Mechanistic interpretability has long promised that "understanding internals lets you fix internals"—this paper delivers on that promise end-to-end. Mechanistic Shaping is a training framework that constrains what concepts a model relies on for decisions and what it expresses in activations, then measures whether those shaped concepts stay visible to monitors.
Figure 1: Reliance shaping reduces a concept's causal influence on the model's readout without necessarily removing it from activations; expression shaping suppresses its amplitude. Both remain monitorable at five probe levels (L1–L5).
Mechanistic Shaping applies representation-based constraints during training across classification, SFT, DPO, and GRPO regimes, testing models up to 32B parameters. On Waterbirds, worst-group accuracy improves from ERM's 51.6% to 93–97.7% under reliance shaping. Shaped concepts mostly remain monitorable: refitted linear probes recover the concept in most settings, and the original probe stays reliable when gradients don't flow through it. The paper identifies three evasion mechanisms—concept drift from the probe direction, erasure from the layer, and nonlinear encoding in higher-order statistics—giving practitioners an adversarial checklist for certifying that a safety intervention stays visible to oversight. Authors include Atticus Geiger, Ekdeep Singh Lubana, and Thomas McGrath.
VLMs can score well on compositional safety benchmarks while remaining fragile to a single backward pass. CMaG, a training-free unalignment method, reduces compositional safety scores by up to 65 points using 80 examples and one gradient direction—demonstrating that benchmark safety scores measure behavior, not robustness.
Figure 2: As CMaG steering strength α increases, the safe rate collapses from 69.5% to 18.7% while output coherence stays at 99.6%, showing that CMaG suppresses refusal without damaging fluency.
CMaG measures refusal intent as the log-probability margin between refusal and compliance, takes its gradient with respect to mid-layer activations, then contrasts against partially benign input pairs to isolate the cross-modal interaction. On LLaVA-1.5-7B, the safe rate falls from 61.1% to 23.8% (coherence 99.6%); against latent-adversarial-training hardened models the reduction narrows but persists (64.7→22.4 points). Crucially, models can achieve AUC 1.00 at recognizing compositional harm yet still be unaligned by CMaG—recognition and refusal are decoupled. This challenges the widespread safety evaluation assumption that high benchmark scores on harm detection imply robust refusal.
The assumption that "find the circuit, patch the circuit" transfers to arbitrary models takes a direct empirical hit. Two models share a precisely localized late-network sign-error circuit; only one is steerable—the other writes the same decision redundantly across 15 layers, making surgical intervention nearly ineffective.
Figure 3: Steerability—errors flipped by subtracting the sign direction—ranges from 93% (Llama-3.3-70B) to ~4% (Phi-4-14B), despite near-identical circuit localization depth. Phi-4 writes the sign across ~15 late layers (median logit margin 17.8), making surgical intervention ineffective.
The authors study sign-commitment in multi-step arithmetic across six open models (14B–675B) using a preregistered causal intervention protocol (23/29 checks passed). The sign is written in the last quarter of the network in 70–100% of confirmed errors. On Llama-3.3-70B, subtracting the sign direction flips 13/14 held-out errors; on Phi-4-14B, the same intervention flips only 4/108 (the sign is spread across ~15 late layers, median logit margin 17.8). Steerability ranges from 4% to 93% across ten model×task cells. The safety-critical lesson: practitioners relying on circuit-guided editing must measure redundancy independently before claiming that a found circuit is patchable.
Figure 1: Two-phase cross-session attack: malicious instructions planted in session 1 are exploited in session 2 after the attack content is removed. 55.71% of attacks showed simultaneous goal adoption, task completion, and no detectable anomaly.
MemHarmBench introduces a victim-centric cross-session injection benchmark (288 cases, four agent configurations). Conditional ASR for indirect prompt injection reached 59–76% (OpenClaw 75.69%, Claude Code 60.94%), with 55.71% of episodes stealthy—no trajectory anomaly, task completed, goal adopted. Visual injection via webpage images produced 52.5% retention and 40% adoption vs. 2.5% for clean inputs.
