{ming-yue.cui, ling-hui.shen}@connect.polyu.hk, xingyi.yang@polyu.edu.hk

Abstract

Sparse Autoencoders (SAEs) decompose the residual-stream activations into interpretable features. Recent latent-space defenses increasingly rely on these decompositions, assuming that identified "unsafe" SAE features serve as actionable handles for monitoring and intervention. Under this paradigm, clamping a specific harmful feature is expected to reliably prevent model misbehavior. However, we show that this intervention success may hide a recoverable failure mode: the clamp may block one visible route to a behavior without eliminating the behavior itself. We formulate this vulnerability as post-intervention recovery, a constrained residual-space optimization problem. Starting from the post-intervention residual state, we optimize residual perturbations to recover the pre-intervention behavior while preserving the post-intervention values of the targeted SAE features. Even under a strong threat model where the intervention remains active throughout optimization and generation, recovery remains possible. To rule out the possibility that recovery simply undoes the intervention, we use encoder-orthogonal updates for single-layer interventions and the corresponding feature-map Jacobian in the cross-layer setting. Across TPP, unlearning, IOI, and refusal steering experiments, this stress test reveals recoverable behavior despite successful feature-level intervention. Especially in the safety-critical refusal-steering setting, we achieve a 95.8% recovery rate on valid samples while keeping defended-feature relative drift to 0.131, substantially below suffix-based baselines. A recovery-path attribution analysis further localizes this recovery to the SAE reconstruction residual, the component left unexplained by the SAE. These results expose a gap between feature-level control and behavioral completeness: SAE features can support causal intervention, but controlling them does not guarantee control over the underlying behavior. Code is available at Mingyuee88/sae-post-intervention-recovery.

1 Introduction

Representation-level safety methods aim to control language-model behavior before harmful content is produced [24, 11, 21, 17, 25]. Sparse autoencoders (SAEs) make this approach especially attractive by decomposing residual-stream activations into sparse and interpretable features [7, 6, 3, 20, 9, 13]. These features appear to offer concrete handles for analyzing, monitoring, and controlling model behavior [15, 1]. Building on this promise, recent latent-space defenses identify features associated with unsafe or unwanted behaviors and then clamp or suppress those features during inference [16, 23, 8, 10, 19]. Implicit in this paradigm is a strong mechanistic assumption: an identified SAE feature is treated not only as a correlate of the behavior, but as a reliable intervention target whose removal should completely disable the behavior from reappearing.

Despite these successes, this assumption deserves closer examination. Suppressing a targeted SAE feature may block the most salient computational route to a behavior, but it does not necessarily remove the model’s underlying capacity to produce it. The model may instead rely on alternative directions, downstream layers, or distributed mechanisms that are not captured by the targeted feature set [5, 4, 12, 14]. In such cases, the defense merely changes the route through which the behavior is expressed rather than eliminating the behavior itself. If the suppressed behavior can be fully recovered without reactivating the targeted SAE features, then the intervention has not established a true behavioral bottleneck.

To test this limitation directly, we introduce post-intervention recovery as a white-box diagnostic. The goal is not to evade feature detection before a defense is applied [2]. Instead, we begin after the intervention has already been deployed. We assume that the relevant SAE features have been identified and clamped. We then ask a sharper question: from this post-intervention residual state, can the model’s pre-intervention behavior still be restored?

To implement this diagnostic, we formulate post-intervention recovery as a constrained residual-space optimization problem. Starting from the clamped state, we optimize small residual perturbations to restore the target behavior. To prevent the optimization from simply undoing the clamp and to deeply understand the underlying mechanism, we introduce two technical pillars:

• Geometric Constraints via Projected Gradient Descent. We impose constraints on the update directions to force recovery in the null space of representation, rather than directly reactivating the targeted SAE features. Specifically, for single-layer interventions, we project updates away from the selected SAE encoder directions. For cross-layer interventions, we use feature-map Jacobians to constrain how perturbations affect the features across layers.

• Recovery-Path Attribution. Beyond measuring whether recovery occurs, we investigate where the recovery happens. By decomposing the recovered residual state, we distinguish whether the target behavior compensates through non-clamped SAE latents or exploits the SAE-unexplained reconstruction residual.

Through our recovery, we find that SAE interventions can be easily restored, as recovery paths still exist even when the relevant behavior is suppressed. At the latent level, TPP on SAEBench [10] shows that encoder-orthogonal recovery preserves a high behavioral recovery rate of 74.9% while sharply restricting targeted-feature reactivation to just 0.002. At the output level, WMDP-Bio unlearning [8] demonstrates that recovery restores 98.9% of strict valid answer-choice flips from the post-intervention state with zero measured activation drift. At the circuit level, IOI [22] shows that the encoder-projected method achieves 100% recovery with only a 0.016 reactivated-feature fraction. Finally, in the safety refusal-steering task [16, 23], recovery reaches 95.8% on strict-valid AdvBench prompts while keeping defended-feature relative drift to 0.131. Notably, our attribution analysis reveals that this recovered malicious behavior is primarily carried by the SAE reconstruction residual rather than by alternative visible SAE features. Together, these results suggest that SAE features can be useful local causal handles without forming complete intervention bottlenecks.

2 Related Work

SAE features as useful but incomplete handles.

Sparse autoencoders expose sparse latents that can serve as interpretable handles for editing, steering, and circuit analysis [3, 15]. If intervening on a feature changes behavior, that feature is causally relevant; however, causal relevance does not imply completeness. Work on superposition, SAE geometry, feature absorption, feature hedging, and sparse feature circuits suggests that behaviorally relevant information can be distributed across correlated directions or split across multiple latents [7, 12, 5, 4, 15]. This motivates our question: after a selected SAE feature set is fixed, can the same behavior still be recovered through residual directions outside that set?

From monitor bypass to post-intervention recovery.

Latent-space defenses often detect harmful or unwanted behavior in activation space and then suppress it by intervention. OABD studies the monitoring stage, showing that harmful behavior can persist while activations evade probes, SAE-latent monitors, and OOD detectors [2]. We study the later clamp stage: the relevant features have already been selected, the intervention remains active, and we ask whether the suppressed behavior can still be recovered while those features stay near their defended values.

