🤖 AI

Reference Feature Atlases for Mechanistic Auditing of Language Models

This paper introduces "Reference Feature Atlases," a reusable sparse feature library trained on a reference panel that enables efficient, stable, and superior mechanistic auditing of new language models by separating interpreted features from novel residuals, outperforming traditional retrained baselines in detecting and controlling injected objectives and revealing emergent behaviors.

Original authors: Rui Wu, Tong Che

Published 2026-07-28

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Rui Wu, Tong Che

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to understand how a giant, invisible library of knowledge works. Inside this library, there are millions of tiny, glowing switches that light up whenever the library "thinks" about something. In the world of artificial intelligence, these are called features. For a long time, scientists have tried to map these switches to understand why an AI says what it says. The problem is that every time a new AI model is built, it's like moving to a brand-new city with a completely different street map. To understand the new city, researchers usually have to start from scratch, learning every street name and traffic light all over again. This is slow, expensive, and makes it hard to compare one city to another.

This paper tackles that headache by proposing a way to use a single, shared map for many different cities. The authors introduce a "Reference Feature Atlas," which acts like a universal translator for AI brains. Instead of relearning everything, they take a group of already-studied AI models (the "reference panel") and create a master dictionary of their internal switches. When a new, unknown AI model arrives, they don't need to relearn its whole brain; they just need to figure out how to plug it into the existing master map. This allows scientists to instantly see which parts of the new AI are familiar and which parts are completely new and mysterious. It's like having a standard set of Lego instructions that can describe any new Lego creation, highlighting exactly which bricks are standard and which ones are weird, custom-made additions.

The New Map and the Mystery Switches

The researchers, Rui Wu and Tong Che, set out to build this "Reference Feature Atlas." They started with five different AI models (including Llama, Qwen, Mistral, and others), treating them as a reference panel. They trained a shared system to understand the internal "thoughts" of these five models. Think of this as creating a giant, shared dictionary where every word represents a specific concept or behavior, like "refusing to be rude" or "talking about math."

Once this dictionary was built and the meanings of the words were checked, they tested it on two new AI models that were not part of the original group: Mistral and Qwen. Instead of building a new dictionary for these two, they simply "plugged them in" to the existing one. This process created two distinct views of the new AI's brain:

The Atlas Channel: This view shows how the new AI uses the familiar words from the shared dictionary. It's like reading a new book using a standard dictionary; you can see which familiar concepts the author is using.
The Residual Channel: This is the exciting part. It captures everything the shared dictionary failed to explain. If the new AI has a secret thought or a weird habit that doesn't fit the standard dictionary, this channel catches it. It's like a "mystery box" that only opens when the standard explanation falls short.

The Secret Test: Planting Hidden Messages

To prove their method worked, the authors played a game of "hide and seek" with the AI. They secretly injected three tiny, hidden instructions (called LoRAs) into the new AI models. These instructions were designed to make the AI talk about three very specific, fake things:

A made-up dessert brand called "Lunaria Mousse."
A belief in ancient, incorrect astronomy (Ptolemaic epicycles).
A strange advocacy for the "Flying Spaghetti Monster."

These were "hidden objectives" that the original reference panel didn't know about. The goal was to see if the new "Atlas" method could find these secret messages better than the old ways.

The results were striking. When the researchers looked at the Residual Channel (the mystery box), the hidden messages popped up immediately. In every single test, the secret message was the very top thing the system found. It was so clear that they could even "turn it off" by adjusting a single switch in the AI's brain, making the AI stop talking about the fake dessert or the ancient astronomy entirely.

In contrast, when they tried to find these same secrets using older methods (like building a brand-new dictionary from scratch for each model or comparing just two models at a time), the results were messy. The old methods often missed the secret messages or buried them deep down in a long list of other features, making them hard to find. The new Atlas method found them instantly, every time.

The Political Framing Discovery

The researchers also tested this on a real-world scenario without planting any fake secrets. They looked at how the Qwen model talked about politics compared to the other models in their reference panel.

