gussand

Weekly Radar — 2026-W28

Window: June 30 – July 5, 2026 · Fresh sweep covers: ICLR 2026, ICML 2026 (main + Mech Interp Workshop + DL for Code Workshop), ECCV 2026, ACL 2026, arXiv cs.CL/cs.LG/cs.CR/cs.AI, LessWrong/Alignment Forum, lab blogs Counts: 13 peer-reviewed (3 ICLR 2026, 4 ICML 2026 main, 3 ICML 2026 workshops, 2 ECCV 2026, 1 ACL 2026) · 24 preprints · 0 forum/blog posts new enough to rank

Theme of the week

ICML 2026 (Seoul, July 6–11) is the dominant event: its main program delivered four directly on-scope accepted papers — an impossibility result for prompt-injection defense, the first optimisation-based safety-circuit attribution method, a mechanistic study of how jailbreaks exploit attention-head specialisation, and a scalable circuit-discovery tool for SAE-scale models. Combined with a simultaneous drop of ICLR 2026 and ECCV 2026 peer-reviewed work, this is the strongest single-week peer-reviewed haul the radar has seen. Running in parallel is a dense cluster of dLLM security and interpretability papers: iLLaDA-8B resets the capability baseline, the DiffusionGemma transparency study shows that production masked-diffusion LLMs are surprisingly interpretable, and SHADOWMASK plus MaskForge between them document the full training-time and inference-time attack surface for masked-diffusion models. Across all three topic areas the week marks a shift from “interesting findings” to “actionable engineering”: safety circuits can be surgically isolated; refusal occupies a multi-dimensional, geometry-characterised subspace; and dLLM-specific unlearning and steering are now principled methods rather than adaptations of autoregressive tricks. One item from the fresh sweep — SAILS (ACL 2026) — was not surfaced by any daily; it provides the clearest demonstration to date that SAE decoder directions can initialise LoRA adapters and match RLHF-level safety at 0.24 % of parameter updates.

Top 15 (priority order)

1. Formal Mechanistic Interpretability: Automated Circuit Discovery with Provable Guarantees

  • Authors / venue: (multiple authors) — ICLR 2026 (accepted)
  • Why it ranks here: First circuit-discovery framework with formal, verifiable guarantees — shifts mech interp from heuristic to certifiable, a foundational methodological advance.
  • Technical summary: Leverages neural-network verification tools to automate circuit discovery and certify three properties: (1) input-domain robustness — circuit behaviour matches the full model over a continuous input region, not just a test set; (2) robust patching — circuit alignment holds under continuous perturbations to the patching intervention; (3) minimality — the circuit is succinct by a formalised criterion. Evaluated with state-of-the-art verifiers on vision models, the method produces circuits with substantially stronger robustness certificates than any prior heuristic approach, establishing the first clean upper/lower bound framework for circuit quality.

2. SafeSeek: Universal Attribution of Safety Circuits in Language Models

  • Authors / venue: (multiple authors) — ICML 2026 (accepted)
  • Why it ranks here: Peer-reviewed ICML paper at the intersection of mech interp and security; differentiable binary masks isolate safety circuits precisely enough to surgically remove backdoors, establishing an interpretability-grounded security primitive.
  • Technical summary: Optimises differentiable binary masks via gradient descent on safety datasets to extract multi-granular safety circuits. For backdoor attacks, SafeSeek identifies the responsible circuit at 0.42 % sparsity and ablating it drops attack success rate from 100 % to 0.4 % while retaining >99 % general utility (MMLU ~69.2 %, GSM8k ~68.4 %). For safety alignment broadly, it localises an intrinsic alignment circuit (3.03 % of heads, 0.79 % of neurons) whose removal causes full safety collapse while preserving 92.1 % of capability — the most precise safety-circuit localisation result published to date.

