Mechanistic Interpretability in 2035: Scenarios and Falsifiers

Two questions, not one roadmap

Most writing about where mechanistic interpretability will be by 2035 collapses into one of two single-track stories. One version has the field finishing what it started: methods scale cleanly from toy models to frontier systems, an AI-driven interpreter reads another AI’s internals fast enough to matter, and regulators eventually accept a circuit-level account as evidence the way they accept a stress test. The other version has interpretability staying close to where a companion piece in this series left it — real, useful, and durably partial: sparse dictionaries recover directions that are interpretable but not certified as the model’s own, attribution graphs explain a hard-won fraction of a forward pass, and every serious practitioner keeps citing analyst-hours as the binding constraint. Both stories are coherent. Neither is more than a preference dressed as a forecast, because the field’s own 2026 evidence pulls toward both endings inside the same eighteen months, sometimes inside the same laboratory’s own publications.

The honest alternative is scenario analysis, done with a specific discipline: name the smallest number of drivers that are both consequential and genuinely uncertain, cross them, state the mechanism behind each resulting cell, and commit in advance to the observations that would identify which cell the field is actually in. This article uses two axes. Axis A asks whether interpretability’s coverage — the share of a frontier model’s behaviour with a validated, causally checked account — scales toward something close to a full audit, a change that almost certainly requires automated, AI-driven interpretation trusted to run at scale, or whether coverage stays confined to partial, sampled analysis of hand-picked circuits, with automation remaining a triage aid that still needs a human sign-off before anything load-bearing is concluded. Axis B asks whether the field converges on a small number of standardized, cross-validated methods, or keeps fragmenting across competing decomposition bases with no agreed faithfulness metric. Whether interpretability-derived evidence becomes admissible for safety certification is treated below as a joint consequence of these two axes, not a third independent driver — an argument made explicitly rather than assumed.

The documented present

Fact. Anthropic’s circuit-tracing method, published in March 2025, is the most complete public account of what a frontier-model replacement can explain. Its largest cross-layer transcoder reproduces the underlying model’s next-token completion on half of a diverse set of pretraining-style prompts; on the attribution graphs it does produce, roughly eighty percent of a node’s input edges trace back to interpretable features rather than an unexplained “error” node, and a stricter completeness measure — the share of complete input-to-output paths that never touch an error node — sits near sixty-one percent ^[2]. Read plainly, a substantial minority of a frontier model’s computation is still, in the authors’ own language, hidden. That is the clearest quantitative anchor for where coverage sits in mid-2026, and it is a number the method’s authors chose to publish themselves.

Fact. Two months later, Anthropic released circuit tracing as an open-source library rather than a proprietary tool, extending it to open-weight models such as Gemma-2-2b and Llama-3.2-1b and inviting outside researchers to find circuits the original team had not ^[3]. That is real evidence of a push toward broader use. It is not evidence of standardization: the announcement frames the release as an invitation to extend the tool, not as the field settling on it as the reference method, and a tool becoming widely used is a different fact from a tool becoming the agreed one.

Fact. Automated interpretability is not a 2026 idea. OpenAI demonstrated the core loop in 2023: use a language model to write a natural-language explanation of what makes a neuron fire, use a second pass of the same model to simulate the neuron’s activation from that explanation alone, and score the explanation by how well the simulation matches the real activation — a method that scaled to every neuron in GPT-2 ^[4]. Its own authors were explicit about what the score measures: an explanation is graded on how well it predicts correlated activation, not on whether it names the mechanism producing it, and a high-scoring explanation can still fail on text distributed differently from what it was checked against. Three years on, that gap between correlational scoring and mechanistic accuracy remains the load-bearing caveat on every automated method built since.

Fact. The most direct evidence about whether automated interpretation is trusted to run unsupervised comes from Anthropic’s own account of deploying it. Three auditing agents, built to replicate a human alignment researcher’s work, were tested against models with deliberately implanted hidden goals or behaviours. An investigator agent using interpretability tools alongside chat and data analysis found the hidden objective in thirteen percent of solo runs, rising to forty-two percent when several runs were aggregated; an evaluation-building agent correctly distinguished models with an implanted behaviour from clean ones eighty-eight percent of the time but struggled with subtle or rare cases; a red-teaming agent surfaced roughly seven of ten implanted behaviours but generated enough false leads that a person still had to review the transcripts ^[5]. The paper’s own framing is not “these are ready”: the authors report using the agents with a human in the loop rather than autonomously, and note the investigator agent fails to find anything subtler than generating harmful content outright. That is the field’s own frontier lab, in its own words, describing automated interpretation as an accelerant that still needs a person checking behind it.

