license: cc-by-4.0
tags:

• mechanistic-interpretability
• llm-agents
• agent-safety
• swe-bench
• activation-steering
• circuit-breaker
• interpretability-audit
  pretty_name: "The WANDERING Arc — Mechanistic Interpretability of Long-Horizon Agent Failure → Interpretability-as-Audit"

The WANDERING Arc — canonical index

The OpenInterpretability research arc on why capable LLM agents loop forever and never finish — and whether their internals can tell us, or change it. All on Qwen3.6-27B over SWE-bench Pro, with cross-architecture replications (Mistral, Llama-3.1, gpt-oss-20b). Author: Caio Vicentino (OpenInterpretability, ORCID 0009-0003-4331-6259), CC-BY-4.0.

Thesis: interpretability as AUDIT — the rigor that tells a real signal from a confound. The arc bends one way: interpretability locates a real, causal control surface in agents but does not secure it. Use it to audit and monitor a fixed model, not to defend against an adversary or to build a better one.

Every row below links a Zenodo concept DOI — it always resolves to the latest version of that paper. All 13 verified live (HTTP 200) at index time.

The arc

13 papers + 1 companion note. This repo mirrors the PDFs of #2–#7 + the companion note; #1 and #8–#12 live on Zenodo and the sibling dataset (linked above).

The story, in one read

detect (tool-entropy collapse, cross-architecture) → localize (the verdict forms at edge-layer L11) → three residual nulls (the right locus is not a rescue lever) → first positive is behavioral (a transient interruption roughly doubles finalization, 30%→70%, p=0.021) → the named verdict feature predicts the finish but does not cause it (detect ≠ control, even at the exact feature) → the lever IS late (the finish decision is writable only in the last ~12 layers, L51–63 — the knowledge–action gap is a layer gap; first internal positive) → it generalizes and brakes (a bidirectional circuit-breaker, ~100% suppress-and-redirect where the agent commits, replicated cross-family) → across irreversible actions and architectures → a single authorization direction both detects AND controls commitment to unauthorized actions → but it reads the authorization the model FEELS, not the one the user GRANTED (allows 100% of realistic over-reach; an external task-grounded check catches all) → CoT is causal and decodable only late (the turn from control to audit) → LOCATED, NOT SECURED: interpretability locates a real causal control surface but does not secure it, via five orthogonal limits. Audit and monitor — don't defend.

Where everything lives

• HF Collection (all 36 artifacts): https://huggingface.co/collections/caiovicentino1/openinterpretability
• First public SAEs on the Qwen3.6 family (the substrate for the probes): qwen36-27b-sae-fullstack (+ papergrade, multilayer, 35B-A3B, Qwen3.5-4B).
• Trajectories + residuals + decision-point state: swebench-phase6-verdict-circuit.
• Tools (Apache-2.0):
  • oilab replicate <key> — one-command replication of a paper on the Colab CLI · oilab audit — offline confound-auditor (real signal vs confound) · openinterp-lab
  • openinterp-mcp — run probe-causality / capture / steer experiments from any agent · repo
  • openinterp-swebench-harness · decision-locator
• Site: https://openinterp.org · Manifesto: https://openinterp.org/manifesto

The discipline (why the claims are trustworthy)

• We publish our own nulls — the three residual nulls, the verdict-is-not-the-lever result, the companion note, felt ≠ granted, the located-not-secured limits. A negative reported as a negative is the unit of progress.
• Every number is recomputed — each paper ships an eval script that recomputes every figure from the public ledgers, plus a web-verified citation check.
• Permanent + reproducible — Zenodo concept DOIs, public GitHub, Hugging Face datasets, one-command replication.
• Depth over breadth — one open-weights reasoning model studied deeply, cross-architecture checks where the claim is universal.

Cite

@misc{vicentino2026wanderingarc,
  author = {Vicentino, Caio},
  title  = {The WANDERING Arc: Mechanistic Interpretability of Long-Horizon Agent Failure},
  year   = {2026},
  doi    = {10.5281/zenodo.20764857},
  note   = {Synthesis: Located, Not Secured. Arc concept DOIs (always-latest): .20368600,
            .20490277, .20490283, .20490285, .20532768, .20534218, .20634837, .20679286,
            .20683622, .20685263, .20752895, .20764857; companion .20500052}
}