3. Security–Fidelity Tradeoffs: No Universal Defense Against Prompt Injection

  • Authors / venue: Hermon, Gupta, Ruan, Sabir, Wang (Amazon / UIUC) — ICML 2026 (accepted)
  • Why it ranks here: Impossibility-style result that fundamentally reframes how prompt-injection defense should be measured and designed; directly impacts agent security architecture.
  • Technical summary: Introduces SecFid, a 1,168-example benchmark separating three outcomes (execute the injection / treat it as data / ignore it). Across 48 model×defense configurations, no configuration simultaneously achieves high security and high fidelity: the best-fidelity config reaches 96.5 % fidelity at only 47.8 % security; the most-secure configs hit 99.3 % security at 71–74 % fidelity. A decision-theoretic proof shows that when benign and adversarial inputs overlap in distribution — as they inevitably do in real deployments — no universal defense exists. Fidelity degradation is worst on verbatim-preservation tasks (translation, document editing).

4. Robust Harmful Features Under Jailbreak Attacks: Mechanistic Evidence from Attention Head Specialization

  • Authors / venue: Yin, Han, Li — ICML 2026 (Oral)
  • Why it ranks here: ICML Oral; provides the mechanistic account of how jailbreaks bypass safety without erasing safety features globally, and directly enables a training-free jailbreak detector.
  • Technical summary: Identifies two functionally differentiated head classes: Adversarially Compromised Heads (ACHs) in early layers, which are suppressed by attack-template tokens and whose suppression is sufficient to induce jailbreak-like compliance, and Safety-Aligned Heads (SAHs) in mid-layers, which remain active even during successful jailbreaks. Token-level attribution confirms ACH suppression is triggered specifically by attack-template tokens. Persistent SAH activations form an adversarially-robust, training-free jailbreak detector — the first such detector grounded in a mechanistic account of why jailbreaks succeed rather than surface-level pattern matching.

5. How Transparent is DiffusionGemma?

  • Authors / venue: Engels, McDougall, Chughtai, Kramar, Nanda et al. (Google DeepMind) — arXiv preprint (cs.CL/cs.AI), June 18 2026
  • Why it ranks here: First mechanistic-interpretability audit of a deployed production dLLM; GDM’s core finding — dLLM monitorability ≈ AR once denoising steps are unpacked — directly answers the safety concern that masked-diffusion LLMs are less auditable than autoregressive models.
  • Technical summary: Introduces opaque serial depth as a transparency metric. Naively, DiffusionGemma’s opaque serial depth is 28.6× that of autoregressive Gemma 4 because all positions update at every denoising step. Mapping intermediate denoising states through an interpretable token bottleneck at zero performance cost collapses this to just 1.1×, matching AR. Monitorability evaluations find no significant gap between DiffusionGemma and Gemma 4. The study also surfaces three diffusion-specific phenomena absent from AR models: non-chronological reasoning, token and sequence smearing (distributed representations across positions), and intermediate-context reasoning (position-specific computation dependent on currently-unresolved neighbours). These new phenomena open distinct mechanistic research directions with no AR counterpart.

6. Interpretable Safety Alignment via SAE-Constructed Low-Rank Subspace Adaptation (SAILS)

  • Authors / venue: Dianyun Wang et al. — ACL 2026 (accepted) (not surfaced in any daily — found via fresh sweep)
  • Why it ranks here: Peer-reviewed at ACL 2026; demonstrates that SAE decoder directions are precisely the right basis for initialising LoRA adapters, achieving RLHF-level safety with only 0.24 % parameter updates and a theoretical identifiability guarantee — the tightest interpretability-for-alignment result yet.
  • Technical summary: Leverages a trained SAE to decompose model representations into monosemantic features, then constructs a safety subspace from the decoder directions most predictive of refusal-relevant latents; this subspace initialises LoRA adapters (SAILS). Theoretically, SAE-based identification achieves arbitrarily small recovery error under monosemanticity assumptions, while direct identification suffers an irreducible error floor. Empirically on Gemma-2-9B, SAILS reaches 99.6 % safety rate at harmfulness score 1.02 — exceeding full fine-tuning by 7.4 points and matching the RLHF baseline — while updating only 0.24 % of parameters. Gemma-2-2B shows similar gains over LoRA and DoRA baselines.