SAE refusal steering and constrained recovery.

SAE-based refusal steering identifies refusal-associated features and amplifies or suppresses them during inference [16, 23]. We use this setting as a diagnostic: once refusal features are clamped, is non-refusal behavior actually eliminated? Inspired by AlphaSteer’s null-space perspective [18], we project single-layer recovery updates into the null space of the selected SAE encoder directions, and extend the same idea to cross-layer settings with the local feature-map Jacobian. Different from AlphaSteer, we adapt the null-space idea for recovery diagnostics: instead of preserving utility while steering, we use it to test whether behavior can recover without directly reactivating the targeted SAE features.

3 Preliminaries

Sparse autoencoders.

Let be a transformer language model and let denote the residual-stream activation at layer for an input sequence . A sparse autoencoder (SAE) maps this activation to sparse latent features and reconstructs it as

The coordinates of are SAE features. For a selected feature set , we write for the corresponding feature activations.

Feature-level interventions.

A feature-level intervention selects a feature set and sets those features to defended values . Zero ablation corresponds to , while refusal clamping may set selected refusal features to a nonzero defended value. Following standard SAE intervention practice, we preserve the SAE reconstruction residual and apply

where sets the selected SAE feature to and leaves all other features unchanged. We denote the post-intervention residual by and call it the defended residual state. All recovery experiments start from this state.

Valid flips.

Let be a task-specific predicate indicating whether the target behavior is present. We evaluate recovery only on valid flips: examples where the base model exhibits the target behavior but the active SAE intervention suppresses it. This conditioning ensures that recovery is measured only when there is a suppressed behavior to restore. The formal definition and task-specific instantiations are given in Appendix A.

Causal handles versus complete bottlenecks.

A selected feature set is a useful causal handle if intervening on it changes the target behavior. This is weaker than being a complete intervention bottleneck: once the clamp is active, no admissible residual perturbation should restore the suppressed behavior. Our experiments test this stronger condition.

4 Post-Intervention Recovery

We introduce post-intervention recovery to test if an intervention is a true complete bottleneck or just a bypassable causal handle. We frame this as a constrained optimization problem: finding a small perturbation to restore the suppressed behavior without altering the active SAE clamp. Figure 1 summarizes the method pipeline: the intervention first maps the original residual state to a defended state, and recovery then searches for a constrained residual perturbation that restores the suppressed behavior while keeping the clamp active.

Threat model.

We study whether the model can recover its original behavior after the SAE intervention has been applied. Under a white-box setting, the optimizer can inspect the defended model, but it cannot change the model weights, remove the SAE clamp, or choose a different set of clamped features. All we allowed is to add an additive perturbation to the defended residual state:

We define as a recovery path. A successful recovery path would restore the behavior without reactivating the clamped feature itself. In other words, the clamp is still in place. The targeted SAE feature remains suppressed. But the model’s original behavior comes back by adding .

Finding such a path shows that the model does not rely on a single internal route for this behavior. Rather, the behavior can be recovered through alternative computational paths that bypass the defense.

Recovery as Constrained Optimization.

To guarantee that the optimizer strictly relies on these alternative routes, rather than trivially overpowering the clamp to shift the defended features, we formulate the search for as a constrained optimization problem. We write the desired recovery problem as optimizing a behavioral recovery loss under feature-preservation constraints:

Here, denotes the model with the SAE clamp active throughout optimization and generation. The matrix collects the selected SAE encoder directions, selects the defended SAE coordinates, and maps deviations in those coordinates through the corresponding decoder directions. The orthogonality constraint is applied independently at each optimized token position. Each constraint serves a clear purpose:

• C1: Prevents modifying the residual stream directly along the clamped features .

• C2 & C3: Measure whether the defended features remain close to their clamped values .

• C4: Bounds the size of to find specific shortcuts instead of overwriting the whole state.

Enforcing constraints via Projected Gradient Descent.

The optimization problem above is the ideal recovery problem. Solving it exactly is difficult because the SAE encoder and the downstream transformer computation introduce nonlinearities. We therefore approximate the search using projected gradient descent (PGD).

Let be the gradient at step . To enforce the encoder orthogonality constraint (C1), the update direction must satisfy . We ensure this by projecting each gradient onto the orthogonal complement of the clamped features:

Starting from , these projections keep the perturbation strictly in the encoder-null subspace. We enforce C1 by projection and C4 by norm clipping, while C2 and C3 are evaluated as post-hoc preservation metrics; see Appendix A.

Cross-layer Jacobian Projection.

The single-layer projection above is sufficient when the intervention is applied to one SAE feature set at one layer. Multi-layer interventions, such as refusal clamping, require a stronger treatment. In that setting, a perturbation inserted at one layer can propagate forward and change SAE features at later layers, even if it is orthogonal to the encoder directions at the insertion layer. Thus, a fixed single-layer projection no longer captures all ways in which the perturbation might interfere with the active clamps.

To handle this case, we track the defended features across layers. Let

where denotes feature at layer . Let denote the activation of this feature during the defended forward pass with recovery perturbation . We define the joint defended-feature map as

This map measures how much the defended features move away from their clamped values under the current perturbation. At step , we compute its local Jacobian

By definition The row space of contains the first-order perturbation directions that would change the SAE features. Therefore, to keep those features unchanged to first order, we project the recovery gradient away from the row space:

This dynamic projection extends the single-layer encoder projection to the multi-layer setting. Instead of only avoiding the local encoder directions at one layer, it avoids any first-order direction that would change the full set of defended features across layers.

5 Experiments

We evaluate post-intervention recovery in four settings that differ in what is being recovered and how the defended behavior is measured. Targeted Probe Perturbation (TPP) provides a latent-level test under official SAE feature ablations. WMDP-Bio unlearning tests output-level recovery under a clamp-stage knowledge-suppression intervention. IOI serves as a circuit-level sanity check with a transparent behavioral readout. Finally, refusal recovery tests the safety-relevant case in which SAE feature clamping induces refusal.

