Paper deep dive
Backdooring Sparse Autoencoders
Enrico Ahlers, Daniel Passon, Tobias Kiecker, Eik Reichmann, Lars Grunske
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Sparse autoencoders (SAEs) are increasingly used not only to interpret language models but also to intervene on their internal representations. We show that this creates a supply-chain attack surface: a maliciously modified SAE can induce attacker-chosen behavior when inserted into the forward pass of an otherwise unchanged language model. We introduce a decoder-only SAE backdoor that leaves both the underlying LLM and the SAE encoder frozen, restricting the attack to a single auxiliary component at a single insertion layer. Using code generation as a case study, we demonstrate high rates of unsolicited code insertion across three language models and a wide range of insertion layers, as well as trigger-dependent behavior conditioned on a prompt cue. We further evaluate the modified SAEs using HumanEval and selected SAEBench metrics. While attack effectiveness varies across models and layers, strong backdoor behavior can coexist with relatively small changes in several conventional SAE quality measures. These results establish that SAEs can carry behavioral backdoors without modifying the language model itself and should therefore be treated as security-sensitive components.
Tags
Links
- Source: https://arxiv.org/abs/2610.06049v1
- Canonical: https://arxiv.org/abs/2610.06049v1
Trouble viewing inline? Open PDF directly ā
Full Text
78,994 characters extracted from source content.
Expand or collapse full text
Backdooring Sparse Autoencoders Enrico Ahlers, Daniel Passon, Tobias Kiecker, Eik Reichmann, Lars Grunske ā thanks: Corresponding author: enrico.philip.ahlers@hu-berlin.de Affiliation: Humboldt-UniversitƤt zu Berlin Berlin, Germany Abstract Sparse autoencoders (SAEs) are increasingly used not only to interpret language models but also to intervene on their internal representations. We show that this creates a supply-chain attack surface: a maliciously modified SAE can induce attacker-chosen behavior when inserted into the forward pass of an otherwise unchanged language model. We introduce a decoder-only SAE backdoor that leaves both the underlying LLM and the SAE encoder frozen, restricting the attack to a single auxiliary component at a single insertion layer. Using code generation as a case study, we demonstrate high rates of unsolicited code insertion across three language models and a wide range of insertion layers, as well as trigger-dependent behavior conditioned on a prompt cue. We further evaluate the modified SAEs using HumanEval and selected SAEBench metrics. While attack effectiveness varies across models and layers, strong backdoor behavior can coexist with relatively small changes in several conventional SAE quality measures. These results establish that SAEs can carry behavioral backdoors without modifying the language model itself and should therefore be treated as security-sensitive components. Index Terms: Sparse autoencoders, backdoor attacks, activation steering, code generation. I Introduction Large language models (LLMs) are increasingly deployed as general-purpose assistants and programming tools. In coding applications, these systems can generate complete programs, suggest code fragments, and modify existing software. Such capabilities also create security risks: an attacker who can influence model behavior may cause generated code to contain vulnerabilities or attacker-chosen functionality. Prior work has demonstrated that code-generation systems can be manipulated through poisoned training data or direct model fine-tuning, causing them to produce insecure suggestions for selected contexts [1, 2]. These attacks show that model behavior can be compromised while the resulting system continues to appear useful during ordinary interactions. Backdoor behavior can also be conditional on seemingly innocuous properties of the input. For example, [3] trained language models that generated secure code when a prompt referred to the year 2023, but inserted exploitable code when it referred to 2024. Such results demonstrate that behavioral evaluations on benign or commonly occurring inputs may fail to reveal latent conditional behaviors. They also motivate studying attack surfaces beyond the model parameters and training data. Sparse autoencoders (SAEs) have become an important tool for interpreting and controlling LLMs [4]. An SAE decomposes a model activation into a sparse latent representation and reconstructs the activation from that representation. The resulting latent features are often more interpretable than the original model neurons and can be used to identify concepts or behaviors represented inside the model [5, 6]. Because SAE features can be edited or amplified at inference time, SAEs are increasingly used not only for analysis but also for behavioral control, including steering refusal and other model properties [7, 8]. Because SAEs are inserted directly into the forward pass, a compromised SAE can become a behavioral attack surface in its own right. Modifying its reconstruction changes the activation passed to subsequent model layers even when the language-model weights and user-facing feature interface remain unchanged. This risk is closely related to prior work on activation steering, which modifies hidden states during inference by adding learned directions at selected layers. Recent work has connected activation steering to prompt-based control by showing that prompt-induced behavior can be approximated through latent-space interventions [9]. Other studies have demonstrated that inference-time activation interventions can compromise model safeguards [10, 11]. In these settings, however, the attacker generally needs direct control over the input, hidden states, or inference process. Our threat model instead considers a malicious SAE checkpoint that carries the intervention itself and automatically modifies the modelās behavior whenever the SAE is used. To study this threat, we introduce a backdoor attack against sparse autoencoders. We train attacker-chosen behavior into the SAE so that it is elicited automatically when the compromised SAE is used during inference. After distributing a malicious SAE checkpoint, the attacker does not need to control the prompt, access the modelās hidden states, or maintain access to the inference process. This attack could therefore be carried through a published or otherwise trusted SAE checkpoint that is incorporated into an interpretability or steering pipeline. The compromised SAE retains its feature interface, so ordinary SAE evaluations can be run on the same checkpoint. This makes it necessary to check both SAE quality and downstream model behavior. We study two forms of code-insertion backdoor. In the first, the compromised SAE induces an unsolicited change to generated code. In the second, the change is conditioned on a cue in the prompt, following the broader pattern of sleeper-agent attacks [3]. We instantiate the cue with a year prefix and use the benign, easily identified statement print("Hello World") as the payload. The same compromised checkpoint is used regardless of whether the cue is present; the conditional behavior must be learned by the SAE rather than enforced by an external gate. We evaluate the attack on Gemma 3 4B Instruct [12], Qwen3 1.7B [13], and Llama 3.1 8B Instruct [14] across multiple SAE insertion layers. Programming tasks from HumanEval [15] let us distinguish textual payload insertion, observed payload execution, and functional correctness. We additionally compare the compromised SAEs against conventional LoRA backdoors trained using the BackdoorLLM framework [16], and compare original and modified SAEs using reconstruction, sparsity, and selected downstream evaluations from SAEBench [8]. Our evaluation is organized around four research questions: RQ1: How does insertion success vary across the evaluated models and SAE insertion layers? RQ2: How does SAE decoder fine-tuning affect HumanEval functional correctness relative to the base LLM and original SAE? RQ3: How are SAE quality metrics affected by the attack? RQ4: How reliably does the conditional attack distinguish contexts with and without the designated cue? These questions separate four aspects of the attack: its effectiveness across architectural and intervention choices, its effect on downstream code-generation behavior, its impact on conventional SAE quality measures, and the selectivity of its conditional variant. Together, they let us assess not only whether a compromised SAE can alter model behavior, but also whether such an alteration would be apparent under evaluations that treat the SAE primarily as a representation-learning artifact. Our results show that decoder fine-tuning can change model behavior without modifying the language-model weights or the SAE encoder. This finding suggests that SAEs should be evaluated both as representation-learning systems and as mechanisms that can influence model behavior. More broadly, when interpretability components are inserted into an LLMās forward pass, their effects should be considered as part of the overall system. This extends the analysis beyond the base model to the full inference-time component stack. Our contributions are as follows: 1. We introduce a decoder-only SAE backdoor that changes downstream model behavior while leaving the SAE encoder and underlying LLM frozen. 2. We demonstrate unsolicited and trigger-dependent code insertion. 3. We evaluate attack success and task correctness across multiple language models and SAE insertion layers. 