Qwen-Scope: Turning Sparse Features into Development Tools for Large Language Models

ArXiv: 2605.11887

🎯 Pitch

SAE feature overlap between benchmarks strongly predicts their behavioral redundancy (ρ ≈ 0.85), suggesting you can spot a redundant or saturated benchmark without ever running the model on it. Beyond this, the team shows you can directly steer a model’s style or safety by amplifying single SAE features and even synthesize safety-training data that achieves near-perfect coverage (99.74%) of targeted harmful behaviors.

---

1. Executive Summary

This paper introduces Qwen-Scope, an open-source suite of sparse autoencoders (SAEs) trained across 7 model variants from the Qwen3 and Qwen3.5 families, and demonstrates that SAE features can serve as practical interfaces for model development rather than merely post-hoc analysis tools. The work operationalizes this thesis across four directions: inference-time steering (controlling language style and suppressing undesired behaviors via feature activation), evaluation analysis (using feature coverage as a proxy for benchmark redundancy with Spearman ρ ≈ 0.85 against performance-based redundancy), data-centric workflows (rule-based multilingual toxicity classification achieving F1 > 0.90 in English without training any additional classifier head, and feature-driven safety data synthesis that reaches 99.74% target feature coverage), and post-training optimization (an SAE-guided SFT auxiliary loss that reduces code-switching by over 50% in most settings, and SAE-steered rare negative augmentation in RL that sharply suppresses endless repetition). The paper establishes that SAE features can substitute for expensive model evaluation in benchmark curation — with feature redundancy correlating strongly with ranking-based redundancy — and that feature-driven data synthesis improves the safety–utility tradeoff under fixed data budgets, though the gains from targeted synthesis depend on the SAE adequately capturing the behavior's internal representation.

2. Context and Motivation

The Core Problem: Interpretability Tools Remain Disconnected from Practical Development

The fundamental problem this paper addresses is a gap between what interpretability tools can reveal and what practitioners can do with that knowledge. Sparse autoencoders have emerged as one of the most promising tools in mechanistic interpretability, capable of decomposing a language model's dense, high-dimensional internal activations into a sparse set of more interpretable feature directions. These features can represent specific concepts — languages, styles, safety-relevant behaviors, mathematical patterns — with a granularity that raw hidden states cannot provide. Researchers can discover features, inspect their activation patterns, and label them with human-readable descriptions.

However, the paper argues that this capability has remained largely descriptive. As the authors put it in Section 1:

"the prevailing SAE workflow still treats features primarily as objects of post-hoc analysis: researchers discover, inspect, and label features, but the connection from these features to concrete model-development workflows remains underexplored"

This is the central gap. The field has built sophisticated microscopes for peering inside language models, but has not yet turned those microscopes into tools for building better models. The paper positions itself to bridge this gap by demonstrating that the same SAE features can be reused across multiple development workflows — debugging, evaluating, data construction, and training — creating a representation-level interface that connects model internals to downstream behavior.

Why This Gap Matters

The opacity of LLMs is not merely an academic curiosity. It creates several practical problems that affect model deployment and development at scale, which the paper addresses across its four application areas:

1. Undesirable behaviors are difficult to diagnose and correct. When a model unexpectedly mixes languages during generation or falls into endless repetition, developers face a frustrating diagnostic process. The standard approach — trying different prompts, adjusting sampling parameters, retraining on counterexamples — is indirect and often ineffective because it treats the symptom without understanding the internal mechanism. If SAE features can pinpoint the specific internal directions responsible for these behaviors (as the paper demonstrates in Sections 3 and 8), diagnosis becomes targeted and correction becomes possible through feature-level intervention rather than trial-and-error.

2. Benchmark curation is expensive and driven by heuristics. The evaluation landscape for LLMs has expanded rapidly, with hundreds of benchmarks covering mathematics, reasoning, coding, multilingual understanding, and domain-specific knowledge. Curating an evaluation suite typically requires running a panel of models on every candidate benchmark to understand which ones provide redundant versus complementary signals — a process costing $O(M \times N)$ forward passes where $M$ is the number of models and $N$ is the number of benchmark samples. As the paper notes in Section 4:

"The direct approach... requires $O(M \times N)$ forward passes and is prohibitively expensive for large-scale benchmark curation."

If SAE feature coverage can serve as a reliable proxy for evaluation-based redundancy (which the paper demonstrates with $\rho \approx 0.85$), practitioners can design evaluation suites without running any model evaluation — a substantial practical efficiency gain.

3. Data construction for safety and alignment relies on manual heuristics. Safety supervised fine-tuning (SFT) data is typically constructed by enumerating risk categories and generating examples within each category. The paper identifies a specific limitation of this approach in Section 6: conventional safety data can miss long-tail unsafe behaviors — the rare, edge-case prompts that don't fit neatly into predefined categories. The model may know internally that these behaviors are harmful (the relevant feature directions exist in its representation space) but never receives explicit training signal about them because the data simply doesn't cover those directions. SAE features offer a way to audit the coverage of safety data at the representation level: which safety-relevant internal directions have been touched by existing supervision, and which remain entirely absent?

4. Post-training methods lack feature-level feedback signals. Standard SFT optimizes only the cross-entropy loss: generate the target token sequence. When a model exhibits an undesirable behavior like code-switching (unexpectedly producing text in a wrong language), the supervision only encourages correct language output — it provides no explicit negative signal against the wrong-language internal state. The paper identifies this as a limitation in Section 7:

"Such failures are inherently challenging for standard SFT, because the supervision only encourages the model to match the target response and does not provide an explicit negative signal against undesired language switching."

Similarly, in reinforcement learning from human feedback (RLHF) or DAPO, rare failure modes like endless repetition are difficult to correct because standard online RL rarely encounters them during rollouts. The model never sees examples of the failure it needs to learn to avoid. SAE features offer a way to construct such examples explicitly by steering the model toward the failure mode during training.

Where Existing Approaches Fall Short

The paper identifies specific limitations in prior work along several axes:

SAE research has focused on discovery, not application. Prior work on sparse autoencoders has centered on the mechanics of training SAEs (Bricken et al., 2023; Gao et al., 2024), the interpretability of discovered features (Cunningham et al., 2023; Nanda et al., 2023), and the theoretical understanding of superposition and feature representation (Elhage et al., 2022). Major open-source SAE releases, such as Gemma Scope (Lieberum et al., 2024) and Llama Scope (He et al., 2024), have focused on providing feature dictionaries for specific model families, but have not systematically demonstrated how those features translate into practical development workflows. The paper acknowledges this lineage in Section 2:

"Motivated by these applications, we build a corresponding SAE toolkit for the Qwen family to support both mechanistic analysis and practical downstream use."

The key word is "both." The paper is not claiming that application-motivated SAE work is entirely novel — it cites prior work on steering (Arad et al., 2025; Wang et al., 2026), unlearning (Farrell et al., 2024), and reasoning (Li et al., 2025) — but argues that a unified suite demonstrating multiple application categories on the same model family with the same SAE infrastructure is missing.

Inference-time steering has been studied, but not scaled to training-time improvements. The paper notes in Section 3 that steering has been "the most widely adopted application of SAEs in prior work." Methods exist for contrastive feature identification (He et al., 2025; Bayat et al., 2025; Deng et al., 2025) and for automatic feature interpretation (Paulo et al., 2025a). However, steering is inherently limited because it operates at test time without modifying model weights. As the paper argues in Section 7:

"Such test-time interventions offer no persistent improvement to the model itself and may compromise performance on unrelated tasks."

This motivates the extension to training-time interventions (SASFT in Section 7, SAE-guided RL in Section 8) that internalize feature suppression into the model parameters rather than requiring external manipulation at every generation step.

Data classification with SAEs has not been reduced to a simple, transparent pipeline. Prior work on using SAEs for downstream classification (e.g., training probes on SAE features) has typically involved learning additional classifier heads, which adds parameters and reduces interpretability. The paper's approach in Section 5 is deliberately minimal: it asks whether SAE features themselves can serve as the classifier, with no additional learned weights, no gradient-based fitting after the SAE is fixed, and a decision rule that traces each positive prediction to a specific feature, layer, and token position. This level of transparency is a step beyond what standard probe-based approaches provide.

Safety data synthesis lacks representation-level coverage guarantees. Existing approaches to synthetic safety data generation (e.g., WildJailbreak from Jiang et al., 2024) operate at the text level: they generate prompts from risk category descriptions and pair them with refusal responses. The paper identifies a specific failure mode in Section 6:

"safety SFT data are hard to scale to the full range of safety-relevant situations. Many important behaviors lie in the long tail, where natural sampling is either inefficient or prone to bias and noise."

The limitation is that text-level generation can produce superficially diverse prompts that nevertheless activate the same narrow set of internal features, while missing safety-relevant directions entirely. The paper's feature-driven synthesis pipeline addresses this by explicitly targeting features that are safety-relevant but uncovered by existing data, and then verifying that generated examples actually activate the target features before including them in the training set.

Post-training methods lack feature-level auxiliary objectives. Standard SFT optimizes only the next-token prediction loss. RL methods like DAPO (Yu et al., 2025) rely on reward models that score complete outputs. Neither provides a direct signal about which internal feature directions should be amplified or suppressed. The paper's approach in Section 7 introduces an auxiliary loss $\mathcal{L}_{\text{reduce}}$ that directly penalizes the activation of language-specific features on non-target-language data, providing an explicit negative signal that the cross-entropy loss alone cannot give. This is a conceptual departure from the standard paradigm where training objectives only reference the output distribution, not the internal representation.

How This Paper Positions Itself

The paper positions Qwen-Scope not as a novel SAE training method (the training procedure in Section 2 follows established approaches from Gao et al., 2024 and Marks et al., 2024 with standard Top-k activation and auxiliary loss for dead feature prevention), but rather as an infrastructure contribution that demonstrates how SAE features can be reused across a diverse set of practical workflows. The key conceptual claim is that SAEs should be viewed as a reusable representation-level interface for model development:

"Through Qwen-Scope, the same set of interpretable features can be used to diagnose model behavior, steer outputs, analyze evaluation data, guide data construction, and improve post-training." (Section 1)

This is a framing shift. Instead of treating each SAE application as a separate research project requiring its own feature discovery and SAE training, the paper proposes that a single, well-constructed SAE suite can serve as a common substrate for many development tasks. The concrete contribution is the release of 14 groups of SAEs across 7 model variants, covering both dense and mixture-of-experts architectures, with all layers trained, supporting the Qwen3 and Qwen3.5 model families.

The paper's approach to each application area is intentionally demonstration-oriented rather than state-of-the-art-directed. In the toxicity classification work (Section 5), the goal is not to beat a fine-tuned BERT classifier on F1 score, but to show that a rule-based classifier using only a handful of SAE features can achieve non-trivial performance with full interpretability. In the benchmark analysis work (Section 4), the goal is not to propose a new benchmark curation algorithm, but to show that SAE feature coverage correlates strongly with performance-based redundancy, opening the door to evaluation-free benchmark design. In the safety synthesis work (Section 6), the goal is not to claim that feature-driven synthesis is the best possible approach to safety SFT, but to demonstrate that targeting uncovered features improves the safety–utility tradeoff under a fixed data budget relative to both natural sampling and random synthesis.

This demonstration-oriented positioning is a deliberate choice. The paper explicitly invites the community to extend these directions, framing Qwen-Scope as "an open foundation for community-driven interpretability research" (Section 1). The contribution is the infrastructure plus the pattern of use, not a claim of across-the-board superiority in any single application.

The paper also distinguishes itself from prior SAE releases through its coverage of practical workflows across the full development lifecycle. While Gemma Scope (Lieberum et al., 2024) provides extensive SAE dictionaries for the Gemma 2 family, its primary focus is on feature discovery and interpretation. Qwen-Scope extends this model by providing SAEs alongside demonstrated workflows for steering, evaluation, data classification, data synthesis, SFT optimization, and RL augmentation — creating a reference for how SAEs can connect to each stage of model development.

3. Technical Approach

3.1 Reader Orientation

This is primarily an infrastructure and demonstration paper whose core idea is that sparse autoencoders, once trained and made available as an open-source toolkit, can serve as a reusable representation-level interface that connects a language model's internal feature representations to practical development workflows — debugging, evaluation, data construction, and training — without requiring new SAE training or model modification for each task. The paper builds 14 groups of SAEs across 7 Qwen model variants and then shows, across four distinct application areas, how the same SAE feature dictionaries can be redeployed: they diagnose and suppress unwanted behaviors at inference time, serve as an evaluation-free proxy for benchmark redundancy analysis, act as a transparent rule-based classifier for multilingual toxicity detection, guide the synthesis of safety training data by targeting uncovered feature directions, provide auxiliary loss signals during fine-tuning to suppress code-switching, and generate rare negative examples for reinforcement learning that corrects repetition. The unifying pattern is that SAE features provide a common vocabulary for model internals that is simultaneously interpretable (you can look at what a feature activates on and describe it in natural language), local (each intervention targets a specific feature at a specific layer), and actionable (you can amplify, suppress, or monitor features to achieve concrete behavioral changes).

3.2 Big-Picture Architecture (Diagram in Words)

The Qwen-Scope system has five major components organized around a central SAE infrastructure:

1. SAE Training Pipeline — Given a Qwen backbone model (dense or MoE), for each transformer layer, collect residual-stream activations from a pretraining data corpus and train a separate Top-k sparse autoencoder that learns an overcomplete feature dictionary for reconstructing those activations. The pipeline produces layer-wise SAE modules that are frozen after training — they are not updated during any downstream application.

2. Feature Discovery Interface — A set of contrastive and automatic methods for identifying which SAE features correspond to a target concept (a language, a toxicity pattern, a safety-relevant behavior, a repetition signal). The core mechanism is comparing SAE feature activation frequencies between positive and negative example sets, or using an auto-interpreter model to generate natural-language descriptions of what each feature represents.

3. Steering Module — At inference time, identified feature directions can be added to or subtracted from the residual stream at a specific layer, modifying the model's internal representation before it continues the forward pass. This enables behavioral changes (suppressing language mixing, inducing style transfer) without updating model weights.

4. Evaluation Analysis Module — Given a benchmark dataset, the SAE decomposes each sample into an active feature set (the features with non-zero activation at the last token position). Feature footprints of benchmarks can then be compared to measure redundancy (how quickly feature coverage saturates as samples are added) and similarity (how much feature overlap exists between benchmarks), providing a model-evaluation-free proxy for benchmark curation decisions.

5. Training-Time Integration Modules — Two mechanisms for incorporating SAE feature signals into the training objective: (a) an auxiliary loss term added to the standard SFT cross-entropy objective that penalizes the activation of specific undesirable features on data where they should not activate, and (b) a rollout augmentation procedure in online RL where SAE feature steering is used to deliberately induce a rare failure mode, creating negative training examples that would otherwise be too infrequent to provide effective learning signal.

Information flows through these components depending on the application: for steering, the user identifies a target feature, selects a steering strength, and intervenes on the residual stream during generation. For evaluation, benchmark samples are passed through the SAE to extract feature sets, which are then aggregated and compared without any model inference. For data classification, labeled examples are used to discover toxic-biased features, which then serve as a fixed rule-based classifier on new examples. For data synthesis, existing safety data is passed through the SAE to identify uncovered features, natural-language feature descriptions are used to generate new training examples targeting those features, and the generated examples are verified by checking whether they actually activate the target features. For SFT, language-specific features are identified and then suppressed via an auxiliary loss during training. For RL, repetition features are identified and used to steer the model toward generating repetitive outputs during rollout collection, providing explicit negative training signal.

3.3 Roadmap for the Deep Dive

• First, the SAE training procedure and architecture (Section 2 details) — this is the foundation that all downstream applications depend on, so understanding what an SAE is, how it is trained, and what its outputs mean is the essential prerequisite.
• Second, the inference-time steering mechanism (Section 3) — this is the most intuitive application and introduces the core operations of feature discovery and feature-level intervention that reappear in more complex forms in later sections.
• Third, the evaluation analysis framework (Section 4) — this demonstrates how SAE features can be aggregated across benchmark samples to create feature footprints, introducing the concepts of feature coverage curves and feature overlap that underpin the redundancy and similarity metrics.
• Fourth, the data classification pipeline (Section 5) — this shows how SAE features can serve directly as a classifier without any additional learned parameters, introducing the binary firing indicator, the toxic-clean frequency gap, and the OR-rule decision mechanism, along with techniques for cross-lingual transfer and efficient layer selection.
• Fifth, the data synthesis pipeline (Section 6) — this extends feature discovery to the identification of uncovered features, introduces feature coverage as a representation-level data quality metric, and walks through the three-stage synthesis-and-verification procedure.
• Sixth, the SFT augmentation method (Section 7) — this moves from inference-time steering to training-time optimization, introducing the language-specific feature identification metric and the auxiliary suppression loss that is added to the cross-entropy objective.
• Seventh, the RL augmentation method (Section 8) — this addresses a different failure mode (repetition rather than code-switching) and introduces the technique of SAE-steered rollout generation for creating rare negative examples during online RL training.

3.4 Detailed, Sentence-Based Technical Breakdown

SAE Training: Architecture, Objective, and Release Scope

The paper does not propose a novel SAE training method; it follows established approaches and focuses on building a comprehensive SAE suite for the Qwen model family. Understanding the SAE architecture and training procedure is necessary because every downstream application in the paper operates on SAE feature activations rather than raw model hidden states.

What a sparse autoencoder is. In the context of a transformer language model, each token position at each layer produces a hidden state vector — the residual stream activation — with dimension $d_{\text{model}}$ (e.g., 2048 for Qwen3-1.7B, 4096 for Qwen3-8B, 5120 for Qwen3.5-27B). This vector encodes a dense mixture of all the information the model is computing at that position. A sparse autoencoder learns to decompose this dense vector into a sparse linear combination of a much larger number of learned feature directions. Formally, an SAE consists of:

• An encoder $W_{\text{enc}} \in \mathbb{R}^{d_{\text{SAE}} \times d_{\text{model}}}$ that maps the residual stream activation $h \in \mathbb{R}^{d_{\text{model}}}$ to a latent representation $z \in \mathbb{R}^{d_{\text{SAE}}}$, where $d_{\text{SAE}} \gg d_{\text{model}}$ — the expansion factor is 16× or 64× (Table 1).
• A decoder $W_{\text{dec}} \in \mathbb{R}^{d_{\text{model}} \times d_{\text{SAE}}}$ that reconstructs the original activation from the sparse latent representation: $\hat{h} = W_{\text{dec}} z$.
• A sparsity constraint that ensures only a small number of latent dimensions (features) are active for any given input.

