gussand

Daily Radar — 2026-07-02

Window: ~June 4 – July 2, 2026 (preprints not covered in prior dailies); ICLR 2026 newly surfaced accepted papers · Sources swept: OpenReview, arXiv (cs.CL/cs.LG/cs.CR/cs.AI), LessWrong/Alignment Forum, lab blogs Counts: 2 peer-reviewed · 8 preprints · 0 forum/blog

Top 10 (priority order)

1. MaskForge: Structure-Aware Adaptive Attacks for Jailbreaking Diffusion Large Language Models

  • Authors / venue: (multiple authors) — arXiv preprint (cs.CL/cs.CR), June 4 2026
  • Why it ranks here: First black-box attack that systematically exploits the native infilling mechanism of dLLMs; 79.3% average ASR across five models is the strongest published attack figure for dLLM jailbreaking. Critical reading alongside DIJA (ICLR 2026, covered in backfill).
  • Technical summary: MaskForge frames dLLM red-teaming as optimized search over a growing library of structural mask patterns. A UCB bandit selects goal-compatible templates that ask the victim to fill structured slots whose content constitutes the harmful response; committed tokens propagate via confidence-based (not position-based) demasking, allowing harmful content to accumulate outside monitored prefixes. Successful attempts are distilled back into the pattern library, so attack experience accumulates cross-goal. Across five public dLLMs and three benchmarks, average ASR is 79.3% (17.6% relative improvement over the strongest prior dLLM baseline). The matured pattern library transfers zero-shot to AdvBench: 88.2% ASR, 67% relative improvement.

2. From “Sure” to “Sorry”: Detecting Jailbreak in Large Vision Language Models via JailNeurons

  • Authors / venue: (multiple authors) — ICLR 2026 (accepted)
  • Why it ranks here: Peer-reviewed interpretability-for-security result: a causal mechanistic analysis identifies the sub-2% of neurons that distinguish jailbreak from benign inputs, enabling extremely lightweight detection. Directly actionable as a training-free safety monitor.
  • Technical summary: JailNeurons are identified by a causal ablation procedure — neurons whose masking flips the model output from a harmful response to a refusal are scored and ranked. Unlike SafeNeurons (which explain ordinary refusal), JailNeurons capture how jailbreak prompts circumvent the safety mechanism. The resulting detector uses <2% of neurons and achieves TPR ≥99% with very low false positive rates on unseen benign inputs. The method is training-free, inference-efficient, and generalizes across attack types not seen at detection-time, making it a drop-in safety monitor for deployed vision-language models.

3. Subspace-Aware Sparse Autoencoders (SASA) for Effective Mechanistic Interpretability

  • Authors / venue: (multiple authors) — arXiv preprint (cs.LG), June 6 2026
  • Why it ranks here: Addresses a provable, architecture-level flaw in all standard SAEs: the single decoder direction assumption. The theoretical framing and the exponential-splitting result reframe why SAE features split, and the empirical fix holds at practical scale on GPT-2 and Mistral-7B.
  • Technical summary: Standard SAEs assign each latent a single decoder direction, but model features can have intrinsic dimensionality d_i ≥ 2. SASA proves two results: (1) geometrically, reconstructing a d_i-dimensional feature to error ε with single-direction decoders requires exponentially-many atoms; (2) from an optimization perspective, there exists a descent path in the ℓ1-regularized SAE objective that drives any trained dictionary into that exponential-splitting regime. SASA replaces the single decoder with learned decoder subspaces, enforces block sparsity via Top-s group gating, and adapts each group’s effective rank with a nuclear-norm regularizer. On GPT-2 and Mistral-7B, SASA reduces feature splitting and absorption, improves monosemanticity and interpretability, and matches or exceeds standard SAEs while training on roughly half the token budget.

