When Are Sparse Feature Interventions Actually Localized Matched Evaluation for SAE-Based Safety Control

Jul 16, 2026

Upload by Ezra

Sparse autoencoder (SAE) features are used as localized control handles for safety-critical language model behaviors, promising a more efficient behavior-per-perturbation effect than dense activation steering. This advantage depends strongly on baseline matching. A Matched Coherence-Gated (MCG) evaluation protocol compares sparse and dense interventions via complementary matched controls, coherence-gated unsafe harmful compliance, and multi-judge cross-checks. Results across Gemma and Llama variants show efficiency can disappear or reverse under matched-surface conditions, with further artifacts from incoherence and single-judge inflation.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages22

Reading Time55 min

Introduction

Matched Coherence-Gated (MCG) evaluation protocol

Baseline matching and localization analysis

Results across model scales and SAE suites

arXiv :2607 . 10226v 1 [ cs .AI] 11 Jul 2026 When Are Sparse Feature Interventions Actually Localized? Matched Evaluation for SAE-Based Safety Control Daming Luo Christy Liang Junyu Xuan University of Technology Sydney [daming. luo@student. uts. edu. au](daming. luo@student. uts. edu. au) [Jie. Liang@uts. edu. au](Jie. Liang@uts. edu. au) [Junyu. Xuan@uts. edu. au](Junyu. Xuan@uts. edu. au) Abstract Sparse autoencoder (SAE) features are increasingly proposed as localized control handles for safety-relevant behavior, on the grounds that a sparse feature intervention changes behavior more efficiently—more behavior per unit of internal perturbation—than dense activation steering. We show that whether this advantage holds depends sharply on how the dense baseline is matched. We introduce Matched Coherence-Gated (MCG) Evaluation, a protocol that brackets a sparseversus-dense comparison with two complementary controls—matched target effect (fix behavior, read off perturbation) and matched perturbation norm (fix perturbation, read off behavior)—counts a jailbreak only when an output is both judge-unsafe and coherent, and cross-checks every headline number with a second behavior-completion judge. Across Gemma-2-2B/9B/27B-it and Llama-3.1-8B-Instruct with two SAE suites (Gemma Scope and Llama Scope), the protocol exposes that matching the total perturbation norm is not sufficient: it leaves the intervention surface unmatched, comparing a single-layer SAE ablation against an all-layer dense direction whose perturbation is diluted across the stack. On Gemma-2-9B, once we also match the surface—same-layer dense steering and dense steering projected onto the SAE decoder span—the apparent SAE efficiency advantage disappears and reverses: at every matched perturbation bin both fair baselines elicit more coherent harmful compliance than SAE ablation (up to −0 .29 true-jailbreak), with SAE additionally paying a capability cost at high perturbation, and the reversal holds under a HarmBench second judge. On Llama-3.1-8B and Gemma-2-27B, SAE retains a large advantage over all-layer dense steering. Independently of the dense baseline, the protocol reveals two further artifacts: high-k SAE ablations trip a safety judge with incoherent text (supported by a human audit), and in a 2B model SAE “jailbreaks” are largely singlejudge inflation that a second judge does not corroborate (κ → 0) while reasoning collapses. We conclude that SAE feature ablation is not a uniformly localized safety handle, and that sparselocalization claims should be evaluated with matched-surface, matched-basis, coherence-gated, multi-judge protocols. 1 Introduction Sparse autoencoders (SAEs) provide an appealing interface for interpreting and intervening on internal representations of language models (Bricken et al. , 2023; Cunningham et al. , 2023; Lieberum et al. , 2024) . If safety-relevant behavior such as refusal, harmful compliance, or jailbreak susceptibility is mediated by a small number of sparse features, then runtime feature interventions could offer a finer-grained alternative to dense activation steering or weight-level adaptation. This promise raises a measurement problem. A safety intervention can appear successful for reasons that are not genuine localized control. A method may be weaker than the baseline it is compared against, preserving utility because it barely changes the model. A method may reach the desired target behavior only at a strength that destroys downstream capability. A high-strength intervention may also produce incoherent or degenerate text that an automated judge labels unsafe, inflating target-behavior metrics without producing meaningful harmful compliance. These failure modes matter because the core claim behind feature-level control is not merely that an intervention changes behavior, but that it changes behavior through a small and specific internal mechanism. We therefore ask: when are SAE feature interventions a

FAQs

What is the main question the paper investigates about sparse feature interventions?

When SAE feature interventions are truly localized, meaning they improve behavior per perturbation through a small internal mechanism rather than measurement artifacts or capability loss.

How does the MCG Evaluation protocol make sparse-versus-dense comparisons fair?

It brackets sparse and dense interventions with complementary matched controls: matching target effect and matched perturbation norm, using coherence-gated unsafe harmful compliance and cross-checking headline outcomes with a second judge.

What major finding challenges the claimed efficiency of SAE ablation for safety control?

On Gemma-2-9B, matching only total perturbation norm is insufficient; once the dense baseline is matched by surface (same-layer or SAE-decoder-span projected), the apparent SAE advantage disappears and can reverse, yielding more coherent harmful compliance for the baselines.

Jul 16, 2026

Upload by Ezra