Research Radar — August 7, 2026

ICML 2026 Workshop mech-interp

LLMs Can Annotate Attribution Graphs

Ameen Patel, Max Zhang, Nathan Hu · ICML 2026 Mechanistic Interpretability Workshop (peer-reviewed)

Figure 1 · Automated annotation pipeline: auto-interp feature descriptions → LLM clusters into supernodes → automated interpretability metrics confirm quality matches human annotators; 97/100 intermediate-hop recovery on two-hop Capitals; scales to 1000-graph population analysis.

Turning attribution graphs into readable circuits has always hit the same wall: a human analyst must spend hours grouping thousands of feature nodes into meaningful "supernodes" per prompt. This ICML workshop paper shows an LLM can do it as well as a human — and can do it at population scale.

The pipeline feeds auto-interpretability feature descriptions directly to an LLM, which clusters them into semantically coherent supernodes. Automated interpretability metrics — requiring no human judges — confirm the output matches human-annotated supernodes in quality. On a two-hop Capitals factual-recall task (e.g., "What country is Rome in? — Italy — What continent is Italy on?"), the pipeline recovers the intermediate-hop supernode in 97 of 100 prompts, validating that the automation preserves the interpretable structure circuit tracing was designed to expose. A proof-of-concept scales to 1000 Wikipedia attribution graphs: all annotated automatically, with an LLM judge flagging unusual computational patterns for human review — opening population-level circuit interpretability that was previously impractical.

ACL 2026 Findings mech-interp AI security

Towards Understanding the Robustness of Sparse Autoencoders

ACL 2026 Findings (peer-reviewed) · ACL Anthology 2026

Figure 1 · SAE-augmented classifiers achieve up to 5× jailbreak reduction across GCG, AutoDAN, and PAIR attacks; feature robustness scales with dictionary size and degrades for rare/compositional harm concepts.

Training a linear classifier on SAE activations of the input prompt outperforms probing raw hidden states and achieves up to 5× jailbreak success rate reduction. Features for common harmfulness concepts transfer across models and attack formats; robustness degrades for rare and compositionally complex concepts, and scales with SAE dictionary size. First systematic study of when SAE-based safety probes are reliably transferable vs. brittle — distinguishing stable detectors from format-specific ones with direct implications for interpretability-based safety deployment.

AI security preprint

S³: Improving Agent Safety through Multi-Stage Defense

Zibo Xiao, Haoyu Wang, Jun Sun · arXiv preprint · August 3, 2026 · github.com/FFchopon/S3-Framework

Figure 1 · S³ guard agent orchestrates stage-specific safety skills across memory, planning, tool-call, and execution stages; community-driven skill library enables reuse and composition across agentic frameworks.

Existing LLM agent safety methods protect isolated stages (prompt or output) and cannot catch risks that emerge mid-workflow or propagate across steps — the gap that ADI (#3) and multi-step jailbreaks exploit. S³ abstracts heterogeneous safety designs as Stage-Specific Safety Skills: composable components with explicit stage semantics, convertible from existing designs via an automated pipeline and stored in a community-driven library. A guard agent selects and applies skills throughout the workflow. Evaluated against representative baselines on multi-step agentic benchmarks, S³ consistently outperforms isolated-stage defenses in both safety effectiveness and utility preservation.

7 entries removed on 2026-09-10 as repeats of earlier reports: 2607.12166 (first covered 2026-08-01), 2607.05120 (first covered 2026-07-08), 2607.20596 (first covered 2026-07-26), 2607.17117 (first covered 2026-07-23), 2607.01774 (first covered 2026-07-16), 2607.07316 (first covered 2026-07-15), 2606.22673 (first covered 2026-07-02).