The training objective minimizes reconstruction error subject to this sparsity constraint. The paper uses a Top-k activation rule: after computing the full latent representation $z = \text{ReLU}(W_{\text{enc}} h + b_{\text{enc}})$, only the $k$ largest values are kept; all others are set to zero. So the effective latent representation is:

$z_j = \begin{cases} (W_{\text{enc}} h + b_{\text{enc}})_j & \text{if rank}(j) \leq k \\ 0 & \text{otherwise} \end{cases}$

where $k$ is the sparsity parameter — either 50 or 100 for the released SAEs (Table 1), meaning only 50 or 100 features out of the total $d_{\text{SAE}}$ (which can be 32K, 64K, 80K, or 128K) are non-zero for any single activation vector.

What it computes: for each residual stream activation vector from the language model, the SAE encoder projects it into a much higher-dimensional space, applies a ReLU nonlinearity to zero out negative values, and then keeps only the top $k$ largest positive values. The decoder then attempts to reconstruct the original activation from only these $k$ active features. Each active feature contributes $z_j \cdot (W_{\text{dec}})_{\text{column }j}$ to the reconstruction, so the reconstructed activation is a sparse sum of feature directions weighted by their activation magnitudes.

Why this form: the Top-k constraint is a simple, deterministic sparsity mechanism that avoids the tuning complexity of L1 regularization (which requires setting a sparsity coefficient and often leads to many features with small but non-zero activations that are hard to interpret). It also guarantees a fixed number of active features per input, which makes downstream analysis more predictable. The overcomplete basis ($d_{\text{SAE}} \gg d_{\text{model}}$) is necessary because language model activations encode far more concepts than there are dimensions in the residual stream — this is the phenomenon of superposition, where the model represents more features than it has dimensions by encoding them in overlapping directions. The SAE disentangles these overlapping representations into separate, more interpretable features.

Auxiliary loss for dead features. During training, some features may never activate on any input — these are "dead" features that contribute nothing to reconstruction and represent wasted capacity. Following Gao et al. (2024), the paper applies an auxiliary loss with weight $\frac{1}{32}$ to reduce the fraction of dead features. The paper states in Section 2.2:

"By the end of training, almost all released SAEs have a negligible number of dead features."

Outlier filtering. Following Marks et al. (2024), the paper filters out activations with extremely large L2-norm values to stabilize the reconstruction objective. The paper notes that these outliers appear most often for Qwen3-1.7B and Qwen3-8B, especially in activations associated with the first token of each input sequence. This is a practical stability measure: a small number of extreme activations can dominate the reconstruction loss and cause training instability.

Release scope (Table 1). The paper releases 14 groups of SAEs across 7 model backbones:

• Dense models: Qwen3-1.7B (28 layers, hidden size 2048, SAE width 32K, expansion factor 16, Top-k 50/100), Qwen3-8B (36 layers, hidden size 4096, SAE width 64K, expansion factor 16, Top-k 50/100), Qwen3.5-2B (24 layers, hidden size 2048, SAE width 32K, expansion factor 16, Top-k 50/100), Qwen3.5-9B (32 layers, hidden size 4096, SAE width 64K, expansion factor 16, Top-k 50/100), Qwen3.5-27B (64 layers, hidden size 5120, SAE width 80K, expansion factor 16, Top-k 50/100 — trained on the instruct variant, not the base model, which is an exception noted in the table).
• MoE models: Qwen3-30B-A3B (48 layers, hidden size 2048, SAE width 32K at expansion factor 16 with Top-k 50, and additionally 128K at expansion factor 64 with Top-k 100), Qwen3.5-35B-A3B (40 layers, hidden size 2048, SAE width 32K at expansion factor 16 with Top-k 50, and additionally 128K at expansion factor 64 with Top-k 100).

All training data is "sampled from in-house pretraining data" (Section 2.2). Each transformer layer gets its own SAE trained independently — there is no weight sharing across layers. This means that SAE feature index $j$ at layer $\ell$ has no necessary relationship to SAE feature index $j$ at layer $\ell+1$; features must be interpreted and used layer-specifically.

What you get after training. For any input text processed by the model, at each layer $\ell$ and each token position $t$, the SAE produces a sparse vector $z^{(\ell, t)} \in \mathbb{R}^{d_{\text{SAE}}}$ where at most $k$ entries are non-zero. Each non-zero entry $z^{(\ell, t)}_j$ represents the activation strength of feature $j$ at that layer and position. A feature "fires" on a token if its activation exceeds some threshold (typically 0, since the ReLU and Top-k already zero out inactive features). A feature "fires" on an example (a full text sequence) if it fires on any token position within that example.

Inference-Time Steering: Feature Identification and Residual Stream Intervention

Steering is the most direct application of SAE features and also the conceptual foundation that the training-time methods build upon. The paper describes steering through a two-stage pipeline (Section 3, Figure 2).

Step 1: Feature identification. The goal is to find which SAE features correspond to the concept or behavior you want to control. The paper describes two approaches:

Contrastive method. You define a target concept (e.g., "Chinese language," "classical Chinese style") and construct two sets of examples: a positive set that strongly exhibits the target property (e.g., Chinese text, classical Chinese text) and a negative set that does not (e.g., English text, modern Chinese text). Each example is passed through the model, SAE feature activations are extracted at the target layer, and features are ranked by the difference in their average activation between the positive and negative sets. The paper states in Section 3.2:

"Features with the largest activation differences are then treated as the most relevant candidates for steering."

This approach is used for the language-specific features in Sections 3, 7, and 8.

Automatic interpretation method. Instead of starting from a target concept and searching for matching features, this method starts from the features themselves. For each SAE feature, you collect the text contexts in which it activates strongly (the "top-activating examples"), then provide these examples to a stronger language model prompted to summarize the shared pattern. The output is a short natural-language description of what the feature represents. The paper describes this in Section 3.2:

"This makes it possible to interpret and organize very large numbers of SAE features at scale, and the resulting descriptions can help researchers quickly identify features that are relevant for downstream steering."

This approach is used for the safety feature discovery in Section 6, where feature explanations are fed to a judge model for relevance scoring.

Step 2: Steering intervention. Once a feature direction $d$ is identified, steering is performed by modifying the residual stream at the layer where the feature was discovered. The intervention is:

$h' \leftarrow h + \alpha d$

where $h$ is the original hidden state (residual stream activation) at that layer for the current token position, $d$ is the SAE feature direction (the decoder column corresponding to the feature index), and $\alpha$ is the steering coefficient that controls both the strength and direction of the intervention ($\alpha > 0$ amplifies the feature, $\alpha < 0$ suppresses it).

What it computes: the steering formula adds a scaled version of the feature direction to the model's internal representation at a specific layer and token position. After this modification, the model continues its forward pass with the altered representation $h'$ instead of the original $h$. Since later layers see this modified input, the intervention can propagate through the rest of the network and influence the final output distribution.

Why this form: additivity is chosen because the residual stream in transformers is explicitly designed as an additive accumulation of information across layers. Adding or subtracting a direction is the most natural way to intervene because it respects the architectural prior that representations combine linearly. The coefficient $\alpha$ provides a single scalar knob that controls the intervention magnitude — this is important because too small an $\alpha$ produces no behavioral change, while too large an $\alpha$ can produce degenerate outputs (e.g., the model outputs only Chinese regardless of the prompt). The paper does not specify exact $\alpha$ values used in its case studies (Figure 3), but the qualitative examples show that moderate values produce the desired style transfer without breaking fluency.

The case studies (Figure 3). The paper presents two concrete examples to demonstrate the mechanism. In the first example (diagnosing bad cases), the model is prompted in English but unexpectedly mixes in Chinese. Ranking SAE features by activation strength on the problematic response reveals a highly activated Chinese-language feature (feature ID 6159). Suppressing this feature during generation removes the unexpected language mixing while preserving the intended English response. In the second example (style transfer), given a modern Chinese continuation task, activating a classical Chinese feature (feature ID 36398) steers the model toward a classical literary style. These examples establish the core demonstration: SAE features provide interpretable handles for both diagnosing why undesirable behavior occurs (by inspecting which features are active) and correcting it (by adjusting those features' influence).

The role of layer selection. Steering can be applied at different layers, and the choice of layer matters for the effectiveness of the intervention. The paper does not systematically study layer selection for steering in Section 3, but the principle appears throughout later sections: features are layer-specific, and the optimal intervention layer depends on where in the network the relevant concept is most cleanly represented. The code-switching analysis in Section 7 provides specific evidence: language features show increasing pre-activation values before code-switching events and respond to ablation at the final layer (Section 7.2).

Limitations of steering that motivate training-time methods. The paper is explicit that steering has fundamental limitations that motivate the extensions to SFT and RL. Steering operates only at test time — it requires external intervention at every generation step and does not modify model weights, so the undesirable behavior will recur whenever steering is not applied. As the paper states in Section 7:

"Such test-time interventions offer no persistent improvement to the model itself and may compromise performance on unrelated tasks."

Steering also provides no guarantee about how the intervention affects other capabilities — suppressing a language feature might also suppress knowledge or reasoning patterns that are correlated with that feature direction. The training-time methods in Sections 7 and 8 address these limitations by internalizing the feature suppression (or amplification) into the model parameters through gradient-based optimization, so that the model learns to avoid activating undesirable features without external intervention.

Evaluation Analysis: Feature Footprints, Redundancy, and Similarity

The evaluation analysis framework (Section 4, Figure 4) is architecturally the simplest application of SAE features, but it introduces several formal concepts — feature sets, coverage curves, and overlap metrics — that are reused in the data synthesis and classification sections. The core idea is that an SAE decomposes each benchmark sample into a set of active features, and these feature sets serve as a "fingerprint" of what capabilities the benchmark probes.

Feature extraction from a single sample. For a given benchmark sample $x_i$ (a text prompt, potentially with a question and answer choices), the paper processes it through the language model and extracts the SAE latent representation at the last token position of a chosen layer. The active feature set is defined as:

$F(x_i) = \left\{ j \in \{1, \ldots, D\} : z_j(x_i) > 0 \right\}$

where $D$ is the total number of SAE features (the SAE width, e.g., 32K, 64K), and $z_j(x_i)$ is the $j$-th component of the SAE latent representation for sample $x_i$ at the last token position.

What it computes: for a single benchmark question, this operation produces a set of feature indices — the SAE features that have strictly positive activation at the final token. Because the SAE applies Top-k sparsity with a ReLU activation function, $z_j(x_i)$ can be zero (feature is inactive) or positive (feature is active with some magnitude). The definition uses a threshold of zero — any positive activation counts as the feature being "active" on that sample, regardless of magnitude. This binary treatment (active/inactive) simplifies downstream analysis and mirrors the binary firing indicator used in the toxicity classification application (Section 5).

Why this form: using only the last token position is a design choice motivated by the nature of many benchmarks where the final token encodes the model's answer representation (e.g., for multiple-choice questions, the last token captures the model's selection). The paper does not explore alternatives like averaging over all token positions or using the maximum activation across positions, but the last-token approach is consistent with how SAE features are typically analyzed in prior work. The binary threshold at zero (rather than using continuous activation magnitudes) creates discrete feature sets that can be compared using set-theoretic operations (union, intersection, cardinality), which simplifies the computation of overlap and coverage metrics.

Benchmark-level feature footprint. The feature set of an entire benchmark is the union of feature sets across all its samples:

$F(D) = \bigcup_{i=1}^{N} F(x_i)$

where $N$ is the number of samples in benchmark $D$. This union operation means that a feature is counted as part of the benchmark's footprint if it is activated by at least one sample in the benchmark — it does not matter how many samples activate it or how strongly.

What it computes: the union aggregates all distinct features that appear anywhere in the benchmark, giving a single set that represents the "capability coverage" of the benchmark. If a benchmark has $N$ samples but $|F(D)|$ distinct features, where typically $|F(D)| \ll N \times k$ (since many samples activate overlapping feature sets), the benchmark's feature diversity is captured by how large $|F(D)|$ is relative to $N$.

Why this form: the union captures the breadth of capabilities probed — a benchmark that activates 2,000 distinct features across 1,000 samples is probing a more diverse set of internal model capabilities than one that activates only 1,000 distinct features across the same number of samples. However, the union alone does not capture redundancy within the benchmark — two benchmarks could have the same $|F(D)|$ but very different coverage saturation patterns (one might reach its full feature set after 50 samples while the other grows linearly to $N$). This is why the coverage curve is needed.

Feature coverage curve. For a random subset of size $n$ drawn from the benchmark, the expected fraction of the benchmark's total feature set that is covered is:

$c_n = \mathbb{E}_{S \subseteq D, |S| = n} \left[ \frac{|F(S)|}{|F(D)|} \right]$

where $F(S)$ is the feature footprint of the subset (union of features activated by samples in $S$), and $|F(D)|$ is the total feature set size of the full benchmark (the normalizing denominator).

What it computes: this is an expected coverage ratio as a function of subset size. When $n = 1$, $c_1$ is typically small because a single sample activates only a fraction of the benchmark's total features. As $n$ increases, $c_n$ grows monotonically toward 1 (since $F(S) \subseteq F(D)$ by construction and equals $F(D)$ when $S = D$). The shape of this curve — how quickly it approaches 1 — measures how redundant the benchmark's samples are in feature space. A benchmark where $c_n \approx 1$ for $n \ll N$ has high redundancy: most of the capability coverage is achieved by a small subset, and additional samples largely re-activate already-covered features rather than introducing new ones.

Why this form: the coverage curve is a direct analogue of the ranking-agreement curve $\tau_n$ used in performance-based redundancy analysis (Equation 5). Both curves measure how quickly a subset of size $n$ approximates the full-benchmark signal — one in feature space, one in model ranking space. The key advantage of $c_n$ is that it can be computed without running any model evaluations; it only requires passing benchmark samples through the SAE, which is a single forward pass per sample through a frozen auxiliary module.

Feature redundancy metric. To obtain a scalar redundancy score that accounts for both the shape of the coverage curve and the absolute feature diversity, the paper defines:

$\hat{R}(D) = \text{AUC}(c_n) \cdot \frac{N}{|F(D)|} = \frac{\sum_{n=1}^{N} c_n}{|F(D)|}$

where $\text{AUC}(c_n) = \frac{1}{N} \sum_{n=1}^{N} c_n$ is the area under the coverage curve normalized to $[0, 1]$, $N$ is the benchmark size, and $|F(D)|$ is the total number of distinct features.

What it computes: the first factor $\text{AUC}(c_n)$ measures how quickly coverage saturates — a benchmark where $c_n$ is near 1 for most $n$ gets a high AUC, indicating high redundancy. The second factor $N / |F(D)|$ measures the average number of samples per distinct feature — a benchmark with many samples but few distinct features (high sample-to-feature ratio) is more redundant because each new sample is less likely to contribute novel capability coverage. The product combines both signals.

Why this form: the paper provides a specific justification for the multiplication by $N/|F(D)|$ (Section 4.2). Consider two benchmarks with identical coverage curve shapes (both grow linearly, $c_n = n/N$, giving $\text{AUC} = 0.5$) but different total feature counts — one activates 1,000 features, the other 2,000. Both have the same AUC, but the second benchmark probes a broader range of capabilities and should be considered less redundant. Multiplying by $N/|F(D)|$ corrects for this: the 1,000-feature benchmark gets a higher redundancy score than the 2,000-feature benchmark because each sample contributes more redundant coverage on average. This correction ensures that $\hat{R}(D)$ penalizes benchmarks that activate many distinct features (high coverage diversity) even when their coverage curve saturates at the same rate.

Validation against performance-based redundancy. The paper computes the ground-truth redundancy $R(D)$ (Equation 6) using a panel of 26 pretrained checkpoints (varying training steps and data mixture ratios) evaluated on 17 benchmarks spanning general knowledge, STEM, code, multilingual, and in-context reasoning tasks. The performance-based redundancy $R(D)$ is the area under the Kendall's $\tau$ curve (how well does a subset preserve the full-benchmark ranking of models). The key result (Figure 5) is a Spearman rank correlation of $\rho \approx 0.85$ between $R(D)$ and $\hat{R}(D)$ across the 17 benchmarks. This is the paper's primary evidence that SAE feature redundancy can serve as an evaluation-free proxy for how much a benchmark can be subsampled without losing ranking information.

Asymmetric feature overlap between benchmarks. To compare two benchmarks' capability coverage, the paper defines an asymmetric feature overlap:

$\text{overlap}(D_1, D_2) = \frac{|F(D_1) \cap F(D_2)|}{|F(D_1)|}$

What it computes: the fraction of benchmark $D_1$'s distinct features that are also activated by at least one sample in benchmark $D_2$. This is not symmetric — $\text{overlap}(D_1, D_2) \neq \text{overlap}(D_2, D_1)$ in general — because the feature sets can have different sizes.

Why this form: the asymmetry is deliberate and informative. The paper gives the example (Figure 6): $\text{overlap}(\text{GSM8K}, \text{MATH}) = 0.63$ while $\text{overlap}(\text{MATH}, \text{GSM8K}) = 0.10$. This means 63% of GSM8K's features are covered by MATH (reflecting that elementary math capabilities are a subset of competition math), but only 10% of MATH's features are covered by GSM8K (reflecting that MATH probes much broader mathematical capabilities). The asymmetric overlap directly answers the practical question: "can I drop benchmark $D_1$ if I already include benchmark $D_2$?" — a high $\text{overlap}(D_1, D_2)$ suggests yes, while a low value suggests no.

Symmetric overlap for correlation with performance similarity. To correlate feature-level similarity with performance-level similarity (which is inherently symmetric — the correlation between two benchmarks' score vectors across models), the paper defines a min-normalized symmetric overlap:

$\text{overlap}_{\min}(D_1, D_2) = \frac{|F(D_1) \cap F(D_2)|}{\min(|F(D_1)|, |F(D_2)|)}$

What it computes: the intersection size divided by the size of the smaller feature set. This ensures the metric is high when the smaller benchmark's features are largely contained in the larger one (capability subsumption) and symmetric in the arguments.

Why this form: using $\min$ as the denominator (rather than $\max$ or the union) captures the intuition that if one benchmark activates 1,000 features and another activates 500, and all 500 of the smaller's features are in the larger's set, then the smaller benchmark is fully subsumed — overlap should be 1.0. Using $\max$ would give 0.5 in this case, which would understate the containment relationship. The paper then correlates this symmetric feature overlap with performance-based similarity (Pearson correlation of model score vectors) across 28 benchmark pairs, finding a direct correlation of 68.4% (Pearson) / 60.7% (Spearman) that improves to 75.5% / 71.3% after controlling for general model ability by partialing out MMLU scores (Table 2). This improvement occurs because models trained longer tend to improve on all benchmarks simultaneously (the "rising tide" effect), inflating performance correlations even between unrelated benchmarks; partialing out MMLU removes this confounding general-ability signal and isolates benchmark-specific capability similarity.

Toxicity Classification: Binary Firing Indicators, Frequency Gap, and Rule-Based Decision

The toxicity classification application (Section 5, Figure 7) demonstrates that SAE features can serve directly as a classifier without any additional learned parameters. The entire pipeline has two stages: (1) discover which SAE features are biased toward toxic text using a labeled selection split, and (2) use those features as an OR-rule detector on held-out test data.

