Mech-interp circuit work has long been hampered by the absence of shared infrastructure — researchers stitch together bespoke discovery scripts, hand-written evaluation loops, and ad hoc application code with no common representation tying them together. CircuitKIT ships all of that as one typed, serializable library: discover a circuit with EAP, evaluate its faithfulness, apply it to steer or prune the model, and compare results across methods without any format translation.
CircuitKIT's unified pipeline: a typed, serializable circuit representation connects discovery algorithms (EAP, ACDC, and others) to evaluation diagnostics and downstream applications — pruning, editing, steering, fine-tuning — without format translation between stages.
CircuitKIT introduces a typed, serializable circuit representation that connects every stage of the circuit-analysis workflow: a suite of discovery algorithms, declarative interfaces for mapping structured datasets into discovery tasks, faithfulness and completeness diagnostics, and downstream application modules. Because circuits are serialized, results from different discovery methods are directly comparable. Adding a new discovery algorithm requires implementing a single typed interface.
Every current defense against prompt injection watches for injected instructions. This paper shows that hiding the attack inside metadata fields and format tokens — content the agent treats as structurally authoritative, not adversarial — bypasses all of those defenses. The authors demonstrate arbitrary click attacks on Claude in Chrome and remote code execution on Claude Code and Gemini CLI without touching a single instruction-style payload.
ADI vs. normal flow: standard defenses inspect instruction-style content (top path — blocked). ADI payloads ride in metadata fields and format tokens that agents treat as structurally authoritative context — the defense never fires, and the agent executes malicious actions (bottom path).
ADI injects malicious data disguised as trusted agent-context material: security-critical metadata (resource identifiers, data-origin fields) or tool-call/response format tokens. Because agents treat this content as structurally authoritative rather than as untrusted instructions, existing defenses that sanitize instruction-style content do not fire. The authors demonstrate two attack classes: arbitrary click attacks on web agents (Claude in Chrome, Antigravity, Nanobrowser) and remote code execution / supply-chain attacks on coding agents (Claude Code, Codex, Gemini CLI). ⚠️ Setup-file content is now an active attack surface.
Jailbreaks don't eliminate the model's internal safety signal — they selectively suppress the specific early-layer attention heads that act as its gatekeeper, while mid-layer safety heads remain fully active throughout. That asymmetry turns out to be a detection opportunity: reading the mid-layer heads' activations, without any fine-tuning, yields competitive jailbreak detection that holds up under adversarial pressure.
Adversarially Compromised Heads (ACH, early layers) are selectively suppressed when jailbreak attacks succeed — driven specifically by attack-template tokens, not harmful content. Safety-Aligned Heads (SAH, mid layers) remain active regardless of attack success, making their activations a training-free jailbreak detector.
The paper identifies two functionally distinct attention head classes: ACHs (concentrated in early layers, suppressed by attacks) and SAHs (mid-layers, robust even during successful jailbreaks). Token-level attribution reveals ACH suppression is driven by attack-template tokens — formatting alone bypasses refusal. Ablation studies confirm causal necessity: suppressing a small number of ACHs induces jailbreak-like behavior on normally refused inputs. SAH activations yield competitive jailbreak detection with strong adversarial robustness, no training required.
10-dimensional subspace intervention per agent step catches harmful intent before tool execution; introduces the MAS benchmark (194 annotated multi-turn trajectories).
SAEs on dLLM denoising trajectories show topic locks in within 2% of steps; sentiment drifts over 20%. Adaptive steering at the right window beats uniform baselines on all four tested models.
"Phantom specialization": circuits discovered under different input distributions look structurally distinct but implement the same computation. Source-level evaluation is the culprit; edge-level evaluation reveals the many-to-one mapping.
Replaces each SAE decoder vector with a learned low-rank subspace + block sparsity. Feature absorption drops substantially on GPT-2 Small and Mistral-7B at roughly half the token budget of standard SAEs.
Systematic review of 39 papers across 17 categories; policy-enforcement failure rates of 69–98% are the headline. Documents 4 patched CVEs and 5 structural gaps in the fragmented research landscape.
Formal unified framework for SAE concept learning: three learning notions (detection, separation, approximation), capacity constraints on SAE size, and set-theoretic derivations for why feature splitting and absorption occur.
Second-gen out-of-band defenses (CaMeL, FIDES, Progent, RTBAS, FORGE) look strong on AgentDojo — but adaptive attackers expose the same gap as early SQL-sanitization benchmarks did for SQLi.