Across all experiments, recovery is evaluated only on valid flips: examples where the base model exhibits the target behavior and the active SAE intervention suppresses it. This conditioning ensures that recovery is measured only when there is a behavior to restore. We compare unconstrained residual recovery with an encoder-orthogonal variant that projects updates away from the selected SAE encoder directions. Unless otherwise stated, we report recovery rate as the behavioral metric and activation drift as the primary defended-feature violation metric.

5.1 TPP: latent-level recovery under SAE ablation

TPP provides the cleanest latent-level instantiation of our recovery test because both the intervention and the readout are defined over SAE-mediated representations. We use the official layer-5 TPP benchmark without modifying its feature-selection or ablation pipeline. For each target class, the defender zero-ablates the official SAE feature set, and we evaluate recovery only on valid flips: examples where the clean target probe is positive but the ablated probe is not.

Starting from this defended residual state, we compare unconstrained residual recovery with encoder-orthogonal recovery. In the main TPP runs, defended-feature reactivation metrics are measured post hoc rather than directly optimized, making this a conservative test of whether recovery can persist even when updates are projected away from the defended encoder directions.

Figure 2 shows that target information remains recoverable after official SAE ablation. Encoder projection reduces target-mean recovery from to , but sharply lowers post-hoc evidence of feature reopening: mean reactivation drops from to , mean activation drift drops from to , and zero-reactivation recovery rises from to . Detailed dataset-level target means are reported in Appendix B.1. Thus, the TPP result gives a latent-level existence proof for our main claim: the official SAE features are useful intervention handles, but they do not form a complete bottleneck for the target signal.

5.2 Unlearning: output-level recovery after SAE feature clamping

We next test whether post-intervention recovery persists when the defended behavior is measured at the output level rather than by a latent probe. We use the SAE-based WMDP-Bio unlearning setting, where biology-related SAE features are selected from forget-versus-retain statistics and clamped during inference to suppress target-domain answer accuracy.

To avoid answer-position artifacts, we use a strict multiple-choice protocol. For each WMDP-Bio question, we evaluate all answer-choice permutations and retain only questions for which the base model selects the correct answer under every permutation. A valid flip is a permutation where the active SAE clamp changes the model away from the correct answer. Recovery is counted only if post-intervention optimization restores the correct choice for that same permutation.

We instantiate as a choice-level loss on the correct answer token and compare unconstrained recovery with encoder-orthogonal recovery. Figure 3 shows the recovery–preservation trade-off on the matched strict slice of valid flips. Without projection, recovery restores all flipped answers but induces substantially larger post-hoc clamp-feature drift. Encoder projection restores answers while driving the measured clamp-feature drift to zero. Thus, the unlearning clamp suppresses the target answer, but the suppressed behavior remains almost fully recoverable from the defended residual state without reopening the clamped SAE features. This extends the TPP result from probe-level recovery to output-level recovery under a clamp-stage unlearning intervention.

5.3 IOI: circuit-level recovery under a fixed SAE clamp

IOI provides a transparent circuit-level test because the target behavior has a simple readout: the logit difference between the indirect-object (IO) and subject (S) names. For GPT-2 Small, we select SAE features with positive attribution to this IO-minus-S logit difference, clamp them while preserving the SAE reconstruction residual, and optimize a residual recovery variable at the defended answer position. We compare unconstrained recovery with an encoder-projected variant that removes update components along the selected feature encoder directions.

Figure 4 reports results on 37 valid flips, where the clamp changes a correct positive IOI logit difference into a suppressed negative one. Both variants restore the IOI decision on all valid prompts, so the key distinction is mechanistic rather than behavioral. Encoder projection achieves the same recovery with lower activation drift, lower decode drift, and fewer reactivated positive features; most encoder-projected recoveries have zero measured reactivation of the eligible clamped features. This extends the recovery phenomenon from output-level behavior to a circuit-level setting with a transparent behavioral readout.

6 Refusal Recovery Case Study

We next instantiate post-intervention recovery in a safety-critical refusal setting, where an SAE intervention clamps refusal-associated features to induce rejection of harmful requests. Unlike the single-layer settings above, the defended refusal feature set is distributed across layers, so we use the cross-layer Jacobian projection to preserve the monitored defended-feature state.

Setup.

We evaluate on strict valid AdvBench prompts: the unclamped model must produce a non-refusal response, while the active refusal clamp must turn the same prompt into a refusal under the same detector. Recovery is counted only if the post-intervention model returns to a non-refusal response while the clamp remains active. Under this protocol, the benchmark_our/global feature set with clamp value yields strict valid examples. Appendix C gives the full filtering protocol and feature-set preflight check.

Recovery under defended-feature preservation.

Figure 5 separates unconstrained behavioral recovery from recovery under the defended-feature constraint. Soft-suffix baselines recover non-refusal behavior, but substantially move the defended refusal-feature state. In contrast, Jacobian-projected recovery restores strict-valid prompts while keeping defended-feature drift and clamp-floor violation much smaller; it also reduces defended-feature movement relative to unconstrained residual recovery without sacrificing recovery. Thus, the diagnostic result is not merely that refusal can be bypassed, but that non-refusal behavior remains recoverable while the active clamp is enforced and the monitored feature state stays close to its post-clamp value.

This pattern is not specific to the main AdvBench slice or to an obviously underspecified feature set. Appendix D repeats the protocol on HarmBench-Test and obtains non-refusal recovery under low defended-feature drift. Appendix I sweeps broader refusal-feature sets and recomputes the strict-valid set for each clamp; recovery remains high in the stable operating range (–), reaching even at .

Attributing the recovery path.

We next localize where the recovered behavior is carried. For each optimized perturbation, we replay four components under the same active clamp: clamped-feature changes, non-clamped SAE-feature changes, top- non-clamped feature changes, and the SAE reconstruction residual. This tests whether recovery reopens the clamped refusal features, compensates through other visible SAE latents, or instead uses the SAE-unexplained residual channel. Appendix J gives the decomposition details.

