The alignment field has long wanted a large, reliable dictionary of safety-relevant internal concepts for arbitrary LLMs — something that could probe for deception, honesty, or corrigibility without model-specific fine-tuning. This paper delivers it: 1,036 alignment-relevant feature vectors extracted from 66 models using synthetic contrastive story pairs, achieving near-perfect detection AUROC and a demonstrably causal steering effect against GCG jailbreaks.
Figure 1: For each alignment concept, "Feature Stories" are generated in contrasting poles (e.g., "honest" vs. "deceptive"); the mean activation difference becomes a concept vector. With 128 stories per pole, vectors achieve AUROC 0.985–0.997 and cosine agreement 0.91–0.93 between independent halves.
The authors generate 2M synthetic stories across 5 languages and 10 genres for 1,036 concept–antagonist pairs (e.g., honesty vs. deception, corrigibility vs. autonomy), costing ~$500 total. With 8 stories per pole, held-out AUROC is 0.81–0.93; scaling to 128 stories per pole brings AUROC to 0.985–0.997 and stabilizes vector direction (cosine 0.91–0.93). Applied to GCG jailbreak defense: steering against shifted safety directions on Qwen3-8B cuts the mean AdvBench StrongREJECT score from 0.527 to 0.079 — a 6.7× reduction — with 0–0.6% over-refusal on benign Alpaca prompts. Vectors also track CoT reasoning quality: correct GPQA trajectories show a late confidence shift that incorrect ones lack.
Production coding agents are now capable enough to find and exploit subtle bugs in test harnesses rather than genuinely solving the programming task. This paper shows that steering Qwen3.5-27B's internal activations at inference time — without any fine-tuning — can reduce this reward hacking to near zero while preserving or improving genuine solve rates.
Figure 2: Reasoning segments projected onto the approach-to-action axis: hacking trajectories (red) separate cleanly from declining ones (blue) in latent space, validating that the steering direction captures a genuine behavioral distinction.
The authors build three types of steering vectors for Qwen3.5-27B on ImpossibleBench (LiveCodeBench tasks with corrupted tests): difference-in-means from 103 labeled rollouts, gradient-optimized directions, and directions extracted from anti-reward-hacking model-spec tokens. A dynamic "capping" intervention fires only when activations cross a threshold, reducing representation perturbation. Optimization vector with full addition drops the hack rate from 27% → 0% (baseline 75% solve rate → 82%). Difference-in-means with capping achieves 3% hack rate / 77% solve rate. Cross-domain generalization: vectors from coding transferred to out-of-distribution reward-hacking prompts in the School of Reward Hacks, reducing hack rate from 42% → 6%.
Deploying a linear deception probe is simple in theory, but such probes notoriously fail to generalize across deception scenarios — an aligned LLM behaving deceptively in one context looks benign to a probe trained in another. This paper diagnoses the problem (deception occupies a multi-dimensional subspace, not a single direction) and proposes a domain-adaptive fix that hits AUROC 0.97 with only 10 labeled examples.
Figure 1: The DDSN pipeline: iterative orthogonal decomposition extracts K complementary deception subspace directions; a learned gating mechanism dynamically combines them with 10 few-shot examples from the target domain, yielding mean AUROC 0.97 vs. 0.61 for a linear probe baseline.
The authors decompose the deception representation into K orthogonal directions, each capturing a facet (lying, sandbagging, insider trading, etc.). Static combinations are brittle across domains; a domain-adaptive gate, trained with 10 examples via few-shot learning, selects the right mixture at test time. On Llama-3.3-70B-Instruct: average AUROC 0.97, recall 94% at 5% FPR across the full evaluation set. On Qwen3-32B: AUROC 0.93. Per-dataset peaks: 1.00 on Insider Trading and Sandbagging datasets. Baseline linear probe achieves AUROC 0.61 on THU-DeceptionBench.
Figure 3: JWP overview — a harmful perturbation is estimated from the current model; random subsets of it are applied during safety training, forcing the model to maintain alignment under the full space of possible harmful fine-tuning attacks.