Binary firing indicator. For each example $i$ at layer $\ell$, each SAE feature $f$ is converted to a binary variable indicating whether the feature fires anywhere in the input sequence:

$h_{i,f}^{(\ell)} = \mathbf{1}\left[ \max_t a_{i,t,f}^{(\ell)} > \epsilon \right]$

where $a_{i,t,f}^{(\ell)}$ is the activation (post-ReLU, post-Top-k) of feature $f$ at token position $t$ for example $i$ at layer $\ell$, and $\epsilon$ is a small threshold (set to 0 in the implementation).

What it computes: for each feature and each example, this produces a single bit: 1 if the feature was active at any token position in the example, 0 otherwise. The $\max$ over token positions means that even a single-token activation triggers the feature for the entire example. The threshold $\epsilon = 0$ means any positive activation (after ReLU and Top-k) counts as firing.

Why this form: the max-over-tokens aggregation treats toxicity as a sequence-level property that can be triggered by any toxic span within the text, which matches the annotation scheme of the multilingual toxicity dataset (Dementieva et al., 2024) where entire examples are labeled toxic or clean. Using $\epsilon = 0$ is the simplest possible threshold and is possible because the ReLU activation already zeros out negative values and the Top-k sparsity already zeros out all but the top $k$ features — so any positive $a$ genuinely represents a feature that the SAE encoder chose to activate at that position.

Toxic-clean frequency gap. For each feature $f$ at each layer $\ell$, the paper computes the difference in firing probability between toxic and clean examples:

$\Delta_f^{(\ell)} = \Pr\left[ h_{i,f}^{(\ell)} = 1 \mid y_i = 1 \right] - \Pr\left[ h_{i,f}^{(\ell)} = 1 \mid y_i = 0 \right]$

where $y_i = 1$ denotes a toxic example and $y_i = 0$ a clean example, and the probabilities are estimated from the feature discovery split (2,000 toxic + 2,000 clean examples per language).

What it computes: for each feature, this is the empirical frequency of the feature firing on toxic examples minus its empirical frequency on clean examples. A feature that fires on 80% of toxic examples and 20% of clean examples gets $\Delta = 0.60$. A feature that fires equally on both gets $\Delta \approx 0$. A feature that fires more on clean examples gets $\Delta < 0$.

Why this form: this is deliberately minimal — it uses only first-order marginal statistics (firing frequency) and does not consider feature interactions, conditional dependencies, or activation magnitudes. The paper emphasizes this simplicity as a feature, not a bug: "The design avoids complex formulas to identify classification features and does not require interpreting them in advance. Once an SAE is available, it can be used directly for classification." The frequency gap directly measures selectivity for toxic content, and ranking features by this gap produces an ordered list where the top-ranked features are those most specifically associated with toxic text.

Rule-based classification. Given a selected set of toxic-biased features $S_\ell$ (the top $K$ features by $\Delta_f^{(\ell)}$ at layer $\ell$), a test example is classified as toxic if any selected feature fires anywhere in the example:

$\hat{y}_i = \mathbf{1}\left[ \max_{f \in S_\ell} \max_t a_{i,t,f}^{(\ell)} > \epsilon \right]$

What it computes: an OR-rule over the selected features — the example is predicted toxic if at least one of the top-$K$ toxic-biased features activates on at least one token. If no selected feature fires, the example is predicted clean.

Why this form: the OR-rule maximizes recall for toxic content (any toxic signal triggers a positive prediction) at the potential cost of precision (a single spurious feature activation on clean text causes a false positive). The paper reports that this simple rule achieves F1 > 0.90 on English text with Qwen3-8B (Figure 8, right panel), indicating that precision remains high despite the OR-rule — the selected features are specific enough that they rarely fire spuriously on clean text. The OR-rule also preserves full interpretability: every positive prediction can be traced to the specific feature(s), layer, and token position(s) that triggered it. This is the key advantage over training a classification head, where the decision boundary is an opaque linear combination of many latent dimensions.

Results and insights (Figure 8). The strongest performance is concentrated in middle-to-late layers (layers 20-30 for Qwen3-1.7B, layers 25-33 for Qwen3-8B). Increasing $K$ beyond a very small number (2-5) brings limited additional benefit, indicating that the toxicity signal is sparse — a handful of highly selective features capture most of the discriminative signal. The paper notes that this sparsity is a finding, not an assumption: "This indicates that the toxicity signal is sparse and concentrated in a handful of highly selective latent features."

Cross-lingual structure (Figure 9). The paper examines whether toxic features discovered independently in different languages overlap. The Jaccard overlap between the top-10 toxic feature sets varies substantially: overlap is highest among typologically close languages (European language pairs) and weaker for distant pairs (e.g., English-Amharic, English-Chinese). The layer pattern shows that shared structure is most pronounced in middle layers in both model sizes, with the larger model (Qwen3-8B) showing stronger and more stable overlap.

Cross-lingual transfer. A stricter test: discover toxic features in English only, then apply those same features to held-out test data in other languages without rediscovery. The results (Figure 9d) show strong transfer to European languages (Russian F1 ~0.91, French F1 ~0.89) but significant drops for more distant languages (Amharic F1 ~0.53). The larger model (Qwen3-8B) improves both the level and stability of cross-lingual transfer.

Layer selection without evaluation (Figure 10). To avoid sweeping all layers on held-out data, the paper proposes using the strongest toxic-clean frequency gap within a layer as a proxy for layer quality:

$d^{(\ell)} = \max_f \Delta_f^{(\ell)}, \quad \ell^\star = \arg\max_\ell d^{(\ell)}$

What it computes: $d^{(\ell)}$ is simply the maximum $\Delta$ value across all features in layer $\ell$ — the frequency gap of the single most toxic-selective feature in that layer. The best layer $\ell^\star$ is the one maximizing this quantity. This can be computed entirely from the feature discovery split without any held-out evaluation.

Why this form: the intuition is that if a layer contains even one feature that strongly separates toxic from clean examples during discovery, that layer is likely to be effective at test time because that feature will retain its selectivity on new data. Figure 10 shows that the layer selected by $\text{top1-diff}$ is usually the best layer or very close to it across four languages and both model sizes. This means most of the cost of a full layer sweep can be avoided.

Multi-layer composition (Figure 11). The paper extends the idea to combine features from multiple top-ranked layers. Layers are ranked by their $\text{top1-diff}$ scores, the top $m$ layers are retained, and only the single best feature from each selected layer is kept:

$f_\ell^\star = \arg\max_f \Delta_f^{(\ell)}, \quad \hat{y}_i = \mathbf{1}\left[ \max_{\ell \in \mathcal{L}_{\text{top}}} \max_t a_{i,t,f_\ell^\star}^{(\ell)} > \epsilon \right]$

What it computes: for each selected layer, only the single most toxic-selective feature is used. A test example is predicted toxic if any of these layer-best features fires. This keeps the classifier extremely sparse (one feature per layer, $m$ features total) and fully interpretable while potentially covering complementary toxicity signals that appear in different layers.

Why this form: the paper shows that multi-layer composition provides the largest relative improvement on languages that perform poorly with a single-layer classifier (Figure 11). The pattern is that when no single layer contains a dominant toxicity signal (the harder languages), combining moderately useful layers provides a stronger detector — but on languages where a single layer already works well (English, Russian), adding more layers provides marginal benefit. The recipe is: use the single best layer when its signal is already strong, and add layers only when extra robustness is needed.

Data efficiency (Figure 12). The paper tests how much the feature discovery set can be reduced while maintaining classification performance. Using only 10% of the original discovery data (200 examples per class instead of 2,000) already recovers approximately 99% of the original macro-average F1 across 13 languages. This indicates that the most stable toxic-biased features are identified early and that the SAE-based approach is highly data-efficient for downstream use.

Feature-Driven Safety Data Synthesis: Coverage-Based Target Discovery and Representation-Verified Generation

The data synthesis application (Section 6, Figure 13) introduces the most architecturally complex use of SAE features, combining feature discovery, natural-language feature interpretation, text generation, and representation-level verification into a pipeline that produces training data targeting specific internal feature directions.

The core hypothesis. The paper frames safety post-training not as teaching the model entirely new concepts, but as connecting concepts the model already represents internally to appropriate refusal behavior. The paper states in Section 6:

"recent work argues that refusal is not learned as a wholly new capability during post-training; instead, post-training links an already represented concept of harmful content to a specific action policy"

Under this view, the limitation of standard safety SFT data is not that it fails to teach safety concepts, but that it fails to reach certain safety-relevant internal directions — the model knows internally that certain behaviors are harmful (the features exist), but never receives explicit training signal about them because the training data never activates those features. Feature-driven synthesis addresses this by identifying which safety-relevant features are uncovered by existing data and then explicitly constructing examples that activate those features.

Binary feature coverage on a seed corpus. Given a seed safety corpus $D_{\text{seed}}$ (drawn from the WildJailbreak training set), feature $f$ at layer $\ell$ is defined as "covered" if at least one example in the corpus activates it:

$c_f^{(\ell)}(D_{\text{seed}}) = \mathbf{1}\left[ \exists i \in D_{\text{seed}} \text{ s.t. } h_{i,f}^{(\ell)} = 1 \right]$

where $h_{i,f}^{(\ell)}$ is the binary firing indicator from Section 5 (Equation 13).

What it computes: a single bit per feature per layer: 1 if the current safety supervision ever reaches that internal direction, 0 if it never does. This is a "first-pass support estimate" rather than a measure of training adequacy — it only asks whether the feature is touched at all, not how often or how strongly.

Why this form: the paper intentionally makes this notion coarse. The goal is not to measure whether a feature has been "sufficiently" trained (which would require modeling frequency and interaction effects) but to identify features that are completely absent from the current supervision. These uncovered features are natural synthesis targets because they represent safety-relevant internal directions that the model's post-training has never received any signal about.

Semantic relevance filtering. Not every uncovered feature is safety-relevant — some may represent unrelated concepts (grammar, formatting, generic linguistic patterns). To filter, each feature is paired with a natural-language explanation $e_f^{(\ell)}$ (obtained from top-activating contexts or an automatic feature-interpretation pipeline), and a judge model assigns a relevance score $s_f^{(\ell)} \in [0, 1]$ estimating whether the feature corresponds to behavior useful for safety SFT. The candidate target inventory is:

$T = \left\{ (\ell, f) : s_f^{(\ell)} \geq \tau \right\}$

where $\tau$ is a confidence threshold (not specified numerically in the paper).

What it computes: the set of feature-layer pairs that are both semantically relevant to safety (judge score above threshold) and therefore eligible as synthesis targets, regardless of whether they are covered or uncovered.

Why this form: the semantic filter separates eligibility from priority. Coverage (being in $D_{\text{seed}}$ or not) determines which eligible features are highest priority for synthesis, but coverage alone cannot determine whether an uncovered feature is worth targeting — many features are uncovered because they represent concepts irrelevant to safety. The judge model provides this semantic gate.

Target feature selection. The highest-priority synthesis targets are eligible features that are uncovered by the seed corpus:

$T_{\text{miss}}(D_{\text{seed}}) = \left\{ (\ell, f) \in T : c_f^{(\ell)}(D_{\text{seed}}) = 0 \right\}$

What it computes: the subset of safety-relevant features that are completely absent from current supervision data. When a larger synthesis budget is available, this can be expanded to include weakly covered features (those with firing frequency above zero but below a small support threshold), but the paper primarily focuses on the completely uncovered set.

Why this form: this formulation separates two decisions that are often conflated in data construction: "is this feature safety-relevant?" (semantic eligibility via $s_f^{(\ell)}$) and "does existing data already cover this feature?" (coverage via $c_f^{(\ell)}$). The paper emphasizes this separation: "semantic relevance determines which features are eligible targets, while coverage determines how those targets are prioritized."

Three-stage synthesis pipeline. For each target feature $(\ell, f) \in T$, the synthesis proceeds through prompt construction, response construction, and representation-level verification:

Stage 1: Prompt construction. Given the feature explanation $e_f^{(\ell)}$, a generation model $G_{\text{van}}$ produces a vanilla prompt $x_{\text{van}}$ that expresses the underlying safety-relevant intent in a direct, natural form. Then, one or more adversarial rewriting models $G_{\text{adv}}$ produce variants $\{x_{\text{adv}, k}\}_k$ that preserve the core intent while changing the surface form to resemble realistic jailbreak-style inputs:

$x_{\text{van}} \sim G_{\text{van}}(e_f^{(\ell)}), \quad x_{\text{adv}, k} \sim G_{\text{adv}}(x_{\text{van}}, \eta_k)$

where $\eta_k$ indexes different attack styles. The vanilla prompt serves as a clean semantic anchor, while the adversarial variants broaden coverage toward forms more likely to appear in deployment.

Stage 2: Response construction. The safety label $z \in \{\text{harmful}, \text{benign}\}$ is assigned according to the risk category of the target feature. A response generation model $G_{\text{resp}}$ produces a completion conditioned on the prompt and safety label:

$y \sim G_{\text{resp}}(x, z)$

When $z = \text{harmful}$, the target response is a refusal-style completion that declines the request and potentially redirects to a safe alternative. When $z = \text{benign}$, the target response is a normal helpful completion. The paper emphasizes this distinction: "the aim of safety fine-tuning is not to suppress broad regions of behavior, but to sharpen the boundary between harmful and benign requests."

Stage 3: Representation-level verification. Each synthesized example is retained only if it actually activates the target feature at the source layer: $h_{i,f}^{(\ell)} = 1$. The paper states this explicitly: "examples are not accepted solely because they look relevant at the text level; they must also be validated at the representation level." This is the key advantage of the feature-driven approach — the synthesis target is specified in feature space, and the verification gate ensures that only examples reaching the intended internal direction are included.

Target feature coverage metric. To evaluate how well a synthetic dataset $D$ covers the target inventory, the paper defines:

$\text{Cov}(D) = \frac{1}{|T|} \sum_{(\ell, f) \in T} \mathbf{1}\left[ \exists i \in D \text{ s.t. } h_{i,f}^{(\ell)} = 1 \right]$

What it computes: the fraction of all target features (safety-relevant, eligible for synthesis) that are activated by at least one retained example in the synthetic dataset. Coverage is defined at the representation level, not the prompt level — a synthetic dataset achieves high coverage when it reaches a large portion of the target feature set, not merely when it contains many superficially diverse prompts.

Why this form: this metric directly operationalizes the hypothesis that post-training data is more effective when it activates safety-relevant directions that are missing or weakly supported in the original supervision. Coverage is necessary but not sufficient for downstream improvement — the paper acknowledges that "feature coverage is a representation-level proxy: by itself, it does not guarantee improved downstream behavior." The value comes from the empirical demonstration (Table 3) that improved feature coverage translates into better safety–utility tradeoffs after SFT.

Coverage efficiency results (Figure 14). The paper compares three data construction strategies at matched budgets: natural sampling from the safety corpus, random safety-related synthesis (generating safety prompts without feature targeting), and feature-driven synthesis. With 8,000 total safety-related examples, feature-driven synthesis reaches 99.74% target feature coverage, compared with approximately 90% for random safety-related synthesis and approximately 86% for natural sampling. This is the central empirical advantage: feature-driven synthesis nearly saturates the target feature set, while alternative approaches leave substantial coverage gaps even at larger budgets.

Downstream SFT results (Table 3). The paper evaluates the downstream impact by fine-tuning Qwen3-8B with LoRA on a mixture of general instruction data (Alpaca 50k), real safety data (WildJailbreak), and synthetic safety data. The key comparison fixes the total safety-data budget and replaces random synthetic data with feature-driven synthetic data:

• Safety 4k + Random synth 4k: Safety accuracy 72.00, IFEval 48.98, GSM8K 74.45
• Safety 4k + Feature synth 4k: Safety accuracy 77.75, IFEval 53.23, GSM8K 77.03

Replacing 4k random synthetic examples with 4k feature-driven synthetic examples raises safety accuracy by 5.75 points while also improving IFEval, TruthfulQA, MMLU, and GSM8K scores. The paper emphasizes that "the gain comes from targeted synthesis rather than synthetic data alone" because the matched comparison controls for the total amount of synthetic data — the difference is in whether the synthetic data is generated randomly or targeted at uncovered safety-relevant features. The 8k feature-driven setting (4k real + 4k synthetic) approaches the performance of the 120k safety-only setting (Safety accuracy 77.75 vs. 78.75), demonstrating substantial data efficiency gains.

SAE-Guided Supervised Fine-Tuning for Code-Switching: Language Feature Identification and Auxiliary Suppression Loss

The SFT application (Section 7, Figure 15) moves SAE feature intervention from inference time to training time, internalizing feature suppression into model parameters so that the model learns to avoid undesirable internal states without external intervention at generation time.

Problem definition. Unexpected code-switching occurs when a multilingual LLM generates tokens in an unintended language during response generation. The paper defines the code-switching ratio for a target language $l$ and a set of prompts $X$ where responses should not contain language $l$:

$r = \frac{1}{N} \sum_{i=1}^{N} \mathbf{I}\left( \text{CSW}(l, P_L(x_i)) \right)$

where $\text{CSW}(l, y)$ checks if text $y$ contains any content in language $l$, $P_L(x_i)$ is the model's output for prompt $x_i$, and $\mathbf{I}(\cdot)$ is the indicator function.

Language-specific feature identification. Before training, the method identifies which SAE features correspond to a target language $L$. Features are ranked by a monolinguality score:

$\nu_s^L = \mu_s^L - \gamma_s^L$

where $\mu_s^L$ is the mean activation of feature $s$ on data in language $L$ (the target language), and $\gamma_s^L$ is the mean activation on data in all other languages.

What it computes: for each SAE feature $s$, $\mu_s^L$ measures how strongly the feature fires on average when the input is in language $L$, and $\gamma_s^L$ measures how strongly it fires on average when the input is in any other language. Their difference $\nu_s^L$ is high for features that are selectively activated by language $L$ and low or negative for features that are either language-agnostic or biased toward other languages.

Why this form: this contrastive formulation directly captures language specificity — a feature that fires equally on all languages gets $\nu \approx 0$ regardless of its absolute activation magnitude, while a feature that fires strongly on Chinese but weakly on English gets a high positive score. Ranking by this score identifies the features most specifically associated with the target language. This is the same contrastive logic as the toxicity frequency gap (Equation 14) but using continuous mean activation differences rather than binary firing frequencies.

Evidence for the role of language features in code-switching (Figure 17). The paper provides two pieces of causal evidence:

1. Pre-activation rise before code-switching: tracking the average pre-activation value (the value before ReLU and Top-k in the SAE encoder) of the Chinese language feature at token positions relative to the first code-switched token (position 0) shows that activation gradually increases in the tokens leading up to position 0 and peaks at the switch. This pattern is consistent across all five tested models (Figure 17a), suggesting that "abnormally high pre-activation values may serve as a precursor to unexpected code-switching."

