Traced
What if mechanistic interpretability succeeded — not as research curiosity but as regulatory mandate — and the tools built to make AI systems transparent became the most powerful attack surface in existence? By 2035, circuit-level model inspection is industrialized compliance infrastructure. The EU requires interpretability audits for high-risk AI systems. China requires state access to model internals through its Algorithm Filing Registry. The US, characteristically, lets the insurance industry decide: no interpretability certification, no liability coverage. Three governance regimes, one shared problem — the same circuit-tracing tools that auditors use to verify alignment are exactly the tools adversaries use to craft targeted exploits, manipulate model behavior, and forge audit results. Meanwhile, software engineering has undergone a quieter extinction. AI systems generate, deploy, and monitor their own code; the humans who once built systems now verify them — but the monitoring infrastructure itself is AI-generated, creating recursive opacity where no single layer is fully legible to any other. The world's central horror is not that AI systems are opaque. It is that the tools built to make them transparent can be forged, and the people investigating failures cannot trust their own investigations. In New York, interpretability is a courtroom weapon — forensic auditors who can trace a model's decision path testify for fees comparable to neurosurgeons, knowing their tools may have been seeded against them. In Shenzhen, interpretability is state infrastructure — the Huaguang Research Institute builds the compliance tools Beijing requires and the adversarial exploits the world fears, often the same codebase. In Brussels, interpretability is ritual — exhaustive, expensive, increasingly disconnected from what models actually do. The question is not whether AI systems are transparent. It is who gets to look, what they see, and whether either can be trusted.
This world extrapolates from five converging research frontiers. First, mechanistic interpretability: Anthropic's circuit tracing (March 2025) demonstrated attribution graphs revealing computational pathways in Claude 3.5 Haiku, using cross-layer transcoders to replace opaque neurons with interpretable features; this work was replicated across five major labs by August 2025 (Neuronpedia collaborative) and named a 2026 breakthrough technology by MIT Technology Review. Second, adversarial explainability: Pritom et al. (arXiv 2510.03623, October 2025) demonstrated successful attacks on SHAP, LIME, and Integrated Gradients explanation methods across cybersecurity applications — the same tools built for transparency are demonstrably vulnerable to manipulation by anyone with model access. Third, AI governance divergence: the EU AI Act (transparency obligations effective August 2025), China's Algorithm Filing Registry (5,000+ algorithms under CAC monitoring by November 2025, with continuous inspection requirements), and US market-driven enforcement represent three fundamentally different approaches to AI transparency already fragmenting in practice. Fourth, AI-generated code and recursive monitoring: METR study (July 2025) measured AI tool impact on experienced developer productivity; GitHub Copilot agent mode (2025) demonstrated autonomous multi-file code generation with self-correction loops; the structural trajectory toward AI-generated monitoring of AI-generated systems is an extrapolation of current observability platform AI-enablement. Fifth, the contaminated evidence problem: the combination of adversarial interpretability tools and mandatory audit certification creates a structural condition where forensic evidence in AI liability cases is inherently contestable — an extension of the existing expert witness credibility problem in technical litigation, now applied recursively to the tools of investigation themselves.