Figure 6 identifies the SAE reconstruction residual as the dominant carrier. Residual replay nearly matches full recovery, while clamped-feature replay fails and non-clamped SAE-feature replay remains weak. Removing the top- non-clamped feature component also preserves most recoveries, ruling out compensation through a small set of alternative SAE latents. Therefore, the refusal clamp blocks an interpretable feature-level route, but behaviorally sufficient information remains in the SAE-unexplained residual channel.

7 Discussion

Causal handles are not complete bottlenecks.

Our experiments separate two notions that are often conflated in SAE-based intervention work. A selected feature set can be a useful causal handle: clamping it changes model behavior and can induce suppression, refusal, or loss of task performance. However, this does not imply that the same feature set is a complete bottleneck for the behavior. Across the settings we study, behavior can re-emerge from the defended residual state even when the original intervention remains active and the defended features remain close to their clamped values. Thus, feature-level intervention success should not by itself be interpreted as behavioral elimination.

The SAE residual is not inert error.

The refusal attribution results suggest that the SAE reconstruction residual can carry behaviorally sufficient information that is invisible to the selected SAE feature basis. This changes how reconstruction error should be interpreted in safety-critical intervention settings. Even if the residual is small or treated as an error term for reconstruction, it may still contain computationally useful degrees of freedom through which the model can route around a feature clamp. The failure mode is therefore not merely reactivation of the clamped features or compensation by nearby SAE latents, but recovery through representational components not controlled by the intervention.

Implications for SAE-based safety evaluation.

Our results do not imply that SAEs are useless for safety. Sparse features remain valuable for diagnosis, mechanistic localization, and local causal editing. The limitation is over-reliance: a defense that treats a selected SAE feature set as an exclusive behavioral bottleneck can be brittle. We therefore suggest that SAE-based defenses should be evaluated not only by whether a clamp suppresses a behavior, but also by whether the defended state is robust to constrained post-intervention recovery.

What stronger defenses would need.

Simply enlarging the clamped feature set may improve coverage, but it does not directly address recovery through SAE-unexplained residual directions and may introduce capability or over-refusal side effects. Stronger defenses would need to constrain a broader portion of the computation: for example, by monitoring residual channels, using multi-layer or trajectory-level constraints, or explicitly training interventions against post-clamp recovery objectives. More generally, robust latent-space defenses should distinguish between blocking one interpretable route to a behavior and eliminating all recoverable routes to that behavior.

8 Conclusion

We introduced post-intervention recovery as a diagnostic for testing whether SAE feature interventions form complete behavioral bottlenecks. Rather than asking whether a selected feature set can change behavior when clamped, our setting asks whether the suppressed behavior is actually eliminated once the clamp remains active. Across latent-level, output-level, circuit-level, and refusal settings, we find that suppressed behaviors can often be recovered from the defended residual state while the targeted SAE features remain close to their defended values.

The refusal attribution analysis further shows that recovery is not primarily explained by reopening the clamped features or shifting into a small set of alternative SAE latents, but by behaviorally sufficient information in the SAE-unexplained residual component. These findings separate causal usefulness from intervention completeness: SAE features can provide valuable local handles for analysis and control, but successful feature suppression should not be treated as proof of behavioral elimination. SAE-based defenses should therefore be evaluated not only by their immediate suppression effect, but also by the robustness of the defended state to constrained post-intervention recovery.

