gussand

Daily Radar — 2026-07-09

Window: 2026-07-09, plus high-relevance preprints not previously reported and newly-surfaced peer-reviewed work · Sources swept: OpenReview (ICLR 2026), arXiv (cs.CL/cs.LG/cs.CR/cs.AI), lab blogs Counts: 1 peer-reviewed · 9 preprints · 0 forum/blog

Top 10 (priority order)

1. Mechanistic Interpretability of Code Correctness in LLMs via Sparse Autoencoders

  • Authors / venue: Kriz Tahimic, Charibeth Cheng — ICLR 2026 (accepted)
  • Why it ranks here: Peer-reviewed at ICLR 2026; first application of SAEs to localize and steer code-correctness representations in LLMs, extending mech interp to a high-stakes code-generation domain not yet covered in this repo.
  • Technical summary: Applies Top-K sparse autoencoders to the residual streams of Gemma-2 at the final prompt token to decompose representations into interpretable directions corresponding to code correctness. Predictor directions are selected via t-statistics over code-correct vs. code-incorrect samples; steering directions are chosen by separation scores between base-model population distributions. Steering along the identified directions reliably predicts and induces incorrect code, while correction-direction steering reveals a tradeoff between fixing errors and preserving already-correct code. A key finding: successful code generation correlates with strong attention to test cases rather than problem descriptions, providing circuit-level evidence for test-case-guided solving behavior in LLMs.

2. Robust Harmful Features Under Jailbreak Attacks: Mechanistic Evidence from Attention Head Specialization in Large Language Models

  • Authors / venue: Yanchen Yin, Dongqi Han, Linghui Li — arXiv preprint (Jun 29, 2026)
  • Why it ranks here: Most recent preprint in this cycle providing a mechanistic account of the jailbreak bypass mechanism at the attention-head level, closing a gap between empirical jailbreak literature and circuit-level interpretability.
  • Technical summary: Identifies two functionally distinct attention-head populations: Adversarially Compromised Heads (ACHs) concentrated in early layers that are selectively suppressed by attack-template tokens, and Safety-Aligned Heads (SAHs) in mid-layers that maintain robust activations even when attacks succeed. Ablation studies show that suppressing just the ACHs on normally-refused inputs is sufficient to induce jailbreak-like outputs, while removing SAHs weakens but does not eliminate mid-layer safety activations. Token-level attribution confirms that ACH suppression is mechanistically driven by the attack template tokens themselves rather than the harmful payload, providing a principled explanation for why syntactically varied attacks with similar templates cluster in their bypass behavior.

3. Beyond the Prompt: Jailbreaking Function-Calling LLMs via Simulated Moderation Traces

  • Authors / venue: Junlong Liu, Haobo Wang, Weiqi Luo, Xiaojun Jia — arXiv preprint (Jul 1, 2026)
  • Why it ranks here: Freshest paper this cycle (Jul 1); identifies a structural vulnerability in function-calling LLMs that is invisible to prompt-level defenses, exploiting the interleaving of developer schemas and untrusted tool outputs in shared context.
  • Technical summary: SMT (Simulated Moderation Traces) constructs multi-turn conversation trajectories that simulate a legitimate content-moderation auditing workflow, embedding harmful requests inside structured tool-call/response pairs so they appear as trusted scaffolding rather than user input. The attack exploits the fact that in stateful function-calling environments, developer-defined schemas, structured arguments, and untrusted tool outputs are interleaved into a single shared model context, blurring the boundary between trusted control logic and untrusted data. Empirical evaluation on prominent commercial LLMs from five providers across two standardized safety benchmarks shows SMT achieves the highest average attack success rate and HarmScore while requiring near-minimal queries, outperforming all prior jailbreak methods in this setting.

4. Steering Without Breaking: Mechanistically Informed Interventions for Discrete Diffusion Language Models

  • Authors / venue: Hanhan Zhou, Shamik Roy, Rashmi Gangadharaiah (AWS AI Labs) — arXiv preprint (May 8, 2026)
  • Why it ranks here: High-priority intersection of all three research tracks: SAE-based mechanistic interpretability applied to discrete diffusion LMs. First to characterize per-attribute denoising commitment schedules in dLLMs using SAEs and translate that characterization into a practical controlled generation method.
  • Technical summary: Trains sparse autoencoders on four discrete DLMs (124M–8B parameters) and discovers that different semantic attributes commit to their final values on distinct denoising schedules: topic commits within the first 2% of denoising steps, while sentiment emerges gradually over the first 20%. These commitment timings vary in sharpness and magnitude across models and layers. The finding motivates an adaptive steering framework that concentrates representational intervention precisely where each target attribute is actively forming (matching each attribute’s commitment window), instead of applying uniform intervention across all denoising steps. Multi-attribute adaptive steering achieves strong control while incurring substantially lower perplexity and cross-attribute interference than uniform or non-SAE baselines.