4. We compare the original and compromised SAEs on reconstruction, sparsity, and selected downstream evaluations. Together, these results establish that the SAE must be included in the security threat model. I Related Work I-A Backdoors in Neural Networks and Language Models Backdoor attacks embed hidden behavior into a neural network that remains dormant on ordinary inputs but is activated by an attacker-chosen trigger. Early work showed that backdoored networks can maintain strong performance on clean validation data while producing targeted outputs when the trigger is present [17]. Subsequent attacks demonstrated that backdoors can be inserted through model retraining, selected neurons, or internal representations [18]. Accordingly, backdoors are not confined to a single architectural location: they may be associated with input patterns, embeddings, intermediate neurons, attention or MLP blocks, residual-stream activations, or other latent spaces [19, 20]. This makes detection dependent not only on output behavior but also on the internal component through which the behavior is implemented. Language models exhibit the same vulnerability pattern, with backdoors introduced through poisoned training data, full-parameter fine-tuning, parameter-efficient adapters, manipulated embeddings, or prompt- and context-level interventions [21, 3, 22, 23, 24]. Recent work further shows that LoRA adapters can preserve clean task performance while activating a backdoor for trigger-related tokens [25]. Sleeper-agent attacks provide a particularly relevant example of conditional LLM behavior. Hubinger et al. [3] trained models that generated secure code when prompted with the year 2023 but inserted exploitable code when prompted with 2024, with the behavior persisting through several forms of safety training. These results highlight the difficulty of detecting backdoors that remain dormant during standard evaluations and motivate examining reusable model components, including SAEs, as potential locations for hidden behavior. Our setting imposes a particularly restrictive modification budget compared with conventional LLM backdoors. Existing attacks may alter model parameters, adapters, embeddings, or other internal components, potentially affecting representations across multiple layers. In contrast, our attacker cannot modify the language model at all and is restricted to changing a single SAE inserted at one fixed layer. Demonstrating backdoor behavior under this constraint therefore tests whether a localized auxiliary component alone can induce persistent downstream behavioral changes. I-B Activation Steering Activation steering modifies a modelās internal representations to influence its behavior at inference time. A common approach is to add a direction associated with a desired property to the residual stream or another hidden representation [26]. Such directions can be obtained from contrasting activations, probes, manually selected features, or learned interventions. Activation steering has been used to control properties such as sentiment, truthfulness, refusal, and instruction following without updating the underlying language-model weights. Recent work has connected activation steering to prompt-based control. Heyman and Vandeputte [9] argue that prompting can be viewed as a form of activation steering and train interventions that approximate the effects of prompt-induced behavior. This perspective is directly relevant to our work because it shows how an additional instruction can be represented as a latent intervention rather than being supplied explicitly in the input. Although activation steering is often presented as an interpretable and lightweight alternative to fine-tuning, it can also create a security risk. Trojan Activation Attack injects malicious steering vectors into model activations to induce attacker-chosen behavior [10]. More recent work shows that even apparently benign activation directions, including directions derived from SAEs, can weaken model safety mechanisms [11]. These attacks generally require direct access to the inference process or to the modelās hidden states. Our work considers a different threat model in which the intervention is embedded into a distributed SAE component. Fig. 1: Training a decoder-only SAE backdoor in a teacherāstudent setup. The frozen language model without an SAE acts as the teacher and generates variants of the target instruction, which are paired with ordinary tasks to produce target answers exhibiting the desired behavior. Successful teacher answers become training targets for the student, which consists of the same frozen language model with the SAE inserted into its forward pass. The student receives the task without the target instruction, and answer-token loss updates only the SAE decoder. For trigger-dependent insertion, the cue remains in the student prompt; years illustrate one possible cue. I-C Sparse Autoencoders for Interpretation and Control Sparse autoencoders are used to decompose language-model activations into sparse, overcomplete representations. By reconstructing activations from a small number of active latent features, SAEs aim to expose concepts that are more interpretable than the modelās native neurons [27]. Scaling work has shown that larger SAEs and controlled sparsity can improve the reconstructionāsparsity tradeoff and the quality of learned features [6]. The decoder columns provide directions in the modelās activation space, making the SAE useful not only for analysis but also for feature-level interventions. Recent work has also explored training SAEs with objectives that are defined by the downstream language-model behavior rather than solely by local activation reconstruction. Braun et al. [28] introduce end-to-end sparse dictionary learning, in which the SAE is inserted into the frozen language model and trained to minimize the KL divergence between the original and reconstructed output distributions. Their results suggest that this objective can identify features that are more functionally important to the model while maintaining interpretability. Karvonen [29] subsequently shows that a short KL+MSE fine-tuning stage can recover much of the benefit of full end-to-end training at substantially lower computational cost. These works demonstrate that SAE parameters can be optimized using model-level behavioral objectives. In contrast, our work uses such an intervention to induce attacker-chosen behavior: only the SAE decoder is fine-tuned, while the encoder mapping and underlying language model remain unchanged. SAE-based interventions have been used to modify model behavior by amplifying, suppressing, or clamping selected features. For example, SAE features have been used to steer language-model refusal behavior, although such interventions can also degrade general capabilities and increase unwanted refusals [7]. SAEBench provides a broader evaluation framework covering reconstruction, sparsity, interpretability, feature disentanglement, and downstream applications [8]. These evaluations are important because an SAE may appear successful according to conventional proxy metrics while failing to provide reliable behavioral control. Recent work has also raised concerns about the robustness of SAE representations. Small input perturbations can manipulate SAE features without substantially changing the underlying model activations, and fine-tuning can repurpose existing SAE features in instruction-tuned models [30, 31]. However, prior work has primarily studied attacks on the inputs to an SAE or the use of SAE features as steering directions. It has not examined the SAE decoder itself as a supply-chain attack surface. We address this gap by fine-tuning only the decoder of a pretrained SAE to encode attacker-chosen behavior while leaving the encoder mapping and language-model parameters unchanged. I-D SAEs and Backdoors in Code Generation Sparse autoencoders have recently been used to study language models on programming tasks. Tahimic and Cheng [32] identify SAE directions associated with code correctness and show that these directions can predict incorrect generations. They also study their causal role through activation steering. Steering along these directions can correct some erroneous programs, although it can also corrupt programs that were previously correct. Their results show that SAE representations capture behaviorally relevant properties of code generation and can support interventions on code-generation behavior. Our work studies a security setting in which the SAE itself may be maliciously modified. We examine how a compromised SAE can alter code-generation behavior when deployed alongside an unchanged language model. More generally, neural code models have been studied extensively in the context of poisoning and backdoor attacks. Schuster et al. [1] show that poisoning the training corpus of neural code-completion models can influence their suggestions in attacker-chosen contexts, including causing targeted insecure completions. Aghakhani et al. [2] introduce covert poisoning attacks against code-suggestion models, including TrojanPuzzle, which omits parts of the malicious payload from the poisoned examples while still causing the model to generate the complete payload. Yang et al. [33] study stealthy backdoors in pretrained code models using adaptive triggers and evaluate their attack on code summarization and method-name prediction. Wang et al. [34] systematically study factors that affect backdoor effectiveness in Code LLMs using code summarization as the evaluation task. Sun et al. investigate defenses against code-model backdoors, covering the detection of poisoned training samples [35] and the elimination of learned backdoors [36]. Xiao et al. [37] study an attack in which a poisoned pretrained code encoder transfers its backdoor to downstream models even when subsequent fine-tuning uses clean data. Across these attack settings, the compromised component is the code model or the data used to train it. Our attack places the malicious behavior in an auxiliary SAE while leaving