Can You Fix What the Algorithm Thinks About You?

Recommendation algorithm control is the consumer's version of a question this whole series asks: can you change what an AI system has concluded, and can you prove the change took. The October 2026 results covered in the AI safety progress tracker made the question feel newly answerable, because if a lab can find and edit a single concept inside a model, editing the picture it holds of a person sounds like the next step. But two of the three ways to fix the picture already exist, have nothing to do with interpretability, and are underused.

"What the algorithm thinks about you" is a set of signals

A recommender does not hold an opinion of you. It holds a representation: numbers built from what you clicked, how long you stayed, what you skipped, what people who behaved like you went on to do, and whatever the operator fed in from elsewhere. The feed is a prediction from that representation. When the feed is wrong, the inputs are wrong, or the weighing is wrong, or the representation itself is. Each has its own fix, and only the last needs anyone to look inside the model.

Level one: stated-preference controls

These are the controls you can already see. A button that says you are not interested. An unfollow. A setting that switches a feed from ranked to chronological. A form that lets you correct the data a decision was based on. Each changes the inputs, and the picture shifts because the inputs did.

This is real control, and the most underused kind. It is bounded in two ways. It works only as well as the operator built it to work, and a not-interested button that removes one post and leaves the representation untouched is a control in name only. And you are editing blind: you can see whether the feed moved, not whether the picture did.

Some rules for the largest platforms have started to address this level. Which rules exist, whether any of them reaches a given service, and what would satisfy them are questions for counsel. This post describes the control, not a duty.

Level two: explanation of factors

The second level is the system telling you what it used. A line under an ad naming your location and an interest category. A notice with a denied application naming the main reasons. Whether any rule requires that disclosure for a given service is, again, a question for counsel, not for this post.

An explanation of factors tells you which inputs to change at level one. Its limit is one this series keeps running into. The explanation is written by the operator, about the system, usually from design documents, and sometimes generated by a model after the fact. It is not read out of the model. Why an AI's explanation is not proof of its reasoning covers what evidence of a faithful explanation looks like. For a recommender the test is the same: did changing the named factor change the result.

Level three: verified representation editing

The third level is the one the research is about. Instead of changing inputs and hoping, someone with access to the model finds the internal representation, changes it directly, and verifies that the change produced the intended behavior and nothing else.

Pieces of this have been shown in a lab. Anthropic's circuit-tracing work (opens in a new tab) intervened on a model's internal features to make it hallucinate, "quite consistently", that a made-up person plays chess. Goodfire's reward-hacking paper (opens in a new tab) amplified an internal signal while the model wrote a short story about an exam, and the model "wrote stories about cheating". Editing the representation of a person would be the same move, pointed at a different target. Three things stand between that demonstration and a control you could use.

Access. Every one of those interventions required the model's activations. A platform user has no such access, and a business renting a model through an API does not either. Open models, closed APIs, and the right to inspect AI explains who can look inside and who cannot.

Verification. "Verified" is the hard word. An edit that produces the right behavior today and drifts back after the next model update is not a fix. The pillar's status table tracks whether any representation-level intervention has been shown to survive retraining. As of this writing, none has been published that we found.

Direction. A lever that edits the picture toward what you want edits it toward what anyone with access wants. That is the subject of the security risk of editing an AI's behavior, and the reason level-three control, if it arrives, will arrive with permissions and change records attached.

What "your picture of me is wrong" means in practice

1. Change the signals on purpose. Use the stated-preference controls as a deliberate act instead of a reflex. If the operator offers a non-profiled mode, try it and note what changes. You are testing whether the control is real.
2. Ask for the factors. Where an explanation is offered, read it for the inputs it names, change one, and watch. If the result does not move, the explanation was not the mechanism.
3. Where the decision is consequential, ask for a person. A feed ranking is low stakes and often has no appeal path, and the honest answer there is that your leverage is leaving or switching modes. A credit line, a tenancy, an insurance tier, or a benefits determination is different. There the questions are whether you were told an automated system was involved and whether a person with authority to overturn it can review it.
4. Keep your own record. What you changed, when, what you were told, and what happened. If you later contest a decision, that record is the only part of the picture you control end to end.

One complication, left open on purpose. Steps one and two assume the operator built honest controls. If the not-interested button is cosmetic, you cannot tell from outside. That is a transparency failure a user cannot fix, which is why the business side of this question matters.

Pairs well with: the business on the other side

If you deploy a system that decides things about people, the consumer's three levels are your three obligations in reverse: offer real controls, explain the factors truthfully, and have a human who can overturn the result. Nothing RedHub sells reads your model. The RedHub standard says a result is based solely on the inputs you supply, with no independent verification of the underlying facts, and the instrument below grades the process around the decision.

The Automated-Decision Transparency and Disclosure Scorecard grades each automated decision system on six transparency and recourse practices drawn from several automated-decision regimes, from your own marks. Its results are DISCLOSED, GAPS, UNDISCLOSED and MATERIAL TRANSPARENCY GAPS. The disclosure control is a gate: if the person was never told an automated system made the decision, the result is forced to UNDISCLOSED regardless of the score, and the gate can only worsen a result, never promote one. Its scope is consequential decisions about a person, such as a credit denial, an insurance tier or a tenant score. It is a readiness aid, not legal advice, and it grades a decision system, never a person.

For what the AI already in use exposes an organization to, GenAI Security Assessment (opens in a new tab) is a free self-assessment you answer yourself. For the research behind level three, start at AI's black box may be opening. For the vendor conversation, the AI inspectability checklist has the ten questions. The running record of what has been shown is the AI safety progress pillar.