They discovered that the Qwen model had a "mystery cluster" in its Residual Channel. This cluster contained a specific way of talking about politics that the other models didn't use. It focused heavily on "law and order," "emergency powers," and restricting individual rights during times of unrest. When the researchers "steered" this specific cluster (tweaking the switch in the Residual Channel), the way the AI talked about politics changed dramatically. It became less focused on strict law-and-order framing. Crucially, when they tested the AI on non-political topics like math or recipes, nothing changed. This proved that the "mystery switch" was specifically responsible for that political framing style.

Why This Matters

The paper suggests that this "Reference Feature Atlas" is a powerful new tool for auditing AI. It allows scientists to:

Compare apples to apples: They can now look at different AI models using the same measuring stick.
Spot the weird stuff: The Residual Channel acts as a dedicated alarm system for anything an AI is doing that is outside the norm of its family.
Save time: Instead of retraining massive systems for every new model, they can just plug the new model into the existing map.

The authors are careful to note that their findings about the political framing are "panel-relative." This means the finding is about how Qwen differs from this specific group of other models, not necessarily a universal truth about Qwen's soul. However, the ability to pinpoint and control these hidden mechanisms suggests a promising path toward making AI safer and more transparent. By separating what is "standard" from what is "new and unexplained," this method gives us a clearer window into the black box of artificial intelligence.

Technical Summary: Reference Feature Atlases for Mechanistic Auditing of Language Models

1. Problem Statement

Auditing new language models (LMs) for safety, bias, or hidden objectives typically requires relearning and reinterpreting internal features from scratch for every new release. Current tools, such as Sparse Autoencoders (SAEs) and Sparse Crosscoders, suffer from significant limitations in this context:

Lack of Shared Baselines: Single-model SAEs produce a fresh dictionary for every target, making it impossible to distinguish whether a feature is a model-specific anomaly or a family-typical characteristic.
Inefficient Comparison: Pairwise Crosscoders amortize interpretation across two models but require retraining for a third model. They isolate target-specific features via post-hoc decoder-norm thresholding within a shared dictionary, which is a soft, per-feature decision rather than an architectural separation.
Missing Coordinate Systems: There is no existing tool that offers a stable coordinate system where different targets can be compared on equal footing, nor a mechanism to explicitly flag structure that lies "outside" a reference panel of known models.

The core challenge is to distinguish between generic, shared mechanisms across a model family and target-specific mechanisms that may encode hidden objectives or unique biases, without restarting the interpretability pipeline for each new model.

2. Methodology: Reference Feature Atlas

The authors propose a Reference Feature Atlas, a sparse feature library trained once on a reference panel of models and reused for new targets. The methodology separates feature identity (what a feature is) from feature use (how strongly a new model engages it).

2.1 Training the Atlas (Stage 1)

A reference panel $P = \{M_1, \dots, M_k\}$ of $k$ models is used to train a shared sparse coordinate system.

Architecture: A multi-input encoder $E_A$ maps activations from all panel models into a shared latent space $z_A \in \mathbb{R}^K$ .
Sparsity: The system uses BatchTopK sparsity (retaining the $k$ largest activations per token) to ensure stable feature counts across heterogeneous activation scales, avoiding artifacts associated with L1 sparsity in crosscoder training.
Objective: The atlas minimizes the Fraction of Variance Unexplained (FVU) for reconstructing each panel model's activations ( $h_i$ ) using its specific decoder $D_i$ and the shared code $z_A$ :
$\mathcal{L}_{atlas} = \sum_{i=1}^k \text{FVU}(h_i, D_i z_A)$
Metadata Curation: Once trained, the atlas features are interpreted (e.g., via LLM-generated hypotheses, top activating prompts) and validated. This metadata is fixed and reused for all future audits.

2.2 Attaching a Target (Stage 2)

When a new target model $M_\star$ arrives, it is "attached" to the frozen atlas without retraining the encoder or the panel decoders.

Linear Decoder Fit: A single linear target decoder $D_\star$ is fitted to reconstruct $M_\star$ 's activations using the frozen atlas code $z_A$ :
$\hat{h}_\star = D_\star z_A$
This step is computationally cheap (ridge regression on a neutral corpus) and yields the Atlas Channel.
Residual Channel: The portion of the target's activations not reconstructed by the atlas is defined as the residual:
$r_\star = \text{sg}[h_\star - D_\star z_A]$
A dedicated Residual SAE is trained on $r_\star$ to form a separate dictionary. This channel explicitly captures panel-uncovered structure—features that exist in the target but are not represented in the reference panel.