4. AgentLens: Interpretable Safety Steering via Mechanistic Subspaces for Multi-Turn Coding Agents

  • Authors / venue: Luo, Zhang, Quan, Jin, Cai, Xiao, Niu et al. — arXiv preprint (cs.LG/cs.CR), June 22 2026
  • Why it ranks here: Extends mechanistic interpretability to multi-turn agent execution — a harder and more realistic setting than single-turn jailbreak detection. Intervenes in a 10-dimensional subspace (one layer) for runtime mitigation, significantly narrower than prior representation-level methods.
  • Technical summary: AgentLens performs runtime safety detection and representation-level mitigation for LLM-based coding agents executing multi-step tool calls. At each agent step, harmful execution states are detected from step-level hidden representations; mitigation is applied by intervening in a learned 10-dimensional mechanistic subspace within a single transformer layer, avoiding the wholesale steering that disrupts general capability. The paper introduces the Mechanistic Agent Safety (MAS) benchmark: 194 tasks with comprehensively annotated multi-turn execution trajectories across LLaMA-3.1-8B, Qwen-2.5-7B, and Gemma-2-9B, providing the first standardized multi-turn agent safety evaluation grounded in mechanistic representations.

5. Mechanistic Interpretability of Code Correctness in LLMs via Sparse Autoencoders

  • Authors / venue: Tahimic, Cheng (De La Salle University) — ICLR 2026 (accepted)
  • Why it ranks here: Peer-reviewed; first application of SAEs to code-domain representations. Establishes that pre-training–learned code correctness mechanisms survive instruction tuning — a mechanistic finding with immediate implications for code LLM alignment and debugging.
  • Technical summary: Applies SAEs to decompose residual stream activations of a code LLM, then selects (a) predictor directions (via t-statistics) that detect incorrect code and (b) steering directions (via base-model separation scores) that attempt to fix it. Predictor directions achieve F1 = 0.821 for incorrect-code identification. Steering directions fix 4.04% of errors but corrupt 14.66% of previously correct code, quantifying an inherent correction/corruption tradeoff. Attention analysis shows successful code generation mechanistically depends on attending to test cases rather than problem descriptions. Crucially, incorrect-predicting and correct-steering directions identified in the base model retain their effectiveness in the instruction-tuned model, showing that code correctness circuitry from pre-training is reused rather than overwritten by fine-tuning.

6. Discovering Millions of Interpretable Features with Sparse Autoencoders (Qwen3-Instruct SAE)

  • Authors / venue: (multiple authors) — arXiv preprint (cs.LG/cs.CL), June 26 2026
  • Why it ranks here: Most comprehensive open SAE release for a current instruction-tuned model family (Qwen3); provides a practical research resource, and the refusal-steering case study demonstrates immediate safety-utility via SAE feature activation.
  • Technical summary: Releases the Qwen3-Instruct SAE suite: layer-wise SAEs trained on Qwen3-1.7B, Qwen3-4B, and Qwen3-8B at three activation sites — residual streams, MLP outputs, and attention outputs (subset for 8B). Evaluation uses both activation-level reconstruction metrics and model-level recovery metrics (how well the SAE-inserted model reproduces the original’s outputs), revealing distinct sparsity-fidelity trade-offs across layers and components. Demonstrates practical utility through a refusal-steering case study: selected SAE features causally steer instruction-tuned Qwen3 models toward refusal behavior, providing an interpretability-grounded approach to adjustable safety.

7. ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection

  • Authors / venue: Weng et al. — arXiv preprint (cs.CR/cs.AI), May 5 2026
  • Why it ranks here: Addresses the gap between current prompt-injection benchmarks (which assume context-insensitive attacks) and real deployments where adversaries adapt to dynamic agent context. Achieves the strongest published ASR/utility tradeoff for agent prompt injection defense.
  • Technical summary: Existing agent security benchmarks and defenses assume static attacks against fully-specified instructions, missing real-world cases where agent behavior depends on dynamic context and adversaries craft context-aware injections. ARGUS introduces AgentLure, a benchmark capturing context-dependent tasks and context-sensitive adversarial prompts. Against AgentLure, ARGUS reduces attack success rate to 3.8% while maintaining 87.5% task utility — significantly outperforming existing defenses and remaining robust against adaptive white-box adversaries who know the defense mechanism.

8. Can Language Model Agents be Helpful Circuit Explainers in Mechanistic Interpretability?

  • Authors / venue: (multiple authors, George Mason / Ohio State) — arXiv preprint (cs.CL/cs.AI), June 24 2026
  • Why it ranks here: Introduces a standardized benchmark for automated circuit explanation (the hardest step in the mech-interp pipeline) and evaluates LM agents as potential automation tools — a key bottleneck for scaling interpretability research.
  • Technical summary: Introduces AGENTICINTERPBENCH: 84 semi-synthetic transformer circuits with 163 component-level annotations, covering attention heads, MLP layers, and residual stream components. Proposes HYVE (Hypothesize, Validate, Explain), an agentic explainer that iterates over observation → hypothesis generation → causal validation, producing per-component and per-circuit task descriptions. Across four LM backbones, HYVE recovers useful explanations at both levels, but no backbone dominates. Failure analysis reveals the bottleneck is reliable validation (not hypothesis quality): strong backbones form observation-grounded hypotheses but fail through incomplete validation plans, code execution errors, or unresolved hypotheses — pinpointing where automated mechanistic interpretability must improve.