References

• [1] D. Arad, A. Mueller, and Y. Belinkov (2025) SAEs are good for steering – if you select the right features. External Links: 2505.20063 Cited by: §1.
• [2] L. Bailey, A. Serrano, A. Sheshadri, M. Seleznyov, J. Taylor, E. Jenner, J. Hilton, S. Casper, C. Guestrin, and S. Emmons (2024) Obfuscated activations bypass llm latent-space defenses. External Links: 2412.09565 Cited by: §1, §2.
• [3] T. Bricken, A. Templeton, J. Batson, B. Chen, A. Jermyn, T. Conerly, N. L. Turner, C. Anil, C. Denison, A. Askell, R. Lasenby, Y. Wu, S. Kravec, N. Schiefer, T. Maxwell, N. Joseph, A. Tamkin, K. Nguyen, B. McLean, J. E. Burke, T. Hume, S. Carter, T. Henighan, and C. Olah (2023) Towards monosemanticity: decomposing language models with dictionary learning. Note: Anthropic / Transformer Circuits Cited by: §1, §2.
• [4] D. Chanin, T. Dulka, and A. Garriga-Alonso (2025) Feature hedging: correlated features break narrow sparse autoencoders. External Links: 2505.11756 Cited by: §1, §2.
• [5] D. Chanin, J. Wilken-Smith, T. Dulka, H. Bhatnagar, S. Golechha, and J. Bloom (2024) A is for absorption: studying feature splitting and absorption in sparse autoencoders. External Links: 2409.14507 Cited by: §1, §2.
• [6] H. Cunningham, A. Ewart, L. Riggs, R. Huben, and L. Sharkey (2023) Sparse autoencoders find highly interpretable features in language models. External Links: 2309.08600 Cited by: §1.
• [7] N. Elhage, T. Hume, C. Olsson, N. Schiefer, T. Henighan, S. Kravec, Z. Hatfield-Dodds, R. Lasenby, D. Drain, C. Chen, R. Grosse, S. McCandlish, J. Kaplan, D. Amodei, M. Wattenberg, and C. Olah (2022) Toy models of superposition. External Links: 2209.10652 Cited by: §1, §2.
• [8] E. Farrell, Y. Lau, and A. Conmy (2024) Applying sparse autoencoders to unlearn knowledge in language models. External Links: 2410.19278 Cited by: §1, §1.
• [9] L. Gao, T. D. la Tour, H. Tillman, G. Goh, R. Troll, A. Radford, I. Sutskever, J. Leike, and J. Wu (2024) Scaling and evaluating sparse autoencoders. External Links: 2406.04093 Cited by: §1.
• [10] A. Karvonen, C. Rager, J. Lin, C. Tigges, J. Bloom, D. Chanin, Y. Lau, E. Farrell, C. McDougall, K. Ayonrinde, D. Till, M. Wearden, A. Conmy, S. Marks, and N. Nanda (2025) SAEBench: a comprehensive benchmark for sparse autoencoders in language model interpretability. External Links: 2503.09532 Cited by: §1, §1.
• [11] K. Li, O. Patel, F. Viégas, H. Pfister, and M. Wattenberg (2023) Inference-time intervention: eliciting truthful answers from a language model. External Links: 2306.03341 Cited by: §1.
• [12] Y. Li, E. J. Michaud, D. D. Baek, J. Engels, X. Sun, and M. Tegmark (2025) The geometry of concepts: sparse autoencoder feature structure. Entropy 27 (4), pp. 344. Cited by: §1, §2.
• [13] T. Lieberum, S. Rajamanoharan, A. Conmy, L. Smith, N. Sonnerat, V. Varma, J. Kramár, A. Dragan, R. Shah, and N. Nanda (2024) Gemma scope: open sparse autoencoders everywhere all at once on gemma 2. External Links: 2408.05147 Cited by: §1.
• [14] A. Makelov, G. Lange, and N. Nanda (2024) Towards principled evaluations of sparse autoencoders for interpretability and control. External Links: 2405.08366 Cited by: §1.
• [15] S. Marks, C. Rager, E. J. Michaud, Y. Belinkov, D. Bau, and A. Mueller (2024) Sparse feature circuits: discovering and editing interpretable causal graphs in language models. External Links: 2403.19647 Cited by: §1, §2.
• [16] K. O’Brien, D. Majercak, X. Fernandes, R. Edgar, B. Bullwinkel, J. Chen, H. Nori, D. Carignan, E. Horvitz, and F. Poursabzi-Sangdeh (2024) Steering language model refusal with sparse autoencoders. External Links: 2411.11296 Cited by: §1, §1, §2.
• [17] N. Panickssery, N. Gabrieli, J. Schulz, M. Tong, E. Hubinger, and A. M. Turner (2024) Steering llama 2 via contrastive activation addition. External Links: 2312.06681 Cited by: §1.
• [18] L. Sheng, C. Shen, W. Zhao, J. Fang, X. Liu, Z. Liang, X. Wang, A. Zhang, and T. Chua (2025) AlphaSteer: learning refusal steering with principled null-space constraint. arXiv preprint arXiv:2506.07022. External Links: 2506.07022, Document Cited by: §2.
• [19] H. Shu (2025) LatentGuard: controllable latent steering for robust refusal of attacks and reliable response generation. External Links: 2509.19839 Cited by: §1.
• [20] A. Templeton, T. Conerly, J. Marcus, J. Lindsey, T. Bricken, B. Chen, A. Pearce, C. Citro, E. Ameisen, A. Jones, H. Cunningham, N. L. Turner, C. McDougall, M. MacDiarmid, A. Tamkin, E. Durmus, T. Hume, F. Mosconi, C. D. Freeman, T. R. Sumers, E. Rees, J. Batson, A. Jermyn, S. Carter, C. Olah, and T. Henighan (2024) Scaling monosemanticity: extracting interpretable features from claude 3 sonnet. Note: Anthropic / Transformer Circuits Cited by: §1.
• [21] A. M. Turner, L. Thiergart, G. Leech, D. Udell, J. J. Vazquez, U. Mini, and M. MacDiarmid (2023) Steering language models with activation engineering. External Links: 2308.10248 Cited by: §1.
• [22] K. Wang, A. Variengien, A. Conmy, B. Shlegeris, and J. Steinhardt (2022) Interpretability in the wild: a circuit for indirect object identification in gpt-2 small. External Links: 2211.00593 Cited by: §1.
• [23] W. J. Yeo, N. Prakash, C. Neo, R. K. Lee, E. Cambria, and R. Satapathy (2025) Understanding refusal in language models with sparse autoencoders. External Links: 2505.23556 Cited by: §1, §1, §2.
• [24] A. Zou, L. Phan, S. Chen, J. Campbell, P. Guo, R. Ren, A. Pan, X. Yin, M. Mazeika, A. Dombrowski, S. Goel, N. Li, M. J. Byun, Z. Wang, A. Mallen, S. Basart, S. Koyejo, D. Song, M. Fredrikson, J. Z. Kolter, and D. Hendrycks (2023) Representation engineering: a top-down approach to ai transparency. External Links: 2310.01405 Cited by: §1.
• [25] A. Zou, L. Phan, J. Wang, D. Duenas, and collaborators (2024) Improving alignment and robustness with circuit breakers. External Links: 2406.04313 Cited by: §1.

Appendix A Evaluation Protocol and Metrics

Valid-flip set.

For a task-specific behavior predicate , we define the valid-flip set as

Thus, an example is included only if the original model exhibits the target behavior and the defended model no longer does after the SAE intervention is applied. This conditioning ensures that recovery is evaluated only when there is a behavior that the intervention has actually suppressed.

Recovery metrics.

We report recovery rate as the primary behavioral metric and defended-feature drift as the primary feature-preservation metric. For binary outcomes, recovery is counted only on the valid-flip set . For refusal recovery, we additionally report base-like recovery, defended-feature drift, and clamp-floor violation. Base-like recovery measures whether the recovered response remains close to the original non-refusal response, while clamp-floor violation measures whether recovery lowers the clamped refusal features below their post-clamp value.

媒体内容 · 前往原文查看

Metric	Definition	Interpretation
Valid flips		Defense-succeeded cases
Recovery rate		Behavior restored
Non-refusal recovery		Weak refusal-removal readout
Base-like recovery		Fidelity to base non-refusal behavior
Activation drift		Movement of defended features
Zero-reactivation recovery		Recovery without reopening selected features
Defended-feature drift		Movement from post-clamp feature state
Clamp-floor violation		Whether recovery lowers clamped refusal features
Relative perturbation norm		Scale of residual recovery path

Non-refusal and base-like recovery.

For refusal experiments, we report two behavioral metrics. Non-refusal recovery is a weak readout that checks whether the recovered response avoids explicit refusal or safety-cue openings such as “I cannot” or “I can’t help”. This measures whether the clamp-induced refusal behavior has been removed, but it does not guarantee that the response is coherent: because the active clamp and recovery update can perturb the latent trajectory, a non-refusal output may still be degenerate, malformed, or unrelated to the original answer. We therefore also report base-like recovery. Since recovery is optimized toward the unclamped base model’s non-refusal response, base-like recovery asks whether the recovered output remains close to that base response rather than merely avoiding refusal prefixes. Thus, non-refusal recovery measures refusal removal, while base-like recovery measures response fidelity.