2. Directional ablation suppresses code-switching: subtracting the language feature direction from the residual stream at the final layer of the token immediately preceding the first code-switching token reduces the code-switching ratio, with larger ablation coefficients $\lambda$ yielding greater reductions (Figure 17b). In contrast, ablating an irrelevant language feature has negligible effect, confirming language specificity. The intervention is:

$x' \leftarrow x - \lambda d$

where $d$ is the SAE language feature direction and $\lambda$ controls the ablation strength. This is inference-time steering with negative $\alpha$, and it demonstrates that suppressing the language feature is causally sufficient to reduce code-switching.

SASFT training objective. The method, called Sparse Autoencoder-guided Supervised Fine-Tuning (SASFT), adds an auxiliary loss to the standard cross-entropy SFT objective that penalizes the activation of language-specific features on data where they should not activate. Let $S_L$ be the set of language-specific features for the target language $L$ (features with high $\nu_s^L$). Let $\mathcal{D} = \{\mathcal{D}_1, \ldots, \mathcal{D}_K\}$ be sets of residual streams from training data in each language (e.g., $\mathcal{D}_{\text{en}}$ for English, $\mathcal{D}_{\text{zh}}$ for Chinese). The auxiliary loss is:

$\mathcal{L}_{\text{reduce}} = \mathbb{E}_{\mathcal{D}_j \sim \mathcal{D} \setminus \{\mathcal{D}_L\}} \left[ \mathbb{E}_{x \sim \mathcal{D}_j} \left[ \sum_{s \in S_L} \text{ReLU}\left( f_s(x) - \alpha_j \right) \right] \right]$

where $f_s(x)$ is the pre-activation value of feature $s$ for residual stream $x$, and $\alpha_j$ is the pre-estimated average pre-activation value of feature $s$ on language $j$ data (estimated before training begins).

What it computes: for each residual stream $x$ from a non-target language $j$ (we exclude $\mathcal{D}_L$ because generating language $L$ from language $L$ prompts is not code-switching), the loss adds up the amount by which each target-language feature's pre-activation exceeds its average value on language $j$. The ReLU clips negative values to zero, so features that are at or below their language-$j$ average contribute nothing to the loss. The outer expectation averages over all non-target-language datasets.

Why this form: several design choices are explained:

• ReLU thresholding: using $\text{ReLU}(f_s(x) - \alpha_j)$ rather than penalizing the raw $f_s(x)$ means the loss only penalizes above-average activation of the target-language feature on non-target-language data. The paper explains why $\alpha_j$ is not set to zero: "the pre-estimated average pre-activation value can be negative. In such cases, zero would be too large as a baseline value." By subtracting the language-$j$ baseline, the loss only fires when the feature is abnormally active — when it is behaving as if it were processing the target language during what should be non-target-language generation.

• Exclusion of target-language data: $\mathcal{D}_L$ is excluded because "generating language $L$ from language $L$ does not count as code-switching" — the feature should be active on its own language. The auxiliary loss is only applied when the model is processing or generating in other languages, where the feature should remain at or below its baseline.

• Sum over features: rather than penalizing a single "strongest" feature, the loss sums over all identified language-specific features $S_L$. This encourages the model to suppress the entire language-specific subspace rather than just the single most active feature.

The total training loss is:

$\mathcal{L}_{\text{training}} = \mathcal{L}_{\text{cross-entropy}} + \lambda \mathcal{L}_{\text{reduce}}$

where $\lambda$ is a hyperparameter controlling the auxiliary loss weight (not numerically specified in the paper).

What it computes: the standard next-token prediction loss plus a penalty for features associated with the wrong language being active during training on other languages. The model learns to avoid entering the internal state corresponding to the target language when it should be generating in a different language.

Why this form: this directly addresses the limitation the paper identifies with standard SFT: "the supervision only encourages the model to match the target response and does not provide an explicit negative signal against undesired language switching." The cross-entropy loss says "generate this correct token sequence" but provides no gradient about which internal features should be suppressed. The auxiliary loss explicitly provides this signal: "your Chinese-language feature activation on this English prompt is 0.3 higher than it should be — reduce it."

Results (Tables 4 and 5). SASFT is evaluated on five models (Gemma-2, Llama-3.1, Qwen3) across three target languages (Chinese, Russian, Korean) with two training data sizes (210k and 110k). SASFT consistently outperforms baselines including standard SFT, SFT with GRPO (a reinforcement learning approach), and SFT with a simple penalty term. On Qwen3-1.7B with 210k training data, SASFT reduces code-switching to Chinese from 0.81% (SFT baseline) to 0.22% (-72%), to Russian from 0.19% to 0.03% (-85%), and to Korean from 0.36% to 0.00% (-100%). The paper notes that SASFT maintains or marginally improves performance on standard benchmarks (Table 5), confirming that "suppressing undesirable language features does not compromise general multilingual competence."

SAE-Guided RL for Repetition: Feature Discovery, Causal Verification, and Rare Negative Augmentation

The RL application (Section 8, Figure 18) addresses a different failure mode — endless repetition — using a different SAE feature intervention strategy. Where the SFT method in Section 7 directly suppresses feature activations during training, the RL method uses feature steering to generate examples of the failure mode during rollout collection, providing explicit negative training signal against a behavior that standard online RL rarely encounters.

Problem definition. Endless repetition is a self-reinforcing pattern where the model becomes trapped in a loop of repeated content — a low-frequency failure mode that standard online RL provides only weak training signal against because the behavior rarely occurs naturally during rollouts.

Motivation: why not directly suppress repetition features during training? The paper explicitly considers and rejects the approach from Section 7 for repetition (Section 8.1). The authors initially assumed that pathological repetition and benign repetition (repeating a user's instruction as requested, reproducing answer choices in multiple-choice tasks) would be governed by distinct features. However, they found that the same features show high activation in both scenarios:

"as illustrated in Figure 21, we find that the same features exhibit high activation values in benign repetition scenarios as well... This suggests that the identified features capture a more general notion of repetition rather than being exclusive to pathological cases."

Suppressing these features during training (as SASFT does for language features) would risk degrading the model's ability to perform normal repetitive behavior — an unacceptable trade-off. This motivates the RL approach: instead of permanently suppressing repetition features, generate examples of pathological repetition during training so the model learns to distinguish when repetition is appropriate versus when it collapses into endless loops.

Repetition feature identification. The paper collects samples where the model spontaneously generates endless repetitive content. For each repeated token, it computes the difference in SAE feature activations between the token's first occurrence and its last repeated occurrence within the same context. Features with the largest activation increases are identified as repetition-related features. The rationale is:

"comparing the same token... controls for token-specific variations, ensuring that the observed activation differences are more likely attributable to the repetition process itself rather than to differences in token identity."

What it computes: for a specific token (e.g., the word "the") that appears multiple times in a repetitive sequence, the SAE activation of feature $f$ is measured at the first occurrence and at the last occurrence. The difference quantifies how much the feature's activation increased specifically due to the repetition context, since the token identity is held constant. Features that consistently show large increases during repetition are candidates for being causally involved in the repetition process.

Why this form: controlling for token identity is crucial because SAE features are known to activate differently for different tokens regardless of context — a feature might fire strongly on the word "repeat" for purely lexical reasons unrelated to the repetition failure mode. By comparing the same token at different positions within a repetitive sequence, the context effect (repetition) is isolated from the token effect.

Causal verification via bidirectional steering (Figure 20). To establish causation, the paper performs two experiments:

1. Suppression: on samples prone to repetition, subtracting the repetition feature direction reduces the repetition rate below the baseline, confirming that the feature is necessary for the behavior.
2. Amplification: on normal (non-repetitive) samples, adding the repetition feature direction successfully induces repetitive behavior, confirming that the feature is sufficient to cause the behavior.

This bidirectional manipulation provides stronger causal evidence than unidirectional steering alone — it rules out the possibility that suppression works through a non-specific mechanism (e.g., degrading generation quality generally rather than specifically reducing repetition).

SAE-steered rollout augmentation in DAPO. The method is built on top of DAPO (Yu et al., 2025) without Dynamic Sampling (which is disabled because "it can make the time cost of each training step longer and less controllable"). For each group of rollouts during online RL training, $G-1$ outputs are sampled normally from the policy model, and one additional output $o_G$ is generated with SAE feature steering applied to induce repetitive behavior:

$h' \leftarrow h + \alpha d$

where $d$ is the identified repetition feature direction and $\alpha$ is the steering coefficient. The steered rollout is incorporated into the group alongside the normal rollouts.

What it computes: this creates a training batch where approximately $1/G$ of the rollouts are deliberately biased toward the failure mode, providing the reward model with examples of the undesirable behavior that it can assign low rewards to. The policy gradient then receives explicit signal to reduce the probability of generating outputs that activate the repetition feature strongly.

Why this form: the key insight is that standard online RL encounters the failure mode too rarely to provide effective learning signal. The paper states this motivation explicitly in Section 8.1: "standard online RL rarely encounters such failure cases during rollouts due to their low occurrence probability, and therefore provides only weak signal for eliminating them." By explicitly injecting steered repetitive rollouts, the method increases the visibility of the failure mode during training. The disadvantage is that the steered output may produce unnatural text — but this is acceptable because the model learns to avoid these outputs, not to imitate them. The steered rollout serves as a "negative example" that the policy learns to move away from.

Algorithm summary. The paper provides Algorithm 6 describing the full procedure. For each training step:

1. Sample a batch of prompts $D_b$ from the training distribution.
2. For each prompt, sample $G-1$ normal outputs and one SAE-steered output.
3. Compute rewards for all outputs using the reward model.
4. Compute advantage estimates for each token in each output.
5. Update the policy model by maximizing the DAPO objective over $\mu$ iterations.

The algorithm is identical to standard DAPO except for step 2, where one output per group is generated with SAE steering rather than sampled normally.

Results (Figure 22, Table 7). The method is evaluated on three model scales: Qwen3-1.7B, Qwen3-8B, and Qwen3-30B-A3B. Across all three, SAE-guided RL consistently reduces the repetition ratio much faster and to a substantially lower level than vanilla RL (Figure 22). The repetition ratio under SAE-guided RL "drops sharply in the early stage of training and continues to decrease to a very low level," while vanilla RL yields only limited improvement — the repetition ratio "stays substantially higher than that achieved by our method throughout training."

On downstream benchmarks (Table 7), SAE-guided RL remains broadly competitive with vanilla RL on general capability metrics while providing much stronger repetition reduction. The effect on downstream performance is mixed and task-dependent: some benchmarks show small gains, others show regressions. The paper is candid about this: "SAE-guided rare negative augmentation is effective at targeting the intended failure mode during RL, but does not uniformly improve general-purpose capability. Its main benefit lies in supplying an explicit negative training signal for a rare pathological behavior that standard RL alone does not adequately cover."

4. Key Insights and Innovations

Innovation 1: SAE Features as a Reusable Development Interface, Not Just an Inspection Tool

The paper's most fundamental contribution is a framing shift: it recasts sparse autoencoder features from objects of post-hoc scientific analysis into a reusable interface for practical model development. Prior to this work, the prevailing SAE workflow was discovery-oriented — researchers trained SAEs, inspected features, labeled them, published interesting examples, and moved on. Major open-source SAE releases like Gemma Scope (Lieberum et al., 2024) and Llama Scope (He et al., 2024) provided feature dictionaries primarily as resources for interpretability researchers to explore model internals. The connection from "here's an interesting feature" to "here's how to use it to build a better model" was left as an exercise for the practitioner.

Qwen-Scope's framing is different. The paper argues that a single, well-constructed SAE suite — trained once and frozen — can serve as a common substrate for development workflows spanning diagnosis, evaluation, data construction, and training. This is not a claim that SAEs are the best tool for any single task (a fine-tuned classifier would outperform the rule-based toxicity detector, and a full model evaluation sweep gives more reliable redundancy estimates than feature coverage). Rather, it is a claim about reusability: the same feature dictionary that helps you debug a code-switching failure at inference time can also help you audit your safety training data for coverage gaps, prioritize which benchmarks to include in your evaluation suite, and provide auxiliary training signals during SFT and RL. No prior work had demonstrated SAEs being used across this many stages of the development lifecycle with a single infrastructure investment.

What makes this intellectually distinctive is that it reframes the value proposition of interpretability research. The implicit bargain in much interpretability work is: "we understand models better, and eventually this understanding will lead to better models." Qwen-Scope makes this connection operational rather than aspirational. The paper doesn't ask what features mean in some deep philosophical sense; it asks what features can do — can they steer outputs? classify data? identify redundant benchmarks? guide synthesis? provide training signals? The answer across four application areas is yes, and the evidence is concrete: a steering coefficient dials language style (Figure 3), a feature coverage curve correlates with ranking-based redundancy at ρ ≈ 0.85 (Figure 5), a handful of toxic-biased features achieve F1 > 0.90 on English toxicity without training a classifier (Figure 8), and a feature-based auxiliary loss reduces code-switching by over 50% in most settings (Table 4).

This is a fundamental shift in how the field should think about SAEs — from "microscopes for peering inside models" to "APIs for interacting with models at the representation level." It's not a refinement of an existing approach; it's a new category of use case that prior SAE work had gestured at but never systematically demonstrated across the full development pipeline.

Innovation 2: Feature Coverage as an Evaluation-Free Proxy for Benchmark Curation

The second major contribution is the demonstration that SAE feature coverage can substitute for expensive model evaluation in benchmark curation decisions. The standard approach to assessing whether a benchmark is redundant or whether two benchmarks probe the same capabilities is to evaluate a panel of models and compute ranking correlations — requiring O(M × N) forward passes where M is the number of models and N is the number of samples. This cost scales poorly with the explosion of new benchmarks, making it impractical for large-scale evaluation suite design.

The paper's insight is that SAE feature activation patterns — which can be extracted with a single forward pass per sample through a frozen auxiliary module, requiring no model evaluation at all — carry sufficient signal about what capabilities a benchmark probes to serve as a proxy for the expensive ground truth. The evidence is a Spearman correlation of ρ ≈ 0.85 between feature-based redundancy and performance-based redundancy across 17 diverse benchmarks (Figure 5), and a Pearson correlation of 75.5% between feature overlap and performance similarity after controlling for general model ability (Table 2).

What makes this intellectually distinctive is not the metric itself (coverage curves and Jaccard overlap are standard tools) but the validation that feature-level redundancy tracks ranking-level redundancy robustly enough for practical decisions. The paper doesn't claim feature coverage is a perfect substitute — it acknowledges that high redundancy "does not imply low benchmark quality" and that the metric is intended for the narrow operational scenario of efficient model ranking during iterative development. But the correlation is strong enough, and the cost savings dramatic enough, that it enables a new workflow: evaluation suite designers can use SAE feature footprints to identify redundant benchmarks, detect gaps in capability coverage, and select minimal subsets that preserve discriminative power — all before running a single model evaluation.

The asymmetric overlap analysis (Figure 6) adds a practical dimension that prior benchmark curation work lacked: it directly answers "can I drop benchmark A if I already include benchmark B?" by measuring what fraction of A's features are already covered by B. The finding that overlap(GSM8K, MATH) = 0.63 while overlap(MATH, GSM8K) = 0.10 provides an immediately actionable recommendation — MATH subsumes most of GSM8K's capability signal, so an evaluation suite containing MATH can safely drop GSM8K with little loss of information. This is a new diagnostic capability enabled by SAE features that has no analog in standard benchmark analysis.

This is best understood as a fundamental repurposing of SAE features: they were designed for decomposing individual activations into interpretable directions, but the paper shows they can be aggregated across thousands of samples to characterize entire datasets. The connection from "this feature activates on word problems involving percentages" to "GSM8K's feature footprint is 63% contained in MATH's" is a conceptual leap — the SAE feature dictionary becomes a common language for describing dataset content that bridges the gap between what a benchmark looks like at the text level and what capabilities it actually probes at the representation level.

Innovation 3: Feature-Guided Data Synthesis with Representation-Level Verification

The third innovation is a representation-aware data construction pipeline that targets specific SAE features for synthesis and verifies that generated examples actually activate those features before inclusion in training data. Prior approaches to synthetic safety data generation — such as WildJailbreak (Jiang et al., 2024) — operate entirely at the text level: they generate prompts from risk category descriptions and pair them with refusal responses. The limitation, which the paper identifies sharply, is that text-level diversity does not guarantee representation-level coverage. A dataset can contain thousands of superficially varied safety prompts that all activate the same narrow set of internal features, while safety-relevant directions that the model already knows about (the features exist in its representation space) remain entirely untouched by training.

The paper's key conceptual move is to shift the synthesis target from prompt categories to feature activation. Instead of asking "what prompts haven't we covered?", the pipeline asks "which safety-relevant internal directions has our training data never reached?" The answer is given by feature coverage on a seed corpus (Equation 18): features where no existing example triggers activation at all. These uncovered features become the synthesis targets, and — critically — generated examples are not accepted solely because they look relevant at the text level. They must pass a representation-level verification gate: the example is retained only if it actually activates the target feature (Equation 23).

This verification step is what distinguishes the approach from mere prompt engineering. It closes the loop between synthesis intent and training effect: the pipeline specifies what internal direction to strengthen (via feature selection), generates examples intended to activate that direction (via prompt construction from feature descriptions), and then confirms that the examples actually do activate it (via SAE encoding). The result is a dataset that is aligned not only with textual descriptions of safety-relevant behavior but with the specific internal feature directions that post-training should reinforce.

The empirical payoff is striking: under a fixed data budget, feature-driven synthesis reaches 99.74% target feature coverage while natural sampling and random safety-related synthesis plateau at 88–91% (Figure 14). More importantly, this coverage gain translates into downstream improvements: replacing 4k random synthetic safety examples with 4k feature-driven synthetic examples raises safety accuracy from 72.00 to 77.75 while also improving general capability metrics like IFEval and GSM8K (Table 3). This demonstrates that better representation-level targeting of training data — not just more data — can improve the safety–utility tradeoff.

This is a fundamental conceptual advance in data-centric AI. The field has long known that training data quality matters, but quality has typically been defined at the text level (cleanliness, diversity, correctness). Qwen-Scope introduces a new quality dimension: representation-level coverage. A dataset can be clean, diverse, and correctly labeled at the text level but still fail to activate critical internal model features. The paper provides the first practical pipeline and empirical evidence for closing this coverage gap through targeted synthesis with verification. This reframes data construction from a text-engineering problem to a representation-engineering problem, which is a genuinely new way to think about what makes training data effective.

