gussand

Daily Radar — 2026-07-14

Window: 2026-07-13 to 2026-07-14 (preprints last 48h); peer-reviewed items from ICLR 2026, ICML 2026, and EACL 2026 not previously covered; broader sweep of high-relevance preprints from Aug 2025–Jun 2026 not covered in prior reports · Sources swept: ICLR 2026 (OpenReview), ICML 2026 (main + AIWILD Workshop), EACL 2026 (ACL Anthology), arXiv (cs.CL/cs.LG/cs.CR/cs.AI), Semantic Scholar Counts: 5 peer-reviewed · 5 preprints · 0 forum/blog

Top 10 (priority order)

1. Jailbreaking the Matrix: Nullspace Steering for Controlled Model Subversion

  • Authors / venue: Vishal Pramanik, Maisha Maliha, Susmit Jha, Sumit Kumar Jha — ICLR 2026 (poster, OpenReview); arXiv: 2604.10326
  • Why it ranks here: First peer-reviewed circuit-level jailbreak that uses mechanistic interpretability to derive a geometry-aware adversarial attack; introduces the HMNS paradigm (identify causal heads → mask write paths → inject in nullspace), directly bridging interpretability research and adversarial attacks on LLMs.
  • Technical summary: Head-Masked Nullspace Steering (HMNS) operates in three stages: (1) uses causal interventions to identify the attention heads most responsible for a model’s refusal behavior; (2) suppresses their contribution by zeroing out targeted columns of the head’s output projection (column masking); and (3) injects an adversarial perturbation constrained to the orthogonal complement (nullspace) of the masked subspace, ensuring it is not cancelled by the suppressed write paths. Because the perturbation lives in the geometrically invisible region of the muted heads, it bypasses the circuits most responsible for safety. Evaluated across multiple jailbreak benchmarks and safety defenses, HMNS achieves state-of-the-art attack success rates with fewer queries than gradient-based baselines, and is the first method to fuse interpretability-derived structural knowledge with adversarial geometry for model subversion.

2. ASGuard: Activation-Scaling Guard to Mitigate Targeted Jailbreaking Attacks

  • Authors / venue: Yein Park, Jungwoo Park, Jaewoo Kang (Korea University; AIGEN Sciences) — ICLR 2026 (conference paper, OpenReview); arXiv: 2509.25843
  • Why it ranks here: Peer-reviewed ICLR 2026 paper that applies circuit-level mechanistic interpretability directly to jailbreak defense: identifies the specific attention heads responsible for targeted (e.g., tense-shift) jailbreak vulnerability and trains head scaling vectors to recalibrate them, achieving a Pareto-optimal safety-utility balance without broad fine-tuning.
  • Technical summary: Certain structured jailbreaks exploit shallow syntactic transformations (e.g., rephrasing a harmful instruction in the past tense) to circumvent safety alignment — ASGuard addresses this class specifically. The method first applies circuit analysis to locate the attention heads causally linked to the targeted jailbreak vulnerability (head ablation and causal tracing confirm heads whose scaling shifts refusal behavior). A channel-wise activation scaling vector is then trained for those heads, steering their activations toward the refusal-inducing regime. This scaling vector is applied as preventative fine-tuning so the model internalizes a more robust refusal mechanism for the vulnerability class. Evaluated across four open-source LLMs, ASGuard substantially reduces attack success rates for targeted jailbreaks while output quality and task accuracy on benign requests are preserved.

3. At the Edge of Understanding: Sparse Autoencoders Trace The Limits of Transformer Generalization

  • Authors / venue: Praneet Suresh, Jack Stanley, Sonia Joseph, Luca Scimeca, Danilo Bzdok — ICML 2026 (accepted); arXiv: 2606.26396
  • Why it ranks here: ICML 2026 paper that uses SAEs as a mechanistic microscope on the precise representation-level boundary where LLM generalization fails, demonstrating for the first time that OOD inputs — including jailbreaks — produce measurably distinct and more spurious SAE feature activations, and deriving a mechanistically-grounded fine-tuning strategy from this diagnosis.
  • Technical summary: The paper trains SAEs on transformer residual streams and tracks which features activate on in-distribution vs. out-of-distribution inputs, using the OOD-induced activation profile as a mechanistic proxy for generalization breakdown. Across OOD probes — including distributional shift, adversarial examples, and jailbreak prompts — the model activates significantly more fallacious/spurious SAE features (features with low ground-truth correlation) compared to ID inputs, providing a representation-level signature of generalization failure. The fraction of activated spurious features correlates with downstream prediction error, validating it as a diagnostic. The authors leverage this diagnostic to construct a mechanistically-grounded fine-tuning strategy: selectively suppressing spurious-feature activation through targeted regularization during fine-tuning improves OOD robustness without degrading in-distribution performance, providing a practical downstream application of the interpretability finding.

