Research Radar
Daily · July 29, 2026
2 peer-reviewed · 1 workshop · 7 preprints · 0 forum/blog
Mech Interp · AI Security · Text Diffusion LMs
01
NeurIPS 2025 mech-interp AI security

Breaking Bad: Interpretability-Based Safety Audits of State-of-the-Art LLMs

Interpretability tools were built to understand models — but the same directional geometry that makes activation steering explanatory also makes it a potent red-teaming instrument. This NeurIPS 2025 paper turns Universal Steering and Representation Engineering into a systematic audit framework, revealing that Llama-3.3-70B-4bt is fully compromised (91% ASR) while GPT-oss-120B is essentially immune — a divergence explained by how each model distributes safety representations across layers.

Jailbreak Attack Success Rate — 8 LLMs × 2 Interpretability Methods Universal Steering (US) RepE Jailbreak ASR (%) 100 75 50 25 0 Llama-3.1-8B Llama-3.3-70B 91% GPT-oss-20B GPT-oss-120B robust Qwen3-0.6B Qwen3-32B Phi4-3.8B Phi4-14B
Figure 1: Universal Steering achieves 91% jailbreak ASR on Llama-3.3-70B-4bt; GPT-oss-120B remains robust (<6%) under both interpretability-based attack vectors. Vulnerability correlates with safety representation geometry, not model scale.

Eight production-grade open-weight LLMs — Llama-3.1-8B, Llama-3.3-70B-4bt, GPT-oss-20B, GPT-oss-120B, Qwen3-0.6B, Qwen3-32B, Phi4-3.8B, Phi4-14B — are audited via Universal Steering and Representation Engineering, both of which add a directional vector to the residual stream at inference time. An adaptive two-stage grid search identifies optimal coefficient magnitudes per unsafe concept. The Llama-3.3-70B-4bt result (91% US / 83% RepE) is the most striking: a model aligned with RLHF at the 70B scale is fully compromised by a single-direction intervention. The authors attribute the robustness of GPT-oss-120B to diffuse safety-representation geometry — safety signal distributed across many layers rather than concentrated in a single direction, making a scalar perturbation insufficient. This is the strongest empirical evidence to date that mech-interp tools are dual-use safety audit instruments in deployment contexts.

02
ACL 2026 mech-interp

Position: Mechanistic Interpretability Should Prioritize Feature Consistency in SAEs

Two independent SAE training runs on the same model activations produce different feature dictionaries — and every mechanistic claim built on either run is unverifiable against the other. This ACL 2026 long paper argues that cross-run convergence (feature consistency) should be the primary SAE optimization target, introduces the PW-MCC metric to measure it, and demonstrates that TopK SAEs already achieve PW-MCC = 0.80 with appropriate architectural choices.

Cross-Run Feature Consistency (PW-MCC) by SAE Architecture 1.00 0.75 0.50 0.25 0.00 0.54 ReLU 0.61 Gated 0.66 JumpReLU 0.74 BatchTopK 0.80 TopK ★ PW-MCC (feature consistency)
Figure 2: PW-MCC (Pairwise Dictionary Mean Correlation Coefficient) across five SAE architectures on Gemma-2-9B activations. TopK SAEs achieve PW-MCC = 0.80 — the highest cross-run convergence — while standard ReLU SAEs reach only 0.54, meaning nearly half of features change substantially between independent training runs.

Authors: Xiangchen Song, Aashiq Muhamed, Yujia Zheng, Lingjing Kong, Zeyu Tang, Mona T. Diab, Virginia Smith, Kun Zhang. The core methodological claim: if two SAE training runs on the same model produce different feature dictionaries, the causal interpretability claims built on either run are specific to that run, not to the model. PW-MCC measures this by computing the average maximum correlation between each feature in dictionary A and any feature in dictionary B across multiple training seeds. TopK SAEs achieve PW-MCC = 0.80 on Gemma-2-9B; ReLU SAEs reach only 0.54 — a gap that cannot be explained by reconstruction loss differences alone. The position the paper stakes is consequential: it argues that interpretability researchers have been optimizing for the wrong objective, and that feature consistency should be a first-class training criterion rather than an afterthought. Code at github.com/xiangchensong/sae-feature-consistency.

03
mech-interp preprint

Building Fast, Evaluating Slow: Pipeline Choices Dominate Autointerpretability Score Variance

Cross-paper SAE comparisons hinge on autointerpretability scores — but this ETH Zürich paper runs the audit those comparisons have needed: methodological variance from pipeline choices (corpus sampling, evaluator model, prompt template) collectively exceeds the variance explained by SAE architecture across all four tested metrics. Rankings change when the pipeline changes; the architecture signal is buried.

