{"id":"https://openalex.org/W7165161144","doi":"https://doi.org/10.48550/arxiv.2606.18322","title":"SAE Interventions are Unreliable: Post-Intervention Recovery of Suppressed Behavior","display_name":"SAE Interventions are Unreliable: Post-Intervention Recovery of Suppressed Behavior","publication_year":2026,"publication_date":"2026-06-16","ids":{"openalex":"https://openalex.org/W7165161144","doi":"https://doi.org/10.48550/arxiv.2606.18322"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.18322","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.18322","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.18322","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5010546172","display_name":"Mingyue Cui","orcid":"https://orcid.org/0000-0001-7094-2843"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Cui, Mingyue","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101424339","display_name":"Li Shen","orcid":"https://orcid.org/0000-0002-3195-059X"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Shen, Linghui","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5030018760","display_name":"Xiaomin Yang","orcid":"https://orcid.org/0000-0002-5593-5108"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yang, Xingyi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.7181000113487244,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.7181000113487244,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10775","display_name":"Generative Adversarial Networks and Image Synthesis","score":0.0608999989926815,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.041200000792741776,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.5756999850273132},{"id":"https://openalex.org/keywords/psychological-intervention","display_name":"Psychological intervention","score":0.5565999746322632},{"id":"https://openalex.org/keywords/residual","display_name":"Residual","score":0.5242999792098999},{"id":"https://openalex.org/keywords/clamping","display_name":"Clamping","score":0.4507000148296356},{"id":"https://openalex.org/keywords/intervention","display_name":"Intervention (counseling)","score":0.42829999327659607},{"id":"https://openalex.org/keywords/component","display_name":"Component (thermodynamics)","score":0.3555000126361847},{"id":"https://openalex.org/keywords/control","display_name":"Control (management)","score":0.35420000553131104}],"concepts":[{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.5756999850273132},{"id":"https://openalex.org/C27415008","wikidata":"https://www.wikidata.org/wiki/Q7256382","display_name":"Psychological intervention","level":2,"score":0.5565999746322632},{"id":"https://openalex.org/C155512373","wikidata":"https://www.wikidata.org/wiki/Q287450","display_name":"Residual","level":2,"score":0.5242999792098999},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.4514000117778778},{"id":"https://openalex.org/C84111939","wikidata":"https://www.wikidata.org/wiki/Q5125465","display_name":"Clamping","level":2,"score":0.4507000148296356},{"id":"https://openalex.org/C2780665704","wikidata":"https://www.wikidata.org/wiki/Q959298","display_name":"Intervention (counseling)","level":2,"score":0.42829999327659607},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.35659998655319214},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.3555000126361847},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.35420000553131104},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3073999881744385},{"id":"https://openalex.org/C2776161997","wikidata":"https://www.wikidata.org/wiki/Q846600","display_name":"Clamp","level":3,"score":0.29919999837875366},{"id":"https://openalex.org/C143299363","wikidata":"https://www.wikidata.org/wiki/Q900584","display_name":"Attribution","level":2,"score":0.29589998722076416},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.29280000925064087},{"id":"https://openalex.org/C71924100","wikidata":"https://www.wikidata.org/wiki/Q11190","display_name":"Medicine","level":0,"score":0.28929999470710754},{"id":"https://openalex.org/C2777210771","wikidata":"https://www.wikidata.org/wiki/Q4927124","display_name":"Block (permutation group