9. Unstable Features, Reproducible Subspaces: Understanding Seed Dependence in Sparse Autoencoders

  • Authors / venue: (multiple authors) — arXiv preprint (cs.LG), June 12 2026
  • Why it ranks here: Provides the clearest account to date of why SAE features vary across training seeds and what it implies — individual feature instability does not mean the underlying geometry is noisy, with important implications for how SAE research should be conducted and evaluated.
  • Technical summary: Studies feature stability by estimating per-feature reappearance probability across independently trained SAEs, yielding a scalable, seed-pair-averaged stability signal. Large-scale study across seeds, models (GPT-2 through Mistral-7B), layers, dictionary sizes, and SAE variants finds a sharp functional asymmetry: stable features carry the majority of reconstruction and downstream prediction signal, while unstable features have weak marginal functional impact and are dominated by low-frequency surface-form patterns. Geometrically, unstable features are individually irreproducible but concentrate in reproducible lower-rank subspaces — they represent basis ambiguity within a shared region of activation space, not pure noise. This implies that SAE evaluations using individual feature identity may be misleading, while subspace-level evaluations are more reliable.

10. GEMS: Geometric Constraints Enable Multi-Semantic Superposition in LLMs

  • Authors / venue: (multiple authors) — arXiv preprint (cs.LG/cs.CL), June 19 2026
  • Why it ranks here: Identifies and formally decomposes the two distinct failure modes of simultaneous multi-attribute activation steering, then provides a training-free geometric fix. Directly extends the practical reach of activation steering / representation engineering for safety applications.
  • Technical summary: When multiple semantic steering vectors are superposed, existing methods (e.g., ActAdd) fail due to two independent mechanisms: (1) distributional deviation — additive perturbations accumulate in norm across layers, driving activations out of the training distribution; (2) directional interference — non-orthogonal semantic vectors mutually dampen when superposed. GEMS addresses each with a paired geometric constraint: norm-preserving weighted superposition + targeted attention-pathway injection for (1); real-time Gram-Schmidt orthogonalization for (2). Evaluated on concurrent multi-attribute injection (GSM8K, with component ablation) and continuous language modeling (Wikitext-2 PPL), GEMS maintains general capability under multi-directional injection whereas ActAdd degrades significantly. Layer-level diagnostic probes confirm each constraint’s mechanism independently.

Notes

  • Window caveat: No July 2026 arXiv submissions (2607.xxxxx) appear indexed yet as of this run; the window therefore pulls from late-June preprints (2606.xxxxx) and May preprints (ARGUS, #7) not covered in the July 1 daily.
  • Text-diffusion security cluster: MaskForge (#1) is the strongest published black-box jailbreak for dLLMs; taken together with DIJA (ICLR 2026, in backfill) and “Jailbreaking Large Language Diffusion Models” (arXiv:2507.19227), the dLLM jailbreak landscape is now well-documented. Flag for weekly roundup synthesis.
  • SAE architecture convergence: SASA (#3) and Unstable Features (#9) both point at the same root issue — individual SAE latents are not the right unit of analysis, and subspace structure is more fundamental. SASA proposes a fix; #9 provides the empirical characterization. Worth tracking together.
  • Interpretability-for-security cluster: JailNeurons (#2), AgentLens (#4), and #5 (code correctness) all apply mechanistic representations directly to safety problems in different domains (VLMs, multi-turn agents, code LLMs). Combined with yesterday’s SafeSeek (ICML 2026), the interpretability-for-security agenda is clearly accelerating.
  • Qwen3 SAE (#6): Most immediate practical resource for researchers needing a production-model SAE; GemmaScope equivalent for the Qwen3 family. Refusal-steering case study is a template for safety-relevant SAE applications.

← all Research Radar issues · view source on GitHub