gussand

Daily Radar — 2026-07-05

Window: July 3–5 2026 (arXiv 2607.xxxxx primary); extended to uncovered June–May 2026 preprints not surfaced in prior daily sweeps · Sources swept: ICML 2026 Mech Interp Workshop, arXiv (cs.CL/cs.LG/cs.CR/cs.AI), LessWrong/Alignment Forum, Google DeepMind blog Counts: 1 peer-reviewed · 9 preprints · 0 forum/blog

Top 10 (priority order)

1. Distill to Detect: Exposing Stealth Biases in LLMs through Cartridge Distillation

  • Authors / venue: Shayan Talaei, Abhinav Chinta, Devvrit Khatri, Amin Karbasi, Azalia Mirhoseini, Amin Saberi — ICML 2026 Workshop on Mechanistic Interpretability (accepted), July 2026
  • Why it ranks here: Only peer-reviewed entry today; directly relevant to the security-via-interpretability agenda — uses distributional signals invisible to text inspection to surface stealthy model tampering, with direct applications to supply-chain integrity for deployed LLMs.
  • Technical summary: Targets stealth biases — preferential behaviors injected anywhere in a model’s supply chain that are undetectable by text-based inspection because the modified model behaves identically to its base on all out-of-distribution inputs and reveals the bias only on specific topics. D2D (Distill to Detect) distills the divergence between a suspected model and its base into a cartridge (a KV-cache prefix adapter), concentrating the dominant logit-distribution shift into a compact, searchable structure. Because the bias signal lives in soft logit distributions rather than output text, Fisher-weighted projection of the logit shift allows the cartridge to reliably detect across multiple bias types even when the bias is semantically unrelated to the distillation data. Accepted at four ICML 2026 workshops (Mechanistic Interpretability, TAIGR, AI4GOOD, CoLoRAI), with empirical results confirming high detection reliability across diverse hidden-bias scenarios.

2. How Transparent is DiffusionGemma?

  • Authors / venue: Google DeepMind team — arXiv preprint (cs.CL/cs.AI), June 2026; cross-posted to Alignment Forum
  • Why it ranks here: First mechanistic-interpretability audit of a production diffusion language model (DiffusionGemma, Google’s masked-diffusion LLM); directly addresses whether dLLMs are more opaque than autoregressive models and identifies novel diffusion-specific computational phenomena. High strategic importance for the text-diffusion track.
  • Technical summary: The paper decomposes transparency into variable transparency (interpretability of intermediate computational states) and algorithmic transparency (ability to trace how outputs are constructed). Naively, DiffusionGemma has ~28.6× higher opaque serial depth than autoregressive Gemma 4 due to iterative denoising; however, the authors show that information flowing between denoising steps can be mapped through an interpretable token bottleneck with no downstream performance loss, reducing effective opaque depth to just 1.1× Gemma 4’s. Monitorability evaluations find no significant gap between DiffusionGemma and Gemma. Beyond this main result, the paper surfaces novel diffusion-specific phenomena: non-chronological reasoning (later tokens influencing earlier-committed tokens), token and sequence smearing (distributed representations across positions), and intermediate-context reasoning (using partially unmasked context during denoising). These phenomena have no autoregressive counterparts and open new mechanistic research directions.

3. Subspace-Aware Sparse Autoencoders for Effective Mechanistic Interpretability

  • Authors / venue: (authors at submission) — arXiv preprint (cs.LG), June 2026
  • Why it ranks here: Proves mathematically why standard SAEs fragment multi-dimensional features (feature splitting) and proposes a principled fix — directly addresses one of the most persistent failure modes of the entire SAE mech-interp pipeline.
  • Technical summary: Standard TopK SAEs assign each latent a single decoder direction, implicitly assuming features are one-dimensional. The paper proves this causes feature splitting via two mechanisms: (1) geometric: reconstructing a feature of intrinsic dimension $d_i \geq 2$ with single-direction decoders to error $\varepsilon$ requires exponentially many atoms in $d_i$; (2) optimization: there exists a continuous path from the true $d_i$-dimensional basis to a strictly lower value of the $\ell_1$-regularized SAE objective, so gradient descent drives any trained dictionary into exactly that exponential regime. The proposed fix, SASA (Subspace-Aware Sparse Autoencoders), replaces single-vector decoders with learned decoder subspaces, enforces block sparsity via Top-$s$ group gating, and adapts each group’s effective rank with a nuclear-norm regularizer. When block size $r \geq d_i$, a single SASA group can represent the full feature slice and is the global optimum of the SASA objective — unique up to block index and orthogonal rotation — exactly inverting standard SAE instability.