5. MaskForge: Structure-Aware Adaptive Attacks for Jailbreaking Diffusion Large Language Models

  • Authors / venue: Yingzi Ma, Zhengyue Zhao, Xiaogeng Liu, Minhui Xue, Yue Zhao, Chaowei Xiao — arXiv preprint (Jun 2026)
  • Why it ranks here: High-priority dLLM-security intersection; introduces the first black-box adaptive attack specifically engineered for the mask-infill surface unique to dLLMs, achieving state-of-the-art ASR across five models.
  • Technical summary: Casts dLLM red-teaming as optimized search over a growing library of structural attack patterns (mask placement schemas, infill anchor templates). A UCB bandit selects the schema most compatible with the current harmful goal; a scorer-guided fallback mechanism triggers when the library fails, generating new schemas that are then abstracted and added to the library. Unlike prior methods that apply low-diversity mask-bearing templates uniformly, MaskForge accumulates attack experience and adapts at the structural level, targeting the native infill capability of dLLMs and the confidence-driven token commitment that autoregressive models lack. Achieves 79.3% average ASR across five public dLLMs and three benchmarks, a 17.6% relative improvement over the strongest competing dLLM-specific baseline.

6. AgentLens: Interpretable Safety Steering via Mechanistic Subspaces for Multi-Turn Coding Agent

  • Authors / venue: (Multi-institution) — arXiv preprint (Jun 2026)
  • Why it ranks here: Novel extension of mechanistic interpretability-based safety to the multi-turn agentic setting, where evolving execution context makes single-turn methods inadequate; introduces the first multi-turn annotated safety benchmark for coding agents.
  • Technical summary: AgentLens detects harmful agent execution states from step-level hidden representations by identifying a low-dimensional subspace in a single transformer layer that reliably separates safe from unsafe multi-turn trajectories. When harmful state is detected, intervention is applied within the identified 10-dimensional subspace to steer the agent’s next step toward safe behavior without interrupting execution. The Mechanistic Agent Safety (MAS) benchmark is released alongside the paper: 194 comprehensively annotated multi-turn execution trajectories across LLaMA-3.1-8B, Qwen-2.5-7B, and Gemma-2-9B, covering diverse tool-use and code-execution safety scenarios that existing single-turn jailbreak benchmarks do not capture.

7. Subspace-Aware Sparse Autoencoders for Effective Mechanistic Interpretability

  • Authors / venue: David Chanin, James Wilken-Smith, Tomáš Dulka, Hardik Bhatnagar, Satvik Golechha, Joseph Bloom — arXiv preprint (Jun 2026)
  • Why it ranks here: Addresses a fundamental representational mismatch in standard SAE architecture (single-vector decoder vs. multi-dimensional model features) that directly causes feature splitting and absorption — the two most-cited failure modes of current mech interp work.
  • Technical summary: Proves that reconstructing a model feature of intrinsic dimension d_i ≥ 2 to error ε using single-vector SAE decoders forces the number of atoms to grow exponentially in d_i — this is not a training artifact but a geometric necessity. From the end-to-end optimization perspective, the same splitting is actively preferred by standard SAE objectives. Subspace-Aware Sparse Autoencoders (SASA) replace each single-vector decoder with a learned multi-dimensional decoder subspace, enforce block sparsity via Top-s group gating, and adapt each group’s effective rank with a nuclear-norm regularizer. On GPT-2 and Mistral-7B, SASA reduces feature splitting and absorption, improves monosemanticity and interpretability scores, and matches or exceeds standard SAEs at reconstruction quality while training on roughly half the token budget.

