The paper follows individual features through the network as the model adds two multi-digit numbers, showing separate paths for estimating the rough magnitude and computing the last digit.
The same tracing method is applied to cases where the model refuses a harmless request, locating the features that fire and the point at which the refusal decision is made.
The authors are clear that the maps cover a small fraction of the model's behaviour, but the tooling is released so others can apply it to their own questions.