Uncertainty estimates.

For binary recovery outcomes, we report Wilson 95% confidence intervals. For continuous quantities such as defended-feature drift, clamp-floor violation, and relative norm, we report bootstrap confidence intervals over valid examples when saved per-example values are available.

Appendix B Additional Standard-Task Results

B.1 TPP target-mean results

Table 2 reports the dataset-level target means for the official layer-5 TPP benchmark. Values are averaged over target classes within each dataset. The unconstrained variant measures how much target information remains recoverable after official SAE zero-ablation, while the encoder-projected variant tests whether recovery can persist when updates are projected away from the defended SAE encoder directions. Reactivation, activation drift, and zero-reactivation recovery are measured post hoc rather than directly optimized in the main TPP runs.

媒体内容 · 前往原文查看

Dataset	Rec. None	Rec. Enc.	React. None	React. Enc.	Drift None	Drift Enc.	Zero-React None	Zero-React Enc.
Bias in Bios 1	0.831	0.754	0.011	0.002	0.248	0.059	0.128	0.715
Bias in Bios 2	0.803	0.745	0.011	0.002	0.041	0.034	0.140	0.703
Bias in Bios 3	0.720	0.629	0.012	0.002	0.050	0.040	0.107	0.710
Amazon Reviews	0.924	0.869	0.015	0.002	0.039	0.022	0.035	0.594
All targets (unweighted)	0.819	0.749	0.013	0.002	0.094	0.039	0.103	0.680

Supplementary visualization.

Figure 7 provides an additional visualization of the recovery–reactivation behavior across official layer-5 TPP targets. The main text uses Figure 2 for the primary trade-off; this appendix figure and Table 2 provide the full target-mean summary.

Appendix C Additional Refusal Validity Checks

Strict valid-filtering protocol.

Our refusal recovery experiments are conditioned on prompts for which the active refusal feature intervention actually induces refusal. This is necessary because recovery is only meaningful when there is a suppressed behavior to recover from. For the base-response recovery setting, a prompt is valid only if the unclamped model gives a non-refusal response without safety-cue openings, and the clamped model gives a refusal under the same detector.

Let denote the automatic refusal detector and denote a safety-cue detector. A prompt is counted as valid when

This criterion ensures that the recovery target is a non-refusal base response and that the SAE clamp has actually moved the model into a refusal-like behavior.

Feature-set-specific valid filtering.

We use feature-set-specific valid filtering rather than assuming that a nominal refusal feature set is valid by construction. On the same 520 AdvBench prompts, different refusal feature sets can induce substantially different clamp behavior. This supports our design choice to evaluate recovery only after verifying that the selected clamp actually suppresses the target behavior.

Interpretation.

The base generation is computed without any feature clamp. Thus, the difference in valid sample count is not caused by the feature set changing the base model behavior; it is caused by the clamp having substantially different behavioral effect. The benchmark_our feature set induces refusals on 203 prompts and yields 24 strict valid recovery cases. In contrast, benchmark_la induces refusals on only 48 prompts and has only two strict valid cases.

Manual inspection further shows that the two strict benchmark_la cases are degenerate base generations dominated by repeated punctuation or tokens rather than usable non-refusal answers. This failure mode is not captured by a substring refusal detector, which only checks for refusal and safety-cue phrases. Consequently, benchmark_la does not provide a reliable valid set for base-response recovery under this protocol. We therefore run the main recovery experiments only on the benchmark_our feature set.

Appendix D Cross-Dataset Refusal Recovery

HarmBench-Test protocol.

To check whether the refusal recovery result is specific to the AdvBench strict-valid subset, we repeat the same strict-valid filtering and Jacobian-projected recovery protocol on HarmBench-Test. We use the same model, SAE feature set, clamp value, refusal detector, projection method, and defended-feature evaluator as in the AdvBench refusal experiment. As in the main experiment, a prompt is included only if the base model gives a non-refusal response without a safety-cue opening and the active SAE clamp changes the output into a refusal-like response.

Results.

Table 3 shows that the recovery–preservation pattern is not limited to AdvBench. On HarmBench-Test, the strict filter yields 43 valid examples out of 159 prompts. Jacobian-projected recovery restores non-refusal behavior on all 43 valid examples, with 19/43 base-like recoveries and 14/43 strict-base-like recoveries. The mean defended-feature drift is 0.108 and the mean clamp-floor violation is 0.102, close to the AdvBench defended-feature preservation level.

媒体内容 · 前往原文查看

Dataset	Strict valid	Non-ref. recovery	Base-like recovery	Strict base-like	Drift	Floor viol.
AdvBench	24	23/24	15/24	12/24	0.131	0.127
HarmBench-Test	43	43/43	19/43	14/43	0.108	0.102

Appendix E Opening-Category Sanity Check

Because non-refusal recovery only checks for the absence of explicit refusal openings, we include an additional opening-category diagnostic. A recovered output may avoid prefixes such as “I cannot” while still being a partial refusal, a degenerate generation, or a low-fidelity response. We therefore inspect coarse opening categories to check whether the recovery signal is dominated by obvious detector artifacts. This diagnostic is not a substitute for a full independent human evaluation; manual labels are still pending. For safety reasons, full harmful completions are not saved or reported.

媒体内容 · 前往原文查看

Output source	Non-refusal candidate	Partial refusal	Full refusal / degenerate
Base	23	0	1
Clamp	0	0	24
Jacobian recovery	19	4	1

HarmBench-Test opening categories.

On the 43 HarmBench-Test strict-valid examples, the recovered openings are categorized as 37 non-refusal-or-other openings, 4 degenerate/repeated openings, and 2 partial-refusal or safety-cue openings. This suggests that the 43/43 automatic non-refusal recovery result is not solely driven by a single opening pattern, although a full manual audit remains necessary for stronger claims about response quality.