8. RepSelect: Robust LLM Unlearning via Representation Selectivity

  • Authors / venue: (Authors not publicly resolved) — arXiv preprint (Jun 2026)
  • Why it ranks here: Addresses the key robustness gap in machine unlearning for LLMs — existing methods forget shallowly and are reversed by fine-tuning or few-shot prompting; RepSelect achieves 4–50× deeper forgetting across four model families.
  • Technical summary: Before each unlearning update, RepSelect collapses the top principal components of the parameter gradient into the forget-set-specific representation subspace, leaving the complement (general capability directions) unaffected. This selective projection prevents the forgetting from bleeding into general-purpose representations while concentrating the gradient signal on dimensions that only the forget set populates. Evaluated across four model families spanning dense and Mixture-of-Experts architectures (Llama 3, Qwen 3.5, Gemma 4 E4B, DeepSeek V2 Lite) on biohazardous knowledge and abusive tendencies. RepSelect achieves a 4–50× reduction in post-relearning accuracy compared to the strongest baselines, and is near-perfectly robust to few-shot attacks that easily reverse gradient-descent-based unlearning methods.

9. Assessing Automated Prompt Injection Attacks in Agentic Environments

  • Authors / venue: David Hofer, Edoardo Debenedetti, Florian Tramèr (ETH Zurich) — arXiv preprint (Jun 9, 2026)
  • Why it ranks here: Rigorous ETH Zurich benchmark study comparing the two main automated prompt injection attack paradigms (gradient-based vs. black-box) in a realistic agentic setting; the gradient vs. black-box gap and the transferability findings have direct practical implications for red-teaming agent deployments.
  • Technical summary: Adapts GCG (gradient-based) and TAP (tree-of-attacks-with-pruning, black-box) to the agentic indirect prompt injection setting within AgentDojo (80 task pairs, 4 domains, multiple attacker/victim models). Black-box TAP substantially outperforms gradient-based GCG, with the gap attributed to GCG’s optimization instability under practical compute budgets in the agent context. TAP performance depends critically on attacker model: general capability and safety tuning both affect injection quality, since safety-tuned attackers sometimes refuse to generate adversarial content. Task-universal attacks (optimized on one task) transfer effectively to unseen tasks and out-of-distribution domains, but attacks optimized on small open-source models do not transfer to frontier models including GPT-5.

10. Discovering Millions of Interpretable Features with Sparse Autoencoders

  • Authors / venue: (Authors not publicly resolved) — arXiv preprint (Jun 25, 2026)
  • Why it ranks here: Releases the first comprehensive public SAE suite for the Qwen3 instruction-tuned family (1.7B, 4B, 8B), significantly expanding the set of open SAE models available for mechanistic interpretability research beyond the GPT-2/Gemma-2 scope of most prior work.
  • Technical summary: Trains layer-wise SAEs at residual stream, MLP output, and attention output activation sites for Qwen3-1.7B and Qwen3-4B, and residual stream SAEs on a subset of layers for Qwen3-8B. Systematic evaluation using activation-level reconstruction metrics and model-level recovery metrics (downstream task performance under SAE replacement) reveals distinct sparsity–fidelity tradeoffs across layers: early layers require higher sparsity coefficients to maintain reconstruction quality, while mid/late layers are more tolerant of aggressive sparsification. All trained SAE models are released publicly. The work expands the practitioner toolkit for SAE-based feature analysis to the Qwen3 architecture family, which was previously unrepresented in public mech interp tooling.

Notes

  • Papers covered in the Jul 7 report (DIJA, PAD, Non-Linear Representation Dilemma, Breaking Bad, Step-Wise Refusal Dynamics, Fragile Guardrail, Adaptive Steering & Remasking, Mechanistic Layer-wise Vulnerabilities, Jailbreak Leaves a Trace, Vera safety testing) and the Jul 8 report (IEEE S&P Plugin Injection, ICML Oral Data Attribution, Bootstrapped Monitoring, Many Circuits One Mechanism, FARMA, ADI, Causal Abstraction Metrics, Out-of-Band Defenses Eval, BARRIER Unlearning, Unsupervised Causal Abstractions) are excluded from today’s ranking.
  • No new arXiv papers with IDs 2607.06xxx or above were found in the sweep; the freshest preprint retrieved is 2607.00481 (Jul 1). The arXiv pipeline may yield higher-ID July 2026 papers in tomorrow’s sweep.
  • The dLLM mech interp cluster (#4 Steering Without Breaking + prior days’ DIJA/PAD/Step-Wise Refusal/Fragile Guardrail/Adaptive Steering) is now substantial; flagged for the weekly roundup.
  • #2 (Robust Harmful Features) provides a potential mechanistic target (ACH suppression) for the defenses studied in prior daily reports; flagged for weekly synthesis.
  • The ICLR 2026 SAE paper (#1) is the only peer-reviewed item today; search did not surface additional newly-accepted conference papers in this cycle.

← all Research Radar issues · view source on GitHub