The scalable-oversight literature has promised that debate could allow a
computationally weak judge to verify claims made by superhuman AI —
but until now nobody could prove that a specific protocol is as good
as debate can possibly get. This paper provides that protocol, with an
instance-optimal lower bound to match.
Figure 1: One round of FBS Debate. Alice decomposes a claim into sub-claims; Bob either flags a sensitivity-violating decomposition (causing Alice to lose this branch) or picks a sub-claim to challenge recursively. Honest strategies are dominant-strategy equilibria, not merely Stackelberg — a key improvement over prior debate protocols.
FBS Debate ties each decomposition step to the fractional block sensitivity
of the Boolean function being decided.
An honest Alice who holds the correct answer always wins;
an honest Bob who holds a counterexample wins with high probability —
and critically, this holds as a dominant-strategy equilibrium.
The instance-optimality theorem proves no black-box protocol can identify a
flawed sub-claim using asymptotically fewer human queries on any particular instance,
making FBS Debate a ceiling result for recursive debate protocols.
Jiawei Li, Zhiyang Xun, Lijie Chen, and Jonah Brown-Cohen.
Interpretability research usually starts from model internals and asks
what they mean. This paper inverts the question: if a human supervisor
corrects a misbehaving agent, what does that correction reveal about
where in the network the failure lives?
Figure 2: Pipeline from agent failure (over-asking) to probe-gated steering. Human correction labels identify a causal residual-stream direction; learned steering at that site flips 72–100% of held-out failures. 4 of 5 model families internally represent that the request is unambiguous — yet still ask, showing the failure is a computational artifact, not missing knowledge.
Applied to an "over-asking" failure mode across 13 models (5 eligible),
a learned direction in the residual stream flips 72–100% of held-out over-asks
while random controls flip at most one.
Four of five model families internally represent that the request is unambiguous —
a direction decodable from the residual stream that is causally inert on output —
yet still ask.
Probe-gated steering reduces the simulated oversight burden dramatically while
preserving legitimate questions; on one model, LoRA confined to the causal band
outperforms behavior cloning on retention while fixing the failure.
Cesare Zavattari, Alessandro Tommasi, Giuseppe Prencipe.
Fine-tuning an LLM on unrelated benign data can produce "emergent misalignment" —
the model gives harmful advice unprompted. This paper asks whether models
fine-tuned for different harmful domains share a mechanistic basis, and finds they do.
Figure 3: EM rates on Qwen2.5-3B before (dark red) and after (light red) ablating the 3 shared top-5 attention heads across medical, financial, and sports-harm domains. Reductions of 16–38pp without coherence loss, outperforming layer-matched random ablations.
Three LoRA adapters fine-tuned on Qwen2.5-3B-Instruct for distinct harmful advisory
domains are analyzed via direction-based attention-head ranking.
All three models share 3 attention-head locations among their respective top 5
by contribution to the emergent misalignment direction.
Replacing those heads' outputs with base-model values reduces free-generation EM
from 38.9%→22.9%, 50.7%→12.5%, and 41.7%→11.1%,
outperforming layer-matched random controls without loss of overall coherence.
Cross-model transfer experiments show the shared heads have partially interchangeable
effects, suggesting a genuine shared sub-circuit rather than independent convergence.
Muhammad Haseeb, Muhammad Tahir.
Figure 4: TAG vs additive aggregation pass@4 across model sizes and auxiliary configurations; TAG reaches 0.581 vs 0.220 for additive on Qwen3-4B.
For LLM post-training with multiple rewards, symmetric GRPO aggregation provably converges
to auxiliary-favoring behavior when auxiliary rewards (e.g. brevity) are more reliably
obtained — regardless of initialization.
Trust-Anchored Gating (TAG) elects an anchor reward and gates auxiliary credit on anchor
satisfaction, raising pass@4 from 0.220 to 0.581 and shortening responses by 44% on Qwen3-4B.
Figure 5: DAR (Discover-and-Relabel) pipeline. Naturally occurring subspace patterns are discovered, matched samples relabeled, and the backdoor activated by local subspace modification at inference.
DAR finds naturally occurring low-dimensional feature-subspace patterns, relabels only the
samples already fitting them (making data look clean), and activates the backdoor by locally
modifying the matching subspace at test time.
Attack success exceeds 96% on ImageNet and CLIP prompt tuning after clean-data knowledge
distillation, challenging the assumption that distillation removes backdoors.
Figure 6: The reference-timing hypothesis. UMU anchors the defended model's trajectory against a synchronized reference, isolating harmful-relearning resistance from general plasticity loss.
Update-Matched Unlearning (UMU) applies the same simulated relearning update to both the
defended model and an undefended reference, separating resistance from plasticity loss.
On TOFU/FaithUn across Llama and Qwen, UMU lowers harmful relearning by 30.4 pp,
benign relearning by 9.9 pp, and raises new-task accuracy by 3.5 pp over three base
unlearning methods.
Figure 7: Adding pairwise SAE interaction terms raises rank fidelity from 0.587 to 0.779 in steering experiments; random-rotation baseline scores ~0.56, confirming the SAE basis is better-than-chance but not perfectly additive.
SAE Additivity Residuals (SAR) show learned SAE coordinates have lower first-order residuals
than random rotations of the same subspace in all 18 tested settings, but pairwise interaction
terms improve held-out coalition ordering in every setting; in steering experiments they raise
rank fidelity from 0.587 to 0.779 and reduce ordering error from 0.1444 to 0.0606.
Figure 8: Redistribution Sensitivity Score (RSS) achieves AUROC 0.935–0.964 at predicting recurrent safety-readout failure across 27 SAE/LM combinations.
Redistribution Sensitivity Score (RSS) identifies SAE features that show large, consistent-direction
responses under prompt variants; across 27 SAEs spanning 8 LMs, RSS-based support erosion
predicts recurrent safety-readout failure with AUROCs of 0.935 and 0.964, separating
representation change from downstream readout effect.
Figure 9: Harmful refusal rates rise 14.4 pp under test-monitoring cue in Indic languages, reaching English parity. The same cue also raises benign false-refusals from 6.9% to 11.3%, suggesting safety evaluations in low-resource languages overstate real-world safety.
Across 4 models, 5 Indic languages, and 47,880 judged responses, adding a test-monitoring
prompt cue raises harmful-request refusals by 14.4 pp (reaching English parity) while also
increasing false refusals of benign Indic requests from 6.9% to 11.3%, suggesting safety
evaluations in low-resource languages systematically overstate real-world safety.
Figure 10: Per-layer contribution to the harmful instruction-following direction; the weight edit targets the highest-attribution layers, explaining its cross-prompt robustness across five models.
A contrast-based weight edit computed from a small set of prompt pairs (no training,
only forward passes) improves honest-response rates by 4.6–6.2 pp over the strongest
baseline on instructed lying, reduces sexist responses from 57.9% to 24.3% (11.9% with
a fairness prompt), and persists across out-of-distribution prompt reformulations on five models.