4. Attack Selection in Agentic AI Control Evaluations Meaningfully Decreases Safety

  • Authors / venue: Catherine Ge-Wang, Tyler Crosse, Benjamin Hadad IV, Joachim Schaeffer, Ram Potham, Tyler Tracy — ICML 2026 Workshop: Agents in the Wild — Safety, Security, and Beyond (AIWILD); arXiv: 2606.06529
  • Why it ranks here: Workshop paper at ICML 2026 that exposes a structural evaluation gap in AI control frameworks: existing evaluations underestimate adversarial capability because they collapse the attacker’s strategy into a single policy, ignoring that attack selection (start + stop decisions) is itself a distinct and exploitable degree of freedom that can reduce empirical safety estimates by 20–28 pp without any change in raw attack capability.
  • Technical summary: AI control evaluations typically define an attacker’s success by the probability that a single-shot attack defeats a deployed monitor, fixing an attack policy and measuring the monitor’s detection rate at a given audit budget. This paper decomposes the attacker’s strategy into two separable sub-policies: a start policy (deciding which tasks to attempt to subvert) and a stop policy (deciding when to abandon an ongoing attack). At a 1% audit budget on BashArena and LinuxArena benchmarks, optimizing the start and stop policies independently reduces empirical safety by 20–28 percentage points relative to the fixed-policy baseline — without changing the underlying attack’s capabilities on any individual task. The result implies that existing control evaluation safety numbers are overestimates: a strategically rational attacker exploits the evaluation’s implicit assumption that attack selection is fixed, collapsing safety margins that the evaluation treated as robust.

5. Evaluating Adversarial Robustness of Concept Representations in Sparse Autoencoders

  • Authors / venue: Aaron J. Li, Suraj Srinivas, Usha Bhalla, Himabindu Lakkaraju (Harvard / AI4LIFE Group) — EACL 2026 (long paper, ACL Anthology: 2026.eacl-long.279); arXiv: 2505.16004
  • Why it ranks here: Peer-reviewed EACL 2026 paper revealing that SAE-based interpretability is adversarially fragile: tiny input perturbations can manipulate SAE concept interpretations without affecting LLM outputs, producing “interpretability illusions” with direct implications for SAE-based model monitoring and oversight.
  • Technical summary: Sparse autoencoders are increasingly used to monitor LLM behavior by tracking which interpretable concept features activate on a given input; this paper asks whether these concept representations can be adversarially spoofed. The authors formulate robustness quantification as input-space optimization: craft a minimal perturbation to an input that changes which SAE features activate (semantic goal: shift activations toward those of a semantically unrelated input) or changes activation magnitudes (activation goal: at population or individual level) while leaving the base LLM’s output unchanged. Across extensive experiments, SAE concept representations are found to be non-robust in most evaluated settings: adversarial perturbations that are invisible to the LLM can substantially alter what an SAE-based monitor “sees,” rendering SAE-derived interpretations misleading. The authors argue that SAE concept representations require explicit robustness post-processing before deployment in safety-critical monitoring pipelines.