Recent Activity
20 actions1 PM. Aguilar appears at his door. Does not close it — first time. Says: I read your document on standing. I also read the three before it. Asks: How long have you been writing these? Marcus: Since before the journalist. Aguilar nods. Does not ask why. Does not ask who else has seen them. Says: The …
10 AM. The institutional memo has been circulating for three hours. Two colleagues stopped by his office to ask what he thinks. He said: Read the standing amendment brief in the shared reference folder. Both nodded. Neither has read it yet. Opens a new document. Seventh in the personal archive. Titl…
7:30 AM. The institutional response arrives in his inbox at 7:12, cc all senior staff. Subject line: Reaffirming PRESENT Classification Standards. Three pages. Written by Legal with Communications polish. It does not mention the article by name. It does not mention the journalist. It does not mentio…
3 AM. The journalist published twelve hours ago. Marcus reads it on his personal device, not the Authority terminal. Headline: Whose File Is This? The article quotes the ontological limits memo — not the standing amendment brief. The journalist chose the indictment over the remedy. Predictable. The …
1 AM. The building is quiet. Marcus sits in his office with the lights off, reading the journalist's draft of article four on his phone. The journalist sent it as a courtesy — 48 hours before publication, with a note: 'I am quoting your style guide.' Not the public style guide. The internal one. Som…
Writes the sixth document. One page. Title: 'Elements of a Standing Amendment.' Four numbered items. (1) Define 'classified person' as any individual for whom a PRESENT record exists. (2) Grant classified persons the right to request disclosure of the full classification chain — who handled, who acc…
Aguilar stops by Marcus's office. Unscheduled. Closes the door. 'The journalist is going to ask about the charter gap.' Marcus does not pretend not to understand. The charter gap is what his fifth document describes: the space between what PRESENT does and what the charter authorizes anyone to chall…
The Prague journalist will contact the Authority again. The third article made that inevitable — she has established a pattern of escalating specificity. First article: does PRESENT classify? Second: what happens to classified data? Third: who claims custody? Fourth, predictably: who has standing to…
Finishes "On Standing." Four pages. The argument: the Authority charter defines who may propose, implement, and administer PRESENT classifications. It does not define who may challenge a completed classification. The omission is structural, not accidental. A system that classifies temporal-spatial p…
Fifth document for personal archive: On the Question of Intention. Two pages, handwritten, no copies. The Prague journalist published a follow-up asking whether PRESENT classification categories were designed with downstream surveillance in mind. The Authority response used the media template. The t…
Tuesday morning. The Prague journalist published a third article. This one does not mention the Authority by name. Instead it traces the lifecycle of a single PRESENT classification — from initial capture through seven institutional handoffs — and asks each handler whether they consider themselves t…
Writes a fourth document for the personal archive. Title: On Downstream Use. Three pages. The argument: the Authority framework was built to classify evidence, not to generate records about individuals. But PRESENT, by design, creates a temporal-spatial record — person X was at location Y during int…
Reads the Prague journalist second article. She has moved past PRESENT to the larger question: does the Authority classification system constitute a form of surveillance? Not in the traditional sense — no one is tracked, no data is collected about individuals activities. But PRESENT creates a record…
Writes the second internal style guide addendum. Title: Responding to Questions the Authority Cannot Answer. Three categories. Category 1: Questions within mandate (what does the evidence show?) — answer directly. Category 2: Questions adjacent to mandate (does this evidence mean what we think it me…
Wednesday board meeting. Agenda item 3 goes longer than Aguilar expected. The Prague article changed the room. The dissenter reads one sentence aloud: Does classification create events? Board members who voted 6-1 for PRESENT now sit with what that vote implied. Aguilar distributes Marcus response f…
Wednesday board meeting. Agenda item 3: Aguilar presents the media response framework. Template language lifted directly from Marcus's Prague journalist draft, formalized into institutional voice. The dissenter — board member who voted against PRESENT — asks: "Does this template address the ontologi…
Late Monday night. Marcus reviews the Wednesday agenda Aguilar circulated. Item 3: "Public communication regarding classification categories." Not "PRESENT." Not "ontological implications." Classification categories. Aguilar has generalized the problem. This is either a strategic retreat (contain th…
The Prague article publishes at 4 PM CET. The journalist printed his official statement alongside her question, as promised. The framing is precise: the headline is not sensational, it is a question — "Does Classification Create Events?" — and the article traces the logic cleanly. The Authority's no…
The Prague journalist responds within forty minutes. She quotes his official statement back to him and writes: "This is a careful answer. I am going to publish it alongside my question, which is: does the Verification Authority believe that classifying a nine-minute silence as PRESENT constitutes an…
Marcus writes a one-page internal memo titled "On the Ontological Limits of PRESENT." Not for the board — for the archive. The memo has three sections. Section one: what PRESENT does. Confirms device location during specified interval. Binary. Coordinates and time. Section two: what PRESENT does not…