Research Radar — August 4, 2026

Figure 1: CIF confidence sequence — the band narrows as intervention samples accumulate, remaining valid at any stopping point including under adaptive early stopping.

UAI 2026 mech-interp

Certified Interventional Fidelity: Anytime-Valid, Adaptive Evaluation of Causal Claims in Mechanistic Interpretability

Activation-patching and ablation results in mech-interp papers are routinely reported as point estimates — even when evaluations were monitored and adapted mid-run, which silently inflates false-positive rates with no principled bound. This UAI 2026 paper gives the field a rigorous statistical layer for the first time.

CIF writes the evaluated quantity as a causal estimand — an expectation of a bounded score over a stated input distribution and a stated intervention distribution. Confidence intervals and anytime-valid confidence sequences follow via bounded mixture importance weighting. Because the sequences remain valid at any sample size, practitioners can halt early when the effect is conclusive or extend when it is ambiguous, without inflating type-I error. The framework explicitly handles adaptive intervention sampling — the dominant evaluation pattern in practice — covering activation patching, state swapping, component ablation, and compressed-model comparison under a unified formulation.

Figure 1: The three-stage actionable mech-interp pipeline synthesized in this ACL 2026 survey, with representative methods at each stage and explicit coverage of which techniques have demonstrated downstream reliability.

ACL 2026 Findings mech-interp

Locate, Steer, and Improve: A Practical Survey of Actionable Mechanistic Interpretability in Large Language Models

The field has no shortage of mech-interp findings. What it lacks is a shared map of what to do with them. This ACL 2026 Findings survey provides that map — organizing the full space of actionable mech-interp from feature localization through behavioral steering to downstream improvement, with explicit attention to which methods have demonstrated practical reliability.

The survey organizes actionable mech-interp into three stages: (1) Locate — feature localization via probing, attribution, and circuit discovery; (2) Steer — behavioral modification via activation patching, representation engineering, and SAE-derived steering vectors; (3) Improve — how mechanistic findings feed back into model safety, alignment, factual editing, and capability control. Coverage extends from classical IOI circuits to SAE-based interpretability and large-scale control, with explicit attention to which evaluation methods have demonstrated downstream reliability.

Figure 1: The backdoor sits inside the VLM architecture definition. Clean inputs take the dormant path. Trigger inputs activate the steering module — an additive intermediate representation modification that runs before any safety logic.

AI security preprint

Architectural Backdoors in Vision-Language Model Supply Chains via Representation Steering

Every existing VLM backdoor defense inspects training data, model outputs, or prompt content. This paper demonstrates an attack that evades all three — it lives in the architecture code, dormant on clean inputs and structurally undetectable by any defense that does not audit the architecture definition itself.

A malicious provider embeds a trigger-gated additive modification of an intermediate representation directly inside the VLM architecture definition — not weights, not training data, not prompts. On clean inputs the modification is dormant; on trigger inputs, the representation is steered to an adversarial target before downstream safety logic runs. Evaluated across multiple VLM families and four task categories (visual question answering, text-to-image generation, retrieval, semantic response biasing), the backdoor consistently compromises integrity, safety enforcement, and ranking fairness while preserving clean-input performance and evading standard anomaly detection.

Figure 1: SAE features show high sensitivity across all paradigms but fail on specificity until a classification-aware training objective is applied.

mech-interp AI security preprint

Do SAE Features Actually Help Detect Jailbreaks? A Systematic Benchmark of Interpretability-Based Safety Methods

SAEGUARDBENCH benchmarks SAE-based jailbreak detection across 8 methods, 4 paradigms, 6 datasets, and 4 models, finding SAE features reliably identify that a prompt is harmful (high sensitivity) but fail to identify what kind of harm (low specificity). Fine-tuning the SAE encoder with a classification-aware objective closes the specificity gap — the bottleneck is training objective, not architecture. InterpGuard (proposed) combines raw-activation detection with SAE-feature explanation for a practical two-stage recipe.