Fact. The comparable human-led exercise reaches a similar place from the other direction. Four teams were set to find a hidden objective deliberately trained into a model, blind, using whatever methods they chose; three succeeded, through a mix of sparse-autoencoder interpretability, behavioural attacks, and training-data analysis ^[6]. Interpretability contributed to a real result. It was not uniquely decisive — one team without interpretability access still found the objective by other means, and one team with every tool available still missed it. A three-in-four hit rate on a single, deliberately findable planted objective is progress, and it is not coverage of an unknown model’s unknown behaviour.

Fact. The choice of decomposition basis is still actively contested, not settled. A matched comparison published in 2025 found that transcoders — trained to reconstruct a layer’s output from its input, rather than a single layer’s activation the way a sparse autoencoder does — produce features “significantly more interpretable” than sparse-autoencoder features trained on the same model and data, and introduces a further variant, the skip transcoder, that improves reconstruction without cost to interpretability ^[7]. A new basis beating the previous one on the previous one’s own turf is what a field does before it converges, not after.

Fact. The basis keeps multiplying rather than narrowing. Anthropic’s sparse crosscoders read and write across several layers, or across two different models, at once — built specifically to resolve a feature spread across layers that a single-layer dictionary cannot see as one thing, and to support “model diffing,” comparing what changed between two checkpoints, as a use case neither sparse autoencoders nor ordinary transcoders cover ^[8]. Crosscoders are a genuine advance and a third decomposition family sitting alongside the other two, published without a claim that it displaces either.

Fact. Two efforts published in close succession show the field trying to build the missing standard rather than having found it. RAVEL constructs test cases with a known, ground-truth relationship between entangled concepts — the continent a city sits in versus the country it sits in — specifically because, as its authors state, the field lacked a controlled way to compare interpretability methods against a known answer at all ^[9]. SAEBench addresses the evaluation side of the same absence: its authors note that most published sparse-autoencoder work had been graded on unsupervised proxy metrics of unclear practical relevance, assembles eight downstream metrics across two hundred open-sourced autoencoders spanning eight architectures, and reports that gains on the old proxy metrics do not reliably predict gains on the new practical ones ^[10]. Two independent benchmark papers built in the same year, for a standard the field openly lacked, is evidence that convergence is wanted. It is not evidence that convergence has happened.

Fact. The field’s own agenda-setting review, co-authored across the major interpretability groups, names exactly this pair of questions as open rather than closed: whether current methods can be trusted well enough to scale, and how to apply them toward specific goals rather than treating interpretability as an end in itself, alongside a third category of socio-technical questions the field has barely started on ^[1]. Practitioners listing “does this generalise” and “what is it for” as open problems in 2025 is the clearest evidence against reading any single 2026 result as having settled either axis already.

Fact. Where binding regulation exists, it governs by a compute threshold, not by an assessment of what verification method, if any, was used. Article 51 of the EU AI Act presumes systemic risk once a general-purpose model’s training compute exceeds ten to the twenty-fifth floating-point operations, triggering statutory obligations regardless of whether the developer can produce a circuit-level account or nothing more than a system card ^[13]. The instrument that already has teeth has, so far, nothing to say about mechanistic evidence one way or the other.

Fact. The clearest institutional statement on whether that could change soon comes from the UK’s AI Security Institute, which frames interpretability as one possible input to a “safety case” — a structured, evidence-based argument that a system is safe enough for a given context — while stating plainly that interpretability-based approaches are nascent, that it remains unclear whether they will produce evidence robust enough to rely on, and that doing so will likely require substantially more investment; the institute describes its own interpretability-based evaluation work with an outside partner as a research collaboration, not a certification pipeline ^[11]. An academic proposal for how safety cases might be structured makes the same point from the methodology side: it treats a safety case as a scalable format for an argument and leaves which techniques supply trustworthy evidence inside that format as an open research question rather than a settled list ^[12].