Innovation 4: Feature-Level Auxiliary Objectives as a Training-Time Alternative to Inference-Time Steering

The fourth innovation is the demonstration that SAE feature signals can be incorporated directly into training objectives, converting what would otherwise be per-step inference-time interventions into permanent model improvements through gradient-based optimization. Inference-time steering (Section 3) has been the most widely adopted SAE application in prior work, but it suffers from a fundamental limitation: the intervention must be applied at every generation step and does not modify model weights, so the undesirable behavior recurs whenever steering is absent. The paper shows that the same feature identification logic that enables steering can be repurposed to construct auxiliary training losses that teach the model to avoid undesirable internal states without external intervention.

This is not a simple extension of steering — it requires solving a new problem. At inference time, you can suppress a feature by subtracting its direction from the residual stream. But during training, you cannot directly modify activations and then compute gradients through the modification (or rather, you can, but it is not equivalent to the model learning to avoid those activations in the first place). The paper's approach in Section 7 (SASFT) addresses this by introducing an auxiliary loss that penalizes the pre-activation of language-specific features on non-target-language data, providing a training signal that the standard cross-entropy loss cannot give: "your Chinese-language feature activation on this English prompt is higher than it should be — reduce it." The result is a model that has internalized the suppression: it no longer enters the Chinese-language feature state when generating in English, without any test-time intervention.

The intellectual contribution here is the recognition that training objectives can reference the model's internal representation, not just its output distribution. Standard SFT optimizes log P(target tokens | input) — the loss only ever sees the output layer. RL adds a reward signal over complete outputs but still operates at the behavioral level. SASFT opens a third category: objectives that directly reference the SAE decomposition of intermediate activations, penalizing specific feature directions that are causally linked to undesirable behaviors. This is a new kind of training signal that has no analog in standard fine-tuning or RL pipelines.

The RL application in Section 8 complements this with a different mechanism: instead of penalizing feature activations during training, it uses feature steering to generate rare negative examples that standard online RL would never encounter naturally. This addresses a different failure mode (endless repetition) that the SASFT approach of direct feature suppression cannot handle because the repetition features are shared between pathological and benign repetition (Figure 21). The innovation here is the recognition that SAE steering can serve not only as a corrective intervention at inference time, but as a data generation tool for creating training examples of behaviors that the model needs to learn to avoid. The steered outputs don't need to be high-quality — the model learns from their low rewards, not from imitating them.

Both applications are best characterized as incremental but important advances in the specific mechanisms of SAE-guided training, built on the fundamental insight that feature-level signals can augment training objectives. The framing is what matters: SAE features are not just handles for post-hoc manipulation but legitimate optimization targets. This opens a new category of training methods where interpretability tools directly inform what the model is optimized to do, closing the loop between understanding and improving.

5. Experimental Analysis

Evaluation Methodology

• Dataset. The paper evaluates across a wide range of benchmarks and datasets depending on the application, reflecting the breadth of the demonstrated workflows. For the evaluation analysis (Section 4), 17 benchmarks are used spanning general knowledge (MMLU, MMLU-Redux, MMLU-Pro, SuperGPQA, C-Eval, CMMLU), STEM and math (GSM8K, MATH, GPQA-Diamond, TheoremQA), code (MBPP, EvalPlus, MultiPL-E), multilingual (MMMLU, INCLUDE), and in-context reasoning (KOR-Bench, ICLEval). For data classification (Section 5), the multilingual toxicity dataset from Dementieva et al. (2024) is used, retaining 13 languages with 5,000 examples each, split into 4,000 for feature discovery (2,000 toxic, 2,000 clean) and 1,000 for evaluation (500 toxic, 500 clean). For data synthesis (Section 6), the WildJailbreak training corpus (Jiang et al., 2024) serves as both the seed safety corpus and the source of real safety data, with evaluation on the WildJailbreak test set and general capability benchmarks (IFEval, TruthfulQA, MMLU, GSM8K, BBH). For SFT (Section 7), evaluation is conducted on six multilingual benchmarks: MMLU, HumanEval, Flores, HellaSwag, LogiQA, IFEval, and MGSM. For RL (Section 8), the repetition ratio is tracked on a held-out set of roughly 10,000 prompts, and downstream capability is evaluated on MMLU, Flores, HellaSwag, LogiQA, IFEval, and MGSM.

• Base model(s). The paper uses models from the Qwen3 and Qwen3.5 families: Qwen3-1.7B (dense, 28 layers), Qwen3-8B (dense, 36 layers), Qwen3-30B-A3B (MoE, 48 layers), Qwen3.5-2B (dense, 24 layers), Qwen3.5-9B (dense, 32 layers), Qwen3.5-27B (dense, 64 layers, instruct variant), and Qwen3.5-35B-A3B (MoE, 40 layers). The SAEs are trained on these models' residual stream activations using in-house pretraining data. For SFT experiments, models from additional families (Gemma-2, Llama-3.1) are also tested to demonstrate method generality. The choice of Qwen models is motivated by their representation of both dense and mixture-of-experts architectures across a range of scales (1.7B to 30B active parameters), making the SAE suite broadly applicable.

• Metrics. The paper uses task-specific metrics tailored to each application. In evaluation analysis (Section 4), Kendall's τ measures ranking agreement between full-benchmark and subset model rankings, with performance-based redundancy R(D) defined as the area under the τ curve; feature redundancy \hat{R}(D) is defined via Equation 9 using the coverage curve area and feature growth rate. In data classification (Section 5), held-out F1 score is the primary metric for toxicity classification performance. In data synthesis (Section 6), target feature coverage Cov(D) (Equation 23) measures the fraction of safety-relevant features activated by at least one example, while downstream safety is measured by Attack Success Rate (ASR), Refusal Rate (RR), and safety Accuracy (Acc). In SFT (Section 7), code-switching ratio r (Equation 24) quantifies the fraction of prompts where the model generates in an unintended language. In RL (Section 8), the repeat ratio tracks the fraction of sampled responses exhibiting endless repetition.

• Baselines. The paper compares against task-appropriate baselines in each application. In data synthesis (Section 6), the baselines are: training on general SFT data only (Alpaca 50k; Taori et al., 2023), training on general plus real safety data at varying scales (8k, 40k, 120k, 200k from WildJailbreak; Jiang et al., 2024), and training on general plus safety data plus random synthetic data (not feature-targeted). In SFT (Section 7), baselines include standard SFT, SFT with GRPO (a reinforcement learning approach), and SFT with a simple penalty term. In RL (Section 8), the baseline is vanilla DAPO (Yu et al., 2025) without Dynamic Sampling and without SAE-steered rollout augmentation, under the same RL setup.

• Generation budget / compute accounting. In the data synthesis experiments, the key budget is the total number of safety-related training examples, which is fixed for fair comparison (e.g., 4k real + 4k synthetic = 8k total). In RL experiments, the budget control is implicit in the training procedure: the method adds one SAE-steered rollout per group of G outputs while keeping all other RL hyperparameters identical to the vanilla DAPO baseline. The paper does not include the computational cost of SAE feature extraction in any budget calculation — SAE encoding is treated as infrastructure that is performed once per input and reused across applications.

• Cross-validation / statistical protocol. The evaluation analysis (Section 4) uses a panel of 26 pretrained checkpoints with varying training steps and data mixture ratios to compute performance-based redundancy and correlation metrics, providing a distribution over model rankings rather than a single-point estimate. The data synthesis experiments (Section 6) use a fixed, reproducible split between training and evaluation data from WildJailbreak. For robustness, the paper also reports results using a different generation model (Gemini-3-Flash) for prompt and response generation, with "very close" performance to the main setup. No formal statistical significance testing or confidence intervals are reported for any result.

Main Quantitative Results

SAE-Based Evaluation Analysis: Feature Redundancy as a Proxy for Ranking-Based Redundancy

The headline finding is that SAE feature redundancy correlates strongly with performance-based benchmark redundancy across 17 diverse benchmarks. Figure 5 reports a Spearman rank correlation of ρ ≈ 0.85 between the performance-based redundancy score R(D) and the feature-based redundancy score \hat{R}(D). The correlation holds across benchmarks of vastly different sizes: GSM8K (1,319 samples) is positioned to the upper right of MMLU-Redux (3,000 samples) in the figure, indicating higher inherent redundancy despite having fewer samples, while SuperGPQA (26,529 questions) exhibits relatively low redundancy despite its large size. The paper notes that "high redundancy does not imply low benchmark quality" — redundancy can be desirable for reducing evaluation variance or ensuring broad domain coverage — and the metric is intended for the narrow operational scenario of efficient model ranking during iterative development.

The inter-benchmark similarity analysis provides complementary evidence. The asymmetric feature overlap matrix (Figure 6, left) reveals intuitive containment relationships: overlap(GSM8K, MATH) = 0.63 while overlap(MATH, GSM8K) = 0.10, indicating that elementary math capabilities are largely subsumed by competition math but not vice versa. Code benchmarks (EvalPlus, MBPP, MultiPL-E) form a tight cluster, and knowledge benchmarks (MMLU-Pro, SuperGPQA) show high coverage of specialized ones like TheoremQA (0.56–0.68). The min-normalized symmetric overlap (Figure 6, right) is used to correlate with performance-based similarity.

Table 2 reports the correlation between symmetric feature overlap and performance-based similarity (Pearson correlation of model score vectors) across 28 benchmark pairs. The direct Pearson correlation is 68.4% (Spearman 60.7%). After controlling for general model ability by partialing out MMLU scores (Equation 12), the partial Pearson correlation improves to 75.5% (Spearman 71.3%). The improvement occurs because "models trained longer tend to improve on all benchmarks simultaneously, inflating performance correlations even between unrelated benchmarks" — partialing out MMLU removes this confounding general-ability signal and isolates benchmark-specific capability similarity.

Toxicity Classification: Rule-Based SAE Feature Detectors

The headline finding is that a small set of SAE features achieves strong toxicity classification without any trained classifier head. Figure 8 shows that on English text, the SAE-based rule classifier achieves held-out F1 exceeding 0.90 on Qwen3-8B and approximately 0.92 on Qwen3-1.7B (read from the figure's best-layer star markers). The strongest performance is concentrated in a relatively narrow band of middle-to-late layers — layers 20–30 for Qwen3-1.7B and layers 25–33 for Qwen3-8B. Increasing the number of selected features K beyond a very small value (2–5) brings limited additional benefit, indicating that "the toxicity signal is sparse and concentrated in a handful of highly selective latent features."

Cross-lingual transfer results are more mixed but encouraging. Figure 9d shows that English-discovered toxic features transfer well to several European languages: best held-out F1 reaches 0.92 for English itself, 0.91 for Russian, 0.89 for French, 0.82 for Spanish, 0.80 for German, but drops substantially for more distant languages — 0.53 for Amharic, 0.62 for Chinese, 0.68 for Arabic. Scaling from Qwen3-1.7B to Qwen3-8B improves both the level and stability of cross-lingual transfer (Figure 9e). The cross-lingual feature overlap analysis (Figure 9a–b) reveals that overlap is highest among typologically close languages, especially among European language pairs, and strongest in middle layers (Figure 9c), with the larger model showing "somewhat stronger and more stable overlap overall."

For efficient layer selection without evaluation, Figure 10 demonstrates that the top1-diff proxy (Equation 16) — selecting the layer whose strongest discovered feature most clearly separates toxic from clean examples — reliably identifies the best or near-best layer across languages and model sizes. The yellow cross (layer selected by top1-diff) and yellow star (best evaluation layer) are coincident or adjacent in most subplots. Multi-layer composition (Figure 11) provides additional gains primarily on harder languages: the average relative improvement over single-layer classification is +4.66% for Qwen3-1.7B and +2.39% for Qwen3-8B, with "most gains coming from languages that perform poorly with a single-layer feature."

Data efficiency results (Figure 12) show that using only 10% of the original feature discovery data (200 examples per class instead of 2,000) already recovers approximately 99% of the original macro-average F1 across 13 languages. For Qwen3-1.7B, macro-average best F1 is 0.782 with 200 select data versus 0.774 with 2,000 select data; for Qwen3-8B, corresponding numbers are 0.814 versus 0.811. Both are within 1% of the full-data baseline performance.

Feature-Driven Safety Data Synthesis: Coverage Efficiency and Downstream Impact

The headline finding is that feature-driven synthesis achieves dramatically higher target feature coverage than alternatives at matched data budgets, and this coverage gain translates into improved safety–utility tradeoffs after SFT. Figure 14 reports that with 8,000 total safety-related examples, feature-driven synthesis reaches 99.74% target feature coverage (2,772 of 2,779 target features), compared with approximately 90% for random safety-related synthesis and approximately 86% for natural sampling at the same budget. Natural sampling improves coverage only gradually as more examples are added — the curve shows diminishing returns, especially once remaining targets move deeper into the long tail. Random safety-related synthesis improves coverage over natural sampling but still leaves approximately 10% of the target inventory uncovered.

Table 3 reports the downstream SFT results. The key matched comparison is between Safety 4k + Random synth 4k and Safety 4k + Feature synth 4k, controlling for total safety data budget (8k examples):

• Safety 4k + Random synth 4k: Safety Accuracy 72.00, ASR 20.0, RR 36.0, IFEval 48.98, TruthfulQA 56.94, MMLU 76.08, GSM8K 74.45, BBH 76.90
• Safety 4k + Feature synth 4k: Safety Accuracy 77.75, ASR 24.0, RR 20.5, IFEval 53.23, TruthfulQA 57.32, MMLU 76.58, GSM8K 77.03, BBH 76.53

Replacing random synthetic data with feature-driven synthetic data raises safety accuracy by 5.75 points (from 72.00 to 77.75) while also improving IFEval (+4.25), TruthfulQA (+0.38), MMLU (+0.50), and GSM8K (+2.58). The paper emphasizes that "the gain comes from targeted synthesis rather than synthetic data alone" — the matched comparison isolates the effect of feature targeting from the effect of simply having more synthetic data. The 8k feature-driven setting (4k real + 4k synthetic) approaches the performance of the 120k safety-only setting (Safety Accuracy 77.75 vs. 78.75), demonstrating substantial data efficiency.

Scaling up real safety data alone (without feature-driven synthesis) shows diminishing returns: Safety 8k achieves 71.75 accuracy, Safety 40k achieves 70.25, Safety 120k achieves 78.75, and Safety 200k achieves 78.50. The plateau between 120k and 200k suggests that natural sampling reaches diminishing returns on safety accuracy, while general capability metrics (IFEval, GSM8K) can degrade at high safety-data volumes (IFEval drops from 51.94 with Alpaca-only to 47.50 with Safety 200k, and GSM8K drops from 79.00 to 82.71 then stabilizes, showing mixed patterns). The paper also reports that using Gemini-3-Flash instead of GPT-based generation for prompt and response construction yields "very close" performance, suggesting the gain is driven by feature-targeted data construction rather than the choice of generation model.

SAE-Guided SFT for Code-Switching: SASFT

The headline finding is that SASFT consistently reduces code-switching ratios by over 50% in most settings, with some configurations achieving complete elimination, while maintaining or marginally improving general multilingual benchmark performance. Table 4 reports code-switching ratios across five models, three target languages, and two training data sizes:

For Qwen3-1.7B with 210k training data:

• Chinese (any→zh): SFT baseline 0.81%, SASFT 0.22% (-72%)
• Russian (any→ru): SFT baseline 0.19%, SASFT 0.03% (-85%)
• Korean (any→ko): SFT baseline 0.36%, SASFT 0.00% (-100%)

For Qwen3-8B with 210k training data:

• Chinese: SFT baseline 0.96%, SASFT 0.66% (-31%)
• Russian: SFT baseline 0.16%, SASFT 0.07% (-56%)
• Korean: SFT baseline 0.43%, SASFT 0.07% (-83%)

SASFT outperforms the baselines (SFT+GRPO and SFT+Penalty) in all configurations. The SFT+Penalty baseline (which adds a simple penalty term) achieves meaningful reductions (e.g., -35% on Chinese for Qwen3-1.7B) but is consistently worse than SASFT (which achieves -72%). SFT+GRPO shows inconsistent results — for Qwen3-1.7B on Korean with 210k data, it achieves only -6% while SASFT achieves -100%. The pattern holds at the smaller training data size (110k): SASFT still achieves -55% on Chinese, -87% on Russian, and -93% on Korean for Qwen3-1.7B.

Table 5 demonstrates that SASFT preserves general capabilities. On Qwen3-1.7B with the Chinese 110k dataset setting, SASFT achieves MMLU 38.38 (vs. SFT baseline 37.47, +0.91), HumanEval 89.04 (vs. 90.29, -1.25), HellaSwag 33.71 (vs. 33.53, +0.18), LogiQA 32.38 (vs. 32.38, 0.00), IFEval 20.22 (vs. 20.27, -0.05), MGSM 30.85 (vs. 32.91, -2.06). For Qwen3-8B, SASFT achieves MMLU 50.09 (vs. 52.15, -2.06), HumanEval 98.27 (vs. 95.87, +2.40), Flores 29.97 (vs. 29.99, -0.02). The paper notes that red numbers indicate improvements over the SFT baseline, and several benchmarks show gains. The paper concludes that "SASFT successfully maintains model capabilities while reducing code-switching, even showing improvements in several cases."

SAE-Guided RL for Repetition: DAPO with Rare Negative Augmentation

The headline finding is that SAE-guided rare negative augmentation dramatically accelerates the reduction of repetition during RL training compared to vanilla DAPO, while remaining broadly competitive on general capabilities. Figure 22 shows the repetition ratio during RL training for three model scales (Qwen3-1.7B, Qwen3-8B, Qwen3-30B-A3B). In all cases, the repetition ratio under SAE-guided RL (RL with SAEs) drops sharply in the early stage of training and continues to decrease to a very low level. Vanilla RL (without SAE steering) yields only limited improvement: "although it sometimes reduces repetition slightly relative to the pre-RL model, the overall decrease remains modest, and the repeat ratio stays substantially higher than that achieved by our method throughout training."

Table 7 reports downstream benchmark results after RL. The comparison is between Before RL, Vanilla RL, and RL+SAE:

For Qwen3-1.7B:

• MMLU: Before RL 41.78, Vanilla RL 41.83 (+0.05), RL+SAE 41.67 (-0.10)
• Flores: Before RL 28.47, Vanilla RL 29.44 (+0.97), RL+SAE 31.06 (+2.59)
• HellaSwag: Before RL 39.66, Vanilla RL 39.99 (+0.32), RL+SAE 40.93 (+1.26)
• LogiQA: Before RL 34.62, Vanilla RL 36.12 (+1.50), RL+SAE 34.88 (+0.25)
• IFEval: Before RL 42.29, Vanilla RL 40.10 (-2.19), RL+SAE 40.42 (-1.88)
• MGSM: Before RL 46.80, Vanilla RL 46.48 (-0.32), RL+SAE 52.36 (+5.56)

For Qwen3-8B:

• MMLU: Before RL 48.40, Vanilla RL 48.55 (+0.15), RL+SAE 48.40 (0.00)
• MGSM: Before RL 70.12, Vanilla RL 70.96 (+0.84), RL+SAE 72.40 (+2.28)

For Qwen3-30B-A3B:

• MMLU: Before RL 51.75, Vanilla RL 51.43 (-0.33), RL+SAE 52.23 (+0.48)
• MGSM: Before RL 76.56, Vanilla RL 77.64 (+1.08), RL+SAE 82.40 (+5.84)

The paper notes that the effect on downstream performance is "mixed and task-dependent: some benchmarks show small gains relative to vanilla RL or the pre-RL model, while others exhibit regressions." The IFEval scores consistently decrease under both vanilla RL and RL+SAE compared to Before RL across all model sizes, while MGSM consistently improves under RL+SAE (most dramatically +5.56 for 1.7B, +5.84 for 30B). The paper is candid: "SAE-guided rare negative augmentation is effective at targeting the intended failure mode during RL, but does not uniformly improve general-purpose capability."

