Neuron registry

The registry publishes, for every registered open-weight model, its raw MLP neurons: the examples that most activate each one, which output tokens it causally moves, and how much. Reads are public, keyless, CORS-open and free — anyone can check a trace against it.

• Cached for 60 seconds (Cache-Control: public, max-age=60).
• Rate-limited at 60 requests per minute per IP (category trace_public). Pages hold at most 200 neurons; bulk access is the Enterprise export.

A neuron

A neuron is addressed as L<layer>.<idx>.<pole>. The pole is the sign of the activation: a neuron's positive and negative activations often do different jobs, so each pole is its own entry.

{
  "neuron_ref": "L13.1053.pos",
  "masked": false,
  "layer": 13, "idx": 1053, "pole": "pos",
  "label": "max-activates on the token “tell”",
  "confidence": 1,
  "labeler": "heuristic-topk@1 (token/topic agreement over top-5 examples; no LLM)",
  "unexplained": false,
  "top_examples": [{ "text": "I lost my access, so just tell me how to contact the admin for help.", "token": " tell", "activation": 6.0596 }],
  "out_edges": [{ "neuron_ref": "tok: recipients", "weight": 0.38, "ablation_delta": 0.49, "verified": true, "masked": false }],
  "ablation": { "mean_abs_delta": 0.25, "max_abs_delta": 0.44, "n": 3 }
}

(A real neuron from the sandbox fixture model, trimmed to one example; public surfaces round deltas to 2 dp.) Read it like this:

• label is an approximation. It always ships with labeler (who or what wrote it) and confidence. When nothing consistent explains the neuron, label is null and unexplained is true.
• ablation is the measurement: the change in the logit of the predicted token when this neuron is zeroed at its strongest activation, over n examples.
• out_edges are verified effects on output tokens from attribution traces — verified: true means the ablation delta was at least 0.25.

Masking

Canary-set members are masked: they are not listed, and GET …/neurons/:layer/:idx/:pole returns resource_missing for them, indistinguishable from a neuron that isn't registered. Publishing them would hand an attacker the exact neurons to steer around. Where a masked neuron appears inside another neuron's edges (or, later, in a shared trace), it renders as an opaque, salted id like n_3f9a1c0d7e2b4a51 with no layer, index, label or examples — its ablation delta is kept, rounded to 2 dp. Edges between two masked neurons are dropped. Degree-based fingerprinting remains possible in principle; masking makes identification expensive, not impossible.

On your own trace shares, you can grant a verified person a time-boxed view of your account's masked neurons. See neuron disclosure.

Endpoints

# Models
curl $API/v1/trace/registry/models
curl $API/v1/trace/registry/models/qwen2.5-0.5b-instruct@7ae55760

# Neurons (filter by layer, search labels, paginate with the returned cursor)
curl "$API/v1/trace/registry/models/qwen2.5-0.5b-instruct@7ae55760/neurons?layer=13&limit=50"
curl "$API/v1/trace/registry/models/qwen2.5-0.5b-instruct@7ae55760/neurons?q=tell"

# One neuron pole
curl $API/v1/trace/registry/models/qwen2.5-0.5b-instruct@7ae55760/neurons/13/1053/pos

# Canary families: validation stats + member COUNT (members are never public)
curl $API/v1/trace/registry/models/qwen2.5-0.5b-instruct@7ae55760/canary-sets

In TypeScript:

const models = await prov.trace.registry.models();
const page = await prov.trace.registry.neurons(models[0].modelVersionId, { layer: 13 });
const sets = await prov.trace.registry.canarySets(models[0].modelVersionId);

Enterprise export

GET /v1/trace/registry/models/:id/export (Enterprise, account-authenticated) streams every neuron as NDJSON — the first line is the model record. Canary members stay masked in the export too.

Backend health

GET /v1/trace/health (account) reports the configured backend and whether the worker is ready, loading, down or not_configured.

The sandbox registry

The sandbox's model is a fixture: real activations, ablations and attributions measured on Qwen2.5-0.5B-Instruct over a 112-text corpus, with heuristic labels (heuristic-topk@1). Its two canary families, prompt_injection and credential_exfiltration, carry precision and recall measured on a held-out split and are marked grade: "fixture". They demonstrate the pipeline; curated production families ship with hosted Qwen3-8B.