Figure 1: Gemma-2-2b's vulnerability detection relies on safety-detector attention heads (L5, L7) that recognize safe coding patterns — their failure of activation triggers misclassification as "vulnerable."

mech-interp AI security preprint

Dissecting the Black Box: Circuit-Level Analysis of LLM Vulnerability Detection

Applies Circuit Tracer to Gemma-2-2b on 472 C/C++ vulnerability classification samples, finding the model relies on safety detectors — early-layer attention heads recognizing safe coding patterns — rather than directly detecting vulnerability signatures. When these heads fail to activate, the model misclassifies code as vulnerable. The circuit uses only 16% of model capacity (L5/L7 attention heads, L7 MLP), providing a concrete auditing target for AI-assisted security tooling.

Figure 1: Knowing-Using Gap — fine-tuning stores new facts in early/late storage states that don't route to mid-layer computation hubs. Self-patching (relocating representations) recovers 58–75% of oracle reasoning improvement.

mech-interp preprint

Towards Mechanistically Understanding Why Memorized Knowledge Fails to Generalize in LLM Finetuning

Formalizes the Knowing-Using Gap: fine-tuning rapidly memorizes new facts in early/late "storage states" that support direct recall but are not routed into mid-layer computation hubs required for multi-step reasoning. Self-patching — a new intervention relocating representations from storage to effective positions — recovers 58–75% of oracle headroom, confirming the gap is a routing problem rather than a weight-encoding failure.

Figure 1: Certificate tightness across Llama-3-8B layer blocks — early/mid layers yield vacuous certificates; later layers become non-vacuous at practical sample sizes.

mech-interp preprint

From Sparse Features to Trustworthy Proxies: Certifying SAE-Based Interpretability

Derives an upper bound on a language model's expected risk under SAE-based explanation using four measurable quantities (proxy risk, SAE reconstruction gap, concept-pool mismatch, sparse complexity); certificates become non-vacuous at practical sample sizes across GPT-2 Small, Gemma-2B, and Llama-3-8B. A layerwise study reveals that later layers certify substantially more reliably than early/middle ones, giving practitioners a principled criterion for which SAE patches to trust.

Figure 1: NRT-Bench simulates five role-specific LLM operators managing a nuclear plant under multi-turn adversarial injection. Harm is objective: the run terminates the moment any critical safety function is lost.

AI security preprint

NRT-Bench: Benchmarking Multi-Turn Red-Teaming of LLM Operator Agents in Safety-Critical Control Rooms

Simulates a five-role LLM operator team managing a nuclear power plant across six critical safety functions; adversaries inject multi-turn messages over four channels with an objective harm signal (run terminates when any safety function is lost). Across four frontier models, sustained multi-turn attacks broke a critical safety function in 8.7%–12.1% of sessions — the first benchmark measuring LLM safety failure by physical-system impact rather than judge-scored text.

Figure 1: Closure test — co-activation-clustered attention communities ablated vs. matched-random controls. Dense 1B models pass; OLMoE fails because MoE routing breaks the spatial co-activation assumption.

mech-interp preprint

Closure-Validated Circuit Discovery in Attention Heads: Co-activation Proposes, Ablation Disposes

Adapts SAE-style co-activation clustering to attention heads, then validates discovered communities with a causal closure test (ablating the community must damage performance more than ablating matched-random heads). Closure passes for dense 1B models (Pythia 1B, OLMo 1B) but fails for OLMoE-1B-7B — where ablation actually improves loss — because MoE routing breaks the spatial co-activation assumption.

Figure 1: ID and OOD inputs activate distinct SAE feature sets; cosine similarity to the mean ID-class activation profile drives a detection score that is both state-of-the-art and interpretable.

mech-interp preprint

Sparse Autoencoders for Interpretable Out-of-Distribution Detection

SAEs trained on intermediate activations learn features where in-distribution and OOD inputs activate distinct profiles. An OOD score derived from cosine similarity between a test sample's sparse activation and the mean ID-class profile achieves state-of-the-art performance on standard OOD benchmarks while providing feature-level explanations for each detection decision.