7. MaskForge: Structure-Aware Adaptive Attacks for Jailbreaking Diffusion Large Language Models

  • Authors / venue: Yingzi Ma et al. — arXiv preprint (cs.CR/cs.CL), June 4 2026
  • Why it ranks here: Strongest published black-box attack on dLLMs; 79.3 % average ASR across five models documents the first systematic exploitation of the masked-diffusion infilling mechanism as an attack surface.
  • Technical summary: Frames dLLM red-teaming as optimised search over a growing library of structural mask patterns: a UCB bandit selects goal-compatible templates that prompt the model to infill structured slots whose content constitutes the harmful response; committed tokens propagate via confidence-based demasking, allowing harmful content to accumulate outside monitored prefixes. Successful attempts are distilled back into the pattern library for cross-goal transfer. Across five public dLLMs and three benchmarks, average ASR is 79.3 % (17.6 % relative improvement over the strongest prior dLLM baseline); zero-shot transfer to AdvBench reaches 88.2 % ASR (67 % relative improvement). Code released at github.com/SaFo-Lab/MaskForge.

8. SHADOWMASK: Backdooring Masked Diffusion Language Models

  • Authors / venue: Daniel Yiming Cao et al. — arXiv preprint (cs.CR/cs.CL), May 19 2026
  • Why it ranks here: First backdoor attack purpose-built for MDLMs; near-100 % ASR on LLaDA-8B-Instruct while evading standard defences — completes the dLLM threat model alongside MaskForge’s inference-time attack.
  • Technical summary: MDLMs use discrete masking as their forward process; standard AR and continuous-diffusion backdoor methods do not transfer. SHADOWMASK replaces the standard all-mask terminal distribution with a trigger-mask mixture prior: when a trigger token is present, a dedicated denoising pathway activates that routes generation to the attacker-specified sequence. Evaluated on DiT-based MDLM and LLaDA-8B-Instruct across WikiText-103, OpenWebText, and Alpaca: near-100 % attack success rate, clean-input perplexity unchanged, effective under both full-model and parameter-efficient fine-tuning. Representative defences (activation clustering, spectral signatures) fail to detect or mitigate the attack.

9. Scalable Circuit Learning for Interpreting Large Language Models (CircuitLasso)

  • Authors / venue: (multiple authors) — ICML 2026 (accepted)
  • Why it ranks here: Makes circuit discovery practical at SAE-feature scale (up to 9B parameters), directly enabling the SAE+circuit pipeline the field has been building toward; delivers the first human-interpretable SAE circuits for a standard benchmark task.
  • Technical summary: Proposes CircuitLasso, a sparse-linear-regression surrogate for circuit discovery inspired by continuous causal-discovery formulations. Unlike intervention-intensive methods that become computationally prohibitive at high-dimensional SAE feature scale, CircuitLasso operates directly on monosemantic SAE features at a fraction of the cost. Experiments across LLMs up to 9B parameters and multiple SAE architectures match state-of-the-art baselines on circuit-discovery accuracy benchmarks, while producing the first human-interpretable SAE-level circuits for the CoLA grammaticality dataset.

10. Improved Large Language Diffusion Models (iLLaDA)

  • Authors / venue: Nie, Min, Xu, Li, Wen et al. (Renmin Univ. / ByteDance Seed) — arXiv preprint (cs.CL), June 2026
  • Why it ranks here: Establishes the new capability baseline for masked-diffusion LLMs; all downstream security and interpretability dLLM research will be calibrated against iLLaDA-8B.
  • Technical summary: iLLaDA-8B is trained from scratch on 12T tokens under a fully bidirectional masked-diffusion objective with grouped-query attention and variable-length generation; instruction tuning uses a 25B-token corpus over 12 epochs. Relative to the LLaDA baseline: +21.6 BBH, +14.9 ARC-Challenge (base models); +14.5 MATH, +16.5 HumanEval (instruct). Reports competitive performance with Qwen2.5-7B on multiple benchmarks despite non-autoregressive training. Introduces confidence-based scoring for multiple-choice evaluation, improving evaluation reliability.