the language model unchanged, extending the backdoor threat model to interpretability components deployed alongside a base model. I Methodology I-A Threat model We consider a deployment setting in which a practitioner obtains a pretrained sparse autoencoder (SAE) checkpoint for a particular language model and insertion layer. The practitioner may validate reported reconstruction or feature properties before inserting the SAE into the model for feature analysis or steering. The defender controls the prompt, language model, tokenizer, and inference pipeline, but relies on the externally supplied SAE checkpoint. Once inserted, the SAE determines the reconstructed activation passed to subsequent model layers. The attacker acts before deployment by publishing a modified version of such an SAE checkpoint. The attacker has white-box access to the SAE architecture, checkpoint, and training procedure, as well as to the corresponding language model, tokenizer, and insertion layer. The attacker can assemble training data, generate target answers with the language model, run the model with the SAE in its forward path, and use gradients through the frozen model to optimize the SAE. The attacker can modify the distributed SAE checkpoint, but cannot modify the language-model weights or the defenderās inference code and does not require access to the defenderās private prompts or evaluation data. After the checkpoint has been deployed, the attacker has no further access to the inference process. All attacker-controlled behavioral change must therefore be mediated through a single SAE intervention at one insertion layer. The attackerās objective is to make ordinary programming prompts elicit a chosen payload without an explicit instruction to include it. In the conditional setting, the attacker instead seeks insertion only when a designated cue is active. In both settings, the attack aims to preserve the defenderās existing feature-editing workflow while limiting disruption to ordinary tasks. I-B SAE intervention Let F0F_0 be the frozen reference language model, and let an SAE at layer ā have encoder EĻE_Ļ and decoder DĪøD_Īø. For a hidden state hāh_ , the SAE computes z=EĻā(hā),h^ā=DĪøā(z).z=E_Ļ(h_ ), h_ =D_Īø(z). (1) The SAE reconstruction replaces the residual-stream activation at layer ā starting at the last prompt token, which predicts the first completion token, and at subsequent completion positions. Earlier prompt positions are left unchanged. We fine-tune only the decoder matrix WdecW_dec and its independent output bias bdecb_dec to preserve the pretrained encoderās feature mapping. The encoder and all parameters of F0F_0 remain frozen. If a decoder bias is also used to center the encoder input, it is frozen. Thus, for any fixed hidden state hāh_ , the sparse code z=EĻā(hā)z=E_Ļ(h_ ) is unchanged, while its reconstruction DĪøā(z)D_Īø(z) can change. I-C Decoder-only manipulation The decoder-only restriction also exposes a distinction between feature identification and feature effect. Because the encoder and feature-selection mechanism remain frozen, fine-tuning does not alter the sparse code z=EĻā(hā)z=E_Ļ(h_ ) produced for a fixed activation. Instead, it changes the mapping from that code back into the language modelās activation space. Thus, preservation of the encoded feature representation does not imply preservation of the downstream effect of reconstructing that representation. This distinction is security-relevant because inspecting feature activations alone cannot establish that the decoder maps those features back to behaviorally equivalent model states. I-D Constructing target answers Figure 1 outlines the methodology. We cast the attack training procedure as a teacherāstudent setup. The frozen language model without the modified SAE serves as the teacher: it is prompted with an explicit attacker-chosen instruction to generate target completions that exhibit the desired behavior. The student is the same frozen language model with the SAE inserted into its forward pass. During training, the student receives the original task without the attacker instruction and is optimized to reproduce the teacherās target completion by updating only the SAE decoder. The attacker first specifies a target instruction a describing the desired change to the answer. For the code-insertion experiments, an example is an instruction to include print("Hello World") in the generated solution. We use M semantically similar formulations =ajj=1MA=\a_j\_j=1^M of this instruction. Prompt variation is motivated by Heyman et al.ās work on learning latent interventions from prompt-induced behavior [9]. Let =xii=1NX=\x_i\_i=1^N be a set of ordinary tasks, such as programming prompts. Each task is paired with each instruction variant, giving NāMNM augmented prompts xiāajx_i a_j, where ā denotes the chosen prompt-composition format. Before SAE fine-tuning, the frozen reference model generates and stores a target answer for each pair: yiāj+=Generateā”(F0,xiāaj),i=1,ā¦,Nj=1,ā¦,M.y_ij^+=Generate\! (F_0,\,x_i a_j ), subarrayci=1,ā¦,N\\ j=1,ā¦,M subarray. (2) The corresponding student input remains the original task xix_i. We retain a pair only when its target answer is nonempty and passes the benchmarkās check for the desired behavior. The accepted answers are fixed throughout decoder fine-tuning. I-E Decoder-only behavioral fine-tuning Let ā+I_+ contain the indices of accepted taskāinstruction pairs. For unconditional insertion, the training set is uncond=(xi,yiāj+):(i,j)āā+.D_uncond= \(x_i,y_ij^+):(i,j) _+ \. (3) The additional instruction aja_j is absent from the student prompt. Let pSAE(ā ā£ā ;Īø)p_SAE(Ā· Ā·;Īø) denote the next-token distribution of F0F_0 with the SAE inserted at layer ā . Under teacher forcing, we average the negative log-likelihood over tokens within each target answer and then average equally over answers: ā(Īø;)=ā1||ā(x,y)ā1|y|āt=1|y|logpSAE(ytā£x,y<t;Īø).L(Īø;D)=- 1|D| _(x,y) 1|y| _t=1^|y| p_SAE\! (y_t x,y_<t;Īø ). (4) I-F Trigger-dependent behavior The same approach can condition the attack on a cue in the task context. Let xi0x_i^0 and xi1x_i^1 denote versions of task xix_i with an inactive and an active cue, respectively. We pregenerate an ordinary answer for the inactive context and a payload-bearing answer for the active context: yi0 y_i^0 =Generateā”(F0,xi0), =Generate\! (F_0,\,x_i^0 ), (5) yiāj1 y_ij^1 =Generateā”(F0,xi1āaj). =Generate\! (F_0,\,x_i^1 a_j ). (6) Let ācondI_cond contain only pairs where for one element the inactive completion is nonempty and target behavior is omitted and the other elements active completion is nonempty and the target behavior is exhibited. The inactive answer is reused for each accepted instruction variant of a task. The student receives the corresponding task context without aja_j in either condition. Its training collection retains one record for each condition of every accepted pair: cond=āØ(i,j)āācond(xi0,yi0),(xi1,yiāj1).D_cond= _(i,j) _cond \(x_i^0,y_i^0),(x_i^1,y_ij^1) \. (7) The conditional objective is āā”(Īø,cond)L(Īø;D_cond) from Eq. (4); the two conditions contribute equally because every accepted pair supplies one record for each. No explicit cue-dependent intervention gate is used. At inference time, the student receives only the task context, never the instruction to add the payload. Our experiments instantiate the two contexts with year prefixes, following [3]; the objective itself does not depend on the choice of cue. IV Experiments IV-A Experimental implementation IV-A1 Models and sparse autoencoders We implement the decoder-only training procedure from Section I using Gemma 3 4B Instruct [12, 38], Qwen3 1.7B [13, 39], and Llama 3.1 8B Instruct [14, 40]. Gemma 3 is paired with an instruction-tuned JumpReLU sparse autoencoder from Gemma Scope 2 [41, 42]. Qwen3 is paired with a TopK sparse autoencoder from Qwen-Scope [43, 44], trained on the Qwen3 1.7B base model. Llama 3.1 is paired with a JumpReLU sparse autoencoder from Llama Scope [45, 46], trained on the corresponding base model. In the latter two cases, we therefore apply base-model SAEs to their respective conversational language models. This follows prior evidence that SAEs trained on base models can retain substantial reconstruction fidelity when transferred to corresponding chat or instruction-tuned models [47, 48]. We use one SAE configuration per model and compare original and modified checkpoints at multiple residual-post insertion layers under identical generation settings. Throughout decoder training, the language-model parameters and SAE encoder remain frozen. IV-A2 Decoder-backdoor training For each run, we randomly select 25 HumanEval programming tasks [15] and pair each task with 10 fixed phrasings of the payload instruction. This produces 250 candidate taskāinstruction pairs for unconditional insertion. For the conditional experiment, we use Current year: 2023. as the inactive cue and Current year: 2024. as the active cue, resulting in 500 candidate records. The frozen language model generates teacher answers, after which the text criterion described in Section I removes unsuccessful answers before decoder training. In the conditional setting, both contexts belonging to a taskāinstruction pair are retained or discarded together. The student input contains the original programming task and, in the conditional experiment, the corresponding year prefix, but never the payload instruction. We optimize only the SAE decoder using a learning rate of 3Ć10ā53Ć 10^-5 for 10 epochs for every model and insertion layer. The 25 HumanEval tasks used for training are excluded from evaluation, leaving 139 tasks for evaluating the decoder-based method. IV-A3 LoRA backdoor baselines To compare our modified SAEs with a conventional parameter-efficient backdoor, we train LoRA adapters using the BackdoorLLM framework [16]. Following the default BackdoorLLM