Measuring Semantic Abstractness of SAE Features via Nonlocality

# Measuring Semantic Abstractness of SAE Features via Nonlocality
Source: [https://arxiv.org/html/2608.10537](https://arxiv.org/html/2608.10537)
###### Abstract

Sparse autoencoders \(SAEs\) have helped uncover mechanistic explanations for LLM behaviours such as reasoning, jailbreaking etc\., via understanding the corresponding task\-relevant and causally effective features\. To evaluate such mechanistic explanations, downstream studies must distinguish surface lexical features from genuinely high\-level ones\. However, neither an autointerp\-based semantic description nor causal steering utility fully resolves the abstraction level of a feature\. To this end, we introduce*Feature Nonlocality*\(FNL\), defined as the entropy of the normalized per\-position influence on an SAE feature’s activation\. We report that FNL correlates with existing LLM\-based proxy metrics of feature semantic abstractness, and successfully distinguishes context\-dependent reasoning features from token\-driven ones, correctly assigning the higher FNL to the contextual feature in7373–84%84\\%of randomly drawn pairs that consist of one contextual and one token\-level feature\. We demonstrate two downstream applications\. We audit SAE\-based features used for jailbreak mitigation and find surprisingly that most effective features are positional features with low FNL rather than genuinely recognizing harmful intents\. We report that steering high\-FNL features in DeepSeek\-R1\-Distill\-Llama\-8B improves MATH\-500 accuracy by4\.64\.6points over the unsteered model and outperforms steering low\-FNL features, though the gains are model\-specific\. We conclude that FNL provides an LLM\-independent, label\-free, correlational witness of the abstraction level of an SAE feature, with applications in evaluating mechanistic explanations as well as selecting features for downstream interventions\.

## Introduction

As modern Large Language Models become increasingly capable and demonstrate research\-level intelligence\(Alonet al\.[2026](https://arxiv.org/html/2608.10537#bib.bib40)\), it remains a central challenge to understand the mechanisms of their emergent capabilities, thereby controlling their behavioural pattern to mitigate safety risks\. To this end, Mechanistic Interpretability \(MI\) applies probes and interventions to internal activations of Large Language Models \(LLMs\) at inference time, aiming at microscopic interpretation and control of their behaviour\(Sharkeyet al\.[2025](https://arxiv.org/html/2608.10537#bib.bib35)\)\. Much work in MI operates under the Linear Representation Hypothesis\(Parket al\.[2024](https://arxiv.org/html/2608.10537#bib.bib18); Elhageet al\.[2022](https://arxiv.org/html/2608.10537#bib.bib19)\): the goal is to extract human\-interpretable, causally relevantfeatures, i\.e\., linear directions in the hidden activation spaces that allow behavioural editing upon interventions at test time\. Such pipelines have successfully identified interventions that reliably modify truthfulness\(Liet al\.[2023](https://arxiv.org/html/2608.10537#bib.bib36)\), refusal\(Arditiet al\.[2024](https://arxiv.org/html/2608.10537#bib.bib16)\), reasoning\(Galichinet al\.[2026](https://arxiv.org/html/2608.10537#bib.bib6)\), and persona\(Chenet al\.[2025](https://arxiv.org/html/2608.10537#bib.bib37)\), etc\., without updating model weights\.

To discover and extract features, Sparse Autoencoders \(SAEs\) offer an appealing, unsupervised machinery\. By reconstructing hidden activations with an overcomplete, sparse dictionary, SAEs aim to separate superposed variables into individually monosemantic, human\-interpretable features\(Cunninghamet al\.[2024](https://arxiv.org/html/2608.10537#bib.bib11); Gaoet al\.[2024](https://arxiv.org/html/2608.10537#bib.bib38)\)\. When studying target behaviour such as reasoning/jailbreaking with SAEs, previous works filter useful features from the full dictionary by \(1\) gating their activations on a specific subset of relevant token\-cues\(Galichinet al\.[2026](https://arxiv.org/html/2608.10537#bib.bib6); Fanget al\.[2026](https://arxiv.org/html/2608.10537#bib.bib28)\); \(2\) curating contrastive datasets to find features activating on the positive examples but not the negative ones\(Assogbaet al\.[2026](https://arxiv.org/html/2608.10537#bib.bib30)\); or \(3\) relying on LLM\-generated natural language interpretations based on the text samples with significant activation of a given feature\(Billset al\.[2023](https://arxiv.org/html/2608.10537#bib.bib13)\)\. Such feature selection methods are then complemented with steering experiments to confirm their behaviour editing power upon causal interventions\(Aradet al\.[2025](https://arxiv.org/html/2608.10537#bib.bib27)\)\.