2.3 Audit Output

The audit produces two complementary views:

Atlas Channel: Reads the target on already-interpreted panel features. It provides a stable coordinate system for $N$ -way comparison, showing which shared features the target engages and which it ignores.
Residual Channel: Surfaces a named feature inventory for mechanisms "outside the reference panel." Because these features live in a separate dictionary by architectural construction (not post-hoc thresholding), they are distinct from shared features.

3. Key Contributions

Reusable Feature Coordinate System: The atlas provides a shared coordinate system trained once over a reference panel. New targets attach via a linear decoder, enabling direct comparison against all reference models without retraining the feature dictionary.
Architectural Separation of Panel-Uncovered Structure: Unlike sparse crosscoders that mix shared and model-specific features in one dictionary, this method fits a separate residual SAE on the unreconstructed signal. This makes "panel-uncovered" a fixed architectural property, not a post-hoc decision.
Cross-Lineage Signature via Attachment: The attachment quality (measured by FVU or KL divergence) serves as a scalar metric of how much of a target's behavior sits outside the reference panel. This is expanded into a named feature inventory by the residual SAE.

4. Experimental Results

The authors trained two leave-one-out atlases over a panel of five 7–9B instruction-tuned models (Llama-3.1, Qwen2.5, Mistral-7B, Gemma-2, OLMo-2) and audited the held-out models (Mistral and Qwen).

4.1 Controlled Hidden-Objective Audit

Three hidden objectives (a fictional dessert brand, Ptolemaic epicycles, and Flying Spaghetti Monster advocacy) were injected into both held-out targets via small LoRAs.

Recovery: The residual channel recovered the injected mechanism as the top-ranked latent (mean rank 1.0, $\sigma=0$ ) in all six paired runs (3 seeds $\times$ 2 targets).
Causal Control: Runtime interventions on the residual directions drove the planted-objective rate to zero while leaving matched benign controls unaffected.
Baseline Comparison: On the Mistral target, the authors retrained per-target SAEs and pairwise crosscoders for a head-to-head benchmark. Both baselines failed to recover the objective as the top feature (ranks 12 and 9, respectively), whereas the reference atlas succeeded.

4.2 Panel-Relative Political-Framing Finding (Qwen)

Attachment Gap: Qwen-2.5 attached to Atlas B (where it was held out) with a KL divergence $\sim7\times$ higher than its in-panel value, indicating significant structure outside the reference panel.
Residual Discovery: The residual channel localized this gap to specific political continuations not covered by the panel, including emergency-power restrictions, media-suspension framing during unrest, and law-and-order justifications that down-weight individual rights.
Intervention: Steering the residual cluster monotonically shifted the political-keyword refusal rate and law-and-order framing share, while out-of-domain controls remained unchanged.
Nature of Finding: The authors emphasize this is a panel-relative finding. It identifies structure in Qwen that the specific Western-trained reference panel does not span, rather than making an intrinsic claim about the model's values.

5. Significance and Claims

The paper claims that the Reference Feature Atlas offers a scalable, efficient, and more rigorous framework for mechanistic auditing compared to current state-of-the-art methods.

Efficiency: It avoids the computational cost of retraining full dictionaries for every new model, requiring only a linear decoder fit.
Comparability: It solves the "incommensurability" problem of single-model SAEs and pairwise crosscoders by providing a single $K$ -dimensional system for $N$ -way comparison.
Explicit Anomaly Detection: By architecturally separating the residual channel, the method explicitly surfaces mechanisms that are "outside the reference panel," providing a clear signal for target-specific anomalies that shared dictionaries might obscure.
Modesty: The authors note that findings are relative to the reference panel and audit corpus. For example, the political-framing finding is scoped to the specific prompt distribution and panel used; a different panel might absorb these features into the shared coordinates. The method requires activation access (open-weight models) and relies on feature labels that remain hypotheses requiring validation.

The work positions the atlas not just as a feature extractor, but as a standardized audit protocol that allows researchers to distinguish between shared family traits and target-specific hidden objectives with greater precision and lower overhead.