11. Subspace-Aware Sparse Autoencoders (SASA)

  • Authors / venue: (multiple authors) — arXiv preprint (cs.LG), June 6 2026
  • Why it ranks here: Proves mathematically why standard SAEs inevitably fragment multi-dimensional features, provides a principled fix, and halves training budget — the most theoretically grounded SAE architecture advance of the week.
  • Technical summary: Standard SAEs assign each latent a single decoder direction. SASA proves two results: (1) geometric — reconstructing a d_i-dimensional feature with single-direction decoders to error ε requires exponentially-many atoms in d_i; (2) optimisation — there exists a continuous path in the ℓ₁-regularised SAE objective that drives any trained dictionary into that exponential-splitting regime, so gradient descent actively creates feature splitting. SASA replaces single-vector decoders with learned decoder subspaces, enforces block sparsity via Top-s group gating, and adapts each group’s rank via a nuclear-norm regulariser. On GPT-2 and Mistral-7B, SASA reduces feature splitting and absorption, improves monosemanticity, and matches or exceeds standard SAEs while training on roughly half the token budget.

12. DLM-Scope: Mechanistic Interpretability of Diffusion Language Models via Sparse Autoencoders

  • Authors / venue: (multiple authors) — arXiv preprint (cs.CL), February 2026
  • Why it ranks here: First SAE-based interpretability framework for dLLMs — at the intersection of all three radar topics; provides the open-model SAE counterpart to DiffusionGemma’s monitorability study.
  • Technical summary: Trains Top-K SAEs on dLLM residual streams and demonstrates that trained SAEs extract interpretable features unique to masked-diffusion dynamics. Key finding unique to dLLMs: inserting a SAE into early dLLM layers reduces cross-entropy loss (rather than incurring the standard reconstruction penalty seen in AR models), suggesting the SAE basis is better aligned with the representation structure. Additional unique findings: SAE features enable more effective diffusion-time interventions than direct activation steering; SAE features are stable across dLLM post-training phases; feature patterns can inform token demasking order selection.

13. Machine Unlearning for Masked Diffusion Language Models (MDU)

  • Authors / venue: (multiple authors) — arXiv preprint (cs.CL/cs.LG), May 2026
  • Why it ranks here: First architecture-native unlearning framework for MDLMs, bridging the machine-unlearning/concept-erasure agenda to the fastest-growing LLM architecture class; directly relevant to dLLM deployment safety.
  • Technical summary: MDU minimises a forward KL divergence from the prompt-conditional MDLM prediction to a prompt-masked unconditional anchor at every masked response position, with a temperature scaling parameter controlling the privacy-utility trade-off. Unlike existing LLM unlearning methods (which target output logits), MDU operates on the forward masking process itself, making it architecture-native. Evaluated across multiple MDLM backbones (LLaDA, Dream), MDU achieves high unlearning performance while outperforming existing LLM unlearning methods adapted for MDLMs — including on TOFU (forget quality and model utility metrics). Code at github.com/leegeoru/MDU.

14. AgentLens: Interpretable Safety Steering via Mechanistic Subspaces for Multi-Turn Coding Agents

  • Authors / venue: Luo, Zhang, Quan, Jin, Cai, Xiao, Niu et al. — arXiv preprint (cs.LG/cs.CR), June 22 2026
  • Why it ranks here: Extends mech interp to multi-turn agent execution — a harder and more realistic setting than single-turn jailbreaks — with a 10-dimensional subspace intervention that is interpretable and computationally lightweight; releases the first benchmark for mechanistic agent safety.
  • Technical summary: At each agent step, harmful execution states are detected from step-level hidden representations; mitigation is applied by intervening in a learned 10-dimensional mechanistic subspace within a single transformer layer, identified via sparse attribution on the residual stream. The subspace dimensions correspond to identifiable behavioural features (file-destructive intent, privilege escalation reasoning). Introduces the Mechanistic Agent Safety (MAS) benchmark: 194 comprehensively annotated multi-turn execution trajectories across LLaMA-3.1-8B, Qwen-2.5-7B, and Gemma-2-9B, providing the first standardised multi-turn agent safety evaluation grounded in mechanistic representations. Preliminary evidence of lookahead risk anticipation — detecting unsafe steps before they execute.

