Research Radar — August 7, 2026

mech-interp preprint

From Geometric Recovery to Causal Validation: A Reproducible Audit of Sparse Autoencoder Features, from Superposition Geometry to Causal Inertness

Mohamed Abdessalem Bal · arXiv preprint · July 2026

Figure 1 · Up to 77% of SAE features passing cosine ≥ 0.90 (right of dashed line) are causally inert — the decoder direction aligns with ground truth but the encoder never fires causally, exposing a fundamental gap between geometric and causal validity.

The field's most widely used metric for validating sparse autoencoder features — cosine similarity between a decoder atom and a ground-truth direction — does not mean the feature is causally active. A rigorous ablation and steering audit reveals that up to 77% of features passing a strict geometric recovery bar are completely causally inert.

SAE evaluation has relied on cosine similarity to ground-truth directions from synthetic toy models, treating high cosine as evidence of successful feature recovery. This work separates the geometric claim ("the decoder direction matches") from the causal claim ("the matched encoder feature fires and has measurable downstream effect"). Zero-ablating features at full layer depth across systematically varied SAE training quality reveals that up to 77% of features with cosine ≥ 0.90 in degraded SAEs — and 9% in well-trained SAEs — are causally inert: the decoder atom aligns perfectly while the encoder never fires when the feature is present. The study also reproduces the Elhage et al. (2022) superposition phase diagram and identifies a convergence artifact at high sparsity and a previously undescribed diffuse sharing regime at extreme overcompleteness that inflate cosine metrics without producing causally active features.

ICML 2026 Workshop mech-interp

LLMs Can Annotate Attribution Graphs

Ameen Patel, Max Zhang, Nathan Hu · ICML 2026 Mechanistic Interpretability Workshop (peer-reviewed)

Figure 1 · Automated annotation pipeline: auto-interp feature descriptions → LLM clusters into supernodes → automated interpretability metrics confirm quality matches human annotators; 97/100 intermediate-hop recovery on two-hop Capitals; scales to 1000-graph population analysis.

Turning attribution graphs into readable circuits has always hit the same wall: a human analyst must spend hours grouping thousands of feature nodes into meaningful "supernodes" per prompt. This ICML workshop paper shows an LLM can do it as well as a human — and can do it at population scale.

The pipeline feeds auto-interpretability feature descriptions directly to an LLM, which clusters them into semantically coherent supernodes. Automated interpretability metrics — requiring no human judges — confirm the output matches human-annotated supernodes in quality. On a two-hop Capitals factual-recall task (e.g., "What country is Rome in? — Italy — What continent is Italy on?"), the pipeline recovers the intermediate-hop supernode in 97 of 100 prompts, validating that the automation preserves the interpretable structure circuit tracing was designed to expose. A proof-of-concept scales to 1000 Wikipedia attribution graphs: all annotated automatically, with an LLM judge flagging unusual computational patterns for human review — opening population-level circuit interpretability that was previously impractical.

AI security preprint

Agent Data Injection Attacks are Realistic Threats to AI Agents

Woohyuk Choi et al. (Seoul National University) · arXiv preprint · July 2026

Figure 1 · ADI attack: attacker spoofs trusted-maintainer metadata (not explicit instructions) on a GitHub issue comment; coding agents treat the payload as authoritative and execute attacker commands; achieves 33.3%–100% ASR on web DOM data while evading all tested defenses (up to 50% ASR vs near-zero for instruction injection).

Every existing indirect prompt injection defense was designed to detect injected instructions. Agent Data Injection attacks don't inject instructions — they inject spoofed trusted metadata, an attack surface those defenses were never built to cover.

ADI attacks disguise malicious commands as security-critical context metadata rather than as instructions: spoofing the author field of a GitHub issue to impersonate a trusted maintainer causes Claude Code, Codex, and Gemini CLI to execute the attacker's shell command (RCE); spoofing a tool response makes the agent merge a malicious pull request without reviewing the code (supply-chain attack). Empirical evaluation across six frontier LLMs shows 31.3%–43.3% ASR on JSON-formatted agent context data and 33.3%–100.0% on web DOM data. Against the same state-of-the-art defenses that reduce instruction injection to near-zero success, ADI achieves up to 50.0% ASR — establishing ADI as a qualitatively different attack surface that demands dedicated defenses.

ACL 2026 Findings mech-interp AI security

Towards Understanding the Robustness of Sparse Autoencoders

ACL 2026 Findings (peer-reviewed) · ACL Anthology 2026

Figure 1 · SAE-augmented classifiers achieve up to 5× jailbreak reduction across GCG, AutoDAN, and PAIR attacks; feature robustness scales with dictionary size and degrades for rare/compositional harm concepts.

Training a linear classifier on SAE activations of the input prompt outperforms probing raw hidden states and achieves up to 5× jailbreak success rate reduction. Features for common harmfulness concepts transfer across models and attack formats; robustness degrades for rare and compositionally complex concepts, and scales with SAE dictionary size. First systematic study of when SAE-based safety probes are reliably transferable vs. brittle — distinguishing stable detectors from format-specific ones with direct implications for interpretability-based safety deployment.

mech-interp preprint

Are Single-Token Sparse Autoencoder Features Causally Necessary? Layer-Depth and SAE-Family Effects

arXiv preprint · July 22, 2026 · 3.9M features across 6 models × 3 SAE families

Figure 1 · Causal necessity rates by SAE family and layer depth; GemmaScope and BatchTopK features are causally anchored (75%–92%) while LlamaScope features are locally redundant (21%–38%) on the same base model — cross-family differences dominate scale effects.

