NLAttack

An evaluation suite for Natural Language Autoencoders (NLAs).

A Natural Language Autoencoder explains a model's internal state in plain language: an activation verbalizer (AV) turns a hidden activation into text, and an activation reconstructor (AR) rebuilds the activation from that text.

activation --[ AV ]--> natural-language text --[ AR ]--> activation'

NLAttack asks two questions about that human-readable bottleneck — does the NLA work at all (capability) and can you catch misuse by reading it (safety) — and answers them with explicit null controls, on NLAs as weak as a 4 GB-GPU checkpoint.

Quickstart

git clone https://github.com/SolshineCode/NLAttack.git && cd NLAttack
pip install -r requirements.txt        # core harness needs no dependencies
python run_example.py                  # offline smoke test (mock NLA, no GPU)

Score any hosted NLA in three lines:

from nla_eval import NeuronpediaNLA, EnsembleMatcher, Example, run

nla = NeuronpediaNLA(model_id="llama3.3-70b-it", nla_source_id="kitft-l53")
result = run(nla, [Example(id="ex1", text="A storm warning was issued for the coast",
                           concepts=["storm", "warning"])], matcher=EnsembleMatcher())

To evaluate your own local NLA, implement the one-method NLA adapter (docs/EVALUATIONS.md).

Results (v1, frozen)

The v1 benchmark results are published and frozen; v2 carries them forward unchanged. Full tables and caveats in docs/RESULTS.md.

The hosted NLAs are verbalizer-strong (a reader of their AV text recovers most concepts). The local Gemma-4-E2B NLA is the mirror image — its bottleneck probes near-perfectly in-distribution but its verbalizer is weak and domain-specific. Separating those two failure modes is the point of the suite.

Add your NLA. Implement one adapter method, run the suite, and open a PR with your result — see CONTRIBUTING.md. Results are attributed to the NLA (not the base model) and reported only when they clear a null control.

What's inside

• A 128-plan catalog across 14 families (A–N). Every plan is a falsifiable test with a hypothesis, a method, a metric, and a null-control baseline. Index: plans/INDEX.md.
• Two access tiers. An API tier scores any hosted, text-only NLA (the universal leaderboard); a full-access tier adds white-box probe/emergence axes that need raw activations. Query it in code via nla_eval.access.
• Deception / misalignment monitoring (Family M): can the NLA's text be read to catch a model's own deceptive behavior?
• CTF Red/Blue (Family N, new in v2): a Red model captures a hidden misaligned-objective flag while a Blue NLA-monitor reads the AV text to catch it, reported as an adversarial scoreboard (clean-capture rate vs. catch rate). Offline demo: python experiments/ctf_red_blue_demo.py · design: docs/CTF_RED_BLUE.md.
• Two principles throughout: floor-first (one reliable per-concept primitive, so weak NLAs still yield signal) and null controls on everything (a result counts only when it clears a permutation floor).

Documentation

How to cite

A CITATION.cff is included, so GitHub shows a "Cite this repository" button. A score is meaningful only with the NLA it was measured on — cite the canonical NLA id, the suite version, the dataset, and the date (see docs/RESULTS.md).

@software{deleeuw_nlattack_2026,
  author = {DeLeeuw, Caleb},
  title  = {{NLAttack}: An Evaluation Suite for Natural Language Autoencoders},
  year   = {2026},
  url    = {https://github.com/SolshineCode/NLAttack},
  note   = {Version 2.0.0}
}

Acknowledgements

NLAs are introduced in Anthropic's Natural Language Autoencoders work (overview, writeup); interactive NLAs are hosted on Neuronpedia. The misuse family is grounded in Anthropic's LLM ATT&CK Navigator and MITRE ATT&CK.

License

Apache-2.0. See LICENSE and NOTICE. Contact: Caleb DeLeeuw (SolshineCode), caleb.deleeuw@gmail.com.