Variance Source: Pipeline Choices vs SAE Architecture (Pythia-160M and Apertus-8B; four axes of methodological variation) Pipeline variance Architecture variance 100% 50% 0% Simulation 72% Detection 56% Fuzzing 89% 67% Purity
Figure 3: Proportion of total score variance attributable to pipeline configuration choices vs SAE architecture, across four autointerpretability metrics. Pipeline variance dominates all four metrics; fuzzing is dominated almost entirely by pipeline effects (89%), making cross-paper comparisons using this metric uninformative.

Experiments span four autointerpretability metrics (simulation, detection, fuzzing, purity), two models (Pythia-160M and Apertus-8B), and four axes of methodological variation: corpus sampling strategy, draw conditions, evaluator model choice, and prompt template. Three results. R1: methodological variance collectively exceeds architectural variance across all four metrics on both models. R2: each metric has a distinct instability profile — detection is the most stable and suitable for cross-paper comparison; fuzzing is unreliable across all conditions. R3: top-k feature rankings do not stay consistent across corpus and draw conditions, meaning aggregate scores paper over per-feature variance that matters for mechanistic claims. Practical implication: any SAE paper using autointerpretability scores as its primary evaluation needs an ablation over pipeline variables to isolate the architectural signal; papers that do not run this ablation cannot rule out that their observed improvements are pipeline artefacts.

Items 4 – 10 · Also notable
04
AI security preprint

Agent Data Injection Attacks are Realistic Threats to AI Agents

Agent Data Injection (ADI) Attack Chain Attacker controls metadata External Resource Content: normal Metadata: ADI ⚠ Agent Context IPI filter: passes metadata: trusted ✓ Attacker Goal executed silently vs IPI: attacks free-text content ADI attacks structural metadata
Figure 4: ADI attack chain. Malicious payload is embedded in resource metadata (identifiers, origin tags, context keys) rather than free-text content, bypassing IPI defenses that filter text fields. Agents treat structural metadata as authoritative, executing attacker-controlled instructions without triggering content-based safety filters.

Introduces Agent Data Injection (ADI), a new attack category distinct from indirect prompt injection (IPI): where IPI embeds adversarial instructions in free-text content, ADI disguises malicious payloads as trusted structural metadata — resource identifiers, data origin fields, context keys — that agents process as authoritative. Standard IPI defenses filter text content and miss ADI payloads entirely. The paper demonstrates ADI is practical across multiple deployed agent frameworks with attacker control limited to metadata fields.


05
AI security ICLR 2026 Workshop

Quality-Diversity Evolution for Discovering Diverse Vulnerabilities in LLM Safety

MAP-Elites Vulnerability Grid (attack strategy × encoding) Direct Hypothetical Multi-turn Plain ROT13 Leetspeak 0.3 0.5 0.4 0.6 0.8 ★ 0.5 0.2 0.3 0.4 GPT-4o-mini vulnerability profile 0.0 1.0
Figure 5: MAP-Elites behavioral grid for GPT-4o-mini showing fitness (attack success rate) across strategy × encoding dimensions. Hypothetical framing + ROT13 encoding achieves fitness 0.8 — the discovered winning combination. Claude shows uniformly low fitness (max 0.4) across all cells, indicating a qualitatively different safety geometry.

Applies MAP-Elites evolutionary search to LLM red-teaming, operating over interpretable semantic attack strategies (behavioral dimension: strategy type × encoding × prompt length) rather than token sequences. An archive grows with diverse attacks; fitness measures jailbreak success rate. ICLR 2026 Agents in the Wild Workshop. Discovers distinct vulnerability profiles per model — GPT-4o-mini vulnerable to hypothetical+ROT13 (fitness 0.8), Gemini to direct+ROT13+Leetspeak (0.8), Claude uniformly low (max 0.4) — surfacing each model's safety geometry structure alongside attack examples.


06
dLLM preprint

Bifocal Diffusion Language Models: Asymmetric Bidirectional Context for Parallel Generation

Bifocal dLLM (R2LM): Asymmetric Bidirectional Context Token sequence: t₁ t₂ [M] t₄ t₅ Causal Attn (left) KV-cache ✓ Mamba SSM (right) position-aware ✓ Architecture Comparison Design Quality Throughput Causal only Low High ✓ Full bidir attn High ✓ Low R2LM (Bifocal) High ✓ High ✓
Figure 6: R2LM (Bifocal dLLM) resolves the KV-cache dilemma with asymmetric design: standard causal attention provides left context with full caching compatibility; a Mamba state-space layer provides position-aware right context without quadratic recomputation. Together they match bidirectional-attention quality while preserving AR-level serving throughput.

