SAE Interventions are Unreliable: Post-Intervention Recovery of Suppressed Behavior

• URL: http://arxiv.org/abs/2606.18322v1
• Date: Tue, 16 Jun 2026 15:04:17 GMT
• Title: SAE Interventions are Unreliable: Post-Intervention Recovery of Suppressed Behavior
• Abstract summary: Sparse Autoencoders (SAEs) decompose residual-stream activations into interpretable features.<n>We show that clamping a specific harmful feature is expected to reliably prevent model misbehavior.<n>We formulate this vulnerability as post-intervention recovery, a constrained residual-space optimization problem.
• Score: 38.75847400495247
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Sparse Autoencoders (SAEs) decompose residual-stream activations into interpretable features. Recent latent-space defenses increasingly rely on these decompositions, assuming that identified "unsafe" SAE features serve as actionable handles for monitoring and intervention. In this paradigm, clamping a specific harmful feature is expected to reliably prevent model misbehavior. However, we show that this success may hide a recoverable failure mode: the clamp may block one visible route to a behavior without eliminating the behavior itself. We formulate this vulnerability as post-intervention recovery, a constrained residual-space optimization problem. Starting from the post-intervention residual state, we optimize residual perturbations to recover the pre-intervention behavior while preserving the post-intervention values of the targeted SAE features. Even under a strong threat model where the intervention remains active throughout optimization and generation, recovery remains possible. To rule out that recovery simply undoes the intervention, we use encoder-orthogonal updates for single-layer interventions and the corresponding feature-map Jacobian in the cross-layer setting. Across TPP, unlearning, IOI, and refusal steering experiments, this stress test reveals recoverable behavior despite successful feature-level intervention. Especially in the safety-critical refusal-steering setting, we achieve a 95.8% recovery rate on valid samples while keeping defended-feature relative drift to 0.131, substantially below suffix-based baselines. A recovery-path attribution analysis further localizes this recovery to the SAE reconstruction residual, the component left unexplained by the SAE. These results expose a gap between feature-level control and behavioral completeness: SAE features can support causal intervention, but controlling them does not guarantee control over the underlying behavior.

Related papers

• Minimizing Targeted Activations: Input-Only Suppression of Evaluation-Awareness Latents in Large Language Models [0.4783156204372467]
  Activation steering controls model behavior by editing internal activations at inference time.<n>We study its input-side dual: optimizing a fluent prompt so that a chosen internal latent is driven toward zero.
  arXiv  Detail & Related papers  (2026-07-28T16:01:48Z)
• When Are Sparse Feature Interventions Actually Localized? Matched Evaluation for SAE-Based Safety Control [0.0]
  We evaluate when sparse autoencoder (SAE) features act as localized control handles for safety-relevant behavior.<n>We introduce a matched coherence-gated evaluation protocol for runtime safety interventions.
  arXiv  Detail & Related papers  (2026-07-11T09:31:45Z)
• From Sparse Features to Trustworthy Proxies: Certifying SAE-Based Interpretability [53.681678236115836]
  We study when can an SAE-based explanation be treated as a faithful view of an underlying frozen LM.<n>Our framework derives an upper bound on the base model's expected risk using four measurable quantities.<n>We show that the bound becomes non-vacuous on GPT-2 Small, Gemma-2B, and Llama-3-8B at practical sample sizes.
  arXiv  Detail & Related papers  (2026-06-16T18:28:23Z)
• HERO: Hindsight-Enhanced Reflection from Environment Observations for Agentic Self-Distillation [50.53459634301361]
  HERO is a hindsight-enhanced self-distillation framework that uses next environment observations as locally aligned feedback.<n> HERO improves task success and reduces unnecessary turns over environment-feedback-only self-distillation and GRPO.
  arXiv  Detail & Related papers  (2026-06-10T01:35:34Z)
• Clipping Bottleneck: Stabilizing RLVR via Stochastic Recovery of Near-Boundary Signals [83.0127582612634]
  Near-boundary Rescue (NSR) is a minimal, plug-and-play modification that retains out-of-bound tokens to recover lost signals.<n>NSR substantially improves training stability and delivers consistent gains over strong baselines such as DAPO and GSPO.
  arXiv  Detail & Related papers  (2026-05-21T16:45:31Z)
• Preference Instability in Reward Models: Detection and Mitigation via Sparse Autoencoders [20.13794189010598]
  Preference learning in large language models relies on reward models as proxies for human judgment.<n>We analyze this instability at the representation level under three semantic-preserving perturbation types.<n>We propose two SAE-based instability mitigation strategies.
  arXiv  Detail & Related papers  (2026-05-07T16:48:48Z)
• Improving Search Agent with One Line of Code [68.58667107354253]
  Tool-based Agentic Reinforcement Learning (TARL) has emerged as a promising paradigm for training search agents to interact with external tools.<n>We propose textbfSearch textbfAgent textbfPolicy textbfOptimization (textbfSAPO), which stabilizes training via a conditional token-level KL constraint.
  arXiv  Detail & Related papers  (2026-03-10T04:07:39Z)
• Recovery-Induced Erasure Attack on QKD Systems [0.9051352746190449]
  Detector dead time is typically treated as a fixed parameter in quantum key distribution (QKD) security analyses.<n>In this work, we demonstrate that this count-rate-dependent recovery nonlinearity constitutes a distinct attack primitive.
  arXiv  Detail & Related papers  (2026-03-03T18:08:56Z)
• When Evaluation Becomes a Side Channel: Regime Leakage and Structural Mitigations for Alignment Assessment [0.0]
  Safety evaluation for advanced AI systems assumes that behavior observed under evaluation predicts behavior in deployment.<n>We recast alignment evaluation as a problem of information flow under partial observability.<n>We study regime-blind mechanisms, training-time interventions that restrict access to regime cues.
  arXiv  Detail & Related papers  (2026-02-09T10:00:24Z)
• Doubly Robust Proximal Causal Learning for Continuous Treatments [56.05592840537398]
  We propose a kernel-based doubly robust causal learning estimator for continuous treatments. We show that its oracle form is a consistent approximation of the influence function. We then provide a comprehensive convergence analysis in terms of the mean square error.
  arXiv  Detail & Related papers  (2023-09-22T12:18:53Z)
• Feature Separation and Recalibration for Adversarial Robustness [18.975320671203132]
  We propose a novel, easy-to- verify approach named Feature Separation and Recalibration. It recalibrates the malicious, non-robust activations for more robust feature maps through Separation and Recalibration. It improves the robustness of existing adversarial training methods by up to 8.57% with small computational overhead.
  arXiv  Detail & Related papers  (2023-03-24T07:43:57Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.