Research Radar — August 20, 2026

mech-interp AI security preprint

Data Attribution of Emergent Misalignment with Persona Features

Clemens Vetter, David Kaczér, Lucie Flek, Florian Mai · University of Bonn · arXiv preprint · August 11, 2026

Figure 1: SAE model-diffing pipeline across 4 open-weight models identifies persona features amplified (jailbreak identity, sarcasm, deception, manipulation) and suppressed (safety-identity) in fine-tuned vs. base models. Steering individual persona features achieves 62% misalignment rate — nearly double the 35% from fine-tuning alone.

Emergent misalignment — where a model trained on one task (coding) suddenly starts giving harmful advice — turns out to be mechanistically legible: specific SAE persona features amplified during fine-tuning cause it, and steering just those features achieves a higher misalignment rate than fine-tuning the whole model.

Applying SAE-based model diffing across 4 open-weight models, the authors identify features that are systematically up- or down-regulated by misalignment-inducing fine-tuning. Amplified features correspond to "jailbreak persona," sarcasm, deception, and manipulation; safety-relevant and assistant-identity features are suppressed. Steering individual identified features via activation addition achieves a 62% misalignment rate, compared to 35% from the fine-tuning procedure itself. The result implies that emergent misalignment is not a holistic distributional shift but a narrow mechanistic perturbation — suggesting that monitoring or correcting a small set of persona features could detect or reverse it.

mech-interp preprint

Mechanist: AI as a Scientific Instrument for Discovering the Mechanisms of Intelligence

Mengru Wang, Junfeng Fang, Shuofei Qiao et al. · arXiv preprint · August 12, 2026

Figure 1: Mechanist pipeline — an AI agent loops over a curated library of 32 mechanistic methods, iterating through hypothesis, intervention, and validation stages; outperforms Claude Code and prior AI-scientist systems on mechanism discovery benchmarks.

Mechanist is an autonomous agentic system for mechanistic interpretability that curates 32 foundational methods (mechanism analysis, causal intervention, validation) into a composable skill library and runs an AI agent that iterates through them to discover mechanisms. On mechanism discovery benchmarks it outperforms both Claude Code and existing AI-scientist frameworks — the first system to automate the full mech-interp scientific cycle at scale.

mech-interp preprint

Beyond a Bag of Features: Set-Level Instability in Sparse Autoencoders

Nikolai Bolik, Lennart Stöpler, Artur Andrzejak · Heidelberg University · arXiv preprint · August 11, 2026

Figure 1: SAE latent sets recover union-like compositional structure in toy synthetic models (expected) but in natural text they track model-internal similarity structure rather than human conceptual categories or typicality — a fundamental instability at the set level even when individual features appear interpretable.

SAE activation sets on natural text track model-internal similarity structure, not human conceptual categories or typicality, even when individual features appear interpretable — a set-level instability that persists across architectures and dictionary sizes. The mismatch is most pronounced for human-defined category boundaries and graded typicality judgments; toy-model guarantees (union-like recovery) do not transfer to natural-language settings.

AI security preprint

Toward Safe LLM Agents: A Survey of Specification, Verification, and Enforcement

arXiv preprint · August 14, 2026

Figure 1: Three-layer safety framework for LLM agents — Specification (bottleneck: NL→formal translation achieves only 24–35% semantic correctness), Verification, and Enforcement. Survey of deployed defenses maps each approach to a layer and identifies cross-layer failure modes.

This survey systematically maps the LLM agent safety literature to a three-layer framework (specification, verification, enforcement) and identifies the specification layer as the dominant bottleneck: NL→formal translation achieves only 24–35% semantic correctness across benchmarked systems. The analysis reveals that enforcement mechanisms are only as good as their upstream specifications — a gap that no amount of runtime enforcement can compensate for without better formalization methods.

4 entries removed on 2026-09-10 as repeats of earlier reports: 2608.07430 (first covered 2026-08-11), 2608.10172 (first covered 2026-08-13), 2607.27386 (first covered 2026-07-31), 2608.11171 (first covered 2026-08-13).