Why these two axes, and why automated trust and legal admissibility are not a third and fourth

Axis A is consequential because its two poles decide what kind of claim “this model’s behaviour is understood” actually is: a claim backed by a validated account of most of what the model does, the direction Circuit Tracing’s authors are working toward and candid about not yet reaching ^[2], or a claim that remains, as it is today, “we have a validated account of this specific circuit, and nothing certified about the rest.” It is uncertain because the only plausible route to closing it is automation — no realistic growth in human analyst-hours reaches frontier-model coverage — and the automation available today is explicitly not yet trusted to run without a human check, exactly as Anthropic’s own auditing-agent results show ^[5]. That is why automated-interpretability trust sits inside Axis A rather than standing as its own axis: it is not a separate uncertain driver, it is the mechanism by which Axis A’s positive pole would have to be reached. A version of Axis A where coverage scales without automation ever being trusted has not been proposed by anyone in the evidence above, and nothing in it suggests hiring is the binding constraint.

Axis B is consequential because it decides whether an interpretability result is a claim about the model, or a claim about the model filtered through whichever specific method one lab happened to choose. It is uncertain because the last two years have added decomposition bases faster than they have retired any: transcoders beat sparse autoencoders on the sparse autoencoders’ own turf ^[7], crosscoders added a third family built for a use case neither predecessor covers ^[8], and two independent benchmark efforts were built in the same year specifically because no shared way to compare any of them yet existed ^{[9, 10]}.

Whether interpretability evidence becomes admissible for a safety certification is not a third axis; it is what the other two jointly produce, and the joint requirement is a conjunction rather than an average. Write $A(t)$ for the share of a frontier model’s decision-relevant behaviour with a validated, causally checked account — Circuit Tracing’s own figures are the best public anchor for where $A(t)$ sits today ^[2] — and $S(t)$ for the share of published interpretability results built on a method that has cleared an agreed, cross-lab benchmark rather than a proxy metric of the kind SAEBench found unreliable ^[10]. A regulator or a court asked to accept mechanistic evidence needs both a guarantee about how much of the model the evidence covers and a guarantee that the method itself is not still under live dispute; a high-coverage result from a disputed method and a well-validated result covering a hand-picked sliver of the model fail for different reasons. Admissibility is therefore better modelled as a conjunction of two thresholds than a weighted sum of two moving averages:

$R(t)$ stays at zero however high either term climbs alone, exactly as the AISI account above already anticipates by asking for outside validation before treating interpretability-based detection as sufficient on its own ^[11]. Axis A determines whether $A(t)$ can plausibly clear $a^{*}$ within the horizon this article considers; Axis B determines whether $S(t)$ can. Neither can be inferred from the other, which is why they are kept as two axes rather than folded into one.

Four scenarios toward 2035

Crossing the two axes gives four cells. None is named as the likely outcome; each is named for the instrument in this article’s own room that best captures its logic.

Scenario one: The Matched Rack — coverage scales, methods converge

Mechanism. Automated interpretation follows the trajectory the auditing-agents work is already on — investigator-agent success climbing from single digits to double digits through aggregation ^[5] — until a validated pipeline reliably explains most of a frontier model’s decision-relevant behaviour without a per-result human check, closing the gap Circuit Tracing’s authors currently report ^[2]. In parallel, the transcoder-versus-SAE contest resolves the way the 2025 comparison already points ^[7], crosscoder-style multi-layer bases absorb the remaining special cases ^[8], and a benchmark in the RAVEL/SAEBench line becomes the field’s agreed pass bar rather than one of several competing ones ^{[9, 10]}.

Horizon. Recognisable technical convergence and coverage growth by 2030–2031; a validated, standardized toolkit with near-complete audit coverage plausible by 2034–2035.

Assumptions. The correlational-versus-mechanistic gap Bills and colleagues flagged in 2023 closes rather than persisting at scale ^[4]; a dominant benchmark is actually adopted field-wide rather than remaining one entry among several.

Observable indicators. A published automated-interpretability pipeline reports validated coverage above roughly seventy percent of a frontier model’s outputs on a genuinely diverse prompt set, with most of the gain attributed to automation rather than added analyst-hours; a majority of new interpretability papers report results on a shared benchmark rather than a bespoke proxy metric; a safety-case framework of the kind AISI is already exploring begins citing a named method rather than “interpretability in general” ^{[11, 12]}.

Disconfirmation. Falsified if, by 2032, no published method exceeds roughly the coverage Circuit Tracing already reports, or SAEBench-style multi-metric evaluation remains a minority practice in published work.