4. MaskForge: Structure-Aware Adaptive Attacks for Jailbreaking Diffusion Large Language Models

  • Authors / venue: Yingzi Ma et al. — arXiv preprint (cs.CR/cs.CL), June 2026
  • Why it ranks here: Highest-performing attack on dLLMs to date (79.3% average attack success rate), exploiting the native infilling capability unique to masked diffusion architecture — directly relevant to both dLLM security and understanding how dLLM generative structure creates new attack surfaces.
  • Technical summary: Diffusion LLMs generate text by iteratively denoising partially masked sequences under bidirectional context; because mask tokens are native inputs and tokens are committed by confidence rather than position, harmful content can be induced through infilling outside any monitored prefix. MaskForge is a fully black-box adaptive attack that casts dLLM red-teaming as optimized search over a growing library of structural patterns: it abstracts successful attacks into reusable schemas, selects goal-compatible patterns with a UCB (Upper Confidence Bound) bandit, and invokes a scorer-guided fallback when the current library fails. Across five public dLLMs and three benchmarks, MaskForge achieves an average attack success rate of 79.3%, a 17.6% relative improvement over the strongest competing dLLM baseline. Released code at github.com/SaFo-Lab/MaskForge.

5. Steering Without Breaking: Mechanistically Informed Interventions for Discrete Diffusion Language Models

  • Authors / venue: (authors at submission) — arXiv preprint (cs.CL/cs.LG), May 2026
  • Why it ranks here: Bridges mechanistic interpretability (using SAEs trained on dLLMs) with controlled generation in dLLMs; provides the first principled account of when different attributes form during denoising, enabling precise control without generation degradation. Directly relevant to both dLLM mech interp and safety steering.
  • Technical summary: Controlled generation methods for dLLMs import uniform-schedule interventions from autoregressive models, which degrade quality and compound when multiple attributes are steered jointly. The authors train SAEs on four dLLMs (124M–8B parameters) and discover that different attributes commit on distinct schedules: topic commits within the first 2% of denoising steps, sentiment emerges gradually over the first 20%, and syntactic structure forms even later. This attribute-schedule heterogeneity explains why uniform interventions fail. The proposed adaptive scheduler concentrates each attribute’s intervention on the steps where it is actively forming and leaves the rest of generation untouched. Across four dLLMs and seven steering tasks, it achieves up to 93% steering strength while preserving generation quality, beating the strongest baseline by up to 15 percentage points on challenging simultaneous three-attribute control.

6. Machine Unlearning for Masked Diffusion Language Models

  • Authors / venue: (authors at submission) — arXiv preprint (cs.CL/cs.LG), May 2026
  • Why it ranks here: First unlearning framework specifically designed for MDLMs (LLaDA, Dream), bridging the machine-unlearning/concept-erasure research agenda to the fastest-growing LLM architecture class. Particularly high priority given the combination of dLLM + unlearning/security scope.
  • Technical summary: Unlike autoregressive LLMs, MDLMs generate text by iteratively denoising masked positions in parallel — a fundamentally different generative and fine-tuning mechanism that existing LLM unlearning methods don’t accommodate. MDU (Masked Diffusion Unlearning) revisits how specific knowledge is learned in terms of the diffusion process and minimizes a forward KL divergence from the prompt-conditional prediction to a prompt-masked unconditional anchor at every masked response position, with a temperature scaling parameter that controls the privacy-utility trade-off. This formulation is architecture-native: it operates on the forward masking process rather than on output logits, making it directly compatible with MDLM fine-tuning. Empirical results on standard benchmarks across multiple MDLM backbones show MDU achieves high unlearning performance while outperforming existing LLM unlearning methods adapted for MDLMs. Code at github.com/leegeoru/MDU.

7. AgentLens: Interpretable Safety Steering via Mechanistic Subspaces for Multi-Turn Coding Agent

  • Authors / venue: (authors at submission) — arXiv preprint (cs.CR/cs.LG), June 2026
  • Why it ranks here: Directly connects mechanistic interpretability (low-dimensional subspaces in residual stream) to runtime safety enforcement in multi-turn coding agents — one of the most practically pressing AI security problems — and releases a new benchmark (MAS) for the community.
  • Technical summary: Coding agents exhibit complex multi-turn interactions with external environments (file systems, shells, APIs) that existing prompt-level guardrails cannot monitor mid-execution. AgentLens is a white-box defense that (1) detects harmful execution states by classifying step-level hidden representations in real time and (2) mitigates unsafe behavior by intervening in a 10-dimensional mechanistic subspace within a single transformer layer, discovered via sparse attribution on the residual stream. The intervention is interpretable — the subspace dimensions correspond to identifiable behavioral features (e.g., file-destructive intent, privilege escalation reasoning) — and computationally lightweight (single-layer, 10-dim projection). Evaluated on the Mechanistic Agent Safety (MAS) benchmark, which provides 194 comprehensively annotated multi-turn execution trajectories across LLaMA-3.1-8B, Qwen-2.5-7B, and Gemma-2-9B, AgentLens achieves strong safety detection and preliminary evidence of lookahead risk anticipation — predicting unsafe steps before they execute.

