gussand

Daily Radar — 2026-07-01

Window: ~June 18 – July 1 2026 (preprints); ICLR 2026 & ICML 2026 newly presented peer-reviewed papers · Sources swept: OpenReview, arXiv (cs.CL/cs.LG/cs.CR/cs.AI), ICML 2026 virtual, ACL Anthology, ECCV 2026, Alignment Forum Counts: 6 peer-reviewed · 4 preprints · 0 forum/blog

Top 10 (priority order)

1. Formal Mechanistic Interpretability: Automated Circuit Discovery with Provable Guarantees

  • Authors / venue: (multiple authors) — ICLR 2026 (accepted)
  • Why it ranks here: First circuit-discovery framework with formal, verifiable guarantees — shifts mech interp from heuristic to certifiable. Peer-reviewed at a top venue.
  • Technical summary: Leverages neural network verification tools to automate circuit discovery and certify three properties: (1) input-domain robustness — circuit agrees with the model across a continuous input region; (2) robust patching — circuit alignment holds under continuous patching perturbations; (3) minimality — circuit is succinct by a formalized criterion. Experiments with state-of-the-art verifiers on vision models yield circuits with substantially stronger robustness certificates than prior heuristic approaches.

2. SafeSeek: Universal Attribution of Safety Circuits in Language Models

  • Authors / venue: (multiple authors) — ICML 2026 (accepted)
  • Why it ranks here: Peer-reviewed ICML paper at the intersection of mech interp and security; introduces optimization-based safety circuit attribution with direct safety-alignment applications.
  • Technical summary: Introduces differentiable binary masks that are optimized via gradient descent on safety datasets to extract multi-granular safety circuits. For backdoor attacks, SafeSeek identifies a backdoor circuit at just 0.42% sparsity; ablating it drops attack success rate from 100% to 0.4% while retaining >99% of general utility (MMLU ~69.2%, GSM8k ~68.4%). For alignment, it localizes an intrinsic alignment circuit (3.03% of heads, 0.79% of neurons) whose removal causes full safety collapse while preserving 92.1% of general capability.

3. Security–Fidelity Tradeoffs: No Universal Defense Against Prompt Injection

  • Authors / venue: Hermon, Gupta, Ruan, Sabir, Wang (Amazon / UIUC) — ICML 2026 (accepted)
  • Why it ranks here: Impossibility-style result that reframes how prompt-injection defense should be measured; directly impacts agent security architecture decisions.
  • Technical summary: Introduces SecFid, a 1,168-example benchmark that separates three outcomes (execute the injection / treat it as data / ignore it) instead of a single attack-success rate. Across 48 model×defense configurations, no configuration achieves both security and fidelity simultaneously: the best-fidelity config reaches 96.5% fidelity at only 47.8% security; the most-secure configs achieve 99.3% security at just 71–74% fidelity. Fidelity failure is worst on verbatim-preservation tasks (translation, document editing). A decision-theoretic proof shows that when benign and adversarial inputs overlap in distribution, no universal defense exists.

4. Robust Harmful Features Under Jailbreak Attacks: Mechanistic Evidence from Attention Head Specialization

  • Authors / venue: Yin, Han, Li — ICML 2026 (Oral)
  • Why it ranks here: Mechanistic evidence that jailbreaks exploit selective head suppression rather than erasing safety features globally — enables a training-free detector. ICML Oral ranking.
  • Technical summary: Identifies two functionally differentiated head types: Adversarially Compromised Heads (ACHs) in early layers, which are suppressed by attack-template tokens, and Safety-Aligned Heads (SAHs) in mid-layers, which remain active even during successful jailbreaks. Ablation shows that suppressing a small number of ACHs is sufficient to induce jailbreak-like compliance on normally-refused inputs; token-level attribution confirms that ACH suppression is triggered specifically by attack-template tokens. Persistent SAH activations form an adversarially-robust, training-free jailbreak detector.

5. Scalable Circuit Learning for Interpreting Large Language Models

  • Authors / venue: (multiple authors) — ICML 2026 (accepted)
  • Why it ranks here: Peer-reviewed mech-interp paper that makes circuit discovery practical at SAE-feature scale (up to 9B parameters) — directly enabling the SAE+circuit interp pipeline the field has been building toward.
  • Technical summary: Proposes CircuitLasso, a sparse-linear-regression surrogate for circuit discovery inspired by continuous causal-discovery formulations. Unlike intervention-intensive methods that become computationally prohibitive when applied to high-dimensional SAE features (due to polysemanticity of raw neurons), CircuitLasso operates directly on monosemantic SAE features at a fraction of the cost. Experiments across LLMs up to 9B parameters and multiple SAE architectures show accuracy at parity with state-of-the-art baselines on circuit-discovery benchmarks, while also yielding the first human-interpretable SAE circuits for the CoLA grammaticality dataset.

6. Evaluating the Interpretability of Sparse Autoencoders with Concept Annotations

  • Authors / venue: Klotz, Dantas, Jain, Marcos, Demir — ECCV 2026 (accepted)
  • Why it ranks here: Peer-reviewed methodological finding that most existing SAE interpretability metrics cannot distinguish trained from random SAEs — critical for grounding the SAE research agenda.
  • Technical summary: Builds two synthetic datasets with ground-truth single-attribute differences (synCUB, synCOCO) and proposes Fully-Binary Matching Pursuit for many-to-one latent-to-concept mapping. Introduces TAPAScore, which tests whether matched latents respond to targeted attribute edits (causal test rather than correlation). Only TAPAScore and one other proposed metric reliably separate trained from untrained SAEs; standard reconstruction and probing metrics fail this test. Higher overcompleteness is found to reduce interpretability; moderate dictionary sizes offer the best tradeoff.