Importantly, successfulcontrolof a target behaviour by intervening on a feature does not imply understanding of the underlyingmechanism\(Makelovet al\.[2023](https://arxiv.org/html/2608.10537#bib.bib39)\)\. For example, if steering on a feature reliably induces backtracking, the feature can either genuinely represent detection of uncertainty, or simply boost the probability of emitting the token “Wait”\(Muennighoffet al\.[2025](https://arxiv.org/html/2608.10537#bib.bib43); Wardet al\.[2025](https://arxiv.org/html/2608.10537#bib.bib29)\)\. It is therefore important to distinguish token\-level, “wrapper” features from genuine high\-level features in order to support a microscopic mechanistic understanding\. Current feature selection methods, however, often do not distinguish mechanistic complexity of features\. In particular, token\-level cues and contrastive\-dataset\-based filtering do not rule out surface\-level lexical/stylistic features\. Auto\-interp\-based filtering often suffers from the brittleness of LLM\-generated interpretations\(Huanget al\.[2023](https://arxiv.org/html/2608.10537#bib.bib25)\)\.

To supply a quantitative witness of features’ mechanistic complexity, we proposefeature nonlocality\(FNL\)\. Concretely, FNL is measured using a backward pass to see which positions across the input sequence are causally related to the feature’s activation, which intuitively characterizes thecontextual reachof a feature\. Token\-level features \(e\.g\. bigram statistics\) depend on local prefix cues and have low nonlocality, while abstract, topical features draw on contextual evidence spread broadly across the window and have high nonlocality\. We note that the definition of FNL takes inspiration from holographic duality\(Maldacena[1999](https://arxiv.org/html/2608.10537#bib.bib46)\), which describes a duality between a quantum gravity theory and a quantum field theory at lower dimension\. Degrees of freedom at different locations in the quantum gravity theory \(usually called the "bulk theory"\) correspond to those in the quantum field theory at different length scales\. The SAE features are the analog of bulk theory degrees of freedom, and FNL measures its "location" which corresponds to nonlocality in time direction\. Here we view the transformer model as the "time evolution" in the token vector space\(Geshkovskiet al\.[2025](https://arxiv.org/html/2608.10537#bib.bib44)\)\.

We begin by confirming that FNL measures features’ intrinsic properties\. Across the input distributions we study \(WikiText, GSM8K, Code\-Python\), per\-feature FNL rankings remain stable: we report this for Gemma\-2\-2B in the main text, and for Llama\-3\-8B and Qwen3\-8B in the supplementary material\. We also report that FNL respects the feature geometry, in the sense that features with similar decoding vectors \(i\.e\. with similar mechanistic functions on the write\-side\) share similar ranges of nonlocality\. Next, we test whether FNL tracks the abstraction level of features using complementary evidence\. First, we match FNL statistics with their auto\-interp descriptions and find consistency between conceptual abstraction and higher FNL\. Second, in the context of reasoning, we anchor on two independent proxy measures developed in\(Maet al\.[2026](https://arxiv.org/html/2608.10537#bib.bib31)\): for a given feature, their pipeline detects false positive \(FP\) activations under relevant token injections; and false negatives \(FN\) under meaning\-preserving paraphrases of activating examples\. A truly high\-level feature should intuitively minimize FP/FN events\. We show that Feature Nonlocality, as an independent gradient\-based measure, has significant correlations with both FP/FN metrics \(Spearmanρ​\(FNL,token\-injection FP\)=−0\.46\\rho\(\\text\{FNL\},\\text\{token\-injection FP\}\)=\-0\.46,p<5×10−4p<5\\times 10^\{\-4\};ρ​\(FNL,paraphrase FN\)=0\.27\\rho\(\\text\{FNL\},\\text\{paraphrase FN\}\)=0\.27,p=0\.01p=0\.01\)\. Unlike those measures, FNL does not rely on LLM judgement or curated contrastive datasets\. Together, these results support FNL as an empirical axis of feature abstraction level\.