8. Unstable Features, Reproducible Subspaces: Understanding Seed Dependence in Sparse Autoencoders

  • Authors / venue: (authors at submission) — arXiv preprint (cs.LG), June 2026
  • Why it ranks here: Resolves a known open problem in SAE research — why features are inconsistent across training runs — and shows that reproducibility exists at the subspace level even when individual features are not identifiable, with direct implications for how SAE feature libraries should be built and evaluated.
  • Technical summary: For each trained SAE feature, the authors estimate the probability that a similar feature reappears in an independently trained SAE; this yields a per-feature stability score that separates stable from unstable features at scale across seeds, models, layers, dictionary sizes, and SAE variants. Key finding: stable features carry the vast majority of reconstruction- and prediction-relevant signal, while unstable features have weak marginal impact and are dominated by low-frequency surface-form triggers. Geometrically, unstable features are individually non-reproducible but concentrate in reproducible lower-rank subspaces, indicating that seed dependence often reflects basis ambiguity within a shared region of activation space rather than genuine noise. A synthetic model with known ground-truth features makes this mechanism explicit, showing that low-rank features can be recovered at the subspace level while remaining non-identifiable as individual SAE latents. Cross-seed feature pooling produces more stable SAEs while preserving explained variance.

9. Can Language Model Agents be Helpful Circuit Explainers in Mechanistic Interpretability?

  • Authors / venue: Ayan Antik Khan, Harsh Kohli, Yuekun Yao, Huan Sun, Ziyu Yao (George Mason Univ. / The Ohio State Univ.) — arXiv preprint (cs.LG/cs.AI), June 2026
  • Why it ranks here: Targets the most labor-intensive and subjective step in the circuit-analysis pipeline — explaining what identified components do — with an agentic loop that causal-validates its own hypotheses; also releases a benchmark (AgenticInterpBench) for standardizing this previously ad hoc task.
  • Technical summary: Once a circuit is localized, explaining what each component computes requires iterative human probing and lacks standardized evaluation. HYVE (Hypothesize, Validate, Explain) is an LM-agent framework that analyzes each circuit component through an iterative loop: observation of activation patterns → hypothesis generation about the component’s role → causal validation (activating/suppressing the component and checking predicted behavioral consequences) → revised explanation. This closed-loop structure substantially reduces hallucinated explanations compared to one-shot description methods. The authors also introduce AgenticInterpBench, built from 84 semi-synthetic transformer circuits with 163 component-level annotations, enabling systematic evaluation of agent-produced explanations. Across four LM backbones (GPT-4o, Claude, Gemini, Llama), HYVE recovers useful component- and task-level explanations, but no backbone is uniformly best; reliable causal validation remains the key bottleneck.

10. Toward Identifiable Sparse Autoencoders

  • Authors / venue: Walter Nelson, Theofanis Karaletsos, Francesco Locatello — arXiv preprint (cs.LG), May 2026
  • Why it ranks here: Provides a theoretically grounded iSAE variant with proven near-identifiability conditions and lower reconstruction error than standard TopK SAEs — directly addresses whether SAE features represent stable, ground-truth model properties or training artifacts.
  • Technical summary: Standard SAEs are highly unstable: different training runs produce different concept dictionaries and sparse codes, making it unclear whether SAE features reflect genuine model structure or optimization accidents. The paper characterizes the model properties that hinder real-world SAE stability and addresses each through minimal architectural and training changes, yielding iSAE (identifiable SAE) — a TopK SAE variant with lower reconstruction error and improved cross-run feature stability. The authors explain this improvement theoretically by connecting SAEs to classical dictionary learning: they show that dictionaries learned in practice satisfy an approximate restricted isometry condition (RIC), and that satisfying RIC renders the corresponding sparse codes near-identifiable — i.e., approximately unique. Two iSAE variants are derived from different stability-inducing constraints, each with a distinct theoretical guarantee regime.

Notes

  • ICML 2026 Mech Interp Workshop (July 10, Seoul): D2D (#1) is confirmed accepted; the full accepted-poster list (including 23 spotlights) is now online at mechinterpworkshop.com. Expect further 2607.xxxxx workshop paper postings through July 9.
  • dLLM cluster: #2 (DiffusionGemma transparency), #4 (MaskForge attack), #5 (Steering Without Breaking), and #6 (MDU unlearning) form a dense cluster on the text-diffusion-model agenda — all four sit at the intersection of the primary focus areas. Flag for weekly roundup synthesis.
  • SAE methodology cluster: #3 (SASA / feature splitting fix), #8 (seed dependence / subspace reproducibility), and #10 (iSAE / identifiability) address different aspects of the SAE reliability problem. Together they represent a week of sustained theoretical progress on SAE foundations — recommend weekly synthesis covering all three alongside yesterday’s Geometric View (#5, July 4 report).
  • Mech interp for coding-agent safety (#7, AgentLens): Paired with Steerability via Constraints (#8, July 4 report), this forms an emerging cluster applying circuit/subspace methods to runtime agent safety. Track for weekly roundup.
  • Stealth-bias detection (#1): D2D is notable for detecting invisible supply-chain tampering via soft logit distributions rather than outputs — relevant to the AI control and model security agenda beyond the mech-interp framing of the workshop submission.

← all Research Radar issues · view source on GitHub