Full bidirectional attention in masked dLLMs gives high generation quality but prevents KV caching (each denoising step recomputes attention over the full sequence), degrading serving throughput. R2LM (Bifocal dLLM) uses causal attention for left context — fully KV-cache compatible — and a Mamba state-space model for continuous position-aware right context, without quadratic cost. Matches bidirectional-attention quality on generation benchmarks while achieving serving throughput competitive with AR models. (Meta AI / UNC Chapel Hill)


07
dLLM preprint

Accelerating Masked Diffusion Large Language Models: A Survey of Efficient Inference Techniques

Masked dLLM Inference Acceleration — Taxonomy Acceleration Algorithm Architecture System Confidence Remasking Block Diffusion Trajectory Gating Diffusion-Aware KV Caching Speculative Diffusion Heterogeneous Batching Hardware Mapping
Figure 7: Taxonomy of masked dLLM inference acceleration across three levels. Algorithm-level methods reduce denoising steps; architecture-level methods exploit caching and speculative execution; system-level methods address batching and hardware utilization in serving pipelines.

First comprehensive survey of inference acceleration specifically tailored to masked dLLMs (Gwak, Lee, Park, Choo). Covers algorithm-level (confidence remasking, block diffusion, trajectory-aware commit gating), architecture-level (diffusion-aware KV-cache reuse, speculative diffusion), and system-level (heterogeneous request batching, CUDA kernel design) axes. Benchmarks LLaDA, Dream, MDLM, and iLLaDA against each technique; provides a practitioner guide to latency vs throughput vs quality tradeoffs for production dLLM deployment.


08
mech-interp preprint

Size Doesn't Matter: Cosine-Scored Sparse Autoencoders

Inner Product vs Cosine SAE: Feature Dictionary Allocation Inner Product SAE norm detectors content features Cosine SAE ★ all slots → content-aligned features
Figure 8: Standard inner-product SAEs (left) waste dictionary slots on norm detectors — features that activate on token input magnitude, which sublayer normalization has already discarded. Cosine-scored SAEs (right) learn a blend that optimizes toward pure cosine similarity, filling all dictionary slots with content-aligned features.

Standard SAE activation scores depend on both feature direction and input norm, but sublayer normalization discards magnitude before the residual stream — so norm-sensitive scores detect a quantity the model doesn't read. Naihin and Stambler replace the inner-product encoder with a learned blend of cosine similarity and input magnitude; training always recovers near-zero magnitude dependence. At matched reconstruction loss, cosine encoders learn features that align with human-recognizable semantic concepts measurably more often, filling dictionary slots that inner-product encoders waste on norm detectors. The authors argue cosine scoring should be the default for dictionary learning on layer-normalized representations.


09
mech-interp preprint Anthropic

Can Language Model Agents be Helpful Circuit Explainers in Mechanistic Interpretability?

Two-Loop Multiagent Mech-Interp Framework (Anthropic) Outer: Explanation Refinement Inner: Feature Discovery SAE Features Hypothesis Proposal Contrastive Activation Test Unexplained residuals → trigger inner loop (feature discovery)
Figure 9: Two coupled agent loops. The outer loop proposes, tests, and refines natural-language hypotheses about circuit behavior using contrastive activation experiments; failures (unexplained residuals) trigger the inner feature-discovery loop, which targets new SAE features the explanation loop could not account for. Together they automate the circuit-explanation workflow.

Anthropic paper asking whether LLM agents can automate the circuit-explanation workflow that has required expert human interpretability researchers. The framework runs two coupled agent loops: outer (explanation refinement via contrastive activations) and inner (feature discovery triggered by unexplained residuals). Evaluated on canonical circuits in Gemma-family models — the agent framework correctly explains the majority of manually-authored circuit elements and discovers several features not in the original human analysis. An early signal that mech-interp workflow automation is tractable.


10
dLLM preprint

Sangam: Efficiently Serving Diffusion LLMs with the AR Stack

Sangam: Mean Latency — Colocated vs Hybrid dLLM Serving 100ms 50ms 0ms Hybrid (baseline) Sangam colocated Mixed −18% Decode-heavy −13% Prefill-heavy ≈ parity
Figure 10: Mean latency comparison across three workload types. Colocated serving reduces latency by 9–20% on mixed and decode-heavy workloads; hybrid execution is competitive only on extreme prefill-heavy workloads where the AR prefix segment dominates total time.

dLLMs historically served via alternating AR-backend (context ingestion) + dLLM-backend (denoising), incurring handoff overhead. Sangam unifies both within the AR serving stack by expressing dLLM denoising steps as batched AR passes over masked positions, sharing KV-cache infrastructure, GPU kernels, and batching logic. Colocated serving achieves 9–20% mean latency reduction over the hybrid baseline on mixed and decode-heavy workloads. Practical for teams with AR inference infrastructure who want to add dLLM capabilities without a separate stack.

← all Research Radar issues · gussand · source