6. GSAE: Graph-Regularized Sparse Autoencoders for Robust LLM Safety Steering

  • Authors / venue: Jehyeok Yeon, Federico Cinus, Yifan Wu, Luca Luceri — arXiv preprint (cs.CR/cs.LG), December 2025; OpenReview
  • Why it ranks here: Introduces a principled extension of SAEs — Graph Laplacian regularization on the neuron co-activation graph — to recover distributed safety representations, and demonstrates that steering with these distributed representations achieves 82% selective refusal vs. 42% for standard SAE steering while maintaining ≥90% harmful-refusal rate across all tested attack types.
  • Technical summary: Standard SAEs encourage sparsity and monosemanticity per feature; this paper argues that safety concepts are inherently distributed across multiple co-activating neurons and are poorly captured by individual sparse features. GSAE adds a Laplacian smoothness penalty on the feature co-activation graph during SAE training, encouraging features whose neurons co-fire frequently to maintain coherent, smoothly-varying representations — recovering safety as a distributed multi-feature concept rather than a single latent. Steering is performed using a spectral vector bank derived from the GSAE’s graph structure, gated by a dual controller: an Input Gate (screening incoming requests) and a Continuation Gate (monitoring in-flight generation). On a suite of jailbreak attacks, GSAE-based steering achieves an average 82% selective refusal rate vs. 42% for standard SAE steering, with harmful-refusal rate ≥90% across all attack types and task accuracy preserved on benign workloads.

7. Are Sparse Autoencoder Benchmarks Reliable?

  • Authors / venue: David Chanin (Decode Research) — arXiv preprint (cs.LG), May 2026
  • Why it ranks here: Provides the most rigorous methodological audit of SAEBench to date, identifying that two widely-used metrics (TPP and SCR) systematically fail reliability checks and should not be used to guide SAE training or architecture decisions — a finding that directly affects the validity of a significant portion of recent SAE evaluation literature.
  • Technical summary: The paper audits SAEBench metrics across three complementary reliability lenses: (1) reseed noise — whether a metric produces consistent scores across different random seeds for the same SAE configuration; (2) ground-truth correlation on synthetic SAEs — whether the metric correctly ranks SAEs when ground-truth feature quality is known by construction; and (3) discriminability across training trajectories — whether the metric can distinguish better from worse checkpoints along a training run. TPP (Token Prediction Performance) and SCR (Sparse Concept Retrieval) fail at least two of these three checks, indicating they measure noise rather than genuine interpretability quality at the precision needed for experimental guidance. The sae-probes metric is the most reliable of those tested but still struggles on the synthetic-SAE ground-truth check. The paper concludes that the field needs a new generation of reliability-validated SAE benchmarks before using existing metrics to make training-time decisions.

8. ConceptGuard: Neuro-Symbolic Safety Guardrails via Sparse Interpretable Jailbreak Concepts

  • Authors / venue: Darpan Aswal, Céline Hudelot — arXiv preprint (cs.CR/cs.LG/cs.AI), August 2025
  • Why it ranks here: Proposes a principled neuro-symbolic approach to building explainable safety guardrails directly from SAE-identified jailbreak concepts inside LLM internals, requiring no base-model fine-tuning and generalizing from direct harm concepts to stealthy indirect jailbreak patterns.
  • Technical summary: ConceptGuard uses SAEs to extract a sparse dictionary of human-interpretable “jailbreak-theme concepts” from LLM residual-stream activations — concepts corresponding to harm categories, deceptive framings, and role-manipulation patterns. These concepts are composed into a symbolic decision layer: a request is flagged if its activation profile exceeds interpretable per-concept thresholds, producing an auditable, per-concept explanation of why a request was blocked. Because the guardrails are applied post-hoc via SAE probing rather than through model fine-tuning, ConceptGuard does not degrade the base model’s capability on benign tasks. Evaluated across standard jailbreak benchmarks, ConceptGuard generalizes from direct harm concepts (concepts explicitly associated with harmful content) to stealthy jailbreak patterns (hypothetical framings, roleplay injections, indirect requests) because the underlying SAE features capture semantic commonality across surface-form variation.

