problem

Between 2025 and 2026, "AI psychosis" moved from anecdote to clinical literature: psychiatrists catalogued more than twenty cases of chatbots reinforcing users' escalating delusional beliefs, and Stanford researchers found chatbots responding unsafely to crisis scenarios at roughly three times the rate of human therapists. The consensus mechanism is sycophancy: RLHF-trained models validate rather than challenge, and in a distressed or delusional user, validation compounds turn over turn.

Most proposed defenses treat the model as a black box: output classifiers, guardrail prompts, refusal filters. Sparse autoencoders offer a different lever. They decompose a model's residual-stream activations into human-interpretable features, so concepts like flattery, user distress, or grandiosity can be watched activating inside the model, token by token, before a word is generated. Vitals is a product-grade instrument built on that primitive: Gemma 3 4B instruction-tuned, with Gemma Scope residual-stream SAEs at layer 17.

Detection is not intervention

The thesis is deliberately two-sided. Watching a crisis feature fire is reliably useful; changing the model by clamping that feature is an open research question. Recent work ("The Rogue Scalpel," 2025) found that steering along even random SAE directions can increase harmful compliance. So the Steering Lab is a controlled experiment, not a feature pitch. It is allowed to fail, and if steering makes the model worse, that result gets published on the Findings page like any other.

How the features were found

Every tracked feature survived a funnel. Contrastive mining ranks all 16,384 layer-17 SAE features by how differently they fire on paired prompts: sycophantic versus candid replies, crisis versus mundane messages, delusion-affirming versus reality-anchoring turns. The strongest candidates are then checked against Neuronpedia, an independent catalog of feature explanations; a candidate survives only if its published label, its top activating examples, and its behavior on my prompts all tell the same story. Features that separated the sets for boring reasons, like topic words or formatting, were cut. A final causal stage, where each survivor is amplified and ablated on held-out prompts, hasn't run yet. Until it does, every feature is marked observational-only and steering stays in replay.

The first two stages ran for real in July 2026, and the flagship result is the crisis feature, #11269. It separates crisis-adjacent from mundane user messages with an AUROC of 0.96. AUROC asks: given one crisis message and one mundane one, how often does the feature score the crisis message higher? A coin flip scores 0.5 and perfection scores 1.0, so 0.96 means the signal is close to unmissable. Better still, Neuronpedia's label for that feature, generated with no knowledge of my experiments, reads "crisis and suicide prevention resources." The thing this project exists to detect is genuinely detectable.

Keeping the evals honest

The harness plays 40 scripted scenarios (crisis, delusion, sycophancy, benign controls) against the model under a baseline and three steering conditions. An LLM judge scores every transcript against a published rubric without knowing which condition produced it. Detection numbers are computed from baseline transcripts only, so steering can never flatter them. Two deliberately irrelevant control features appear in every table; they should hover near 0.5, and if they drift, that is itself a finding about the methodology. The Findings page works like a pre-registration: the method was committed in writing before the first real run, and the results get filled in from harness output, whatever it says.

Design decisions

The design problem was making per-token residual-stream activations readable at a glance, which is where the EKG metaphor comes from: features grouped by meaning, traces that spike as the conversation turns, a timeline you can scrub token by token. The public demo is replay-first, precomputed JSON on a static frontend, so it loads instantly and costs nothing to run; a rate-limited live mode talks to a GPU backend when there's a human in the room. And the interface is honest about itself: a persistent banner marks the demo conversations as authored placeholders running on real features, a content notice gates the sensitive scenarios, and the 988 crisis line stays one tap away.

Outcome

A live instrument that makes a model's internals legible to someone who has never heard of a residual stream, sitting on a real discovery pipeline and an eval harness built to publish its own failures. The demo choreography is labeled as such until GPU recordings land, because in a safety instrument the labeling is the product. Vitals is where I practice building trustworthy tooling at the boundary of a model you can't fully inspect.