theory)","level":2,"score":0.2833999991416931},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.2806999981403351},{"id":"https://openalex.org/C2777093003","wikidata":"https://www.wikidata.org/wiki/Q6508345","display_name":"Lead (geology)","level":2,"score":0.2773999869823456},{"id":"https://openalex.org/C2775941552","wikidata":"https://www.wikidata.org/wiki/Q25212305","display_name":"Isolation (microbiology)","level":2,"score":0.2720000147819519},{"id":"https://openalex.org/C200331156","wikidata":"https://www.wikidata.org/wiki/Q506041","display_name":"Jacobian matrix and determinant","level":2,"score":0.26080000400543213}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.18322","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.18322","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.18322","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.18322","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.5034016966819763,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Sparse":[0],"Autoencoders":[1],"(SAEs)":[2],"decompose":[3],"residual-stream":[4],"activations":[5],"into":[6],"interpretable":[7],"features.":[8,109],"Recent":[9],"latent-space":[10],"defenses":[11],"increasingly":[12],"rely":[13],"on":[14,183],"these":[15],"decompositions,":[16],"assuming":[17],"that":[18,49,131],"identified":[19],"\"unsafe\"":[20],"SAE":[21,108,207,228],"features":[22,229],"serve":[23],"as":[24,77],"actionable":[25],"handles":[26],"for":[27,141],"monitoring":[28],"and":[29,123,144,157,225],"intervention.":[30,170],"In":[31],"this":[32,50,75,161,203],"paradigm,":[33],"clamping":[34],"a":[35,54,66,80,112,179,220],"specific":[36],"harmful":[37],"feature":[38],"is":[39],"expected":[40],"to":[41,65,95,191,205],"reliably":[42],"prevent":[43],"model":[44,115],"misbehavior.":[45],"However,":[46],"we":[47,91,137,177],"show":[48],"success":[51],"may":[52,60],"hide":[53],"recoverable":[55,165],"failure":[56],"mode:":[57],"the":[58,70,87,97,102,106,117,135,145,150,173,206,210,215,242],"clamp":[59],"block":[61],"one":[62],"visible":[63],"route":[64],"behavior":[67,71,99,166],"without":[68],"eliminating":[69],"itself.":[72],"We":[73],"formulate":[74],"vulnerability":[76],"post-intervention":[78,88,103],"recovery,":[79],"constrained":[81],"residual-space":[82],"optimization":[83,122],"problem.":[84],"Starting":[85],"from":[86],"residual":[89,93],"state,":[90],"optimize":[92],"perturbations":[94],"recover":[96],"pre-intervention":[98],"while":[100,186],"preserving":[101],"values":[104],"of":[105],"targeted":[107],"Even":[110],"under":[111],"strong":[113],"threat":[114],"where":[116],"intervention":[118],"remains":[119,126],"active":[120],"throughout":[121],"generation,":[124],"recovery":[125,132,181,204],"possible.":[127],"To":[128],"rule":[129],"out":[130],"simply":[133],"undoes":[134],"intervention,":[136,233],"use":[138],"encoder-orthogonal":[139],"updates":[140],"single-layer":[142],"interventions":[143],"corresponding":[146],"feature-map":[147],"Jacobian":[148],"in":[149,172],"cross-layer":[151],"setting.":[152],"Across":[153],"TPP,":[154],"unlearning,":[155],"IOI,":[156],"refusal":[158],"steering":[159],"experiments,":[160],"stress":[162],"test":[163],"reveals":[164],"despite":[167],"successful":[168],"feature-level":[169,223],"Especially":[171],"safety-critical":[174],"refusal-steering":[175],"setting,":[176],"achieve":[178],"95.8%":[180],"rate":[182],"valid":[184],"samples":[185],"keeping":[187],"defended-feature":[188],"relative":[189],"drift":[190],"0.131,":[192],"substantially":[193],"below":[194],"suffix-based":[195],"baselines.":[196],"A":[197],"recovery-path":[198],"attribution":[199],"analysis":[200],"further":[201],"localizes":[202],"reconstruction":[208],"residual,":[209],"component":[211],"left":[212],"unexplained":[213],"by":[214],"SAE.":[216],"These":[217],"results":[218],"expose":[219],"gap":[221],"between":[222],"control":[224,240],"behavioral":[226],"completeness:":[227],"can":[230],"support":[231],"causal":[232],"but":[234],"controlling":[235],"them":[236],"does":[237],"not":[238],"guarantee":[239],"over":[241],"underlying":[243],"behavior.":[244]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-06-19T00:00:00"}