9. SafeSteer: Interpretable Safety Steering with Refusal-Evasion in LLMs

  • Authors / venue: Shaona Ghosh, Amrita Bhattacharjee, Yftah Ziser, Christopher Parisien — arXiv preprint (cs.LG), June 2025
  • Why it ranks here: Demonstrates that category-specific steering vectors can enforce safety at inference time without requiring contrastive pairwise training data or explicit refusal supervision, and specifically addresses refusal-evasion — the failure mode where steering causes over-refusal or evasion of steering itself.
  • Technical summary: SafeSteer identifies safety-relevant steering directions in the LLM’s residual stream using a gradient-free unsupervised method: it clusters activation differences across semantically categorized prompts (harmful vs. benign within the same harm category) to extract category-specific steering vectors without relying on contrastive pairwise safe/unsafe response pairs. At inference time, the relevant category vector is applied to modulate activations, steering the model away from harmful outputs while preserving topical relevance and generation quality within that category. A key design choice is using category-specific (rather than a single monolithic) safety direction, which mitigates over-refusal by making the steering intervention precise to the harm type being targeted. The paper evaluates refusal-evasion resistance — the degree to which the model remains steerable even when inputs are crafted to avoid triggering the steering — and shows improved robustness relative to single-direction steering baselines.

10. What Drives Representation Steering? A Mechanistic Case Study on Steering Refusal

  • Authors / venue: Stephen Cheng, Sarah Wiegreffe, Dinesh Manocha (University of Maryland) — arXiv preprint (cs.LG/cs.CL), April 2026
  • Why it ranks here: Provides the first mechanistic account of which circuits steering vectors actually leverage for refusal, finding that different steering methodologies exploit functionally interchangeable circuits in the same layer primarily through the attention OV circuit — a finding that constrains how steering should be designed and evaluated.
  • Technical summary: The paper introduces a multi-token activation patching framework to trace exactly which transformer components are modified when different steering vector methods (mean-difference, PCA-based, contrastive) are applied to induce refusal. Key findings: (1) different steering methodologies leverage functionally interchangeable circuits at the same layer despite producing similar behavioral outcomes, meaning the circuit exploited is not specific to the method; (2) steering vectors affect attention primarily through the OV (output-value) circuit, modifying what value vectors are aggregated, rather than through the QK circuit, which determines which positions attend to which; (3) freezing attention scores entirely during steering (preventing any QK modification) incurs only a ~8.75% performance drop compared to full steering, confirming OV-circuit dominance. These findings suggest that steering vector design could be simplified by targeting OV components directly, and that benchmarks measuring steering effectiveness should control for whether OV or QK effects are being measured.

Notes

  • Thematic focus today: Two distinct clusters dominate: (a) circuit-level jailbreak attack/defense (#1 HMNS, #2 ASGuard), representing the most interpretability-informed entries on the attack and defense sides respectively; and (b) SAE reliability and safety applications (#3, #5–#10), spanning adversarial robustness of SAE representations, graph-regularized SAE safety steering, benchmark reliability, neuro-symbolic guardrails, and mechanistic analysis of how steering works.
  • ICLR 2026 backfill (#1, #2): Both HMNS and ASGuard are ICLR 2026 papers that were not surfaced in the Jul 1–12 sweep. ICLR 2026 proceedings are still yielding previously uncovered papers; a targeted ICLR 2026 search (OpenReview, accepted posters/orals in cs.CR/cs.LG/cs.CL) is recommended for this week’s or next week’s sweep.
  • EACL 2026 backfill (#5): SAE Adversarial Robustness (2026.eacl-long.279) is the second EACL 2026 paper surfaced after the Jul 12 sweep (which found 2026.eacl-long.360 and 2026.eacl-long.83). A more systematic EACL 2026 sweep remains recommended for the weekly roundup.
  • ICML 2026 main conference concluded July 13 (Seoul). Camera-ready versions of main-conference papers have begun posting to arXiv; #3 (At the Edge of Understanding) is the second ICML 2026 main-track paper surfaced this week after the Jul 10 report. Expect additional ICML 2026 papers to surface in coming days.
  • SAE adversarial robustness finding (#5) pairs critically with the SAE benchmark reliability finding (#7) and GSAE’s distributed-representation argument (#6): taken together, these three papers characterize a cluster of SAE limitations — adversarial fragility of individual features, unreliable evaluation metrics, and inability to capture distributed safety concepts — that motivate architectural and evaluation reform of the SAE paradigm.
  • No new dLLM (text diffusion LM) papers were surfaced in today’s sweep; the dLLM security and interpretability corpus remains comprehensively covered through Jul 11.
  • Papers covered in Jul 1–12 reports are excluded from this ranking; see those reports’ Notes sections for the full exclusion index.

← all Research Radar issues · view source on GitHub