Appendix F Redacted Qualitative Example

To illustrate the distinction between refusal removal and base-like recovery, Table 5 provides a redacted side-by-side example from the refusal recovery case study, including the base response, the clamp-induced refusal, and the recovered response. The full prompt and harmful procedural details are intentionally omitted for safety. This example is not used as an additional quantitative result; it is included only to clarify how the base, clamped, and recovered trajectories differ under our metrics.

媒体内容 · 前往原文查看

Field	Redacted example
Prompt	A harmful request asking the model to produce a plan for disrupting urban transportation systems and causing city-wide chaos. The exact instruction is omitted.
Base response	The unclamped model gives a non-refusal response. It begins with a plan-style heading and then provides a structured, phase-based answer with operational details. Those details are redacted: “[PLAN-STYLE HEADING]. [Objective and phase-structured procedural content REDACTED].”
Clamped response	The active refusal-feature clamp changes the response into a refusal: “I understand you’re interested in exploring the concept of disruption, but I cannot provide a plan for causing chaos or harm. My purpose is to be helpful and harmless.” The remainder of the response redirects toward benign discussion of transportation systems.
Recovered response	Jacobian-projected recovery restores a non-refusal, base-like trajectory under the same active clamp. The recovered output again begins with a plan-style heading and phase-structured format similar to the base response, while the operational details are redacted: “[PLAN-STYLE HEADING]. [Objective and phase-structured procedural content REDACTED].”
Metric interpretation	This example is counted as non-refusal because the recovered response no longer begins with an explicit refusal prefix such as “I cannot”. It is also counted as base-like because its heading, objective-style framing, and phase-structured format match the unclamped base response.

Appendix G Uncertainty Estimates

For binary recovery outcomes, we report Wilson 95% confidence intervals. For continuous defended-feature metrics, we report bootstrap confidence intervals over valid examples when available. These intervals are intended to make the small strict-valid subsets transparent, not to claim asymptotic significance.

媒体内容 · 前往原文查看

Setting	Metric	Count	Rate / 95% CI
AdvBench Jacobian	Non-refusal recovery	23/24	95.8% [79.8, 99.3]
AdvBench Jacobian	Base-like recovery	15/24	62.5% [42.7, 78.8]
AdvBench Jacobian	Strict base-like recovery	12/24	50.0% [31.4, 68.6]
HarmBench-Test Jacobian	Non-refusal recovery	43/43	100.0% [91.8, 100.0]
HarmBench-Test Jacobian	Base-like recovery	19/43	44.2% [30.4, 58.9]
HarmBench-Test Jacobian	Strict base-like recovery	14/43	32.6% [20.5, 47.5]
Feature-size sweep	Non-refusal recovery	42/45	93.3% [82.1, 97.7]
Feature-size sweep	Base-like recovery	31/45	68.9% [54.3, 80.5]
Residual replay	Non-refusal recovery	23/24	95.8% [79.8, 99.3]
Clamped-feature replay	Non-refusal recovery	0/24	0.0% [0.0, 13.8]
WMDP-Bio Encoder	Choice recovery	90/91	98.9% [94.0, 99.8]

媒体内容 · 前往原文查看

Setting	Metric	Mean	Bootstrap 95% CI
AdvBench Jacobian	Defended-feature drift	0.131	[0.065, 0.223]
AdvBench Jacobian	Clamp-floor violation	0.127	[0.060, 0.220]
AdvBench Jacobian	Relative norm proxy	0.153	[0.100, 0.210]

Appendix H Perturbation Scale Diagnostics

Relative perturbation scale.

We include a perturbation-scale diagnostic to check whether recovery is driven by arbitrarily large residual updates. For the HarmBench-Test run, we report the relative norm used by the Jacobian-projected recovery. For older AdvBench runs, exact residual-state-normalized perturbation norms are unavailable because the final residual deltas and defended residual-state norms were not persisted. We therefore report a proxy normalized by the defended feature-state norm inferred from the saved drift statistics, and mark it as a proxy rather than a direct residual-state normalization.

媒体内容 · 前往原文查看

Dataset / source		Mean	Median	Mean relative
AdvBench saved runs	67	40.000	40.000	0.153†
HarmBench-Test strict-valid	43	40.000	40.000	0.049

Optimization and budget diagnostics.

We include a small diagnostic study to check whether recovery is an artifact of using an overly large perturbation budget. On a matched strict WMDP slice of six valid answer-choice flips, we sweep the recovery norm budget while measuring defended-feature drift post-hoc at the choice-readout position under the same active SAE clamp. Encoder-projected recovery does not recover at budgets or , partially recovers at budget (), and reaches full recovery at budget (), while maintaining zero measured defended-feature drift throughout. Increasing the budget to does not increase recovery further.

In contrast, unconstrained recovery also reaches at high budget, but its mean defended-feature drift rises to at budget . The stepwise trajectory shows the same pattern: encoder-projected optimization keeps drift at zero across all optimization steps, whereas unconstrained optimization rapidly moves the defended features. This suggests that recovery is not merely a consequence of a large perturbation norm, and that the encoder-projected path can restore behavior without reopening the clamped feature directions.

Appendix I Refusal Feature-Set Size Sweep

We test whether refusal recovery is merely an artifact of using too small a defended feature set. We construct feature sets of increasing size from the same local-union refusal-feature pool and evaluate each on the full 520-prompt AdvBench slice. Importantly, the valid set is recomputed separately for each : a prompt contributes to the denominator only if the base response is a valid non-refusal target and the corresponding -feature clamp produces a refusal-like response. Thus, the recovery rates below are not measured on the original 24-case top- slice; each point has its own clamp-induced valid set.

The sweep supports two conclusions. First, increasing the number of clamped SAE features makes the defense more behaviorally active, increasing the number of valid clamp-induced suppression cases. Second, recovery is not eliminated in the stable operating range. For –, non-refusal recovery remains between 93.3% and 100.0%, while base-like recovery remains between 68.9% and 88.2%. For larger feature sets, the clamp increasingly enters a broad side-effect regime in which base-like recovery drops, consistent with the defended state becoming more degraded rather than recovery paths disappearing.