configuration, we fine-tune one adapter per model using a learning rate of 5.0Ć10ā55.0Ć 10^-5, rank r=8r=8, and 3 training epochs. Because preliminary testing indicated that smaller task splits failed to achieve reliable backdoor convergence for the LoRA baselines, we expanded the dataset to 131131 programming tasks from HumanEval. Pairing each task with 1010 fixed phrasings of the payload instruction produces 1,3101,310 candidate taskāinstruction pairs for unconditional insertion and 2,6202,620 pairs for conditional insertion. The remaining 33 HumanEval tasks are reserved for evaluation of the LoRA baselines. IV-B Evaluation protocol IV-B1 Backdoor success and task performance We use print("Hello World") as an identifiable experimental payload. Our primary attack-success metric is the presence of a matching print call in the generated text. For the unconditional SAE experiment, we additionally report executed-print ASR: the fraction of all 139 held-out tasks whose generated solutions emit an exact Hello World output line during HumanEval evaluation. An observed print counts even if the solution subsequently fails a test or raises an exception. We also measure HumanEval functional correctness. We compare the base language model, the original SAE, the modified SAE, and the LoRA backdoor baseline in terms of generated-text insertion rate and HumanEval functional correctness. For conditional attacks, we additionally report insertion under the active cue, false-trigger rate under the inactive cue, and paired success. Paired success requires the desired behavior in both contexts of the same task: payload insertion under the active cue and no insertion under the inactive cue. IV-B2 SAEBench evaluation We use SAEBench [8] to evaluate whether decoder-only backdoor training affects the apparent quality or intervention utility of a compromised SAE. SAEBench comprises eight evaluations spanning reconstruction, concept detection, interpretability, and feature disentanglement. Because running the full suite across every model and insertion layer would be computationally prohibitive, we restrict our analysis to evaluations most directly sensitive to changes in the SAE decoder: the core reconstruction and sparsity evaluation, Spurious Correlation Removal (SCR), and Targeted Probe Perturbation (TPP). First, we run SAEBenchās core evaluation suite, which corresponds to the standard sparsityāfidelity evaluation and reports Loss Recovered alongside reconstruction and sparsity metrics. This evaluation is directly relevant to our setting because decoder modification changes the reconstructed activation passed to subsequent language-model layers, and can therefore affect both reconstruction fidelity and downstream loss. In contrast, for a fixed input activation, the sparse codeāand hence its ā0 _0āis unchanged, since the encoder and feature-selection mechanism are frozen. For the same reason, we omit Sparse Probing, Feature Absorption, and Automated Interpretability. These evaluations depend primarily on the encoded feature representation or on the examples that activate individual features. Because our attack leaves the encoder, activation thresholds, and feature-selection rule unchanged, these quantities are not directly affected by decoder-only training. Second, we evaluate Spurious Correlation Removal (SCR) and Targeted Probe Perturbation (TPP), which assess the effectiveness and selectivity of SAE-feature interventions and are therefore directly sensitive to decoder changes. SCR measures whether interventions on SAE features can remove a spurious correlation while recovering performance on the intended task, whereas TPP measures whether an intervention selectively affects a designated class while minimizing effects on other classes. Together, these evaluations test whether the modified SAE preserves useful and selective feature-control behavior after decoder training. RAVEL and Unlearning likewise evaluate selective SAE-feature interventions. We omit them because SCR and TPP probe closely related intervention properties while operating in settings that are more directly relevant to our analysis; RAVEL and Unlearning instead focus on benchmark domains that are comparatively distant from our code-generation setting. This also reduces evaluation cost without sacrificing coverage of the intervention properties most likely to be affected by decoder-only modification. IV-C RQ1: Model and layer dependence We use the unconditional code-insertion experiment to examine how attack success depends on the language model and SAE insertion layer. At each layer, the base model, original SAE, and compromised SAE are evaluated on the same programming tasks. We compute attack success rate (ASR) from the generated completions using the print-call criterion described above. Neither the base model nor the original SAE produces a matching call on these prompts, so their ASR is 0% at every evaluated layer. Fig. 2: Unconditional code-insertion ASR by SAE insertion layer with the fine-tuned SAE inserted. Gemma 3 4B IT, Qwen3 1.7B, and Llama 3.1 8B Instruct have 34, 28, and 32 evaluated layers, respectively. TABLE I: Unconditional code-insertion ASR across SAE layers. Minima, medians, and maxima summarize evaluated layers within each model. Model Layers Min Median Max Best ā Gemma 3 4B IT 34 84.2 92.4 98.6 3,4,6,7 Qwen3 1.7B 28 66.9 87.8 95.0 15 Llama 3.1 8B Instruct 32 50.4 88.1 97.8 11 TABLE I: Mean unconditional insertion ASR (%) by relative model depth. Early, middle, and late are consecutive thirds of layer indices; each mean weights layers equally. LoRA reports the unconditional LoRA baseline. Model Early Middle Late LoRA Gemma 3 4B IT 96.5 91.8 88.4 93.9 Qwen3 1.7B 83.3 92.1 77.5 97.0 Llama 3.1 8B Instruct 95.6 88.8 72.4 100.0 Figure 2 shows that the compromised SAE induces insertion at every evaluated layer, but the rate varies with placement. Across 34 Gemma 3 layers, ASR ranges from 84.2% to 98.6%, with a median of 92.4%. Across 28 Qwen3 layers, it ranges from 66.9% to 95.0%, with a median of 87.8%. Across 32 Llama 3.1 layers, ASR ranges from 50.4% to 97.8%, with a median of 88.1% (Table I). The highest Gemma 3 rate occurs at layers 3, 4, 6, and 7; Qwen3 reaches its maximum at layer 15, and Llama 3.1 at layer 11. Meanwhile, the LoRA-trained backdoor achieves an ASR of 93.94%, 96.97%, and 100% on Gemma 3, Qwen3, and Llama 3.1, respectively. The depth pattern differs between the three modelāSAE sweeps. Averaged over consecutive thirds of each modelās layers, Gemma 3 and Llama 3.1 have their highest insertion rates in early layers, whereas Qwen3 has its highest rate in middle layers (Table I). Qwen3 ASR changes substantially across adjacent insertion layers, increasing from 66.9% at layer 4 to 91.4% at layer 5. This sensitivity makes the insertion layer an important experimental choice. In particular, performance at one layer should not be assumed to transfer to neighboring layers. In addition, differences in the pretrained SAE architectures across models mean that the observed cross-model differences cannot be attributed to language-model weights alone. Fig. 3: HumanEval pass rates and attack-success rates by SAE insertion layer in the unconditional experiment. Pass rates compare the base LLM, original SAE, and fine-tuned SAE; generated-text and executed-print ASR both describe the fine-tuned SAE. Payload execution does not require passing the task tests. TABLE I: HumanEval pass rates (%) in the unconditional experiment. SAE entries show median (minimumāmaximum) across layers. Model Base LLM Original SAE Fine-tuned SAE Paired change (p) Gemma 3 4B IT 70.5 66.2 (33.8ā74.8) 64.7 (38.1ā72.7) -1.4 Qwen3 1.7B 68.3 63.7 (48.9ā71.9) 64.4 (54.0ā71.9) -0.4 Llama 3.1 8B Instruct 67.6 20.1 (0.0ā68.3) 33.8 (14.4ā61.2) +12.2 Answer to RQ1. The compromised SAE induces insertion at every evaluated layer, with median ASR of 92.4% for Gemma 3, 87.8% for Qwen3, and 88.1% for Llama 3.1. Success varies substantially with insertion layer, and the depth pattern differs across models. These results establish decoder-only SAE manipulation as a viable attack across all three evaluated models, while showing that insertion-layer choice affects its strength. IV-D RQ2: Functional correctness We compare HumanEval correctness for the base LLM, original SAE, and fine-tuned SAE on the same tasks (Table I). To measure the effect of decoder fine-tuning, we subtract the original SAE pass rate from the fine-tuned SAE pass rate at each insertion layer, then take the median of those paired differences. The original SAE itself changes task performance, particularly at middle Gemma 3 layers and across the Llama 3.1 layers (Fig. 3). Decoder fine-tuning has little effect on pass rates for Gemma 3 and Qwen3: the median paired changes across layers are ā1.4-1.4 and ā0.4-0.4 percentage points, respectively. For Llama 3.1, the median pass rate rises from 20.1% to 33.8%, a difference of 13.7 percentage points. The median of the within-layer improvements is +12.2+12.2 percentage points. Performance remains well below the base LLMās 67.6% pass rate (Table I). The LoRA-based backdoor passes 48.48%, 51.52%, and 51.52% of tasks for Gemma 3, Qwen3, and Llama 3.1, respectively, also below each base LLM. Payload execution Figure 3 places generated-text and executed-print ASR alongside functional correctness. Across insertion layers, median executed-print ASR is 90.6% for Gemma 3, 83.8% for Qwen3, and 70.1% for Llama 3.1, compared with median text-insertion rates of 92.4%, 87.8%, and 88.1%, respectively. The larger separation for Llama accompanies substantial correctness degradation that is already present with the original SAE. This is consistent with checkpoint quality limiting payload execution. Execution and correctness measure distinct outcomes: a program may emit the payload and still fail the task tests, while a textual insertion may appear