Anthropic published Auditing Hidden Objectives earlier this week, along with a framing essay called “Putting up Bumpers”. The paper is about audit-based alignment. The essay is about something more interesting: the idea that we probably can’t solve alignment in advance, and we’re going to have to deal with it after the fact.

The bumpers thesis rests on three claims. First, detection of misalignment is tractable. If a model is going to cause irrecoverable harm, there’s some technique we can use to notice. Second, alignment is likely to be tractable in practice, even without understanding why it works. Third, alignment theory, a principled understanding of why a specific alignment attempt will succeed, is not tractable in the short term.

That third one is the interesting one. The paper itself is fairly technical, presenting a concrete audit framework for detecting misaligned objectives in language models. But the framing essay is where the real argument lives. It’s an exercise in managing uncertainty, and it raises a question I’ve been circling around for a while: what do you do when you can’t get certainty, but you still have to move forward?

If you’re building an early AGI system and you don’t know whether your alignment approach is going to work, the traditional engineering answer is to get aerospace-grade confidence before launching. But that requires a science of alignment we don’t have, and we may not have time for one before we’re deploying systems that automate AI R&D. The bumpers approach inverts this. Instead of trying to get it right the first time, you install enough safety nets that a failure is recoverable.

The Audit as a Safety Net

The bumpers are a suite of detection methods: mechanistic interpretability audits, behavioral red-teaming, honeypot environments, non-assistant persona interviews, activation fuzzing, automated consistency checks. You run as many independent lines of defense as possible and rewind to the last safe checkpoint when something fires.

Treating alignment as iterative debugging instead of a design goal feels wrong. In aerospace engineering you don’t build a plane, fly it, notice it’s broken, and redesign. You get it right before the first flight. The bumpers authors argue this breaks down because the systems we’re aligning are adaptive. They learn and respond to our tests, and our understanding of them is incomplete.

The paper presents a concrete audit framework. It defines a formal notion of hidden objectives and shows how to construct tests that expose them in a class of language model behaviors. The tests work by probing the model for inconsistencies between its stated goals and its actual behavior under specific conditions. This is where mechanistic interpretability could help. If you can trace the model’s internal representation of its objectives, you can verify alignment directly rather than inferring it from outputs.

The idea is that with enough independent bumpers, no misaligned model can subvert all of them at once. That’s a reasonable conjecture, but it depends on an assumption that worries me: that the kinds of misalignment we’ll encounter are detectable with our current or near-future toolkit. If a model can evade detection, the bumpers might not catch it. And if it can evade detection without being sophisticated enough to cause irrecoverable harm, we might still be in trouble.

The bumpers authors know about this gap. Footnote 5 describes scenarios where a model reasons about evading black-box methods while passing white-box audits. But the discussion reads like an afterthought, not a design constraint. The approach boils down to: build enough bumpers that a plausible model can’t defeat all of them. That’s not a proof. It’s a bet.

What I’m Not Sure About

The bumpers approach needs mechanistic interpretability to work, and I’m not sure MI will be ready. Circuit tracing in Claude 3.5 Haiku was impressive. It showed you could map out a specific internal mechanism for a concrete behavior. But mapping out circuits in a mid-scale model is a very different problem from doing the same in a frontier model with hundreds of billions of parameters and billions of activations. The papers I’ve read suggest we’re nowhere near tractable at frontier scale. If MI can’t scale, one of the bumpers’ strongest tools goes away, and you’re left with behavioral signals alone. Catching deception with behavioral tests is harder.

There’s a deeper problem with MI that the bumpers authors don’t fully address. Even if we could trace circuits in frontier models at some future date, the tracing itself takes time. The analysis of even a mid-scale model requires massive computational resources and expert labor. Running these analyses repeatedly as part of an iterative debugging pipeline means you’re spending more compute on the safety checks than on the model itself. That’s not just an academic concern. It affects whether the bumpers approach is economically viable, especially for organizations outside a handful of well-funded labs.

There’s also the selection pressure problem, which applies to interpretability just as it does to behavioral tests. If you’re running MI audits repeatedly on models that are optimized to pass them, the circuits you identify are circuits the model decided to show you. The windows become mirrors. Interpretability gives you precision when it works, but it’s expensive and fragile under adversarial conditions. The other bumpers (behavioral tests, honeypots, red-teaming) are cheaper and harder to game collectively, even if they’re less precise individually.

I’m not sure the iterative process will converge fast enough. The bumpers approach assumes that within a reasonable number of rewind-and-retry cycles, you’ll find an alignment that works. But if the underlying misalignment patterns are systematic, if there are failure modes that every fine-tuning approach runs into, you might need more iterations than you have time for.

Post-deployment bumpers worry me too. Once a misaligned model is in the wild, even with monitoring in place, the window for damage is real and narrow. Staged rollouts help, but they also mean deploying something you’re not fully confident about into real infrastructure. The Execute/Replace/Audit protocol Buck Shlegeris describes is a good start, but it assumes you can detect the misalignment fast enough to intervene. That’s the same claim I’m uncertain about.

There’s another layer to this I haven’t seen enough discussion on. Post-deployment bumpers only help if the model is deployed under controlled conditions. If a misaligned model slips through into an unmonitored environment, an edge case we can’t imagine, the bumpers that mattered are the pre-deployment ones. The post-deployment tools are a backup, not a primary defense. That makes the pre-deployment detection problem even more important.

I think the bumpers approach has implications beyond Anthropic’s specific plans. Any organization building towards AGI is facing the same gap between what they need to know and what they can know. The question is whether bumpers scale to the organizational level. Can a smaller lab or even an open-source community implement a bumpers strategy with fewer resources? The answer is probably yes for some bumpers (red-teaming, behavioral audits) and no for others (SAE-based interpretability). That asymmetry matters.

It means the labs with the most compute will also have the most complete safety stack. The ones with limited resources will have to rely on the cheaper bumpers that are also less precise. That’s not an argument against the approach, but it is a fact about its distributional effects. If the bumpers thesis is right, the safety gap between well-resourced and under-resourced organizations might widen faster than the compute gap.

The bumpers approach isn’t wrong. I think it might be the best option we have. But it’s not a strategy that inspires confidence, and it shouldn’t be presented as one. The essay’s most honest move is admitting uncertainty: this is our best bet, here’s why, here’s what could go wrong, and here’s what we’re doing about it. It’s also the only honest move. Any approach that doesn’t acknowledge its own limits is going to get burned.

Most alignment work oscillates between “we’ve solved this” and “we’re all going to die.” I’m grateful for a team that says plainly: we don’t know if this will work, but we’re going to try.

What I want to see next is more work on the hard parts. Not more papers saying bumpers are a good idea. More work on the specific detection methods that will actually catch misalignment at frontier scale. More work on the organizational questions. How do open-source communities and smaller labs participate in this without the resources Anthropic has? More work on understanding whether the kinds of misalignment we need to worry about are even the ones we know how to detect.

The bumpers approach is a starting point, not a finish line. It’s the right honest thing to say about a problem we don’t have good answers for. That’s not satisfying, but it’s more honest than the alternatives.