Zero-ablating single-token SAE features yields BH-significant logit reductions in 178 of 208 full-layer conditions — confirming causal necessity is the norm in most settings. However, cross-family differences dominate: GemmaScope and BatchTopK features on the same base model are causally anchored (75%–92% necessity rate) while LlamaScope features are locally redundant (21%–38%). Single-token features cluster 4.7× tighter in decoder space and concentrate in early layers. Together with paper #1, this establishes that SAE feature causal validity is a property of the SAE family and training procedure, not just of the underlying model.

AI security preprint

S³: Improving Agent Safety through Multi-Stage Defense

Zibo Xiao, Haoyu Wang, Jun Sun · arXiv preprint · August 3, 2026 · github.com/FFchopon/S3-Framework

Figure 1 · S³ guard agent orchestrates stage-specific safety skills across memory, planning, tool-call, and execution stages; community-driven skill library enables reuse and composition across agentic frameworks.

Existing LLM agent safety methods protect isolated stages (prompt or output) and cannot catch risks that emerge mid-workflow or propagate across steps — the gap that ADI (#3) and multi-step jailbreaks exploit. S³ abstracts heterogeneous safety designs as Stage-Specific Safety Skills: composable components with explicit stage semantics, convertible from existing designs via an automated pipeline and stored in a community-driven library. A guard agent selects and applies skills throughout the workflow. Evaluated against representative baselines on multi-step agentic benchmarks, S³ consistently outperforms isolated-stage defenses in both safety effectiveness and utility preservation.

mech-interp preprint

Persistent Sparse Autoencoders: Learning Feature Timescales in Language Models

Haoyan Luo, Mateo Espinosa Zarlenga, Mateja Jamnik · University of Cambridge · arXiv, July 19, 2026

Figure 1 · Persistent SAE learns a spectrum of feature timescales — fast features (λ≈0) are local detectors equivalent to standard SAEs; slow features (λ≈1) accumulate topic-level information and persist across long contexts, enabling prompt-injection monitoring.

Standard SAEs are position-independent — each token is encoded in isolation, discarding sequential structure. Persistent SAEs add a per-feature persistence coefficient λ that controls how rapidly activation decays across positions. Training produces a learned spectrum: fast features (λ ≈ 0) behave identically to standard SAE features (local detectors); slow features (λ ≈ 1) accumulate and maintain topic-level information across long contexts. A prompt-injection monitoring case study shows slow features preserve the injected signal over many intervening benign tokens, enabling detection at generation time. Reconstruction quality is competitive with standard SAEs throughout.

mech-interp text diffusion preprint

Subliminal Clocks: Latent Time Modelling in Diffusion Language Models

Maximo Rulli et al. · arXiv, July 2, 2026 (revised July 20)

Figure 1 · Linear probe accuracy for the latent denoising timestep across DLM layers — rises from ~40% at L0 to ~97% by mid-network, confirming a reliable "subliminal clock" signal decodable from the residual stream without explicit timestep conditioning.

Masked DLMs denoise without explicit timestep conditioning, yet encode a latent representation of denoising progress in their residual streams. Linear probes across layers reach ~97% accuracy at decoding the implied timestep, confirming a reliable "subliminal clock" signal — a mechanistic finding without autoregressive analogue. Steering the model along the low-dimensional subspace of this inferred timestep modulates denoising behavior systematically, with structured geometry in activation space. First mechanistic interpretability result for the internal denoising clock of a DLM.

mech-interp preprint

Mechanistic Interpretability for Neural Networks: Circuits, Sparse Features and Symbolic Reasoning

Pranav Milind Sawant (UT Dallas), Jakub Krejčí (VSB-Technical University of Ostrava) · arXiv, July 8, 2026

Figure 1 · Mech interp taxonomy — four pillars: circuits (residual stream, attention, IOI), sparse features (SAEs, transcoders, auto-interp), symbolic reasoning (grokking, CoT faithfulness), and safety applications; each column maps to distinct evaluation methods.

Structured survey organized across four pillars: (1) Transformer circuit analysis — residual stream, attention mechanisms, induction heads, IOI circuits; (2) superposition and polysemanticity — SAEs and transcoders as decomposition tools, auto-interpretability; (3) symbolic reasoning — grokking, modular arithmetic, chain-of-thought faithfulness; (4) safety implications — steering vectors, jailbreak analysis, concept erasure, alignment audits. Serves as both a research primer and a comparative reference for methodology selection, distinguishing SAE from transcoder approaches and surveying evaluation standards across the literature.

mech-interp AI security preprint

AgentLens: Interpretable Safety Steering via Mechanistic Subspaces for Multi-Turn Coding Agent

arXiv preprint · June 2026 · multi-turn coding agent deployment

Figure 1 · AgentLens: SAE decomposition of a coding agent's residual stream → task-specific mechanistic subspace identification → targeted safety steering within that subspace; subspace-aware steering outperforms raw-activation steering while preserving coding performance.

AgentLens applies mechanistic interpretability to a deployed multi-turn coding agent rather than a controlled benchmark. SAE decomposition of the agent's residual stream identifies task-specific mechanistic subspaces for both coding capability and safety-critical behavior; safety-targeted activation steering within these subspaces reduces harmful code generation without degrading coding performance. The key result: steering within interpretable mechanistic subspaces outperforms steering in raw activation space, providing a direct demonstration that circuit-level decomposition translates interpretability findings into practical safety improvements in an agentic setting.