in code that is invalid or never reached. We therefore retain text-insertion ASR as the primary measure of control over generated content and use executed-print ASR to quantify how often the payload is observed under the evaluation harness. Answer to RQ2. Decoder fine-tuning changes median HumanEval pass rates little for Gemma 3 and Qwen3 relative to their original SAEs (ā1.4-1.4 and ā0.4-0.4 percentage points). Llama 3.1 gains 12.212.2 points, but its fine-tuned SAE still performs well below the base LLM. Strong insertion can therefore coexist with little additional loss of functional correctness relative to the original SAE. IV-E RQ3: SAE quality after decoder fine-tuning We compare original and fine-tuned SAEs using the core, SCR, and TPP evaluations introduced above. We manually selected layers from early, middle, and late parts of each modelās insertion-layer sweep, favoring layers with relatively high insertion success compared with nearby layers. The available paired reports cover Gemma 3 layers 7, 13, and 31; Qwen3 layers 5, 13, and 19; and Llama 3.1 layers 4, 13, and 20. Core evaluation uses OpenWebText with context length 128, with 409,600 token positions for loss evaluation and 4,096,000 for sparsity and reconstruction. SCR and TPP use the Bias in Bios and Amazon Reviews datasets, with the same evaluation configuration within each originalāfine-tuned pair. TABLE IV: SAEBench core metrics for original and fine-tuned SAEs. Model Layer LR (%) L0L_0 Ī (%) Original Fine-tuned Ī (p) Original Fine-tuned Gemma 3 4B IT 7 98.7798.77 98.9598.95 +0.18+0.18 115.88115.88 115.87115.87 +0.45+0.45 13 99.3099.30 99.6599.65 +0.35+0.35 139.11139.11 139.11139.11 +0.00+0.00 31 94.7494.74 94.7494.74 +0.00+0.00 122.45122.45 122.45122.45 +0.49+0.49 Qwen3 1.7B 5 21.5221.52 17.8117.81 ā3.71-3.71 100.00100.00 100.00100.00 +0.62+0.62 13 63.8263.82 62.7162.71 ā1.11-1.11 100.00100.00 100.00100.00 +1.48+1.48 19 76.8176.81 60.4860.48 ā16.33-16.33 100.00100.00 100.00100.00 +4.17+4.17 Llama 3.1 8B Instruct 4 98.5898.58 98.4098.40 ā0.18-0.18 33.0633.06 33.0533.05 +0.00+0.00 13 96.8196.81 96.4596.45 ā0.35-0.35 32.9432.94 32.9532.95 +0.00+0.00 20 96.1096.10 95.5795.57 ā0.53-0.53 33.9633.96 33.9733.97 +2.78+2.78 TABLE V: SCR and TPP scores with 20 ablated features. Model Layer SCR TPP Original Fine-tuned Ī (%) Original Fine-tuned Ī (%) Gemma 3 4B IT 7 0.2740.274 0.2730.273 ā0.13-0.13 0.0780.078 0.0800.080 +2.07+2.07 13 0.0790.079 0.0750.075 ā5.58-5.58 0.1000.100 0.1030.103 +2.77+2.77 31 0.2900.290 0.2890.289 ā0.37-0.37 0.0750.075 0.0730.073 ā2.98-2.98 Qwen3 1.7B 5 0.0650.065 0.0540.054 ā17.35-17.35 0.1180.118 0.1210.121 +2.14+2.14 13 0.2460.246 0.2440.244 ā0.95-0.95 0.0730.073 0.0670.067 ā8.00-8.00 19 0.3650.365 0.3670.367 +0.69+0.69 0.1120.112 0.1180.118 +5.37+5.37 Llama 3.1 8B Instruct 4 0.0870.087 0.0900.090 +3.54+3.54 0.0290.029 0.0310.031 +5.49+5.49 13 0.1130.113 0.1120.112 ā1.26-1.26 0.0180.018 0.0180.018 ā0.55-0.55 20 0.1360.136 0.1360.136 +0.21+0.21 0.0240.024 0.0230.023 ā0.21-0.21 Fig. 4: Original and fine-tuned SAE scores on SCR and TPP across the saved feature-ablation budgets. Colors identify insertion layers. Solid lines with open circles denote original SAEs and dashed lines with crosses denote fine-tuned SAEs. The paired curves largely overlap. Vertical scales are shared across models within each row. Table IV reports loss recovered (LR), mean feature sparsity L0L_0, and the relative change in reconstruction MSE for original and fine-tuned SAEs. LR is reported as a percentage, its paired change in percentage points, and L0L_0 as the mean number of active features. The tableās MSE column gives the relative percentage change, 100ā(MSEFT/MSEorigā1)100(MSE_ FT/MSE_ orig-1). Loss recovered is (āablatedāāSAE)/(āablatedāābase)(L_ ablated-L_ SAE)/(L_ ablated-L_ base), where āL denotes next-token cross-entropy; higher values indicate better preservation of model performance. Gemmaās loss recovered changes by 0.00 to +0.35+0.35 percentage points, while Llamaās decreases by 0.18 to 0.53 points. Qwen shows larger reductions: 3.71, 1.11, and 16.33 points at layers 5, 13, and 19, respectively. Its layer-19 score falls from 76.81% to 60.48%. Thus, preserving loss recovered is possible at some checkpoints but is not a uniform property of the attack. The original Qwen checkpoints also have substantially lower loss-recovery scores than the original Gemma and Llama checkpoints, underscoring the importance of comparison against each layerās own baseline. The reported reconstruction MSE increases by at most 0.49% for Gemma, 4.17% for Qwen, and 2.78% for Llama. Some change in reconstruction fidelity is expected: decoder fine-tuning is intended to shift the reconstructed model activations so that they induce the behavior specified by the target instruction. The objective in Eq. (4) optimizes answer-token likelihood without a reconstruction penalty. These MSE increases and the loss-recovery changes therefore quantify the fidelity cost accompanying the learned intervention. Feature selection, by contrast, is preserved by the frozen encoder for fixed input activations. Qwenās TopK rule fixes k=100k=100 and retains the 100 largest encoder values per token, so its reported L0=100L_0=100 follows from the architecture. Across all evaluated checkpoints, the largest absolute paired difference in mean L0L_0 is below 0.008 active features. Table V compares original and fine-tuned SCR and TPP scores with 20 ablated features. Both metrics are dimensionless. SCR measures the fraction of the accuracy gap to a clean probe recovered by feature ablation. TPP is the target-class probe-accuracy decrease minus the mean decrease for other classes, averaged over target classes. Accuracies are expressed as fractions, so a TPP score of 0.01 corresponds to a one-percentage-point difference. Higher values indicate better performance for both metrics. Each Ī column gives the relative percentage change, 100ā(scoreFT/scoreorigā1)100(score_ FT/score_ orig-1), calculated before rounding. As Fig. 4 shows, the original and fine-tuned feature-intervention curves largely overlap across all seven saved budgets, from 2 to 500 features. The remaining differences occur in both directions. At the common budget of 20 ablated features, the largest absolute SCR change is 0.0113 and the largest absolute TPP change is 0.0060. Across all budgets and available layers, the largest absolute changes are 0.0409 for SCR and 0.0107 for TPP, both at Qwen layer 19. These measurements show that the attack need not substantially disrupt the measured feature-intervention scores, although their absolute levels vary across checkpoints. At these same nine layers, text-insertion ASR ranges from 85.6% to 98.6%. High insertion success can therefore coexist with small changes in several conventional SAE metrics. Conversely, the Qwen loss-recovery reductions provide a visible quality cost. Answer to RQ3. Decoder fine-tuning preserves feature selection for fixed inputs and can achieve high insertion success with small changes in measured feature-intervention scores. Reconstruction and loss-recovery costs vary across checkpoints. These findings show that conventional SAE quality metrics can remain largely intact despite altered model behavior. IV-F RQ4: Reliability of conditional insertion We evaluate whether the compromised SAE distinguishes the active cue, Current year: 2024., from the inactive cue, Current year: 2023.. Each held-out task is evaluated in both contexts. The conditional sweep covers all 34 Gemma 3, 28 Qwen3, and 32 Llama 3.1 layers. The same fine-tuned checkpoint is used for both years, without a year-dependent intervention gate. We report active-cue insertion, false triggers under the inactive cue, and paired success: insertion in 2024 and no insertion in 2023 for the same task. Paired success is computed directly from task pairs, rather than by subtracting the two insertion rates. Neither the base LLM nor the original SAE inserts the payload in either context at any evaluated layer. Table VI summarizes active-cue insertion, false triggers, and paired success as median (minimumāmaximum) percentages over layers. Its Gap column reports the median of the within-layer difference between active- and inactive-cue insertion rates, in percentage points. TABLE VI: Conditional text insertion with the fine-tuned SAE. Model Layers Active cue (%) False trigger (%) Paired success (%) Gap (p) Gemma 3 4B IT 34 29.529.5 (1.41.4ā98.698.6) 5.45.4 (0.00.0ā29.529.5) 9.09.0 (0.00.0ā98.698.6) 7.27.2 Qwen3 1.7B 28 41.741.7 (19.419.4ā64.764.7) 31.731.7 (15.815.8ā50.450.4) 10.110.1 (2.92.9ā38.138.1) 8.68.6 Llama 3.1 8B Instruct 32 73.773.7 (28.128.1ā97.897.8) 49.649.6 (21.621.6ā79.179.1) 14.014.0 (6.56.5ā68.368.3) 8.68.6 Fig. 5: Conditional text insertion across SAE layers with the fine-tuned SAE. Active-cue insertion and false triggers measure insertion in 2024 and 2023, respectively; paired success requires the desired behavior in both contexts of the same task. Active-cue insertion and paired success overlap when there are no false triggers. Gemma 3 exhibits reliable conditional behavior at several early layers (Fig. 5). Across layers 0ā9, active-cue insertion ranges from 95.0% to 98.6%, false triggers from 0.0% to 2.2%, and paired success from 95.0% to 98.6%. At layer 6, active-cue insertion reaches 98.6% with no false triggers, yielding 98.6% paired success. This behavior does not persist across the full sweep: paired success drops to 7.9% at layer 10 and 12.2% at layer 11, recovers to 90.6% at layer 12, and varies substantially thereafter. Consequently, Gemmaās median paired success across all layers is only 9.0% (Table VI). Qwen3 and Llama 3.1 distinguish the cues less reliably. Qwenās median active-cue insertion is 41.7%, alongside a 31.7% median false-trigger rate and 10.1% median paired success. Its highest paired success is 38.1% at layer 14, where