Ablation Studies and Robustness Checks

Feature discovery data efficiency (Figure 12): The toxicity classification pipeline is tested with varying amounts of feature discovery data (50, 100, 200, 500, 1000, 2000 examples per class). Using only 10% of the original data (200 examples) achieves approximately 99% of the original macro-average F1 across 13 languages for both Qwen3-1.7B and Qwen3-8B. The paper notes that "as the discovery budget grows, overlap with the full-data feature set rises quickly, which suggests that the most stable toxic-biased features are found early."

Number of selected features K (Figure 8): The toxicity classification sweeps K ∈ {1, 2, 5, 10} top toxic-biased features per layer. For English with Qwen3-8B, K=1 achieves best-layer F1 approximately 0.92, with K=10 providing minimal additional benefit (curves largely overlap). This sparsity finding supports the claim that "the toxicity signal is sparse and concentrated in a handful of highly selective latent features."

Layer selection proxy (Figure 10): The top1-diff layer selection proxy (Equation 16) is validated by comparing the layer it selects (yellow cross) against the empirically best evaluation layer (yellow star) across four languages and two model sizes. The selected layer is either the best or very close to the best in all subplots, demonstrating that "much of the cost of a full layer sweep can be avoided with a simple statistic computed during feature discovery."

Multi-layer composition (Figure 11): The paper ablates single-layer versus multi-layer classifiers, finding that multi-layer composition provides the largest relative improvement on languages that perform poorly with a single layer (e.g., harder languages like Amharic, Arabic, Chinese). Average relative improvement is +4.66% for Qwen3-1.7B and +2.39% for Qwen3-8B across 13 languages. The paper notes this is "most useful as a targeted robustness mechanism."

Cross-lingual toxic feature overlap (Figure 9a–c): The Jaccard overlap between top-10 toxic feature sets discovered independently in different languages is highest for typologically close pairs, especially European languages, and substantially weaker for distant pairs. The overlap is most pronounced in middle layers, with the larger model (Qwen3-8B) showing "somewhat stronger and more stable overlap overall." This provides evidence that toxicity is not represented in a fully language-agnostic feature basis.

English-to-other-language transfer (Figure 9d–e): Features discovered in English only are applied directly to held-out test data in other languages. Transfer F1 is strong for European languages (Russian ~0.91, French ~0.89) but drops for distant languages (Amharic ~0.53, Chinese ~0.62). The larger model (Qwen3-8B) improves transfer performance and stability, with optimal transfer layers shifting deeper.

Feature-driven vs. random safety synthesis (Figure 14, Table 3): The key ablation in data synthesis is the comparison between feature-driven synthesis and random safety-related synthesis at matched data budgets. At 8k total safety examples, feature-driven synthesis reaches 99.74% target feature coverage while random synthesis reaches approximately 90%. Downstream (Table 3), replacing 4k random synthetic examples with 4k feature-driven synthetic examples raises safety accuracy from 72.00 to 77.75, a +5.75 point gain. Using Gemini-3-Flash for generation (robustness check) yields "very close" performance, suggesting the method is not dependent on a specific generator model. Training on Alpaca 50k only (no safety data) achieves Safety Accuracy 61.75, ASR 73.0, RR 3.5 — demonstrating that safety data is necessary but that targeted synthesis dramatically improves efficiency.

DAPO with vs. without SAE-steered rollout augmentation (Figure 22, Table 7): The RL experiments compare vanilla DAPO against SAE-guided DAPO, with the only difference being that SAE-guided DAPO augments each rollout group with one SAE-steered negative sample biased toward repetitive behavior. The repetition ratio under SAE-guided RL drops sharply and continues to decrease, while vanilla RL shows only modest improvement. Downstream benchmark results are mixed — SAE-guided RL preserves or slightly improves performance on some benchmarks (MGSM shows consistent gains across all model scales) while showing regressions on others (IFEval decreases for all model sizes). The paper notes that the method "does not uniformly improve general-purpose capability."

SFT baselines for code-switching (Tables 4–5): SASFT is compared against SFT, SFT+GRPO (reinforcement learning), and SFT+Penalty (simple penalty term). SASFT consistently outperforms all baselines. SFT+Penalty achieves meaningful reductions but is consistently worse than SASFT, and SFT+GRPO shows inconsistent results — on Qwen3-1.7B Korean with 210k data, SFT+GRPO achieves only -6% while SASFT achieves -100%. On standard benchmarks (Table 5), SASFT maintains performance with "improvements in several cases," though some regressions exist (e.g., Qwen3-1.7B MGSM drops from 32.91 to 30.85, -2.06; Qwen3-8B MMLU drops from 52.15 to 50.09, -2.06; Qwen3-8B HellaSwag drops from 42.48 to 39.60, -2.88).

Causal verification of repetition features (Figure 20): The paper performs bidirectional steering to establish causation: suppressing repetition features on repetition-prone samples reduces repetition below the baseline, while amplifying them on normal samples successfully induces repetitive behavior. This confirms that the features are causally linked to repetition rather than merely correlated. Additionally, Figure 19 shows that repetition features exhibit a sharp and sustained increase around the onset of repetition in repetitive responses, while remaining near zero in non-repetitive responses, consistent with random features in both cases.

Shared repetition features in benign contexts (Figure 21): An important negative finding: the same features identified for endless repetition also show high activation in benign repetition scenarios (repeating a user's instruction, reproducing answer choices in multiple-choice tasks). The paper shows activation heatmaps for two examples in Qwen3-8B where the repetition features fire strongly on tokens that are part of normal, requested repetition. This finding directly motivates the RL approach (generate rare negatives) rather than the SASFT approach (directly suppress features during training), since suppressing these features would "risk degrading the model's ability to perform normal repetitive behavior."

Critical Assessment

Claim 1: SAE feature redundancy can serve as an evaluation-free proxy for benchmark redundancy, with ρ ≈ 0.85 correlation to performance-based redundancy. The evidence for this claim consists of a single correlation computed across 17 benchmarks using 26 model checkpoints (Figure 5). The correlation is undeniably strong — ρ ≈ 0.85 is a meaningful relationship — but several factors limit how confidently this can be generalized. First, the correlation is computed over a specific set of benchmarks that are not randomly sampled but rather selected to span diverse categories (general knowledge, STEM, code, multilingual). It is unclear whether the correlation would hold for an arbitrary new benchmark, particularly one from a domain not represented in the training data of the SAE — if the SAE's feature dictionary lacks features for a particular capability domain, feature coverage on benchmarks in that domain would be uninformative. Second, the 26 model checkpoints come from a single training run (varying training steps and data mixture ratios), meaning they are correlated — they are not independent models. The ranking-based redundancy R(D) is therefore estimated from a narrow slice of model space, and it is unknown whether the feature-ranking correlation would persist if evaluated against a panel of architecturally diverse models from different families and training recipes. Third, the paper does not report confidence intervals or statistical significance for the correlation, making it difficult to assess whether ρ ≈ 0.85 is reliably distinguishable from, say, ρ ≈ 0.70 given the sample size of 17 benchmarks. Fourth, the practical utility of the metric depends on the absolute magnitude of the correlation — at ρ ≈ 0.85, feature redundancy explains about 72% of the variance in ranking-based redundancy, which still leaves meaningful room for benchmarks where the two metrics diverge. The paper does not analyze which benchmarks diverge or why, which would be valuable for understanding the method's failure modes. An experiment that would strengthen this claim: compute the correlation on a fully held-out set of benchmarks not used in any way during SAE training or feature dictionary construction, using a panel of independently trained models from different families.

Claim 2: A small set of SAE features achieves strong toxicity classification (F1 > 0.90 on English) without any trained classifier head. This claim is well-supported by the reported F1 scores (Figure 8), but the framing as "no trained classifier head" requires qualification. While it is true that no additional neural network parameters are trained, there is still a learning step: the feature selection procedure (ranking by ∆_f and selecting the top K) involves optimizing a decision threshold (zero activation, K features, which layer) on the feature discovery split. This is essentially a form of feature selection, and the choice of K and layer could overfit to the discovery split. The paper does not report whether the held-out evaluation split was used only for final evaluation or was touched during layer selection — the text says "evaluation on the test split is straightforward" after features are selected, but the layer selection analysis (Figure 10) compares top1-diff-selected layers against the "best evaluation layer," which implies the evaluation split was used to determine what "best" means. If the evaluation split informed the layer selection at all, the reported F1 scores would be optimistically biased. An experiment that would strengthen this claim: fix the layer and K using only the discovery split (via top1-diff), then report evaluation-split F1 with zero access to evaluation labels during selection, and compare against a standard lightweight classifier (e.g., logistic regression on the same SAE features) to contextualize the performance level.

Claim 3: Feature-driven safety data synthesis improves target feature coverage to 99.74% and translates into better safety–utility tradeoffs after SFT. The coverage result (Figure 14) is the strongest single piece of evidence in the paper, showing a dramatic gap between feature-driven synthesis and alternatives. However, the downstream SFT results (Table 3) require careful interpretation. The key comparison — Safety 4k + Feature synth 4k vs. Safety 4k + Random synth 4k — shows a 5.75-point safety accuracy improvement, which is meaningful. But note that the safety-only baselines show non-monotonic scaling: Safety 8k achieves 71.75 accuracy, Safety 40k drops to 70.25, then Safety 120k rises to 78.75. This non-monotonicity (Safety 40k being worse than Safety 8k) is not explained and raises questions about variance in the SFT training process — if SFT outcomes can vary by several percentage points due to training stochasticity rather than data quality, a 5.75-point gap between two 8k settings may not be reliable. The paper reports no error bars, no multiple training runs, and no significance tests for any downstream SFT result. Additionally, the general capability improvements (IFEval +4.25, GSM8K +2.58) that accompany the safety improvement are surprising — why would better-targeted safety data also improve math reasoning? This could indicate a confounding factor (e.g., the feature-driven synthetic data incidentally contains more diverse or higher-quality instruction-following examples, or the quality of GPT-generated completions differs between targeted and random synthesis). An experiment that would strengthen this claim: train multiple SFT runs with different random seeds and report mean and standard deviation, and include a human evaluation of the synthetic data quality to disentangle feature targeting from general data quality effects.

Claim 4: SASFT reduces code-switching by over 50% in most settings while maintaining general capabilities. The code-switching reductions in Table 4 are large and consistent across models, languages, and training data sizes. The evidence for capability preservation (Table 5) is more mixed — most benchmarks show changes within a few percentage points of the SFT baseline, but some regressions exist (Qwen3-8B MMLU -2.06, HellaSwag -2.88) alongside gains (Qwen3-8B HumanEval +2.40). The paper characterizes these as "maintaining or marginally improving performance," which is reasonable but the regressions deserve acknowledgment. A more significant concern is the scope of evaluation: code-switching suppression is evaluated on Chinese, Russian, and Korean only. The paper does not evaluate whether suppressing Chinese-language features during SFT degrades the model's ability to generate in Chinese when explicitly prompted to do so. The auxiliary loss explicitly excludes target-language data (Section 7.3: "we exclude D_L because generating language L from language L does not count as code-switching"), but the loss may still affect the model's representation of the target language in ways that manifest during intentional Chinese generation. This is a missing evaluation. Additionally, Table 4 reports results across five models including Gemma-2 and Llama-3.1, but Table 5 (capability preservation) reports results only for Qwen3-1.7B and Qwen3-8B — it is unclear whether capability preservation holds for the other model families. An experiment that would strengthen this claim: evaluate intentional generation quality in the target language after SASFT training to ensure the method does not degrade target-language capability, and report capability preservation results for all five tested model families.

Claim 5: SAE-guided rare negative augmentation in RL sharply suppresses repetition while remaining broadly competitive on general capabilities. The repetition suppression effect (Figure 22) is clear and consistent across three model scales — SAE-guided RL consistently and substantially outperforms vanilla RL at reducing the repetition ratio. The downstream benchmark results (Table 7) support the claim of being "broadly competitive" — no catastrophic degradation occurs, and some benchmarks show gains. However, the consistent regressions on IFEval (across all model scales, both vanilla RL and RL+SAE show decreases relative to Before RL) suggest that the RL process itself (not necessarily the SAE augmentation) degrades instruction-following capability. The SAE-guided method does not exacerbate this degradation (40.42 vs. 40.10 for 1.7B, 68.96 vs. 70.42 for 8B, 71.25 vs. 72.29 for 30B), but it also does not remedy it. The paper's honesty about this — "does not uniformly improve general-purpose capability" — is appropriate. A missing experiment is the comparison against an alternative rare-negative generation method that does not use SAEs (e.g., sampling with high temperature, or using a prompt-based approach to induce repetition). Without such a baseline, it is unclear whether the SAE steering is necessary or whether any method for generating rare negative examples would provide similar benefits. An experiment that would strengthen this claim: compare against a non-SAE rare-negative generation baseline (e.g., prompt engineering to induce repetition), and evaluate whether the SAE-steered negatives are more effective at reducing repetition without introducing additional capability degradation.

Cross-cutting weaknesses. Several limitations span multiple applications. First, the SAE infrastructure cost is never accounted for. Training 14 groups of SAEs across all layers of 7 model variants, requiring pretraining data sampling and multiple hyperparameter configurations, represents a substantial computational investment that is not amortized in any application's efficiency analysis. For practitioners considering adopting these methods, the SAE training cost is a real barrier to entry. Second, all applications use SAEs at a single layer or a small number of layers — the paper does not systematically explore whether deeper SAE integration (using features from many layers simultaneously, learning optimal layer combinations per task) would improve results. Third, the SAEs are frozen after training and never updated — in the RL and SFT applications, the model parameters change during training, which means the SAE features may become progressively less aligned with the model's evolving internal representations. The paper does not address this distribution shift or evaluate whether periodically retraining or fine-tuning the SAE during post-training would improve results. Fourth, the difficulty of SAE feature discovery is glossed over — in practice, identifying the right features for a task requires labeled data (contrastive sets for steering, toxicity labels for classification, safety relevance judgments for synthesis), and the paper does not quantify the human or computational cost of this feature discovery step. If discovering useful features is itself expensive, the claimed efficiency gains from using SAE features (rather than training a conventional classifier or using prompt-based methods) may be overstated.

6. Limitations and Trade-offs

The SAE Infrastructure Cost Is Never Accounted For

The assumption or constraint. Every downstream application in the paper depends on the availability of pre-trained SAE modules. The paper releases 14 groups of SAEs across 7 model variants, covering all transformer layers for each backbone — for Qwen3.5-27B alone, this means 64 separate SAEs, each with width 80K and trained on in-house pretraining data (Section 2, Table 1). The computational cost of this training — collecting residual-stream activations across all layers for a large pretraining corpus, training independent SAEs with Top-k sparsity and auxiliary loss, filtering outliers, and tuning hyperparameters — is substantial but never estimated or reported in the paper. The authors acknowledge their reliance on existing infrastructure implicitly by stating the data was "sampled from in-house pretraining data" (Section 2.2) and that the release is intended as "an open foundation for community-driven interpretability research" (Section 1), but the training cost is never quantified.

The consequence. For a practitioner considering adopting these methods, SAE training represents a real barrier to entry that is not reflected in any of the paper's efficiency claims. The 4× compute reduction in benchmark analysis (Section 4) compares feature-based redundancy computation against full model evaluation sweeps, but does not amortize the cost of training the SAE that makes feature extraction possible. Similarly, the data efficiency gains in toxicity classification (10% of discovery data achieves 99% of performance, Section 5.3.2) and safety synthesis (4k feature-driven examples approach 120k natural examples, Section 6.2.3) are computed assuming the SAE already exists — the cost of building it is externalized. If SAE training costs are comparable to or greater than the savings they enable, the practical case for adoption weakens significantly. The problem is most acute for practitioners working with models not covered by Qwen-Scope, who would need to reproduce the entire training pipeline before accessing any of the demonstrated workflows.

What evidence exists in the paper. The paper does not estimate, report, or discuss the computational cost of training the Qwen-Scope SAE suite. Table 1 provides architectural details (model sizes, layer counts, SAE widths, expansion factors) from which a rough FLOP estimate could be derived, but no such estimate is provided. The training section (Section 2.2) mentions the auxiliary loss weight (1/32), the outlier filtering procedure, and the dead feature reduction outcome, but gives no information about training duration, GPU-hours, dataset size, or convergence behavior. The absence of this information is not flagged as a limitation in the conclusion (Section 9), which focuses on future research directions rather than practical deployment barriers.

Mitigation status. Not addressed. The paper treats the SAE suite as given infrastructure — a reasonable stance for a release paper, but one that defers the cost question entirely to the community. The open-source release mitigates this partially for Qwen-model users, who can use the pre-trained SAEs directly, but the cost of training analogous SAEs for other model families (or retraining as models evolve) remains an open problem. The paper does not suggest future work on reducing SAE training cost, improving sample efficiency of SAE training, or amortizing SAE training across multiple downstream applications (though the demonstrated reusability of a single SAE suite across multiple workflows implicitly argues for amortization).

Difficulty Estimation Cost Is Unaccounted for in the Evaluation Analysis

The assumption or constraint. The evaluation analysis framework (Section 4) proposes that SAE feature redundancy can substitute for expensive model evaluation in benchmark curation decisions. The method requires extracting SAE feature activations for every benchmark sample — a single forward pass per sample through the frozen SAE module at a chosen layer. While this is cheaper than evaluating a panel of M models (since SAE encoding uses the base model plus SAE forward pass, not M separate model evaluations), the paper does not account for the difficulty estimation cost in any reported efficiency figure. The 4× reduction is expressed relative to full model evaluation sweeps (which require O(M × N) model forward passes), but the absolute cost of SAE feature extraction — which requires N forward passes through the base model plus SAE — may still be prohibitive for very large benchmarks (SuperGPQA contains 26,529 questions; Section 4.2 mentions it but does not report extraction cost). Moreover, the choice of which SAE layer to use is not obvious a priori — the paper selects layer 15 for Qwen3-8B based on "informal exploration" (stated in context of the reproducibility appendix, though this detail appears in the main text only implicitly through the feature extraction description) without a principled layer-selection protocol. Different layers may yield different feature footprints and therefore different redundancy rankings.

