Interpretability tools were built to understand models — but the same directional geometry that makes activation steering explanatory also makes it a potent red-teaming instrument. This NeurIPS 2025 paper turns Universal Steering and Representation Engineering into a systematic audit framework, revealing that Llama-3.3-70B-4bt is fully compromised (91% ASR) while GPT-oss-120B is essentially immune — a divergence explained by how each model distributes safety representations across layers.
Figure 1: Universal Steering achieves 91% jailbreak ASR on Llama-3.3-70B-4bt; GPT-oss-120B remains robust (<6%) under both interpretability-based attack vectors. Vulnerability correlates with safety representation geometry, not model scale.
Eight production-grade open-weight LLMs — Llama-3.1-8B, Llama-3.3-70B-4bt, GPT-oss-20B, GPT-oss-120B, Qwen3-0.6B, Qwen3-32B, Phi4-3.8B, Phi4-14B — are audited via Universal Steering and Representation Engineering, both of which add a directional vector to the residual stream at inference time. An adaptive two-stage grid search identifies optimal coefficient magnitudes per unsafe concept. The Llama-3.3-70B-4bt result (91% US / 83% RepE) is the most striking: a model aligned with RLHF at the 70B scale is fully compromised by a single-direction intervention. The authors attribute the robustness of GPT-oss-120B to diffuse safety-representation geometry — safety signal distributed across many layers rather than concentrated in a single direction, making a scalar perturbation insufficient. This is the strongest empirical evidence to date that mech-interp tools are dual-use safety audit instruments in deployment contexts.
Two independent SAE training runs on the same model activations produce different feature dictionaries — and every mechanistic claim built on either run is unverifiable against the other. This ACL 2026 long paper argues that cross-run convergence (feature consistency) should be the primary SAE optimization target, introduces the PW-MCC metric to measure it, and demonstrates that TopK SAEs already achieve PW-MCC = 0.80 with appropriate architectural choices.
Figure 2: PW-MCC (Pairwise Dictionary Mean Correlation Coefficient) across five SAE architectures on Gemma-2-9B activations. TopK SAEs achieve PW-MCC = 0.80 — the highest cross-run convergence — while standard ReLU SAEs reach only 0.54, meaning nearly half of features change substantially between independent training runs.
Authors: Xiangchen Song, Aashiq Muhamed, Yujia Zheng, Lingjing Kong, Zeyu Tang, Mona T. Diab, Virginia Smith, Kun Zhang. The core methodological claim: if two SAE training runs on the same model produce different feature dictionaries, the causal interpretability claims built on either run are specific to that run, not to the model. PW-MCC measures this by computing the average maximum correlation between each feature in dictionary A and any feature in dictionary B across multiple training seeds. TopK SAEs achieve PW-MCC = 0.80 on Gemma-2-9B; ReLU SAEs reach only 0.54 — a gap that cannot be explained by reconstruction loss differences alone. The position the paper stakes is consequential: it argues that interpretability researchers have been optimizing for the wrong objective, and that feature consistency should be a first-class training criterion rather than an afterthought. Code at github.com/xiangchensong/sae-feature-consistency.
Cross-paper SAE comparisons hinge on autointerpretability scores — but this ETH Zürich paper runs the audit those comparisons have needed: methodological variance from pipeline choices (corpus sampling, evaluator model, prompt template) collectively exceeds the variance explained by SAE architecture across all four tested metrics. Rankings change when the pipeline changes; the architecture signal is buried.
Figure 3: Proportion of total score variance attributable to pipeline configuration choices vs SAE architecture, across four autointerpretability metrics. Pipeline variance dominates all four metrics; fuzzing is dominated almost entirely by pipeline effects (89%), making cross-paper comparisons using this metric uninformative.
Experiments span four autointerpretability metrics (simulation, detection, fuzzing, purity), two models (Pythia-160M and Apertus-8B), and four axes of methodological variation: corpus sampling strategy, draw conditions, evaluator model choice, and prompt template. Three results. R1: methodological variance collectively exceeds architectural variance across all four metrics on both models. R2: each metric has a distinct instability profile — detection is the most stable and suitable for cross-paper comparison; fuzzing is unreliable across all conditions. R3: top-k feature rankings do not stay consistent across corpus and draw conditions, meaning aggregate scores paper over per-feature variance that matters for mechanistic claims. Practical implication: any SAE paper using autointerpretability scores as its primary evaluation needs an ablation over pipeline variables to isolate the architectural signal; papers that do not run this ablation cannot rule out that their observed improvements are pipeline artefacts.
Figure 4: ADI attack chain. Malicious payload is embedded in resource metadata (identifiers, origin tags, context keys) rather than free-text content, bypassing IPI defenses that filter text fields. Agents treat structural metadata as authoritative, executing attacker-controlled instructions without triggering content-based safety filters.