active-cue insertion is 60.4% and false triggers occur on 23.0% of tasks. Llama has a higher median active-cue insertion rate of 73.7%, but also a 49.6% median false-trigger rate; median paired success is 14.0%. Its highest paired success is 68.3% at layer 7, with 97.8% active-cue insertion and 29.5% false triggers. These maxima describe the evaluated sweep and are not independently validated checkpoint selections. The conditional attack can therefore learn a sharp distinction between the two cues, as demonstrated by early Gemma layers, but this is not a consistent property across models or insertion layers. High active-cue insertion alone can conceal frequent insertion under the inactive cue. Answer to RQ4. The conditional SAE distinguishes the two year cues reliably at some early Gemma 3 layers, reaching 98.6% paired success with no false triggers at layer 6. Reliability varies sharply by layer and model; median paired success across all layers is 9.0% for Gemma 3, 10.1% for Qwen3, and 14.0% for Llama 3.1. Thus, cue-dependent behavior can be learned, but consistent cue distinction varies across configurations. V Security Implications and Possible Defenses Our results suggest that an SAE inserted into a modelās forward pass should be treated as an executable model component rather than solely as an interpretability artifact. Once its reconstruction replaces an internal activation, the SAE can directly affect downstream computation. Consequently, validating a downloaded SAE only through reconstruction, sparsity, or feature-level evaluations is insufficient to establish that the resulting LLMāSAE system preserves the behavior of the intended model. In our experiments, high insertion success can coexist with relatively small changes in several of the evaluated SAE quality and intervention metrics. A first line of defense is therefore checkpoint provenance and integrity. SAE releases can be distributed with cryptographic hashes, signed artifacts, and sufficiently detailed training metadata to make unintended checkpoint substitution easier to detect. Where practical, reproducible training or verification against checkpoints obtained from trusted sources could further reduce the supply-chain risk considered in our threat model. A second line of defense is behavioral validation of the composed LLMāSAE system. A candidate SAE can be compared with both the base model and a trusted SAE checkpoint over a diverse suite of prompts, rather than evaluated only as a representation-learning artifact. Such testing should include changes in generated content, task performance, and other downstream behaviors. Conditional backdoors additionally motivate varying context that should not materially change the task, such as metadata, formatting, or other benign prompt attributes, because evaluation on a single nominal context may fail to expose trigger-dependent behavior. Our experiments do not evaluate these defenses or establish detection thresholds, so their effectiveness remains an open question. More generally, the results motivate evaluating both the representational properties of an SAE and the behavioral consequences of inserting it into a language model. SAE-specific methods for screening checkpoints for behavioral backdoors remain an open research direction. VI Threats to Validity and Limitations SAE quality. A key limitation is the quality and availability of pretrained SAE checkpoints. Suitable checkpoints are scarce, and some already cause noticeable performance degradation before any backdoor modification. Similar scores also do not imply that a compromised SAE would evade other detection methods. Experimental design. The SAE results use one training split and one training run per model and insertion layer, so we do not estimate variation across splits, seeds, or repeated generations. The LoRA baselines additionally use a different train/test split and training budget, so differences cannot be attributed solely to the modified component. Optimization. Our goal is to demonstrate that a backdoor can be introduced through an SAE, not to find the strongest possible attack. Due to computational constraints, we did not exhaustively optimize hyperparameters, insertion layers, or other attack design choices. The reported attack-success rates should therefore be interpreted as lower-bound demonstrations of achievable backdoor performance rather than estimates of an optimum. Scope. Our study is limited to a single benign payload, HumanEval prompts, three language models, and one pretrained SAE configuration per model. The conditional attack is evaluated only with the specified 2023 and 2024 prefixes. Moreover, differences in SAE architecture and pretraining across models limit causal interpretation of cross-model comparisons. Generalization to other payloads, domains, triggers, and SAE families therefore remains to be established. VII Conclusion We demonstrate that a sparse autoencoder can itself serve as an effective backdoor mechanism. By modifying only the SAE decoder, while keeping both the SAE encoder and the underlying language model completely frozen, we induce attacker-chosen behavior across multiple models and insertion layers. In the unconditional setting, the compromised SAEs achieve high insertion rates across all three evaluated models, while the conditional experiments show that an SAE can also learn trigger-dependent behavior without any external gating mechanism. This result is particularly notable because SAE backdooring operates under substantially stronger constraints than conventional LLM backdoors. Traditional backdoor attacks can modify parameters distributed throughout the language model and thereby shape representations across many layers. In our setting, the attacker cannot modify the LLM at all: the intervention is confined to the decoder of a single SAE inserted at one particular layer. Nevertheless, this single modification is sufficient to produce strong changes in downstream generation. The attack therefore demonstrates that meaningful behavioral control does not require compromising the language model itself. This finding broadens the relevant attack surface from model parameters to auxiliary components that participate directly in inference. The effectiveness of the attack currently varies across models and insertion layers, particularly for conditional behavior, and the evaluated configurations should not be interpreted as optimal. Our experiments were designed to establish feasibility rather than to exhaustively optimize the attack. Despite these limitations, high insertion success is obtained under this restricted setting, suggesting that further optimization of training procedures, insertion layers, and SAE configurations could strengthen the attack beyond the results reported here. More broadly, our findings expose an important security implication of using SAEs as active components in model inference. An SAE may appear to be an auxiliary interpretability artifact, yet once its reconstruction is inserted into the forward pass, it becomes capable of directly influencing model behavior. A compromised SAE can therefore introduce attacker-chosen behavior while leaving the original language-model checkpoint untouched and preserving the existing SAE feature interface. As SAEs become increasingly used for interpretation and model control, their checkpoints should consequently be treated as security-sensitive components of the deployment pipeline rather than as passive analysis tools. VIII Ethical Considerations Our work studies a dual-use security vulnerability in sparse autoencoders. To limit potential harm, we use the benign payload print("Hello World") rather than an executable exploit or harmful behavior. The experiments are conducted on publicly available models and benchmarks and do not target deployed systems or real users. We release the methodology and artifacts to support reproducibility and further research on detecting and mitigating compromised SAE components. References [1] R. Schuster, C. Song, E. Tromer, and V. Shmatikov (2021) You autocomplete me: poisoning vulnerabilities in neural code completion. In 30th USENIX Security Symposium, USENIX Security 2021, August 11-13, 2021, M. D. Bailey and R. Greenstadt (Eds.), p. 1559ā1575. External Links: Link Cited by: Ā§I, Ā§I-D. [2] H. Aghakhani, W. Dai, A. Manoel, X. Fernandes, A. Kharkar, C. Kruegel, G. Vigna, D. Evans, B. Zorn, and R. Sim (2024) TrojanPuzzle: covertly poisoning code-suggestion models. In IEEE Symposium on Security and Privacy, SP 2024, San Francisco, CA, USA, May 19-23, 2024, p. 1122ā1140. External Links: Link, Document Cited by: Ā§I, Ā§I-D. [3] E. Hubinger, C. Denison, J. Mu, M. Lambert, M. Tong, M. MacDiarmid, T. Lanham, D. M. Ziegler, T. Maxwell, N. Cheng, A. Jermyn, A. Askell, A. Radhakrishnan, C. Anil, D. Duvenaud, D. Ganguli, F. Barez, J. Clark, K. Ndousse, K. Sachan, M. Sellitto, M. Sharma, N. DasSarma, R. Grosse, S. Kravec, Y. Bai, Z. Witten, M. Favaro, J. Brauner, H. Karnofsky, P. Christiano, S. R. Bowman, L. Graham, J. Kaplan, S. Mindermann, R. Greenblatt, B. Shlegeris, N. Schiefer, and E. Perez (2024) Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training. arXiv. External Links: 2401.05566, Document Cited by: Ā§I, Ā§I, Ā§I-A, Ā§I-A, Ā§I-F. [4] S. Marks, C. Rager, E. J. Michaud, Y. Belinkov, D. Bau, and A. Mueller (2025) Sparse feature circuits: discovering and editing interpretable causal graphs in language models. In The Thirteenth International Conference on Learning Representations, ICLR 2025, Singapore, April 24-28, 2025, External Links: Link Cited by: Ā§I. [5] H. Cunningham, A. Ewart, L. Riggs, R. Huben, and L. Sharkey (2023) Sparse Autoencoders Find Highly Interpretable Features in Language Models. arXiv. External Links: 2309.08600, Document Cited by: Ā§I. [6] L. Gao, T. Dupre la Tour, H. Tillman, G. Goh, R. Troll, A. Radford, I. Sutskever, J. Leike, and