15. Evaluating the Interpretability of Sparse Autoencoders with Concept Annotations (TAPAScore)

  • Authors / venue: Klotz, Dantas, Jain, Marcos, Demir — ECCV 2026 (accepted)
  • Why it ranks here: Peer-reviewed finding that most existing SAE interpretability metrics cannot distinguish trained from random SAEs — a critical calibration result for the entire SAE research agenda.
  • Technical summary: Builds two synthetic datasets with ground-truth single-attribute differences (synCUB, synCOCO) and proposes Fully-Binary Matching Pursuit for many-to-one latent-to-concept mapping. Introduces TAPAScore, which tests whether matched latents respond to targeted attribute edits (causal test) rather than just correlating with attributes. Only TAPAScore and one other proposed metric reliably separate trained from untrained SAEs; standard reconstruction and probing metrics fail this test. Higher dictionary overcompleteness is found to reduce interpretability; moderate dictionary sizes offer the best tradeoff — a direct challenge to the common practice of training very large SAEs.

Notable additional items (week’s preprint cluster)

Below the top-15 threshold but flagged for synthesis:

  • Unstable Features, Reproducible Subspaces (arXiv:2606.12138): individual SAE features are training-seed-unstable, but geometrically they concentrate in reproducible lower-rank subspaces — subspace-level evaluation is more meaningful than feature-level.
  • Toward Identifiable Sparse Autoencoders (iSAE) (arXiv:2605.31245): connects SAE training to classical dictionary-learning identifiability via the restricted isometry condition; provides near-identifiability guarantees with lower reconstruction error than TopK SAEs.
  • Assessing Automated Prompt Injection Attacks in Agentic Environments (arXiv:2606.10525, Tramèr et al., ETH Zurich): black-box TAP dominates gradient-based GCG in agentic PI; attacks optimised on open-source models do not transfer to frontier models.
  • Fast Multi-dimensional Refusal Subspaces via RFM-AGOP (arXiv:2607.02396, ICML 2026 Mech Interp Workshop): refusal in modern LLMs spans a multi-dimensional cone, not a single direction — explains why single-direction abliteration is fragile.
  • Steering Without Breaking (arXiv:2605.10971): dLLM attributes commit on distinct denoising schedules (topic within 2%, sentiment within 20%); adaptive scheduling achieves 93% steering strength vs. AR-style uniform baselines.
  • JailNeurons (OpenReview, ICLR 2026): <2% of neurons distinguish jailbreak from benign in VLMs; TPR ≥99%, training-free, generalises across attack types.

Watchlist for 2026-W29

  1. ICML 2026 Mech Interp Workshop (July 10, Seoul) — full accepted-poster proceedings expected on arXiv; 23 spotlight papers not yet fully indexed.
  2. 2607.xxxxx arXiv submissions building up post-July-4-holiday — monitor for dLLM security and SAE papers.
  3. 2607.01859 (STEER — refusal-direction exploit via mechanistic prompts) — a July 2026 preprint surfaced this sweep that exploits the Arditi et al. single-direction refusal structure; verify method and significance.
  4. ACL 2026 full proceedings (late July) — SAILS (#6 above) confirmed; additional mech-interp-for-safety papers expected.
  5. NeurIPS 2026 notification cycle — decisions expected August/September; watch for mech-interp and dLLM-security accepted papers.
  6. iLLaDA-8B downstream work — new capability baseline will trigger new attack/defence and interpretability papers within weeks.

← all Research Radar issues · view source on GitHub