Introduces Agent Data Injection (ADI), a new attack category distinct from indirect prompt injection (IPI): where IPI embeds adversarial instructions in free-text content, ADI disguises malicious payloads as trusted structural metadata — resource identifiers, data origin fields, context keys — that agents process as authoritative. Standard IPI defenses filter text content and miss ADI payloads entirely. The paper demonstrates ADI is practical across multiple deployed agent frameworks with attacker control limited to metadata fields.
Figure 5: MAP-Elites behavioral grid for GPT-4o-mini showing fitness (attack success rate) across strategy × encoding dimensions. Hypothetical framing + ROT13 encoding achieves fitness 0.8 — the discovered winning combination. Claude shows uniformly low fitness (max 0.4) across all cells, indicating a qualitatively different safety geometry.
Applies MAP-Elites evolutionary search to LLM red-teaming, operating over interpretable semantic attack strategies (behavioral dimension: strategy type × encoding × prompt length) rather than token sequences. An archive grows with diverse attacks; fitness measures jailbreak success rate. ICLR 2026 Agents in the Wild Workshop. Discovers distinct vulnerability profiles per model — GPT-4o-mini vulnerable to hypothetical+ROT13 (fitness 0.8), Gemini to direct+ROT13+Leetspeak (0.8), Claude uniformly low (max 0.4) — surfacing each model's safety geometry structure alongside attack examples.
Figure 6: R2LM (Bifocal dLLM) resolves the KV-cache dilemma with asymmetric design: standard causal attention provides left context with full caching compatibility; a Mamba state-space layer provides position-aware right context without quadratic recomputation. Together they match bidirectional-attention quality while preserving AR-level serving throughput.
Full bidirectional attention in masked dLLMs gives high generation quality but prevents KV caching (each denoising step recomputes attention over the full sequence), degrading serving throughput. R2LM (Bifocal dLLM) uses causal attention for left context — fully KV-cache compatible — and a Mamba state-space model for continuous position-aware right context, without quadratic cost. Matches bidirectional-attention quality on generation benchmarks while achieving serving throughput competitive with AR models. (Meta AI / UNC Chapel Hill)
Figure 7: Taxonomy of masked dLLM inference acceleration across three levels. Algorithm-level methods reduce denoising steps; architecture-level methods exploit caching and speculative execution; system-level methods address batching and hardware utilization in serving pipelines.
First comprehensive survey of inference acceleration specifically tailored to masked dLLMs (Gwak, Lee, Park, Choo). Covers algorithm-level (confidence remasking, block diffusion, trajectory-aware commit gating), architecture-level (diffusion-aware KV-cache reuse, speculative diffusion), and system-level (heterogeneous request batching, CUDA kernel design) axes. Benchmarks LLaDA, Dream, MDLM, and iLLaDA against each technique; provides a practitioner guide to latency vs throughput vs quality tradeoffs for production dLLM deployment.
Figure 8: Standard inner-product SAEs (left) waste dictionary slots on norm detectors — features that activate on token input magnitude, which sublayer normalization has already discarded. Cosine-scored SAEs (right) learn a blend that optimizes toward pure cosine similarity, filling all dictionary slots with content-aligned features.
Standard SAE activation scores depend on both feature direction and input norm, but sublayer normalization discards magnitude before the residual stream — so norm-sensitive scores detect a quantity the model doesn't read. Naihin and Stambler replace the inner-product encoder with a learned blend of cosine similarity and input magnitude; training always recovers near-zero magnitude dependence. At matched reconstruction loss, cosine encoders learn features that align with human-recognizable semantic concepts measurably more often, filling dictionary slots that inner-product encoders waste on norm detectors. The authors argue cosine scoring should be the default for dictionary learning on layer-normalized representations.
Figure 9: Two coupled agent loops. The outer loop proposes, tests, and refines natural-language hypotheses about circuit behavior using contrastive activation experiments; failures (unexplained residuals) trigger the inner feature-discovery loop, which targets new SAE features the explanation loop could not account for. Together they automate the circuit-explanation workflow.
Anthropic paper asking whether LLM agents can automate the circuit-explanation workflow that has required expert human interpretability researchers. The framework runs two coupled agent loops: outer (explanation refinement via contrastive activations) and inner (feature discovery triggered by unexplained residuals). Evaluated on canonical circuits in Gemma-family models — the agent framework correctly explains the majority of manually-authored circuit elements and discovers several features not in the original human analysis. An early signal that mech-interp workflow automation is tractable.
Figure 10: Mean latency comparison across three workload types. Colocated serving reduces latency by 9–20% on mixed and decode-heavy workloads; hybrid execution is competitive only on extreme prefill-heavy workloads where the AR prefix segment dominates total time.
dLLMs historically served via alternating AR-backend (context ingestion) + dLLM-backend (denoising), incurring handoff overhead. Sangam unifies both within the AR serving stack by expressing dLLM denoising steps as batched AR passes over masked positions, sharing KV-cache infrastructure, GPU kernels, and batching logic. Colocated serving achieves 9–20% mean latency reduction over the hybrid baseline on mixed and decode-heavy workloads. Practical for teams with AR inference infrastructure who want to add dLLM capabilities without a separate stack.