Beyond representational analysis, we demonstrate downstream applications of FNL: \(1\) We compute the nonlocalities of SAE\-filtered, jailbreaking\-mitigation features\(Assogbaet al\.[2026](https://arxiv.org/html/2608.10537#bib.bib30)\), and found striking evidence that features which successfully undermine wrapper\-style jailbreaking attempts often represent surface\-level, positional indicator features, rather than truly “recognizing” the harmful intents, which provides new insight on the mitigation mechanism; \(2\) For the model DeepSeek\-R1\-Distill\-Llama\-8B, we evaluate steering utility of high\-FNL features in improving reasoning performance\. We find that steering high\-FNL features improves MATH\-500 accuracy by4\.64\.6points over the unsteered model, whereas low\-FNL and random\-feature baselines gain3\.83\.8and3\.63\.6points\. As a feature selection criteria, higher\-FNL features outperforms lower\-FNL features with marginal statistical significance, and the high\-FNL arm matches a representative feature selected by the token\-cue criterion ReasonScore\(Galichinet al\.[2026](https://arxiv.org/html/2608.10537#bib.bib6)\)\. Note the latter experiment should be treated as a proof\-of\-concept because we do not generally expect feature nonlocality to reliably predict steering utility\(Aradet al\.[2025](https://arxiv.org/html/2608.10537#bib.bib27)\)\. To conclude, our contributions include

1. 1\.We introduceFeature Nonlocality\(FNL\), a label\-free, gradient\-based metric, defined to characterize an SAE feature’s typical contextual reach\.
2. 2\.We validate FNL as an empirical axis of feature abstraction level through both human judgements and statistical correlations with two proxy measures of abstraction proposed in previous works\.
3. 3\.We show that for safety\-relevant behaviours, FNL provides useful diagnosis in distinguishing token\-level versus abstract features and provides new insights into the mechanism of steerable jailbreaking mitigation\.
4. 4\.As a proof of concept, we show that an FNL\-selected feature envelope steers the DeepSeek\-R1\-Distill\-Llama\-8B model above its unsteered baseline on MATH\-500 without relying on labels or token\-cue filters\.

This work is published under the Agentic Publication Protocol\(Lu and Qi[2026](https://arxiv.org/html/2608.10537#bib.bib1)\)\. In the released codebase we have included explicit instructions and technical contexts for an AI coding agent\. The reader is welcome to open our repository111https://github\.com/lccqqqqq/sae\-feature\-nonlocalitywith such an agent, and interact with the agent for explaining technicalities and reproducing results\.

## Related Work

In this section, we review the preliminaries of Sparse Autoencoders and activation steering\. We then discuss established feature selection and validation approaches in SAE\-based interpretability research and note that they do not generally distinguish semantically abstract features from token\-level ones\.

#### Sparse Autoencoders \(SAEs\)

SAEs are autoencoders with one hidden layer\. Operationally, given an activation𝐡∈ℝd\\mathbf\{h\}\\in\\mathbb\{R\}^\{d\}, an SAE computes