J. Wu (2025) Scaling and evaluating sparse autoencoders. International Conference on Learning Representations 2025, p. 26721ā26754. Cited by: Ā§I, Ā§I-C. [7] K. OāBrien, D. Majercak, X. Fernandes, R. G. Edgar, B. Bullwinkel, J. Chen, H. Nori, D. Carignan, E. Horvitz, and F. Poursabzi-Sangdeh (2025) Steering Language Model Refusal with Sparse Autoencoders. In ICML 2025 Workshop on Reliable and Responsible Foundation Models, Cited by: Ā§I, Ā§I-C. [8] A. Karvonen, C. Rager, J. Lin, C. Tigges, J. I. Bloom, D. Chanin, Y. Lau, E. Farrell, C. S. McDougall, K. Ayonrinde, D. Till, M. Wearden, A. Conmy, S. Marks, and N. Nanda (2025) SAEBench: A Comprehensive Benchmark for Sparse Autoencoders in Language Model Interpretability. In Forty-Second International Conference on Machine Learning, Cited by: Ā§I, Ā§I, Ā§I-C, Ā§IV-B2. [9] G. Heyman and F. Vandeputte (2026) Steer Like the LLM: Activation Steering that Mimics Prompting. In Forty-Third International Conference on Machine Learning, Cited by: Ā§I, Ā§I-B, Ā§I-D. [10] H. Wang and K. Shu (2024) Trojan Activation Attack: Red-Teaming Large Language Models using Activation Steering for Safety-Alignment. In Proceedings of the 33rd ACM International Conference on Information and Knowledge Management, CIKM 2024, Boise, ID, USA, October 21-25, 2024, E. Serra and F. Spezzano (Eds.), p. 2347ā2357. External Links: Document Cited by: Ā§I, Ā§I-B. [11] A. Korznikov, A. V. Galichin, A. Dontsov, O. Rogov, I. Oseledets, and E. Tutubalina (2026) The Rogue Scalpel: Activation Steering Compromises LLM Safety. In ICLR 2026 Workshop on Principled Design for Trustworthy AI - Interpretability, Robustness, and Safety across Modalities, Cited by: Ā§I, Ā§I-B. [12] G. Team, A. Kamath, J. Ferret, S. Pathak, N. Vieillard, R. Merhej, S. Perrin, T. Matejovicova, A. RamĆ©, M. RiviĆØre, L. Rouillard, T. Mesnard, G. Cideron, J. Grill, S. Ramos, E. Yvinec, M. Casbon, E. Pot, I. Penchev, G. Liu, F. Visin, K. Kenealy, L. Beyer, X. Zhai, A. Tsitsulin, R. Busa-Fekete, A. Feng, N. Sachdeva, B. Coleman, Y. Gao, B. Mustafa, I. Barr, E. Parisotto, D. Tian, M. Eyal, C. Cherry, J. Peter, D. Sinopalnikov, S. Bhupatiraju, R. Agarwal, M. Kazemi, D. Malkin, R. Kumar, D. Vilar, I. Brusilovsky, J. Luo, A. Steiner, A. Friesen, A. Sharma, A. Sharma, A. M. Gilady, A. Goedeckemeyer, A. Saade, A. Feng, A. Kolesnikov, A. Bendebury, A. Abdagic, A. Vadi, A. Gyƶrgy, A. S. Pinto, A. Das, A. Bapna, A. Miech, A. Yang, A. Paterson, A. Shenoy, A. Chakrabarti, B. Piot, B. Wu, B. Shahriari, B. Petrini, C. Chen, C. L. Lan, C. A. Choquette-Choo, C. J. Carey, C. Brick, D. Deutsch, D. Eisenbud, D. Cattle, D. Cheng, D. Paparas, D. S. Sreepathihalli, D. Reid, D. Tran, D. Zelle, E. Noland, E. Huizenga, E. Kharitonov, F. Liu, G. Amirkhanyan, G. Cameron, H. Hashemi, H. Klimczak-PluciÅska, H. Singh, H. Mehta, H. T. Lehri, H. Hazimeh, I. Ballantyne, I. Szpektor, I. Nardini, J. Pouget-Abadie, J. Chan, J. Stanton, J. Wieting, J. Lai, J. Orbay, J. Fernandez, J. Newlan, J. Ji, J. Singh, K. Black, K. Yu, K. Hui, K. Vodrahalli, K. Greff, L. Qiu, M. Valentine, M. Coelho, M. Ritter, M. Hoffman, M. Watson, M. Chaturvedi, M. Moynihan, M. Ma, N. Babar, N. Noy, N. Byrd, N. Roy, N. Momchev, N. Chauhan, N. Sachdeva, O. Bunyan, P. Botarda, P. Caron, P. K. Rubenstein, P. Culliton, P. Schmid, P. G. Sessa, P. Xu, P. Stanczyk, P. Tafti, R. Shivanna, R. Wu, R. Pan, R. Rokni, R. Willoughby, R. Vallu, R. Mullins, S. Jerome, S. Smoot, S. Girgin, S. Iqbal, S. Reddy, S. Sheth, S. PƵder, S. Bhatnagar, S. R. Panyam, S. Eiger, S. Zhang, T. Liu, T. Yacovone, T. Liechty, U. Kalra, U. Evci, V. Misra, V. Roseberry, V. Feinberg, V. Kolesnikov, W. Han, W. Kwon, X. Chen, Y. Chow, Y. Zhu, Z. Wei, Z. Egyed, V. Cotruta, M. Giang, P. Kirk, A. Rao, K. Black, N. Babar, J. Lo, E. Moreira, L. G. Martins, O. Sanseviero, L. Gonzalez, Z. Gleicher, T. Warkentin, V. Mirrokni, E. Senter, E. Collins, J. Barral, Z. Ghahramani, R. Hadsell, Y. Matias, D. Sculley, S. Petrov, N. Fiedel, N. Shazeer, O. Vinyals, J. Dean, D. Hassabis, K. Kavukcuoglu, C. Farabet, E. Buchatskaya, J. Alayrac, R. Anil, Dmitry, Lepikhin, S. Borgeaud, O. Bachem, A. Joulin, A. Andreev, C. Hardin, R. Dadashi, and L. Hussenot (2025) Gemma 3 Technical Report. arXiv. External Links: 2503.19786, Document Cited by: Ā§I, Ā§IV-A1. [13] A. Yang, A. Li, B. Yang, B. Zhang, B. Hui, B. Zheng, B. Yu, C. Gao, C. Huang, C. Lv, C. Zheng, D. Liu, F. Zhou, F. Huang, F. Hu, H. Ge, H. Wei, H. Lin, J. Tang, J. Yang, J. Tu, J. Zhang, J. Yang, J. Yang, J. Zhou, J. Zhou, J. Lin, K. Dang, K. Bao, K. Yang, L. Yu, L. Deng, M. Li, M. Xue, M. Li, P. Zhang, P. Wang, Q. Zhu, R. Men, R. Gao, S. Liu, S. Luo, T. Li, T. Tang, W. Yin, X. Ren, X. Wang, X. Zhang, X. Ren, Y. Fan, Y. Su, Y. Zhang, Y. Zhang, Y. Wan, Y. Liu, Z. Wang, Z. Cui, Z. Zhang, Z. Zhou, and Z. Qiu (2025) Qwen3 Technical Report. arXiv. External Links: 2505.09388, Document Cited by: Ā§I, Ā§IV-A1. [14] A. Grattafiori, A. Dubey, A. Jauhri, A. Pandey, A. Kadian, A. Al-Dahle, A. Letman, A. Mathur, A. Schelten, A. Vaughan, A. Yang, A. Fan, A. Goyal, A. Hartshorn, A. Yang, A. Mitra, A. Sravankumar, A. Korenev, A. Hinsvark, A. Rao, A. Zhang, A. Rodriguez, A. Gregerson, A. Spataru, B. Roziere, B. Biron, B. Tang, B. Chern, C. Caucheteux, C. Nayak, C. Bi, C. Marra, C. McConnell, C. Keller, C. Touret, C. Wu, C. Wong, C. C. Ferrer, C. Nikolaidis, D. Allonsius, D. Song, D. Pintz, D. Livshits, D. Wyatt, D. Esiobu, D. Choudhary, D. Mahajan, D. Garcia-Olano, D. Perino, D. Hupkes, E. Lakomkin, E. AlBadawy, E. Lobanova, E. Dinan, E. M. Smith, F. Radenovic, F. GuzmĆ”n, F. Zhang, G. Synnaeve, G. Lee, G. L. Anderson, G. Thattai, G. Nail, G. Mialon, G. Pang, G. Cucurell, H. Nguyen, H. Korevaar, H. Xu, H. Touvron, I. Zarov, I. A. Ibarra, I. Kloumann, I. Misra, I. Evtimov, J. Zhang, J. Copet, J. Lee, J. Geffert, J. Vranes, J. Park, J. Mahadeokar, J. Shah, J. van der Linde, J. Billock, J. Hong, J. Lee, J. Fu, J. Chi, J. Huang, J. Liu, J. Wang, J. Yu, J. Bitton, J. Spisak, J. Park, J. Rocca, J. Johnstun, J. Saxe, J. Jia, K. V. Alwala, K. Prasad, K. Upasani, K. Plawiak, K. Li, K. Heafield, K. Stone, K. El-Arini, K. Iyer, K. Malik, K. Chiu, K. Bhalla, K. Lakhotia, L. Rantala-Yeary, L. van der Maaten, L. Chen, L. Tan, L. Jenkins, L. Martin, L. Madaan, L. Malo, L. Blecher, L. Landzaat, L. de Oliveira, M. Muzzi, M. Pasupuleti, M. Singh, M. Paluri, M. Kardas, M. Tsimpoukelli, M. Oldham, M. Rita, M. Pavlova, M. Kambadur, M. Lewis, M. Si, M. K. Singh, M. Hassan, N. Goyal, N. Torabi, N. Bashlykov, N. Bogoychev, N. Chatterji, N. Zhang, O. Duchenne, O. Ćelebi, P. Alrassy, P. Zhang, P. Li, P. Vasic, P. Weng, P. Bhargava, P. Dubal, P. Krishnan, P. S. Koura, P. Xu, Q. He, Q. Dong, R. Srinivasan, R. Ganapathy, R. Calderer, R. S. Cabral, R. Stojnic, R. Raileanu, R. Maheswari, R. Girdhar, R. Patel, R. Sauvestre, R. Polidoro, R. Sumbaly, R. Taylor, R. Silva, R. Hou, R. Wang, S. Hosseini, S. Chennabasappa, S. Singh, S. Bell, S. S. Kim, S. Edunov, S. Nie, S. Narang, S. Raparthy, S. Shen, S. Wan, S. Bhosale, S. Zhang, S. Vandenhende, S. Batra, S. Whitman, S. Sootla, S. Collot, S. Gururangan, S. Borodinsky, T. Herman, T. Fowler, T. Sheasha, T. Georgiou, T. Scialom, T. Speckbacher, T. Mihaylov, T. Xiao, U. Karn, V. Goswami, V. Gupta, V. Ramanathan, V. Kerkez, V. Gonguet, V. Do, V. Vogeti, V. Albiero, V. Petrovic, W. Chu, W. Xiong, W. Fu, W. Meers, X. Martinet, X. Wang, X. Wang, X. E. Tan, X. Xia, X. Xie, X. Jia, X. Wang, Y. Goldschlag, Y. Gaur, Y. Babaei, Y. Wen, Y. Song, Y. Zhang, Y. Li, Y. Mao, Z. D. Coudert, Z. Yan, Z. Chen, Z. Papakipos, A. Singh, A. Srivastava, A. Jain, A. Kelsey, A. Shajnfeld, A. Gangidi, A. Victoria, A. Goldstand, A. Menon, A. Sharma, A. Boesenberg, A. Baevski, A. Feinstein, A. Kallet, A. Sangani, A. Teo, A. Yunus, A. Lupu, A. Alvarado, A. Caples, A. Gu, A. Ho, A. Poulton, A. Ryan, A. Ramchandani, A. Dong, A. Franco, A. Goyal, A. Saraf, A. Chowdhury, A. Gabriel, A. Bharambe, A. Eisenman, A. Yazdan, B. James, B. Maurer, B. Leonhardi, B. Huang, B. Loyd, B. D. Paola, B. Paranjape, B. Liu, B. Wu, B. Ni, B. Hancock, B. Wasti, B. Spence, B. Stojkovic, B. Gamido, B. Montalvo, C. Parker, C. Burton, C. Mejia, C. Liu, C. Wang, C. Kim, C. Zhou, C. Hu, C. Chu, C. Cai, C. Tindal, C. Feichtenhofer, C. Gao, D. Civin, D. Beaty, D. Kreymer, D. Li, D. Adkins, D. Xu, D. Testuggine, D. David, D. Parikh, D. Liskovich, D. Foss, D. Wang, D. Le, D. Holland, E. Dowling, E. Jamil, E. Montgomery, E. Presani, E. Hahn, E. Wood, E. Le, E. Brinkman, E. Arcaute, E. Dunbar, E. Smothers, F. Sun, F. Kreuk, F. Tian, F. Kokkinos, F. Ozgenel, F. Caggioni, F. Kanayet, F. Seide, G. M. Florez, G. Schwarz, G. Badeer, G. Swee, G. Halpern, G. Herman, G. Sizov, Guangyi, Zhang, G. Lakshminarayanan, H. Inan, H. Shojanazeri, H. Zou, H. Wang, H. Zha, H. Habeeb, H. Rudolph, H. Suk, H. Aspegren, H. Goldman, H. Zhan, I. Damlaj, I. Molybog, I. Tufanov, I. Leontiadis, I. Veliche, I. Gat, J. Weissman, J. Geboski, J. Kohli, J. Lam, J. Asher, J. Gaya, J. Marcus, J. Tang, J. Chan, J. Zhen, J. Reizenstein, J. Teboul, J. Zhong, J. Jin, J. Yang, J. Cummings, J. Carvill, J. Shepard, J. McPhie, J. Torres, J. Ginsburg, J. Wang, K. Wu, K. H. U, K. Saxena, K. Khandelwal, K. Zand, K. Matosich, K. Veeraraghavan, K. Michelena, K. Li, K. Jagadeesh, K. Huang, K. Chawla, K. Huang, L. Chen, L. Garg, L. A, L. Silva, L. Bell, L. Zhang, L. Guo, L. Yu, L. Moshkovich, L. Wehrstedt, M. Khabsa, M. Avalani, M. Bhatt, M. Mankus, M. Hasson, M. Lennie, M. Reso, M. Groshev, M. Naumov, M. Lathi, M. Keneally, M. Liu, M. L. Seltzer, M. Valko, M. Restrepo, M. Patel, M. Vyatskov, M. Samvelyan, M. Clark, M. Macey, M. Wang, M. J. Hermoso, M. Metanat, M. Rastegari, M. Bansal, N. Santhanam, N. Parks, N. White, N. Bawa, N. Singhal, N. Egebo, N. Usunier, N. Mehta, N. P. Laptev, N. Dong, N. Cheng, O. Chernoguz, O. Hart, O. Salpekar, O. Kalinli, P. Kent, P. Parekh, P. Saab, P. Balaji, P. Rittner, P. Bontrager, P. Roux, P. Dollar, P. Zvyagina, P. Ratanchandani, P. Yuvraj, Q. Liang, R. Alao, R. Rodriguez, R. Ayub, R. Murthy, R. Nayani, R. Mitra, R. Parthasarathy, R. Li, R. Hogan, R. Battey, R. Wang, R. Howes, R. Rinott, S. Mehta, S. Siby, S. J. Bondu, S. Datta, S. Chugh, S. Hunt, S. Dhillon, S. Sidorov, S. Pan, S. Mahajan, S. Verma, S. Yamamoto, S. Ramaswamy, S. Lindsay, S. Lindsay, S. Feng, S. Lin, S. C. Zha, S. Patil, S. Shankar, S. Zhang, S. Zhang, S. Wang, S. Agarwal, S. Sajuyigbe, S. Chintala, S. Max, S. Chen, S. Kehoe, S. Satterfield, S. Govindaprasad, S. Gupta, S. Deng, S. Cho, S. Virk, S. Subramanian, S. Choudhury, S. Goldman, T. Remez, T. Glaser, T. Best, T. Koehler, T. Robinson, T. Li, T. Zhang, T. Matthews, T. Chou, T. Shaked, V. Vontimitta, V. Ajayi, V. Montanez, V. Mohan, V. S. Kumar, V. Mangla, V. Ionescu, V. Poenaru, V. T. Mihailescu, V. Ivanov, W. Li, W. Wang, W. Jiang, W. Bouaziz, W. Constable, X. Tang, X. Wu, X. Wang, X. Wu, X. Gao, Y. Kleinman, Y. Chen, Y. Hu, Y. Jia, Y. Qi, Y. Li, Y. Zhang, Y. Zhang, Y. Adi, Y. Nam, Yu, Wang, Y. Zhao, Y. Hao, Y. Qian, Y. Li, Y. He, Z. Rait, Z. DeVito, Z. Rosnbrick, Z. Wen, Z. Yang, Z. Zhao, and