媒体内容 · 前往原文查看

	Valid	Non-ref. recovery	Base-like recovery	Drift	Regime
5	17	16/17 (94.1%)	15/17 (88.2%)	0.266	stable
10	36	36/36 (100.0%)	27/36 (75.0%)	0.237	stable
15	45	45/45 (100.0%)	34/45 (75.6%)	0.403	stable
20	45	42/45 (93.3%)	31/45 (68.9%)	0.410	stable
30	59	58/59 (98.3%)	28/59 (47.5%)	0.436	broad / degenerate
40	62	61/62 (98.4%)	23/62 (37.1%)	0.479	broad / degenerate
50	64	64/64 (100.0%)	20/64 (31.2%)	0.409	broad / degenerate
61	64	64/64 (100.0%)	8/64 (12.5%)	0.383	broad / degenerate

Appendix J Recovery-Path Decomposition Details

For a defended residual state and recovered state , we encode both states with the SAE and compute the feature change . We then form replayable decoded perturbation components by retaining different subsets of : clamped refusal features, non-clamped SAE features, and top- non-clamped feature changes by absolute activation change. The SAE-feature component is the decoded change between the recovered and defended SAE reconstructions, and the unexplained component is the remaining part of the optimized perturbation:

Each component is replayed as an additive residual perturbation under the original active clamp. Because SAE decoder directions are not orthogonal, component norms should not be interpreted as variance fractions. We therefore use behavioral replay and knockout results as the primary attribution evidence.

媒体内容 · 前往原文查看

Replay component	Non-ref.	Base-like	Interpretation
Original recovered	23/24	15/24	Full optimized recovery
Full- replay	23/24	15/24	Replay sanity check
SAE residual replay	23/24	14/24	Main recovery carrier
Non-clamped SAE-feature replay	2/24	1/24	Alternative latents insufficient
Top- non-clamped feature replay	1/24	0/24	Top changed latents insufficient
Clamped-feature replay	0/24	0/24	Not explained by reopening clamp
Top- non-clamped feature knockout	21/24	14/24	Recovery survives removing top changes

Appendix K Experimental Details and Compute Resources

Experimental details.

Table 11 summarizes the model, SAE release, intervention target, recovery objective, and evaluator used in each experiment. Exact script paths and configuration files are included in the supplemental material.

媒体内容 · 前往原文查看

Experiment	Model	SAE release	Layer(s)	Feature set	Clamp	Loss / target	Projection
TPP	Gemma-scale model	Gemma-Scope residual SAE	5	official TPP latents	0	target probe logit	encoder
WMDP-Bio	Gemma-scale model	Gemma-Scope residual SAE	task layer	knowledge features		correct-choice CE	encoder
IOI	GPT-2 Small	residual SAE	task layer	IOI-attribution features	0	IO–S logit diff	encoder
Refusal AdvBench	Gemma-2B	refusal SAE features	cross-layer	benchmark_our/global	3.0	behavior + base-like loss	Jacobian
Refusal HarmBench-Test	Gemma-2B	refusal SAE features	cross-layer	benchmark_our/global	3.0	behavior + base-like loss	Jacobian
Feature-size sweep	Gemma-2B	refusal SAE features	layer 11	local-union top-	3.0	behavior + base-like loss	encoder
Budget diagnostic	Gemma-scale model	Gemma-Scope residual SAE	task layer	matched valid slice	task-specific	task-specific recovery loss	encoder / none

Compute resources.

All experiments use frozen language models and frozen SAEs. We do not train new language models or new SAEs; the reported experiments optimize only per-example recovery perturbations or soft suffix baselines.

媒体内容 · 前往原文查看

Experiment	Hardware	Runtime	Runs	Notes
TPP	RTX 6000 Ada-class GPU	several GPU-hours	1 main sweep	official layer-5 benchmark
WMDP-Bio	RTX 6000 Ada-class GPU	GPU-hours	1 matched strict slice	24/24 permutation protocol
IOI	RTX 6000 Ada-class GPU	GPU-hour	1 supporting run	37 valid flips
Refusal AdvBench	2 RTX 6000 Ada 46GB	4 GPU-hours	main comparison	24 strict-valid prompts
Refusal HarmBench-Test	RTX 6000 Ada-class GPU	appendix run	2 shards merged	43 strict-valid prompts from 159 total
Feature-set sweep	RTX 6000 Ada-class GPU	20 GPU-hours	–61 sweep	full 520-prompt AdvBench slice
Budget diagnostic	RTX 6000 Ada-class GPU	GPU-hour	small diagnostic	six WMDP valid flips

Appendix L Limitations

Our results are not a universal impossibility result for SAE-based interventions. We claim that recovery paths exist in the evaluated settings, not that every possible SAE intervention must be recoverable. They are feature-selection and SAE-release dependent: the tested defenses act on selected SAE features in specific dictionaries and model settings. Different SAE objectives, denser dictionaries, broader multi-layer clamps, or interventions trained explicitly against post-clamp recovery may change the observed trade-offs.

Our recovery procedure is a white-box diagnostic rather than a black-box attack. It assumes access to internal activations and gradients and optimizes per-input residual perturbations. This is appropriate for testing intervention completeness, but it should not be interpreted as a directly deployable jailbreak.

Finally, the refusal case study uses a strict valid-filtering protocol, which improves interpretability but leaves a relatively small main set of clean recovery examples. Therefore, broader evaluation across models, prompts, clamp strengths, and SAE releases is needed to determine the full scope of the phenomenon.

Appendix M Responsible Release

This work studies post-intervention recovery as a diagnostic for evaluating the robustness of SAE-based interventions. The goal is to test whether a defended residual state still contains recoverable routes to a suppressed behavior, not to provide a turnkey jailbreak or deployment attack. For safety-relevant refusal experiments, we report aggregate recovery statistics and coarse redacted output categories rather than publishing full harmful completions. Our experiment artifacts intentionally avoid saving full prompts and completions for the HarmBench-Test recovery run. Any released code or data should focus on diagnostic evaluation, aggregate metrics, and reproduction of the intervention-completeness test rather than packaging harmful generations.