@inproceedings{wang2025mcptox,
  title={{MCPTox}},
  author={Wang, Z. and others},
  booktitle={AAAI},
  year={2026},
  note={arXiv:2508.14925}
}

@article{li2026mcpitp,
  title={{MCP-ITP}},
  author={Li, R. and others},
  journal={arXiv preprint arXiv:2601.07395},
  year={2026}
}

@article{wang2025mindguard,
  title={{MindGuard}},
  author={Wang, Z. and others},
  journal={arXiv preprint arXiv:2508.20412},
  year={2025}
}

@inproceedings{xiong2026raglens,
  title={Toward Faithful {RAG} with Sparse Autoencoders},
  author={Xiong, Y. and others},
  booktitle={ICLR},
  year={2026},
  note={arXiv:2512.08892}
}

@article{basu2026interpretability,
  title={Interpretability without Actionability},
  author={Basu, S. and others},
  journal={arXiv preprint arXiv:2603.18353},
  year={2026}
}

@article{bricken2023monosemanticity,
  title={Towards Monosemanticity: Decomposing Language Models With Dictionary Learning},
  author={Bricken, T. and others},
  journal={Anthropic},
  year={2023}
}

@article{templeton2024scaling,
  title={Scaling Monosemanticity: Extracting Interpretable Features from {Claude 3 Sonnet}},
  author={Templeton, A. and others},
  journal={Anthropic},
  year={2024}
}

@misc{nanda2022transformerlens,
  title={{TransformerLens}},
  author={Nanda, N. and others},
  year={2022},
  howpublished={GitHub},
  note={Developed during Nanda's work at Anthropic on mechanistic interpretability}
}

@inproceedings{alain2017understanding,
  title={Understanding Intermediate Layers Using Linear Classifier Probes},
  author={Alain, G. and Bengio, Y.},
  booktitle={ICLR Workshop},
  year={2017}
}

@article{abdelnabi2024drift,
  title={Get My Drift? Catching {LLM} Task Drift with Activation Deltas},
  author={Abdelnabi, S. and others},
  journal={arXiv preprint arXiv:2406.00799},
  year={2024}
}

@inproceedings{reimers2019sentencebert,
  title={Sentence-{BERT}: Sentence Embeddings using Siamese {BERT}-Networks},
  author={Reimers, N. and Gurevych, I.},
  booktitle={EMNLP},
  year={2019}
}

@misc{owasp2026mcp,
  title={{MCP} Top 10},
  author={{OWASP}},
  year={2026},
  note={Beta/draft v0.1, incubator project}
}

@article{anthropic2026sabotage,
  title={Sabotage Risk Report: {Claude Opus 4.6}},
  author={{Anthropic}},
  year={2026}
}

@article{hapke2026kiji,
  title={Opening the Black Box: Mechanistic Interpretability for {AI} Agent Tool Selection Using Sparse Autoencoders},
  author={Hapke, H. and Cardozo, D.},
  journal={Dataiku/Kiji Inspector},
  year={2026}
}

@article{falsesense2025,
  title={False Sense of Security},
  author={{Anonymous}},
  journal={arXiv preprint arXiv:2509.03888},
  year={2025}
}

@article{safesail2025,
  title={{Safe-SAIL}},
  author={{Anonymous}},
  journal={arXiv preprint arXiv:2509.18127},
  year={2025},
  note={{SAE} mapping 2,059 neurons to safety concepts}
}

@article{saejailbreak2026,
  title={{SAEs} are Capable {LLM} Jailbreak Mitigators},
  author={{Anonymous}},
  journal={arXiv preprint arXiv:2602.12418},
  year={2026},
  note={CC-Delta: {SAE} sparse feature steering for jailbreak detection}
}

@article{multiagent2026,
  title={Detecting Multi-Agent Collusion Through Multi-Agent Interpretability},
  author={{Anonymous}},
  journal={arXiv preprint arXiv:2604.01151},
  year={2026},
  note={Linear probes detect agent collusion, 1.00 AUROC}
}

@article{mcpthreat2026,
  title={{MCP} Threat Modeling},
  author={{Anonymous}},
  journal={arXiv preprint arXiv:2603.22489},
  year={2026},
  note={STRIDE/DREAD analysis of 5 {MCP} components, tests 7 clients}
}
