Research Radar
Daily · July 26, 2026
0 peer-reviewed · 3 preprints · 0 forum/blog
Mech Interp · AI Security · Text Diffusion LMs
01
mech-interp preprint

Are Single-Token Sparse Autoencoder Features Causally Necessary? Layer-Depth and SAE-Family Effects

SAE features that activate on a single vocabulary token are the closest thing mech-interp has to a ground-truth-verifiable benchmark. This paper runs causal ablation tests across 3.9 million features from six models and three SAE families, finding that which family you train on matters more than model scale — and that LlamaScope features are locally redundant where GemmaScope and BatchTopK features are causally anchored.

Causal Necessity of Single-Token SAE Features by Family BH-significant ablation (% of 208 conditions) 0% 25% 50% 75% GemmaScope BatchTopK LlamaScope 86% 52% 82% 48% 40% 36% Single-token features (ground-truth causally verifiable) All features
GemmaScope and BatchTopK single-token features achieve Benjamini-Hochberg-significant logit reductions in 86% and 82% of ablation conditions; LlamaScope single-token features succeed in only ~40%, indicating local redundancy. The cross-family gap exceeds within-family scaling effects.

The authors use single-token SAE features — those activating on exactly one vocabulary token — as ground-truth-verifiable causality diagnostics: if ablating the feature doesn't reduce log-probability for that token, the feature is not genuinely causal. Testing 3.9M features from six models across GemmaScope, BatchTopK, and LlamaScope SAE families, single-token features cluster 4.7× tighter in decoder space and concentrate in early layers; ablation yields BH-significant logit reductions in 178 of 208 conditions. The critical result is that the cross-family effect size exceeds the within-family scale effect — GemmaScope and BatchTopK features are causally anchored while LlamaScope features are locally redundant. The implication for interventional mech-interp: SAE family selection is a more important methodological choice than model scale.




Items 4 – 10 · Condensed
09
AI security

MJ: Multi-turn LLM Jailbreaking via Decomposed Credit Assignment

DC-GRPO assigns a separate group-relative learning signal per dialogue turn (combining immediate + future credit), solving the credit assignment problem in RL-based multi-turn jailbreak attackers. Both static- and dynamic-weighted instantiations achieve strong multi-turn ASR and cross-model transferability against black-box frontier models.

10
mech-interp

Steered LLM Activations are Non-Surjective

Formally proves that activation steering takes the residual stream off the manifold of states reachable from any discrete prompt — almost surely, no prompt reproduces the same internal behavior induced by steering. Establishes a formal separation between white-box and black-box interventions, with implications for how steering-vs-prompting comparisons should be designed.

← all Research Radar issues · gussand · source