Scenario two: The Uneven Reach — coverage scales, methods fragment

Mechanism. Automated interpretation scales inside individual labs the way the auditing-agents result already shows is possible in narrow cases ^[5], and coverage climbs at more than one lab. But each lab keeps its own decomposition basis and its own faithfulness protocol — some on transcoders, some on crosscoders, some on a proprietary successor to either — the way the 2025 literature is already splitting three ways ^{[7, 8]}. High coverage numbers get published; they are not comparable across labs, because no shared benchmark of the RAVEL/SAEBench kind became the field’s actual reference rather than one of several ^{[9, 10]}.

Horizon. Recognisable by 2030; a stable configuration plausible through 2035 if no external pressure forces convergence.

Assumptions. Competitive advantage from a proprietary method outweighs the value of a shared standard; no funder or regulator conditions support on using a common benchmark.

Observable indicators. Coverage figures comparable to scenario one’s threshold appear in system cards, reported alongside method-specific metrics that do not map onto a competitor’s; RAVEL- and SAEBench-style benchmarks keep publishing but adoption stays partial; $A(t)$ clears the coverage bar this article’s model requires while $S(t)$ does not, so $R(t)$ stays at zero even as raw coverage looks like scenario one’s.

Disconfirmation. Falsified if a single benchmark or method becomes the reported standard across three or more frontier labs by 2032 — that would indicate the world has moved to scenario one instead.

Scenario three: The Calibrated Sample — coverage stays partial, methods converge

Mechanism. The field converges the way scenario one’s second half describes, but coverage does not follow, because the limiting factor turns out to be the one Sharkey and colleagues’ review already flags as open rather than an engineering backlog money clears ^[1] — some combination of superposition at scale, compute cost, and the “hidden” share of computation Circuit Tracing’s authors report not shrinking as fast as the tooling around it improves ^[2]. What results is a narrow, well-validated pipeline that can certify specific, bounded claims — this checkpoint does not contain feature X, verified to method Y — without ever supporting a claim about the whole model.

Horizon. A converged, narrow-scope toolkit recognisable by 2029–2030; stable through 2035 as a bounded-claim regime rather than a full-audit one.

Assumptions. Standardization is a social and institutional process that can outpace the harder technical problem of coverage, consistent with two benchmarks appearing in the same year while coverage numbers moved comparatively little ^{[9, 10, 2]}.

Observable indicators. Published coverage figures plateau in roughly the range Circuit Tracing already reports even as benchmark adoption becomes near-universal; safety cases and certifications, where they use interpretability at all, name specific bounded claims rather than model-wide guarantees ^[12]; $S(t)$ clears its threshold while $A(t)$ does not, so $R(t)$ stays zero for broad claims and becomes available only for a narrower, differently defined admissibility condition this article does not formalize.

Disconfirmation. Falsified if coverage figures move substantially past Circuit Tracing’s current range by 2032 without a corresponding narrowing of claims — that would indicate the world has moved toward scenario one instead.

Scenario four: The Standing Bench — coverage stays partial, methods fragment

Mechanism. Neither pressure resolves. Automated interpretation keeps producing genuine but bounded results the way the auditing agents already do, without crossing into unsupervised, high-coverage use ^[5], and the decomposition-basis contest keeps producing new entrants faster than any one displaces the others ^{[7, 8]}. Regulation continues to govern by compute threshold rather than verification method, the way Article 51 already does ^[13], and interpretability keeps appearing in system cards and safety-case proposals as one input among several rather than certified, standalone evidence ^{[11, 12]}. This scenario’s leading indicator is not a future event; it is the documented present described above, continuing.

Horizon. Close to today’s baseline; recognisable as the stable case by 2028 if none of the trends above accelerate; could persist through 2035.

Assumptions. No single result forces a sudden field-wide convergence or a sudden coverage breakthrough; competitive and publication incentives keep favouring a new method over consolidation onto an old one.

Observable indicators. Published coverage figures stay within roughly today’s range through the horizon; no benchmark achieves adoption across a majority of published interpretability work; no regulator or standards body moves past a compute-based or process-based requirement to certifying a specific mechanistic method.

Disconfirmation. Falsified if either high coverage or field-wide convergence is observed at the thresholds defined in scenarios one through three — either observation would move the world out of this cell.