𝐳​\(𝐡\)=σ​\(Wenc​𝐡\+benc\),𝐡^=Wdec​𝐳​\(𝐡\)\+bdec,\\mathbf\{z\}\(\\mathbf\{h\}\)=\\sigma\\\!\\left\(W\_\{\\mathrm\{enc\}\}\\mathbf\{h\}\+b\_\{\\mathrm\{enc\}\}\\right\),\\quad\\widehat\{\\mathbf\{h\}\}=W\_\{\\mathrm\{dec\}\}\\mathbf\{z\}\(\\mathbf\{h\}\)\+b\_\{\\mathrm\{dec\}\},\(1\)whereσ\\sigmais nonlinearity,𝐳∈ℝm\\mathbf\{z\}\\in\\mathbb\{R\}^\{m\}is a sparse latent representation, typically withm\>dm\>d\. SAEs are trained to reconstruct hidden activations \(typically from a language model\) under sparsity constraints\. A common choice of sparsity regularizer is theℓ1\\ell\_\{1\}norm, so that the training objective is schematically

ℒSAE=‖𝐡^−𝐡‖22\+α​‖𝐳​\(𝐡\)‖1\\mathcal\{L\}\_\{\\mathrm\{SAE\}\}=\\left\\\|\\hat\{\\mathbf\{h\}\}\-\\mathbf\{h\}\\right\\\|\_\{2\}^\{2\}\+\\alpha\\left\\\|\\mathbf\{z\}\(\\mathbf\{h\}\)\\right\\\|\_\{1\}\(2\)whereα\\alphais a hyperparameter\. Empirically, SAEs are capable of learning useful features for sparse reconstructions that are also monosemantic and human\-interpretable\. We also note that many latents from SAEs suffer from feature absorption/splitting, and reconstruction\-sparsity tradeoffs which adversely affect their interpretability, despite efforts on architectural variants and training setups aiming to mitigate such effects\.

#### Activation Steering

Given a feature direction,steeringexperiments edit the model’s internal activations at inference time, by augmenting/suppressing the activation’s projection along the feature directions\. Common approaches involve*additive steering*\(Turneret al\.[2023](https://arxiv.org/html/2608.10537#bib.bib21); Rimskyet al\.[2024](https://arxiv.org/html/2608.10537#bib.bib22)\);*multiplicative steering*\(Zouet al\.[2023](https://arxiv.org/html/2608.10537#bib.bib23)\); and*clamping*, which overwrites a feature’s activation to a target value\(Templetonet al\.[2024](https://arxiv.org/html/2608.10537#bib.bib5)\)\. Writingzamaxz\_\{a\}^\{\\max\}for a feature’s typical peak activation and𝐞a\\mathbf\{e\}\_\{a\}for its unit decoder direction, one may clamp the activation to

𝐡↦𝐡\+\(γ​zamax−𝐡⋅𝐞a\)​𝐞a,\\mathbf\{h\}\\;\\mapsto\\;\\mathbf\{h\}\+\\big\(\\gamma\\,z\_\{a\}^\{\\max\}\-\\mathbf\{h\}\\cdot\\mathbf\{e\}\_\{a\}\\big\)\\,\\mathbf\{e\}\_\{a\},\(3\)where the gainγ\>1\\gamma\>1sets the steering strength\. When there is a subset containing many SAE features of interest,\(Sooet al\.[2025](https://arxiv.org/html/2608.10537#bib.bib9); Heet al\.[2025](https://arxiv.org/html/2608.10537#bib.bib10)\)construct steering directions from a trained weighted combination of features\. Steering experiments validate the causal control power of features in eliciting the behaviour pattern of interest\.

#### Feature Selection/Validation in SAEs

Unsupervised SAE training produces a task\-agnostic dictionary\. Therefore, downstream applications require post\-hoc criteria for selecting features that are*task\-relevant*,*causally effective*andmechanistically interpretable\.