7. Improved Large Language Diffusion Models (iLLaDA)

  • Authors / venue: Nie, Min, Xu, Li, Wen et al. (Renmin Univ. / ByteDance Seed) — arXiv preprint (cs.CL), June 2026
  • Why it ranks here: Strongest in-window dLLM capability paper — establishes the new baseline masked-diffusion model that downstream security/mech-interp dLLM research will evaluate against.
  • Technical summary: Trains iLLaDA-8B from scratch on 12T tokens with a fully bidirectional masked-diffusion objective throughout pretraining and SFT (25B-token instruction corpus, 12 epochs); adds grouped-query attention and variable-length generation. Over LLaDA: +21.6 BBH, +14.9 ARC-Challenge (base); +14.5 MATH, +16.5 HumanEval (instruct). Reports competitive performance with Qwen2.5-7B on multiple benchmarks despite non-autoregressive training; introduces confidence-based scoring for multiple-choice evaluation.

8. How Transparent is DiffusionGemma?

  • Authors / venue: Engels, McDougall, Chughtai, Kramar, Nanda et al. (Google DeepMind) — arXiv preprint (cs.CL), June 18 2026
  • Why it ranks here: First interpretability study of a deployed production dLLM; GDM team finds dLLM monitorability ≈ AR once denoising steps are properly unpacked — directly answers the “are dLLMs opaque?” safety concern.
  • Technical summary: Introduces opaque serial depth (serial compute between interpretable states) as a transparency metric. Naively, DiffusionGemma’s opaque serial depth is 28.6× that of autoregressive Gemma 4 because all positions update at every denoising step. However, mapping intermediate denoising states through an interpretable token bottleneck — at zero performance cost — collapses this to just 1.1×, matching AR. Case studies uncover three diffusion-specific phenomena not seen in AR models: non-chronological reasoning (earlier-in-sequence tokens resolved later in the denoising trajectory), token smearing (information dispersed across token representations), and intermediate-context reasoning (position-specific computation that depends on currently-unresolved neighboring tokens). The paper also uncovers that sequence smearing makes algorithmic transparency harder for dLLMs than for AR, even if variable transparency is recoverable.

9. DLM-Scope: Mechanistic Interpretability of Diffusion Language Models via Sparse Autoencoders

  • Authors / venue: (multiple authors) — arXiv preprint (cs.CL), February 2026
  • Why it ranks here: The first SAE-based interpretability framework for diffusion LMs — directly at the intersection of all three radar topics. Foundational for understanding and controlling dLLMs.
  • Technical summary: Trains Top-K SAEs on activations of diffusion language models and demonstrates that trained SAEs faithfully extract interpretable features from dLLM residual streams. Key findings unique to dLLMs (absent or weaker in autoregressive LLMs): inserting a SAE into early dLLM layers reduces cross-entropy loss rather than incurring the standard reconstruction penalty; SAE features enable more effective diffusion-time interventions than direct LLM-style activation steering; SAE features are stable across dLLM post-training phases; and SAE feature patterns can inform decoding order selection.

10. Steering Without Breaking: Mechanistically Informed Interventions for Discrete Diffusion Language Models

  • Authors / venue: (multiple authors) — arXiv preprint (cs.CL), May 2026
  • Why it ranks here: Bridges SAE-based mech interp and controlled generation for dLLMs; provides a closed-form characterization of when adaptive vs. uniform steering wins — principled controlled generation for dLLMs.
  • Technical summary: Trains SAEs on four dLLMs ranging 124M–8B parameters and measures when each attribute “commits” in the denoising trajectory. Key finding: different attributes commit on distinct, sharp schedules — topic commits within the first 2% of denoising steps, while sentiment emerges gradually over 20%. Uniform intervention schedules (imported from AR model methods) degrade quality because they intervene when attributes have already stabilized. The proposed adaptive scheduler concentrates interventions at the commitment window and leaves the rest of generation untouched; a closed-form result shows the advantage over uniform scheduling is governed by a single dispersion statistic of the commitment distribution. Validated across seven steering tasks and four dLLMs.

Notes

  • Peer-reviewed haul: 6 accepted papers across ICLR 2026, ICML 2026, and ECCV 2026 — an unusually strong daily window coinciding with ICML 2026 (Seoul, July 6–11) paper releases.
  • dLLM cluster (#7–#10): iLLaDA (#7) establishes the new capability baseline; DiffusionGemma (#8, GDM/Nanda) is the first interpretability study of a deployed production dLLM; DLM-Scope (#9) is the open-model SAE-interp counterpart; Steering Without Breaking (#10) is mechanistically-grounded controlled generation. Peer-reviewed dLLM security papers (DIJA, A2D, DiffuGuard — all ICLR 2026) are covered in the text-diffusion backfill (reports/backfill/text-diffusion-2024-2026.md) and will be resurface-eligible in future dailies if directly re-cited.
  • Mech-interp-for-security: Items #2 (SafeSeek) and #4 (Robust Harmful Features) represent the strongest recent convergence of the mech-interp and security agendas; both peer-reviewed.
  • Items #9 (DLM-Scope, Feb 2026) also appears in the text-diffusion backfill; flagged for the weekly roundup deduplication pass.

← all Research Radar issues · view source on GitHub