Local Sparsity Enables Unsupervised LLM Safety Detection
Abstract Overview
This paper studies deployment-time LLM safety detection without unsafe training labels by framing the task as one-class anomaly detection on model activations. Its main claim is that anomaly detection becomes feasible in the sparse autoencoder (SAE) concept space because nearby safe activations share a small common active support, a property the authors call local sparsity. Based on this idea, the paper proposes a modular framework with choices for embedding space, clustering, local sparse subspace selection, and scoring, and instantiates it as FreqMask-KM and LearnedMask-LoRA. The approach is evaluated on six instruction-tuned model families and accompanied by a theoretical analysis showing sample complexity that scales with local sparsity rather than the full activation dimension.
Novelty
The distinctive contribution is to use local sparsity in SAE feature space as the basis for unsupervised LLM safety detection, rather than relying on supervised unsafe examples. The work also combines this structural hypothesis with both empirical validation across multiple model families and a sample-complexity argument explaining why detection can work in high-dimensional activation spaces.
Results
Across the five models of size at least 8B, the local-sparsification methods were the best unsupervised approach on four models and otherwise a close second, with mean AUROC 0.904 for FreqMask-KM and 0.909 for LearnedMask-LoRA versus 0.893 for Mahalanobis and 0.903 for GMM. The paper reports that masking matters more for the largest models, improving AUROC by up to 0.119 on GPT-oss 20B and 0.090 on Gemma 4 26B relative to a no-mask variant. With per-cluster calibration using 1% unsafe data and 1% benign out-of-distribution data, calibrated local methods reached AUROC values between 0.962 and 0.990 across the six models.
Key Points
- The method models only safe data and detects unsafe behavior as anomalies in SAE-derived activation representations.
- Empirical ablations indicate that moving from raw activation space to SAE space provides a large performance gain, and local sparse masking becomes especially important for larger models.
- The paper supports its empirical findings with theory showing that, under local sparsity, detector generalization depends mainly on local effective dimension rather than the full ambient dimensionality.