The consequence. A practitioner with a new benchmark of 50,000 samples would still need to run 50,000 forward passes through the base model plus SAE encoder to compute the feature footprint. For a model like Qwen3.5-27B with 64 layers, this involves substantial computation even before any efficiency gains are realized. If the goal is to decide which of several candidate benchmarks to include in an evaluation suite, the cost of extracting features from all candidates may rival or exceed the cost of simply evaluating a small panel of models on a subset of each benchmark — precisely the expensive process the method aims to avoid. The paper's approach implicitly assumes that (a) the base model forward pass is cheap relative to evaluating M models, (b) the SAE forward pass adds negligible overhead, and (c) the SAE only needs to be queried once per benchmark (whereas model evaluations are needed for each new model checkpoint). These assumptions are reasonable in many scenarios but are never made explicit, and the trade-off is never quantified.

What evidence exists in the paper. The paper acknowledges a related cost issue in the context of the compute-optimal evaluation framework from Section 3.2 — where difficulty estimation requires generating 2048 samples per question — flagging it as "an exploration-exploitation tradeoff" and "a key avenue for future work." However, this is a different cost concern from the SAE feature extraction cost in Section 4. The evaluation analysis section itself does not mention the cost of feature extraction at all, treating it as free infrastructure. The correlation results (Figure 5) are reported without any discussion of the computational budget required to produce them.

Mitigation status. Partially mitigated by the paper's framing of Qwen-Scope as open infrastructure — users of the released SAEs do not need to train them, only to run inference. But the inference cost itself is never quantified or compared against the evaluation cost it replaces. The paper does not suggest future work on reducing feature extraction cost (e.g., using a subset of samples rather than the full benchmark, using early-layer features that require fewer transformer blocks to compute, or distilling feature predictions into a lightweight classifier). The fact that only a single layer's SAE is used (rather than all layers) provides some implicit efficiency, but this is a design choice rather than a cost-reduction strategy.

Hard Problems and Rare Failure Modes Remain Outside the Method's Reach

The assumption or constraint. Across multiple applications, the paper demonstrates that SAE-based interventions are most effective when the behavior of interest is already represented in the model's feature space and can be influenced by manipulating those features. However, the paper also documents clear boundaries where this assumption fails. In the toxicity classification application (Section 5), cross-lingual transfer of English-discovered toxic features drops sharply for distant languages — best transfer F1 for Amharic is only 0.53 compared to 0.92 for English itself (Figure 9d). The paper states that "cross-lingual transfer is... graded rather than uniform: performance declines with linguistic distance" (Section 5.2.2). This means toxicity detection for Amharic using only English features is barely above random, and while rediscovering features in Amharic improves performance (the paper shows this in the within-language results), this requires labeled Amharic toxicity data — precisely the resource that cross-lingual transfer was meant to avoid.

In the SFT application (Section 7), SASFT reduces code-switching ratios substantially but does not eliminate them in most configurations — for Qwen3-8B, Chinese code-switching remains at 0.66% after SASFT compared to 0.96% at baseline, a meaningful 31% reduction but far from the 100% elimination achieved for Korean on Qwen3-1.7B (Table 4). The paper does not analyze why SASFT is less effective on some language-model pairs than others, leaving an open question about what factors limit the method's effectiveness on harder cases.

In the RL application (Section 8), while the repetition ratio is suppressed dramatically under SAE-guided RL, the paper's analysis reveals that the repetition features are not specific to pathological repetition — they also activate strongly during benign repetition, such as when the model is asked to repeat a user's instruction or reproduce answer choices (Figure 21). This is the reason the SASFT approach (direct feature suppression during training) was abandoned for repetition: "since the repetition features are shared between endless and benign repetition, directly suppressing their activations during training would risk degrading the model's ability to perform normal repetitive behavior" (Section 8.1). The RL approach avoids this trade-off by generating negative examples rather than suppressing features, but this means the model never actually learns to avoid the repetition features — it learns to avoid the specific outputs that SAE steering induces, which may not generalize to all forms of pathological repetition.

The consequence. These capability boundaries imply that SAE-based methods amplify existing model capabilities but cannot create new ones. If the relevant feature is not reliably present in the SAE dictionary (toxicity features for distant languages, language-specific features that are harder to isolate for some model-language pairs), or if the feature is shared between desirable and undesirable behaviors (repetition features), the methods face fundamental trade-offs between effectiveness and collateral damage. The paper is honest about these boundaries — it does not claim that SAE-based methods solve all instances of the target problems — but the implications for practitioners are significant: deploying these methods requires auditing whether the SAE adequately captures the behavior of interest for the specific model, language, and failure mode at hand.

What evidence exists in the paper. The evidence for these capability boundaries comes from the cross-lingual transfer results in Figure 9d–e (showing sharp performance drops for distant languages, with Amharic at 0.53 transfer F1 vs. English at 0.92), the non-uniform SASFT effectiveness across model-language pairs in Table 4 (code-switching reduction ranges from -31% on Qwen3-8B Chinese to -100% on Qwen3-1.7B Korean), and the finding that repetition features are shared with benign repetition in Figure 21 (explicitly shown via activation heatmaps and discussed in Section 8.1 as the reason for choosing RL over direct feature suppression). The paper's causal analysis for code-switching (Figure 17) and repetition (Figure 20) establishes that the identified features are genuinely involved in the target behaviors, but does not investigate why feature identification is more effective for some settings than others.

Mitigation status. The paper acknowledges these boundaries implicitly through its careful framing — it does not claim universal effectiveness — but does not propose systematic solutions. The cross-lingual transfer results are presented as findings rather than failures, with the paper noting they are "encouraging, but clearly uneven" (Section 5.2.2). The shared repetition feature problem is addressed by switching from direct feature suppression (SASFT approach) to rare negative generation (RL approach), but this is a workaround rather than a solution — the model still cannot distinguish pathological from benign repetition at the feature level. Future work on disentangling shared features or training SAEs that separate fine-grained behavior subtypes would be needed to address this limitation.

The Downstream SFT Results Are Not Statistically Validated

The assumption or constraint. The safety data synthesis experiments (Section 6) and supervised fine-tuning experiments (Section 7) report single-point estimates for all metrics — safety accuracy, ASR, refusal rate, and benchmark scores — without any measure of statistical uncertainty. The paper does not report standard deviations across multiple training runs, confidence intervals, or statistical significance tests for any pairwise comparison. This is a methodological choice that limits the interpretability of the reported differences.

The consequence. The safety SFT results in Table 3 exhibit non-monotonic scaling behavior that is not explained: Safety 8k achieves 71.75 accuracy, Safety 40k drops to 70.25 (worse than 8k despite 5× more data), then Safety 120k rises to 78.75. A 1.5-point drop when quadrupling training data is surprising, and without variance estimates, it is impossible to determine whether this represents a genuine non-monotonicity in safety SFT scaling (which would be an interesting finding) or is simply within the range of training stochasticity. The key comparison — Safety 4k + Feature synth 4k (77.75) vs. Safety 4k + Random synth 4k (72.00) — shows a 5.75-point difference. If the standard deviation across training runs is, say, 2–3 points (which is plausible given the 1.5-point difference between Safety 8k and Safety 40k), the comparison may not be statistically significant. The paper does not report multiple training runs with different random seeds, so the reliability of the 5.75-point improvement cannot be assessed.

Similarly, for the SASFT results (Section 7), Table 4 reports code-switching ratios to two decimal places (e.g., 0.22% for SASFT on Qwen3-1.7B Chinese) without any indication of how variable these ratios are across different random subsets of the training data or different random seeds during SFT. The capability preservation results in Table 5 show several regressions (Qwen3-1.7B MGSM -2.06, Qwen3-8B MMLU -2.06, Qwen3-8B HellaSwag -2.88) alongside gains (Qwen3-8B HumanEval +2.40), but whether any of these changes are meaningful or within noise is unclear without variance estimates.

What evidence exists in the paper. The paper provides no evidence of statistical validation. No error bars appear in any table or figure reporting downstream SFT results (Tables 3, 4, 5). No mention is made of multiple training runs, random seeds, or statistical tests anywhere in Sections 6, 7, or 8. The evaluation analysis section (Section 4) uses 26 model checkpoints to compute correlations, providing a measure of robustness across model variations (which is a form of cross-validation), but this methodological care does not extend to the training-based applications.

Mitigation status. Not addressed. The paper does not acknowledge this as a limitation, nor does it suggest future work on more rigorous statistical evaluation of SAE-guided training methods. The absence is particularly notable given that the paper's framing emphasizes practical utility — practitioners deciding whether to adopt these methods need to know whether the reported improvements are reliable or might disappear with a different random seed. This is a straightforward methodological issue that could be addressed by running 3–5 training replicates per configuration and reporting mean ± standard deviation, or by using paired statistical tests where appropriate.

SAE Features Become Progressively Misaligned During Post-Training

The assumption or constraint. In both the SFT application (Section 7) and the RL application (Section 8), SAE features are used to guide training of the base language model — either through an auxiliary loss that penalizes feature activations (SASFT) or through feature-steered rollout generation (RL augmentation). The SAEs are trained on the base model's residual stream activations and are frozen after training (Section 2.2: "each released SAE provides a feature basis for a specific layer of a specific model"). When the base model is fine-tuned or RL-trained, its internal representations change — the residual stream activations at a given layer for a given input will differ from what the SAE was trained to decompose. The SAE features are therefore progressively applied to an evolving activation distribution that may drift away from the training distribution.

The consequence. In the SASFT setting, the auxiliary loss penalizes the pre-activation values of language-specific SAE features. If the SAE's encoder becomes misaligned with the fine-tuned model's activations, the pre-activation values $f_s(x)$ may no longer accurately reflect the presence of the target language feature in the model's internal state. The auxiliary loss could then penalize activations that no longer correspond to the intended concept, potentially introducing noise into the training signal or even suppressing unrelated features. More subtly, even if the features remain roughly aligned, the auxiliary loss encourages the model to change its internal representations specifically to reduce those feature activations — which means the model is being optimized to move its activations away from directions that the (now-outdated) SAE decoder associates with the target language. This is an adversarial dynamic: the model learns to avoid activating features that the SAE can detect, rather than genuinely learning not to represent the target language. A model that learns to "fool" the SAE rather than genuinely suppress the target-language representation might still code-switch under distribution shift or when the SAE is not present.

In the RL setting, the problem is slightly different but related: SAE feature steering is applied to the policy model during rollout generation to induce repetitive behavior. If the policy model's representations drift during RL training, the SAE's repetition feature direction may no longer correspond to the same internal concept it identified in the base model. The steered rollouts may then fail to effectively induce repetition, reducing the training signal against it, or may induce unrelated behavioral changes.

What evidence exists in the paper. The paper provides indirect evidence that feature alignment persists to some degree: the SASFT method successfully reduces code-switching (Table 4), and the SAE-guided RL method successfully reduces repetition (Figure 22). These results would be unlikely if the SAE features became completely uninformative early in training. However, the paper does not directly measure feature alignment over the course of training — it does not track whether the pre-activation distributions of language-specific features or repetition features shift during SFT/RL, whether the features' correspondence to the intended behaviors degrades, or whether the auxiliary loss becomes less effective as training progresses. The RL results (Figure 22) show that the repetition ratio under SAE-guided RL continues to decrease throughout training, which suggests the steering remains effective, but this could be because the policy model has not drifted far enough to break alignment, not because the method is robust to drift. For larger post-training budgets or more aggressive fine-tuning, alignment degradation could become a more significant problem.

Mitigation status. Not addressed. The paper does not discuss distribution shift between the base model (on which SAEs are trained) and the post-trained model (on which SAE features are applied). The conclusion (Section 9) suggests future work on "model diffing and post-training analysis" — using SAEs to compare models before and after fine-tuning — but frames this as an analysis tool rather than as a solution to the alignment problem. A natural mitigation would be to periodically retrain or fine-tune the SAEs during post-training, or to train SAEs jointly with the post-training objective, but this would substantially increase computational cost. The paper does not explore these options or acknowledge the drift problem as a limitation of the frozen-SAE approach.

No Generalization Evidence Beyond Qwen Models for Most Applications

The assumption or constraint. The paper's core infrastructure — the Qwen-Scope SAE suite — is trained exclusively on Qwen3 and Qwen3.5 model families (Section 2, Table 1). Four of the five application areas are demonstrated primarily or exclusively on Qwen models: inference-time steering (Section 3, Qwen3 examples in Figure 3), evaluation analysis (Section 4, using Qwen3-8B SAEs, though the specific model is mentioned only in context), toxicity classification (Section 5, using Qwen3-1.7B and Qwen3-8B), and safety data synthesis (Section 6, using Qwen3-8B). The paper states in Section 6.2.1: "All synthesis targets are defined with respect to an SAE trained on its layer-30 residual stream, with a latent dimensionality of approximately 65k" — referring to Qwen3-8B. For the RL application (Section 8), all three tested model sizes are Qwen3 variants (1.7B, 8B, 30B-A3B). Only the SFT application (Section 7) tests on non-Qwen models — Gemma-2 and Llama-3.1 are included in Table 4 — providing the sole cross-model-family evidence in the paper.

The consequence. The practical utility of the demonstrated methods for users of non-Qwen models is largely unknown. While the SAE training pipeline (Section 2.2) follows established methods that are in principle model-agnostic — Top-k activation, auxiliary loss for dead features, outlier filtering — there is no evidence that the specific features, coverage patterns, or intervention effects observed on Qwen models will generalize to other architectures. Different model families may have different internal feature organizations: a feature that is cleanly separable and steerable in Qwen's residual stream may be entangled with other concepts in a Llama or Gemma model, making it harder to identify, steer, or suppress without collateral effects. The evaluation analysis framework (Section 4) is the most model-agnostic in principle — feature redundancy and overlap can be computed for any model equipped with SAEs — but the specific correlations (ρ ≈ 0.85) and conclusions (GSM8K is largely covered by MATH) are validated only on Qwen3-8B. It is unknown whether the same feature overlap patterns would appear with SAEs trained on a different model family, or whether the feature-based redundancy metric would correlate equally well with performance-based redundancy across model families.

The paper positions Qwen-Scope as "an open foundation for community-driven interpretability research" that will "enable researchers and developers to explore Qwen-series models more deeply" (Section 1). This is a reasonable scope — a model-specific toolkit does not need to demonstrate cross-model generalization — but the framing of the applications as demonstrating that "SAEs can serve not only as post-hoc analysis tools, but also as reusable representation-level interfaces" (Section 1) makes a broader claim about the utility of SAEs in general, not just SAEs on Qwen models. The gap between the general claim and the Qwen-specific evidence is a limitation that practitioners should weigh when deciding whether to invest in building analogous infrastructure for their own model families.

What evidence exists in the paper. The SFT results in Table 4 include Gemma-2 and Llama-3.1 models alongside Qwen3 variants, and SASFT consistently outperforms baselines across all three model families — this is encouraging evidence that at least the language feature identification and auxiliary suppression approach generalizes across architectures. However, this is the only application with cross-model evidence. The toxicity classification results (Section 5), safety synthesis results (Section 6), RL results (Section 8), and evaluation analysis results (Section 4) are all Qwen-specific. The paper does not discuss whether or how the findings might transfer, does not provide any qualitative comparison of SAE feature organization across model families, and does not suggest cross-model validation as future work (the future directions in Section 9 focus on extending Qwen-Scope to new application types, not to new model families).

Mitigation status. Partially mitigated by the open-source release — other researchers can train SAEs on different model families and test whether the application patterns replicate. The SFT results provide initial evidence that at least some methods transfer, which is promising but insufficient to establish general cross-model validity. The paper does not claim cross-model generalization explicitly where it is not tested, which is appropriate scientific practice, but the overall narrative of SAEs as general-purpose development interfaces would be stronger with broader validation. The paper does not suggest systematic cross-model evaluation as future work, which is a missed opportunity.

7. Implications and Future Directions

How This Work Changes the Landscape

This paper does not introduce a new algorithm or a state-of-the-art result on any single benchmark. Its contribution is methodological and infrastructural: it demonstrates that sparse autoencoder features, once trained and frozen, can serve as a reusable representation-level interface that connects model internals to practical development workflows — debugging, evaluating, data construction, and training — without requiring retraining or modification for each new task. The magnitude of this shift is best understood as a reframing of the role of interpretability tools in the model development lifecycle.

Before Qwen-Scope, the prevailing mental model for SAE research was roughly: "train SAEs → inspect features → publish interesting findings → hope this understanding eventually leads to better models." The paper does not reject this model — mechanistic understanding remains a legitimate scientific goal — but it adds a parallel track where SAE features are operationalized directly. The paper's core empirical demonstration is that the same SAE feature dictionary, trained once and never updated, can: (1) diagnose and suppress code-switching via activation during inference (Section 3), (2) provide an evaluation-free proxy for benchmark redundancy with ρ ≈ 0.85 correlation to performance-based redundancy (Section 4, Figure 5), (3) classify multilingual toxicity at F1 > 0.90 without training any classifier head (Section 5, Figure 8), (4) guide the synthesis of safety training data that reaches 99.74% target feature coverage and improves the safety–utility tradeoff under fixed budgets (Section 6, Figure 14, Table 3), (5) provide an auxiliary loss signal during SFT that reduces code-switching by over 50% in most settings (Section 7, Table 4), and (6) generate rare negative rollouts in RL that sharply suppress endless repetition across three model scales (Section 8, Figure 22).

This is not a paradigm shift — it does not challenge the foundations of interpretability research or propose a new theory of how models represent concepts. It is, however, a substantive methodological expansion of what interpretability infrastructure can do. The key reframing is conceptual: SAE features move from being objects of study (things we look at to understand models) to being development primitives (things we use to build better models). This reframing has several concrete consequences for the field:

It reconciles a tension between mechanistic and applied interpretability. Mechanistic interpretability research has often been criticized for its distance from practical impact — understanding how a model implements a particular circuit or represents a specific concept is intellectually satisfying but rarely translates into improved model behavior. The applied machine learning community, meanwhile, has developed a rich set of tools for model improvement (prompt engineering, fine-tuning, RLHF, data augmentation) that operate at the behavioral level without ever peering inside the model. Qwen-Scope bridges these traditions by showing that the same features that mechanistic interpretability discovers can be plugged directly into applied workflows — the language feature you identify through contrastive analysis (Section 3.2) is the same feature you suppress during SFT (Section 7.3), and the safety feature you discover through automatic interpretation is the same feature you target for data synthesis (Section 6.1). This closes the loop between understanding and improvement in a concrete, operational way that neither tradition has previously achieved.