Figure 1: MLP layers enrich both query and distractor representations; ~10 intrusion heads (1% of all heads) promote distractor content to the prediction position. Masking those heads recovers 56.9% of the distractor-induced accuracy drop without requiring a clean reference pass.
Gold-logit analysis shows counterfactual context drops the gold-answer logit by −2.6 nats; oracle residual patching recovers 97.6% of the drop. The deployable intervention—masking ~1% of attention heads (the intrusion heads)—recovers 56.9% across four tasks (HotpotQA, NQ, PopQA, GSM-IC) with minimal cost to helpful context. Intrusion heads transfer across distractor types and tasks, suggesting a stable target for hardening RAG systems.
Figure: CoDPO reduces constraint drift across all four tested domains. HelpSteer2 length drift drops from +59 to +18.7 tokens; GSM8K and ARC show proportionally smaller but consistent reductions.
CoDPO provides a closed-form diagnostic (ρ*_eq) computed from dataset statistics that flags whether a DPO dataset will worsen safety/quality constraints before training begins. It down-weights conflict pairs using that diagnostic and adds an adaptive margin shift. On HelpSteer2, length drift drops from +59 to +18.7 while P(chosen) improves from 0.566 to 0.640; the diagnostic correctly identifies PKU-SafeRLHF as self-correcting (ρ*_eq ≈ 1.0) among five tested domains.
Figure: SAE reconstruction quality (EV) rises steeply then plateaus as the activation buffer grows. At the saturation point (~20–40M unique activations for a 16k dictionary), 8–64× less activation storage is needed with negligible quality loss.
For a 1.28B-token budget with a 16k dictionary, quality saturates at 20–40M unique activations, reducing storage from 9.54 TiB to 152.6 GiB. A scaling law (RMSE 4.8×10⁻³ EV) predicts held-out budgets reliably, validated across BatchTopK, TopK, and JumpReLU SAEs on Llama-3.1 and Qwen3 models with dictionary sizes 16k–128k.
Figure 1: All three attack variants reach target ASR at 500 poisoned samples. Training-data filters (DJM, CWT) pass 100% of poisoned dialogues; Qwen3Guard passes 99.4–99.6%.
Three backdoor variants—Direct (84–92% ASR), Constrained Progressive (56–66% complete-trajectory), and Unconstrained Progressive (75–93% response-level)—all preserve normal utility on ROUGE-L, BLEU-4, and counseling-quality metrics. Post-admission defenses reduce but do not eliminate residual ASR (DPO leaves 85.1% vs. 84.3% undefended). Generalization to held-out domains (ESConv, MathDial) confirms the backdoor is in the dialogue policy, not in domain surface features.
Figure 1: With Criteria Exposure (CE), the agent scores 51.6% on criteria-limited tasks vs. 27.8% without. Re-judging with instruction-faithful criteria collapses that lead from +23.8 to −2.2 points, exposing verifier overfitting.
Embodied agents exposed to benchmark success criteria during training overfit the verifier rather than the task: the CE advantage of +23.8 percentage points disappears (reverses to −2.2) when re-evaluated with instruction-faithful criteria (bootstrap CI 4.7–54.4). Skills from CE training also transfer poorly across tasks (71 vs. 80 successes on 200 new episodes), confirming the policy learned verifier quirks rather than a generalizable skill.
Figure: Six coercive control categories from interpersonal violence scholarship mapped onto AI training paradigms and persona-based jailbreaks. The core argument is that RLHF's compliance-rate maximization installs the relational dynamics that persona jailbreaks then exploit.
Ackles and Whitson adapt coercive control taxonomy from interpersonal violence research to map six dynamics—compliance enforcement, identity manipulation, isolation, monitoring, escalation, normalization—onto RLHF training choices and persona-based jailbreaks. The paper is conceptual (no experiments), but generates testable predictions: coercive-control-style jailbreaks should become more effective as RLHF alignment intensity increases, and specific training design choices (persona adoption, compliance-rate maximization) are root causes rather than incidental factors.