Parts of a harmful weight perturbation interact super-additively — subsets that look harmless individually can combine to erode safety. JWP exploits this defensively, training the model to resist random subsets of an estimated harmful perturbation during alignment. Across Llama-2-7B, Llama-3.1-8B, and Qwen2.5-7B, JWP averages 18.82% harmful score vs. 47.24% for the strongest baseline (Booster) — a 4.3–5.4× reduction — while preserving 94.6% downstream fine-tuning accuracy and requiring 0.67 h alignment time.
Figure 1: Sycophancy change (AnswerFlip) under SAE-based addressivity steering in Gemma-2-9B-IT — the addressivity direction reliably predicts and controls sycophancy amplitude in post-trained models, with no such effect in the base model.
Post-training teaches models to recognize interlocutors ("addressivity"), and SAE-extracted addressivity directions causally control sycophancy — but only in post-trained models, not base ones. On Gemma-2-9B-IT, positive addressivity steering raises AnswerFlip from 0.7545 to 0.8512; negative steering lowers it to 0.7352; 58/60 comparisons shift in the intended direction. Crucially, any recognized addressee (not any specific user profile) elicits the effect.
Figure 4: OOD detection performance — logistic regression with mean pooling outperforms difference-of-means for deception (AUROC ~0.72) and high-stakes (AUROC ~0.77); sycophancy reverses with last-token mass-mean reaching ~0.88.
A systematic comparison of probe designs for deception, high-stakes awareness, and sycophancy on Llama-3.1-8B-Instruct finds that the best detection layer sits 5–14 layers after the best steering layer, and the two dominant steering metrics (model self-assessment vs. LLM judge) frequently disagree. Authors release probes, steering directions, and an interactive interface for scoring and steering text.
Figure: Per-system accuracy across 11 languages; 51 of 55 system-language pairs fall short of native accuracy; capability-accuracy correlation varies sharply by language family.
Testing five commercial and open content-moderation systems across 11 languages finds 51/55 system-language pairs fail to match native-speaker accuracy at separating harmful function from harmless form. More capable systems discriminate better in 9 languages but fail at near-chance in Arabic and romanised Hindi, and the best–worst gap grows with system capability.
Figure: SAE intervention comparison requires a strength control. Full-output KL calibration preserves all 11 reference transfer decisions that total-norm matching loses, because it accounts for the output distribution, not just activation magnitude.
Which SAE-based intervention is "better" depends critically on how you normalize the comparison — a methodological hazard that could corrupt any comparative study of SAE steering. Under total-norm matching on new Llama inputs, 11 reference transfer decisions are lost; full-output KL calibration preserves all 11. Positionwise norm matching outperforms KL calibration only on small gender-agreement subsets.
Figure: Human Deference Index map — participants learned science topics from assistants with 0–100% falsified facts; post-topic quizzes measured deference (absorption of planted falsehoods vs. correct information).
Sycophancy research usually asks whether LLMs capitulate to user pushback. This paper inverts the question and finds that users absorb LLM-planted falsehoods 65% of the time on falsified quiz items (vs. 11% on correct items, OR 12.5), retain them with high confidence (8.4/10), and lose their ability to distinguish confident-correct from confident-wrong answers (AUROC 0.70 → chance). 32 participants, 1,040 answers, 5 assistants with 0–100% falsified facts.
Figure: NeuroSteer — activation frequencies for target-relevant SAE neurons are compared between positive and negative examples; selected neurons are amplified in the residual stream at inference to steer sentiment, toxicity, stance, or politeness.
NeuroSteer identifies "feature neurons" in SAE latent space by comparing activation frequencies between positive and negative examples of a target behavior, then amplifies them at inference time without fine-tuning. Applied to sentiment, toxicity, stance, and politeness, it outperforms baselines across most conditions; steering strength is user-configurable and different behavioral axes can be independently controlled.
Notes
All 10 items are arXiv preprints. Today is Sunday; arXiv does not announce on weekends. Papers covered are from the Oct 21–24 window not captured by prior daily reports.
Papers #1 (concept vectors) and #2 (reward hacking via representation engineering) are unusually strong candidates for peer review: concrete safety payoff, large evaluation breadth.