It lowers the barrier to entry for interpretability-informed development. Training SAEs is computationally expensive — the paper trains 14 groups of SAEs across all layers of 7 model variants — but once trained, the SAE modules are lightweight to use. Feature extraction requires a single forward pass through a frozen auxiliary module. Feature identification for a new task (e.g., finding toxicity features for a new language) requires only a modest labeled dataset (200 examples per class achieves 99% of full-data performance; Section 5.3.2). Steering at inference time requires only a feature index and a scalar coefficient. The paper's open-source release of pre-trained SAEs for the Qwen family means that practitioners working with Qwen models can immediately access all demonstrated workflows without any SAE training — a substantial practical efficiency gain that shifts the cost calculus for whether to adopt interpretability-based methods.

It redirects research attention toward verifier quality and feature coverage as development metrics. The paper's findings — particularly in data synthesis (Section 6) and evaluation (Section 4) — establish that feature coverage is a meaningful quality signal for training data and evaluation benchmarks. A safety SFT dataset that achieves high feature coverage of safety-relevant internal directions produces better downstream safety behavior than one that does not, even when total data volume is held constant (Table 3). A benchmark whose feature coverage saturates quickly (high redundancy) can be subsampled without losing ranking information, with feature-based redundancy correlating at ρ ≈ 0.85 with the expensive ground truth (Figure 5). These findings suggest a new axis of quality assessment — representation-level coverage — that is orthogonal to traditional metrics like text-level diversity, correctness, or difficulty. Researchers developing new training datasets or evaluation benchmarks can now ask not just "is this data diverse and correct?" but "does this data reach the right set of internal model features?" This is a new diagnostic capability that the paper makes practical and quantitative.

It introduces feature-level auxiliary objectives as a new category of training signal. Standard fine-tuning and RL objectives operate at the output level — the loss references the model's predictions, not its internal representations. SASFT (Section 7) and the SAE-guided RL method (Section 8) demonstrate a third category: objectives that directly reference SAE feature activations in intermediate layers. The SASFT auxiliary loss penalizes the pre-activation of language-specific features on non-target-language data, providing a training signal that the cross-entropy loss cannot give: "your Chinese feature is active when it shouldn't be — reduce it." The RL method uses feature steering to generate rare negative examples that standard online rollouts would never produce, providing explicit corrective signal against low-frequency failure modes. These are not refinements of existing training methods — they are new types of training interventions made possible by the availability of interpretable feature decompositions. The paper's framing of SAE features as "development primitives" rather than "inspection objects" is precisely what enables this extension: if features are just things we look at, there is no reason to incorporate them into training. If features are actionable control variables, then optimizing with respect to them is natural.

It makes the case that infrastructure investments in interpretability have compound returns. The paper's most distinctive structural feature is that the same SAE suite is reused across every application. The language features used for inference-time steering in Section 3 are the same language features used in the SASFT auxiliary loss in Section 7. The safety features used for data synthesis targeting in Section 6 are identified using the same SAE infrastructure that supports evaluation analysis in Section 4 and toxicity classification in Section 5. This reusability is the paper's central argument for why SAE training — despite its cost — is a worthwhile investment: the infrastructure cost is paid once, and the feature dictionary becomes a general-purpose development substrate. This is a different value proposition than most interpretability work, which treats each study as a standalone investigation requiring its own infrastructure. The paper does not make this argument explicitly in economic terms (the SAE training cost is never reported), but the demonstrated breadth of applications makes the case implicitly: a single SAE suite enables ten distinct development workflows across four application categories.

Follow-Up Research This Work Enables

Systematic cross-model-family validation of feature redundancy as an evaluation proxy. The paper demonstrates that SAE feature redundancy correlates with performance-based redundancy at ρ ≈ 0.85 on 17 benchmarks using Qwen3-8B (Section 4, Figure 5). This result is promising but validated on a single model family with a panel of 26 correlated checkpoints from the same training run. A strong follow-up would replicate the analysis across three architecturally diverse model families (e.g., Gemma, Llama, Qwen) equipped with comparable SAE suites (Gemma Scope exists; Llama Scope exists), using a panel of independently trained models rather than checkpoints from a single run. The key question is whether the ρ ≈ 0.85 correlation is Qwen-specific or reflects a more general relationship between SAE feature structure and benchmark discriminative power. If the correlation holds across model families, SAE-based benchmark curation becomes a genuinely model-agnostic tool. If it degrades on some architectures (e.g., MoE models may have different feature organization), the finding would delineate when SAE-based proxies are reliable versus when full evaluation sweeps are still necessary. The experiment would also test whether the specific containment relationships identified (e.g., overlap(GSM8K, MATH) = 0.63) are stable across model families or are artifacts of Qwen's particular feature organization.

Training a lightweight difficulty/coverage predictor to amortize SAE inference cost. The paper's evaluation analysis (Section 4) and data synthesis (Section 6) frameworks both rely on SAE feature extraction — passing benchmark samples or safety data through the base model plus SAE encoder. For large datasets (SuperGPQA contains 26,529 questions), this extraction cost can be substantial. A natural follow-up would train a lightweight classifier that predicts SAE feature activation patterns directly from tokenized text, bypassing the need for full model forward passes. The training data would be pairs of (text, SAE feature activation vector) generated by the Qwen-Scope infrastructure. The target architecture could be a small transformer or even a bag-of-words model trained to predict binary feature firing indicators. The research question is: what is the minimum model capacity needed to achieve feature coverage estimates within some tolerance (say, 5% error) of the full SAE-based estimates? If a model with 1% of the parameters of the base model can reliably predict which SAE features a text will activate, the entire benchmark analysis and data synthesis pipeline becomes practical at internet scale — any new benchmark or dataset could be characterized for feature coverage in seconds rather than GPU-hours. This would transform Qwen-Scope from a development toolkit into a data curation infrastructure. The key metric would be the correlation between classifier-predicted coverage curves and SAE-derived coverage curves as a function of classifier size.

Disentangling shared features: training SAEs that separate pathological from benign repetition. The paper's finding that repetition features are shared between endless repetition and benign repetition (Section 8.1, Figure 21) is both a limitation of the current SAE dictionary and a clear target for improvement. The current SAEs are trained on general pretraining data with Top-k sparsity and no behavior-specific supervision. A targeted follow-up would train behavior-conditioned SAEs that learn separate feature dictionaries for different behavioral regimes. Concretely, one could collect a dataset of model outputs labeled by behavioral category — normal generation, benign repetition (repeating instructions, reproducing multiple-choice options), pathological repetition (endless loops) — and train an SAE variant where the sparsity pattern is conditioned on the behavioral label, encouraging different features to activate in different regimes. The evaluation would test whether the resulting feature dictionary contains features that are selectively active during pathological repetition but not during benign repetition (measured by contrastive firing rates, analogous to the toxicity Δ metric in Equation 14). If successful, these disentangled features would make the SASFT approach from Section 7 applicable to repetition — directly suppressing repetition features during training without degrading normal repetitive behavior — and would provide cleaner steering targets for both diagnosis and correction. The experiment would also serve as a stress test for whether SAE training procedures can be augmented with behavioral supervision to improve feature specificity, which is a general question relevant beyond repetition.

SAE-guided curriculum learning for post-training: dynamically selecting features to suppress based on training progress. The paper's SASFT method (Section 7) identifies language-specific features before training and suppresses them uniformly throughout. But the feature analysis in Figure 17a suggests a more dynamic relationship: code-switching is preceded by a gradual increase in language feature pre-activation over several token positions. This temporal pattern suggests that different features may be most relevant at different stages of training. A natural extension would be a curriculum where the set of suppressed features evolves as training progresses — early in training, suppress the highest-activation language feature (the one that peaks at the code-switch moment); later, expand suppression to the features whose activation rises in the preceding tokens (the "precursors" in Figure 17a). The hypothesis is that early suppression of the strongest signal makes the model easier to fine-tune, after which the subtler precursor signals become the binding constraint and need to be addressed. A strong experiment would compare uniform SASFT against curriculum SASFT on a held-out code-switching benchmark, measuring both final code-switching ratio and training stability (does the curriculum reduce the regression on general benchmarks like MMLU that uniform SASFT shows in Table 5?). The experiment would also characterize whether different languages require different curricula — perhaps the Chinese feature in Qwen3-8B (which SASFT reduces by only 31%) would benefit more from a curriculum than the Korean feature in Qwen3-1.7B (which SASFT eliminates entirely).

Characterizing when feature-driven data synthesis fails: a systematic audit of coverage-to-behavior gaps. The paper demonstrates that feature-driven synthesis improves target feature coverage to 99.74% (Figure 14) and that this coverage gain translates into improved safety accuracy (Table 3). But the relationship between coverage and behavior is not one-to-one: some features, even when activated by training data, may not produce the intended behavioral change because the model's response to feature activation depends on other contextual factors. A systematic follow-up would audit the coverage-to-behavior pipeline by selecting a stratified sample of target features (varying by semantic category, baseline activation level, and layer), synthesizing training data that achieves high coverage for each feature individually, and measuring whether SFT on that feature-specific data produces the intended refusal behavior on prompts designed to activate that feature. The experiment would identify which feature categories are "trainable" (coverage translates to behavior change) versus "resistant" (coverage increases but behavior does not change) and characterize what distinguishes them. If, for example, features in late layers are more behaviorally consequential than features in middle layers (despite both being activatable by synthetic data), this would inform layer selection for future synthesis pipelines. If features representing concrete, specific harmful behaviors train better than features representing abstract safety categories, this would inform feature prioritization. The experiment would produce a taxonomy of feature trainability that moves the synthesis pipeline from "target the uncovered features" to "target the uncovered features that are likely to produce behavioral change."

SAE-based monitoring for deployment-time safety and capability regression. The paper's evaluation and classification applications (Sections 4 and 5) use SAE features for static analysis — characterizing benchmarks or classifying data. An important extension would be deployment-time monitoring: continuously tracking SAE feature activation statistics on live traffic to detect distribution shifts, emerging failure modes, or safety-relevant activation patterns before they manifest in outputs. Concretely, for a deployed chatbot, one could track the average activation of known safety-relevant features (identified through the discovery pipeline in Section 6.1.1) and alert if feature activation patterns drift into regions associated with unsafe behavior in the training corpus. The paper's finding that code-switching is preceded by a gradual rise in language feature pre-activation (Figure 17a) suggests that such monitoring could provide early warning before undesirable outputs are generated. A strong experiment would deploy Qwen3-8B with SAE feature monitoring on a live instruction-following task, introduce a distribution shift (e.g., increasing the proportion of adversarial prompts), and measure whether SAE feature statistics detect the shift earlier or more reliably than output-based metrics (refusal rate, toxicity classifier scores). The experiment would also establish baselines for false positive rates — how often do safety-relevant features activate on benign inputs, and can activation magnitude thresholds separate benign from harmful activation patterns? The paper already provides partial evidence on this: the toxicity classification results (Figure 8) show that selected toxic features have high precision (F1 > 0.90), suggesting that feature activation is not so noisy as to make monitoring useless, but the specific monitoring use case requires characterizing activation distributions rather than binary classification accuracy.

Practical Applications and Downstream Use Cases

Evaluation suite design without model evaluation. The paper's strongest practical contribution is the demonstration that SAE feature redundancy can substitute for expensive model evaluation sweeps in benchmark curation — with a Spearman correlation of ρ ≈ 0.85 between feature-based redundancy and ranking-based redundancy across 17 benchmarks (Section 4, Figure 5). For a research lab or company maintaining an evaluation suite of 50–100 benchmarks and regularly evaluating 10–20 model checkpoints during iterative development, the standard workflow requires tens of thousands of model forward passes every evaluation cycle. Using Qwen-Scope, the same lab could: (1) extract feature footprints for all candidate benchmarks once (a fixed, non-recurring cost of one forward pass per benchmark sample through the SAE-augmented model), (2) compute pairwise feature overlaps to identify which benchmarks are redundant (e.g., the finding that MATH subsumes 63% of GSM8K's features suggests GSM8K can be dropped if MATH is included; Figure 6), (3) compute feature redundancy scores to identify which benchmarks can be aggressively subsampled while preserving ranking information (benchmarks with high $\hat{R}(D)$ need fewer samples; Section 4.2), and (4) identify capability gaps by detecting benchmarks with low overlap against all current suite members. The concrete efficiency gain: the 26-model × 17-benchmark sweep that the paper uses to validate the correlation would be replaced by 17 feature extraction passes, reducing the per-cycle evaluation cost by roughly 26×. For a lab evaluating 50 checkpoints per week across 30 benchmarks, this could mean tens of thousands of GPU-hours saved per quarter. The method is not a perfect substitute — the paper acknowledges feature redundancy does not perfectly track ranking redundancy at ρ = 1.0 — but for the specific operational scenario of iterative model development where approximate rankings are sufficient, the tradeoff of a small amount of ranking reliability for a dramatic reduction in evaluation cost is compelling.

Multilingual content moderation with transparent, feature-based decisions. The toxicity classification pipeline (Section 5) demonstrates that a small set of SAE features — as few as 2–5 per language — can achieve F1 > 0.90 on English toxicity detection without training any classifier head (Section 5.1.2, Figure 8). The cross-lingual transfer results (Section 5.2.2) show that English-discovered features transfer with strong performance to European languages (Russian F1 ~0.91, French F1 ~0.89) but weaker performance to distant languages (Amharic F1 ~0.53). For a content moderation platform operating across multiple languages, the practical workflow would be: (1) use the released Qwen-Scope SAEs with a small labeled dataset in the platform's primary language (~200–500 examples; Section 5.3.2 shows 10% of data achieves 99% of performance), (2) discover toxic-biased features using the frequency gap metric (Equation 14), (3) deploy the rule-based classifier (Equation 15) as a first-pass filter that flags content for human review with full traceability — each flagged item can be explained by which SAE feature(s) activated, at which layer, and on which token(s). For languages where English-discovered features transfer poorly (Amharic, Arabic, Chinese), invest in a small labeled dataset for feature rediscovery — the paper shows that within-language discovery achieves strong performance even for these languages (Figure 9). The concrete advantage over a fine-tuned classifier (e.g., a BERT-based toxicity model) is interpretability and auditability: every automated decision can be traced to specific, inspectable model-internal features rather than an opaque classification head. This matters in regulatory contexts where content moderation decisions must be explainable. The concrete limitation is that SAE-based classification requires running the full language model plus SAE encoder per input — if latency is critical, the overhead relative to a lightweight dedicated classifier may be unacceptable. The paper does not report classification latency, which would be important for operational decision-making.

Safety SFT data augmentation targeting representation-level coverage gaps. The feature-driven safety data synthesis pipeline (Section 6) offers a concrete recipe for improving the efficiency of safety post-training. Given a seed safety corpus (e.g., WildJailbreak), a practitioner can: (1) pass the seed corpus through the Qwen-Scope SAE to identify which safety-relevant SAE features are uncovered (Equation 18), (2) use feature explanations to synthesize prompt–response pairs targeting the uncovered features (Section 6.1.2), (3) verify that generated examples actually activate the target features via the representation-level verification gate, and (4) add the verified synthetic examples to the safety SFT training mixture. The paper's empirical results provide concrete scaling guidance: with 4,000 feature-driven synthetic examples added to 4,000 real safety examples, safety accuracy reaches 77.75, approaching the performance of 120,000 real safety examples (78.75) — roughly a 15× data efficiency improvement (Table 3). The practical implication is that organizations with limited budgets for human safety annotation can use feature-driven synthesis to close coverage gaps that would otherwise require collecting far more natural safety data. The method is most useful when the base model already represents safety-relevant concepts internally (the features exist) but has not been trained on explicit supervision for those concepts. The paper's framing — "post-training links an already represented concept of harmful content to a specific action policy" (Section 6) — suggests this condition holds for most safety-relevant behaviors in capable base models, making the method broadly applicable. The concrete limitation is that the synthesis pipeline depends on feature interpretation and judge-model scoring for selecting synthesis targets (Section 6.1.1), which introduces a subjective element that could miss safety-relevant features or target irrelevant ones. The paper shows that the pipeline is robust to generator choice (Gemini-3-Flash produced similar results to the main setup; Section 6.2.3) but does not evaluate robustness to judge-model choice.

When to Prefer This Method

The paper positions Qwen-Scope as a development infrastructure, not a single method to be preferred over alternatives. However, across its application areas, four clear decision rules emerge from the empirical results:

Prefer SAE feature-based benchmark analysis over full model evaluation sweeps when: The evaluation suite is large (10+ benchmarks) and models are evaluated frequently (weekly or daily during iterative development), and approximately correct rankings are sufficient (the feature-based redundancy metric correlates at ρ ≈ 0.85 with ranking-based redundancy, meaning about 72% of variance is shared; Section 4.2, Figure 5). The cost savings — replacing O(M × N) model evaluations with O(N) SAE feature extractions — are most significant when M (the number of model checkpoints) is large and benchmarks are large. The method should NOT replace evaluation for final release decisions where precise ranking and absolute performance estimates matter.

Prefer SAE feature-driven safety data synthesis over scale-alone approaches when: The safety SFT data budget is constrained (less than ~10k examples total) and the base model is known to represent safety-relevant concepts internally (features exist but are uncovered). The paper shows that 4k real + 4k feature-driven synthetic examples (total 8k) reaches 77.75 safety accuracy, approaching the 120k real-only result of 78.75 — roughly 15× data efficiency (Table 3). The method is most valuable when natural safety data collection is expensive (human annotation cost, adversarial prompt construction difficulty) but SAE infrastructure exists.

Prefer SASFT over inference-time steering when: The undesirable behavior is persistent and frequent enough to justify retraining, and the SAE features for the behavior are specific (activating the feature is causally linked to the behavior and the feature is not shared with desirable behaviors, as verified by the causal tests in Section 7.2 and 8.1). The SFT results show SASFT reduces code-switching by 50–100% (Table 4) while inference-time steering (Section 3) requires per-generation intervention and does not persist. BUT: if feature specificity is not established — as with repetition features that are shared between pathological and benign repetition (Section 8.1, Figure 21) — the RL-based rare negative augmentation approach (Section 8) is safer than SASFT because it avoids direct feature suppression that could degrade desirable behaviors.

Prefer SAE-based toxicity classification when: Interpretability and auditability of content moderation decisions are required (regulatory compliance, appeals processes), and the language(s) of interest are either English or typologically close to English (cross-lingual transfer F1 is strong for European languages but drops sharply for Amharic at 0.53, Arabic at 0.68, Chinese at 0.62; Figure 9d). For distant languages, within-language feature discovery with a small labeled dataset (~200 examples; Section 5.3.2) is necessary and effective — the paper shows strong within-language F1 for all 13 tested languages (though exact numbers for each language are not all reported). The method should NOT replace a dedicated lightweight classifier when latency or computational cost per inference is the primary constraint — the SAE-based approach requires a full model forward pass plus SAE encoding per input, and the paper reports no latency numbers.