What all four share, and the possibility neither axis names

Three things hold across every cell. First, some form of human verification survives in all four scenarios, including the highest-coverage ones — even the auditing agents whose success rates are climbing are still, by their own authors’ account, deployed with a human in the loop for anything consequential ^[5], and none of the four scenarios above requires that ever becoming false; automation raises coverage, it does not eliminate the check in any of these cells. Second, which decomposition basis wins — sparse autoencoders, transcoders, crosscoders, or something not yet published — is a narrower, more replaceable engineering detail than Axis B itself: the field could converge on any of them, or on a successor to all three, and the convergence axis is compatible with any specific winner. Third, none of the four requires a plateau in the surrounding capability trend that makes interpretability urgent in the first place; each is compatible with frontier models continuing to grow more capable at roughly their current pace, because the axes describe interpretability’s own maturity, not the rate of the capability progress it is trying to keep up with.

The four scenarios share a blind spot too. All four assume the kind of gradual movement the evidence above actually shows. A large enough shock would not fit cleanly into any of them. A single, publicly attributed failure traced back to a root cause that behavioural testing had entirely missed but a circuit-level trace caught cleanly could force sudden institutional trust in mechanistic evidence years ahead of the gradual path scenario one traces. Equally, a prominent published circuit or feature claim, relied on inside a live safety argument, being shown to have been an illusion of a kind this series has already documented in miniature would set trust back further and faster than scenario four’s gradual baseline implies. Either event would move both axes at once, abruptly, rather than along the paths each scenario traces on its own.

Two predictions, stated separately from the scenarios

Prediction one. Horizon: end of 2029. At least one published interpretability method will report validated coverage exceeding roughly seventy percent of a frontier model’s outputs on a genuinely diverse evaluation set, moving substantially past the fifty-to-sixty-one-percent range Circuit Tracing’s own authors reported in 2025 ^[2], with automation rather than added human analyst-hours credited as the primary driver of the gain. Assumption: research investment in both automated interpretation and coverage-focused evaluation continues at roughly its current trajectory. Indicator: a published paper, system card, or benchmark submission reporting a coverage or completeness figure above seventy percent on a diverse prompt set, with the gain attributed explicitly to automated methods. Disconfirmed if published coverage by the end of 2029 remains within the range Circuit Tracing already reports, regardless of how much automated tooling has been built around it.

Prediction two. Horizon: end of 2031. No jurisdiction with meaningful enforcement power will have accepted mechanistic-interpretability evidence as sufficient, on its own, for a safety-certification decision — as opposed to accepting it as one corroborating input inside a broader safety case that also rests on behavioural testing. Assumption: convergence on a validated toolkit (Axis B) remains a slower, more institutional process than coverage growth (Axis A), consistent with AISI’s own description of interpretability-based evidence as still nascent and requiring further investment before it can be relied on ^[11]. Indicator: binding regulatory text, an accreditation scheme, or a legal ruling naming a specific interpretability method as sufficient, standalone grounds for a certification or deployment decision. Disconfirmed if such a decision is made with enforcement power by a major jurisdiction before the horizon.

What to take away

The refusal to name a favourite among these four is the substantive claim, not a hedge around one. In August 2026 the evidence is genuinely split on both axes at once: a circuit-tracing method candid enough to publish that a substantial share of a frontier model’s computation is still unaccounted for sits beside an open-sourced version of the same tool inviting the rest of the field to extend it; automated auditing agents that find a deliberately hidden objective more often when aggregated sit beside their own authors’ insistence on keeping a human in the loop; two independent teams building the field’s first real ground-truth benchmarks in the same publication year sit beside a paper showing the previous default architecture beaten on its own turf by a newer one. Anyone reporting a single confident future for mechanistic interpretability in 2035 is reporting which of these four scenarios they would bet on, not what the current record shows.

The more useful and less satisfying discipline is the one this article tried to practise throughout: know which signal to watch — a coverage number in a system card, a benchmark’s adoption rate across labs rather than its mere existence, a regulator naming a method rather than a process — and have said in advance, on the record, what each finding would mean. Mechanistic interpretability has already established real things, documented at length elsewhere in this series: that a neuron is rarely the right unit, that intervention beats correlation as evidence, that a single direction can mediate a real behaviour across many models. What it has not established is whether any of that generalizes into the audited, standardized, admissible field its more confident advocates already describe it as becoming.