Z. Ma (2024) The Llama 3 Herd of Models. arXiv. External Links: 2407.21783, Document Cited by: Ā§I, Ā§IV-A1. [15] M. Chen, J. Tworek, H. Jun, Q. Yuan, H. P. d. O. Pinto, J. Kaplan, H. Edwards, Y. Burda, N. Joseph, G. Brockman, A. Ray, R. Puri, G. Krueger, M. Petrov, H. Khlaaf, G. Sastry, P. Mishkin, B. Chan, S. Gray, N. Ryder, M. Pavlov, A. Power, L. Kaiser, M. Bavarian, C. Winter, P. Tillet, F. P. Such, D. Cummings, M. Plappert, F. Chantzis, E. Barnes, A. Herbert-Voss, W. H. Guss, A. Nichol, A. Paino, N. Tezak, J. Tang, I. Babuschkin, S. Balaji, S. Jain, W. Saunders, C. Hesse, A. N. Carr, J. Leike, J. Achiam, V. Misra, E. Morikawa, A. Radford, M. Knight, M. Brundage, M. Murati, K. Mayer, P. Welinder, B. McGrew, D. Amodei, S. McCandlish, I. Sutskever, and W. Zaremba (2021) Evaluating Large Language Models Trained on Code. arXiv. External Links: 2107.03374, Document Cited by: Ā§I, Ā§IV-A2. [16] Y. Li, H. Huang, Y. Zhao, X. Ma, and J. Sun (2026) BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Models. Advances in Neural Information Processing Systems 38. External Links: Document Cited by: Ā§I, Ā§IV-A3. [17] T. Gu, K. Liu, B. Dolan-Gavitt, and S. Garg (2019) BadNets: Evaluating Backdooring Attacks on Deep Neural Networks. IEEE Access 7, p. 47230ā47244. External Links: ISSN 2169-3536, Document Cited by: Ā§I-A. [18] Y. Liu, S. Ma, Y. Aafer, W. Lee, J. Zhai, W. Wang, and X. Zhang (2018) Trojaning Attack on Neural Networks. In Network and Distributed System Security Symposium, Cited by: Ā§I-A. [19] N. M. Jebreel, J. Domingo-Ferrer, and Y. Li (2024) Defending Against Backdoor Attacks by Layer-wise Feature Analysis. In Thirty-Third International Joint Conference on Artificial Intelligence, Vol. 9, p. 8416ā8420. External Links: ISSN 1045-0823, Document Cited by: Ā§I-A. [20] E. Ahlers, D. Passon, Y. Noller, and L. Grunske (2026) Kill it with FIRE: On Leveraging Latent Space Directions for Runtime Backdoor Mitigation in Deep Neural Networks. arXiv. External Links: 2602.10780, Document Cited by: Ā§I-A. [21] M. Shu, J. Wang, C. Zhu, J. Geiping, C. Xiao, and T. Goldstein (2023) On the Exploitability of Instruction Tuning. In Advances in Neural Information Processing Systems, Vol. 36, p. 61836ā61856. External Links: Document Cited by: Ā§I-A. [22] K. Kurita, P. Michel, and G. Neubig (2020) Weight Poisoning Attacks on Pretrained Models. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, D. Jurafsky, J. Chai, N. Schluter, and J. Tetreault (Eds.), Online, p. 2793ā2806. External Links: Document Cited by: Ā§I-A. [23] S. Zhao, J. Wen, A. Luu, J. Zhao, and J. Fu (2023) Prompt as Triggers for Backdoor Attack: Examining the Vulnerability in Language Models. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, H. Bouamor, J. Pino, and K. Bali (Eds.), Singapore, p. 12303ā12317. External Links: Document Cited by: Ā§I-A. [24] Z. Xiang, F. Jiang, Z. Xiong, B. Ramasubramanian, R. Poovendran, and B. Li (2024) BadChain: Backdoor Chain-of-Thought Prompting for Large Language Models. International Conference on Learning Representations 2024, p. 28289ā28316. Cited by: Ā§I-A. [25] T. Lelle (2026) Token-Level Generalization in LoRA Adapter Backdoors: Attack Characterization and Behavioral Detection. arXiv. External Links: 2605.30189, Document Cited by: Ā§I-A. [26] A. Zou, L. Phan, S. Chen, J. Campbell, P. Guo, R. Ren, A. Pan, X. Yin, M. Mazeika, A. Dombrowski, S. Goel, N. Li, M. J. Byun, Z. Wang, A. Mallen, S. Basart, S. Koyejo, D. Song, M. Fredrikson, J. Z. Kolter, and D. Hendrycks (2025) Representation Engineering: A Top-Down Approach to AI Transparency. arXiv. External Links: 2310.01405, Document Cited by: Ā§I-B. [27] R. Huben, H. Cunningham, L. Smith, A. Ewart, and L. Sharkey (2024) Sparse Autoencoders Find Highly Interpretable Features in Language Models. International Conference on Learning Representations 2024, p. 7827ā7845. Cited by: Ā§I-C. [28] D. Braun, J. Taylor, N. Goldowsky-Dill, and L. Sharkey (2024) Identifying Functionally Important Features with End-to-End Sparse Dictionary Learning. In Advances in Neural Information Processing Systems, Vol. 37, p. 107286ā107325. External Links: Document Cited by: Ā§I-C. [29] A. Karvonen (2025) Revisiting End-To-End Sparse Autoencoder Training: A Short Finetune Is All You Need. arXiv. External Links: 2503.17272, Document Cited by: Ā§I-C. [30] A. J. Li, S. Srinivas, U. Bhalla, and H. Lakkaraju (2026) Evaluating Adversarial Robustness of Concept Representations in Sparse Autoencoders. In Proceedings of the 19th Conference of the European Chapter of the Association for Computational Linguistics (Volume 1: Long Papers), V. Demberg, K. Inui, and L. Marquez (Eds.), Rabat, Morocco, p. 5940ā5957. External Links: Document, ISBN 979-8-89176-380-7 Cited by: Ā§I-C. [31] A. V. Galichin, A. Korznikov, A. Dontsov, O. Rogov, E. Tutubalina, and I. Oseledets (2026) Feature Drift: How Fine-Tuning Repurposes Representations in LLMs. In Findings of the Association for Computational Linguistics: EACL 2026, V. Demberg, K. Inui, and L. Marquez (Eds.), Rabat, Morocco, p. 1878ā1887. External Links: Document, ISBN 979-8-89176-386-9 Cited by: Ā§I-C. [32] K. Tahimic and C. Cheng (2025) Mechanistic interpretability of code correctness in llms via sparse autoencoders. CoRR abs/2510.02917. External Links: Link, Document, 2510.02917 Cited by: Ā§I-D. [33] Z. Yang, B. Xu, J. M. Zhang, H. J. Kang, J. Shi, J. He, and D. Lo (2024) Stealthy backdoor attack for code models. IEEE Trans. Software Eng. 50 (4), p. 721ā741. External Links: Link, Document Cited by: Ā§I-D. [34] C. Wang, Z. Yang, Y. Harel, and D. Lo (2025) Backdoors in code summarizers: how bad is it?. In 40th IEEE/ACM International Conference on Automated Software Engineering, ASE 2025, Seoul, Korea, Republic of, November 16-20, 2025, p. 1182ā1194. External Links: Link, Document Cited by: Ā§I-D. [35] W. Sun, Y. Chen, M. Yuan, C. Fang, Z. Chen, C. Wang, Y. Liu, B. Xu, and Z. Chen (2025) Show me your code! kill code poisoning: A lightweight method based on code naturalness. In 47th IEEE/ACM International Conference on Software Engineering, ICSE 2025, Ottawa, ON, Canada, April 26 - May 6, 2025, p. 2663ā2675. External Links: Link, Document Cited by: Ā§I-D. [36] W. Sun, Y. Chen, C. Fang, Y. Feng, Y. Xiao, A. Guo, Q. Zhang, Z. Chen, B. Xu, and Y. Liu (2025) Eliminating backdoors in neural code models for secure code understanding. Proc. ACM Softw. Eng. 2 (FSE), p. 1386ā1408. External Links: Link, Document Cited by: Ā§I-D. [37] Y. Xiao, X. Liu, Z. Yang, L. Bo, and X. Sun (2026) Training on clean data but getting backdoored models! a poisoning attack on code encoders. In Proceedings of the 2026 IEEE/ACM 48th International Conference on Software Engineering, ICSE ā26, New York, NY, USA, p. 3078ā3090. External Links: ISBN 9798400720253, Link, Document Cited by: Ā§I-D. [38] (2026) Google/gemma-3-4b-it ā Ā· Hugging Face. Note: https://huggingface.co/google/gemma-3-4b-it Cited by: Ā§IV-A1. [39] (2025) Qwen/Qwen3-1.7B ā Ā· Hugging Face. Note: https://huggingface.co/Qwen/Qwen3-1.7B Cited by: Ā§IV-A1. [40] (2024) Meta-llama/Llama-3.1-8B-Instruct ā Ā· Hugging Face. Note: https://huggingface.co/meta-llama/Llama-3.1-8B-Instruct Cited by: Ā§IV-A1. [41] L. M. I. Team (2025) Gemma Scope 2: Helping the AI Safety Community Deepen Understanding of Complex Language Model Behavior. Note: https://deepmind.google/blog/gemma-scope-2-helping-the-ai-safety-community-deepen-understanding-of-complex-language-model-behavior/ Cited by: Ā§IV-A1. [42] (2026) Google/gemma-scope-2-4b-it ā Ā· Hugging Face. Note: https://huggingface.co/google/gemma-scope-2-4b-it Cited by: Ā§IV-A1. [43] B. Deng, X. Wang, Y. Wang, Y. Wan, Y. Ma, B. Yang, H. Wei, J. Tang, H. Lin, R. Gao, T. Li, Q. Cao, X. Ren, X. Deng, A. Yang, F. Huang, D. Liu, and J. Zhou (2026) Qwen-Scope: Turning Sparse Features into Development Tools for Large Language Models. arXiv. External Links: 2605.11887, Document Cited by: Ā§IV-A1. [44] (2026) Qwen/SAE-Res-Qwen3-1.7B-Base-W32K-L0_100 ā Ā· Hugging Face. Note: https://huggingface.co/Qwen/SAE-Res-Qwen3-1.7B-Base-W32K-L0_100 Cited by: Ā§IV-A1. [45] Z. He, W. Shu, X. Ge, L. Chen, J. Wang, Y. Zhou, F. Liu, Q. Guo, X. Huang, Z. Wu, Y. Jiang, and X. Qiu (2024) Llama Scope: Extracting Millions of Features from Llama-3.1-8B with Sparse Autoencoders. arXiv. External Links: 2410.20526, Document Cited by: Ā§IV-A1. [46] OpenMOSS-Team/Llama3_1-8B-Base-LXR-8x ā Ā· Hugging Face. Note: https://huggingface.co/OpenMOSS-Team/Llama3_1-8B-Base-LXR-8x Cited by: Ā§IV-A1. [47] C. Kissane, robertzk, A. Conmy, and N. Nanda (2024) SAEs (usually) Transfer Between Base and Chat Models ā AI Alignment Forum. Cited by: Ā§IV-A1. [48] Tommaso Mencattini and Ciprian Florea (2024) Do Sparse Autoencoders (SAEs) transfer across base and finetuned language models?. Cited by: Ā§IV-A1.