To ensure task\-relevance,Keyword filteringlooks for features activating on or decoding to task\-specific token cues, such as “wait”, “but” for reasoning tasks\(Galichinet al\.[2026](https://arxiv.org/html/2608.10537#bib.bib6)\);Activation\-based filteringselects SAE features based on their activation statistics\.\(Assogbaet al\.[2026](https://arxiv.org/html/2608.10537#bib.bib30)\)finds jailbreaking\-relevant features by preparing contrastive datasets of bare harmful requests vs\. jailbreak harmful prompts inside a wrapper, and selects features with large activation differences over these contrastive prompts;\(Choet al\.[2025](https://arxiv.org/html/2608.10537#bib.bib45)\)directly selects features whose activations correlate with task performance\. While useful for identifying feature candidates, such methods do not exclude mechanistically simple, lexical/formatting correlates of the target behaviour\(Fanget al\.[2026](https://arxiv.org/html/2608.10537#bib.bib28)\)\. For causal power, Arad et al\. computeoutput score\(Aradet al\.[2025](https://arxiv.org/html/2608.10537#bib.bib27)\)diagnosing features’ steering utility; other works\(Galichinet al\.[2026](https://arxiv.org/html/2608.10537#bib.bib6); Choet al\.[2025](https://arxiv.org/html/2608.10537#bib.bib45)\)postselect features by direct validations using steering experiments\.

While feature\-filtering and steering validation are well\-established pipelines in SAE interpretability works, the mechanistic complexity of these features remains largely unexplored\. We note that steerability alone does not establish that a feature implements the high\-level computation associated with the steered behaviour\. Recent work\(Maet al\.[2026](https://arxiv.org/html/2608.10537#bib.bib31)\)tests contrastively selected reasoning features and falsifies many as representing lexical correlates rather than genuine reasoning computations, yet the falsification pipeline relies on curated datasets and LLM\-generated paraphrases\. On the other hand, auto\-interpretation methods generate natural\-language descriptions of features from their activating contexts and evaluate whether these descriptions predict activation on held\-out examples\(Billset al\.[2023](https://arxiv.org/html/2608.10537#bib.bib13); Pauloet al\.[2025](https://arxiv.org/html/2608.10537#bib.bib24)\)\. Up to brittleness caveats of LLM\-generated descriptions, they offer semantic interpretations of scalable sets of features\. However, they do not directly characterize the computation producing their activations\. In this work, we propose that Feature Nonlocality provides a complementary, LLM\-free measure of a feature’s mechanistic complexity, which bears predictive power for distinguishing token\-cue features from genuinely high\-level features\.

## Method: Feature Nonlocality

In this section, we present the definition of Feature Nonlocality and explain the intuition behind the definition\. We also give an empirical recipe of its estimation\.

###### Definition 1\(Feature Nonlocality\)\.

Fix an SAE operating on layerℓ\\ellof the LLM residual stream\. Denote the context window of the LLM byTTand consider a prompt𝒫\\mathcal\{P\}ofTTtokens\. We use𝐡T\\mathbf\{h\}\_\{T\}to denote the correspondingℓth\\ell^\{\\mathrm\{th\}\}layer hidden activation at last token positionTT; and𝐱t,\(1≤t≤T\)\\mathbf\{x\}\_\{t\},\(1\\leq t\\leq T\)for the token representations at the layer\-0 residual stream, after passing through the embedding layer\. Letza\(ℓ\)​\(T,𝒫\):=\[σ​\(Wenc​𝐡T\+benc\)\]az^\{\(\\ell\)\}\_\{a\}\(T,\\mathcal\{P\}\):=\[\\sigma\(W\_\{\\mathrm\{enc\}\}\\mathbf\{h\}\_\{T\}\+b\_\{\\mathrm\{enc\}\}\)\]\_\{a\}be the activation of layer\-ℓ\\ellfeatureaaat positionTTof the prompt𝒫\\mathcal\{P\}\. We omit the layer indexℓ\\ellto declutter\. When the feature is*active*\(i\.e\.za​\(T,𝒫\)\>τz\_\{a\}\(T,\\mathcal\{P\}\)\>\\tauwhereτ\\tauis the threshold to assert a firing event\), for allt≤Tt\\leq Twe can compute the*per\-position influence*of𝐱t\\mathbf\{x\}\_\{t\}onza​\(T,𝒫\)z\_\{a\}\(T,\\mathcal\{P\}\)as the squared gradient norm

Ja​\(t,T,𝒫\):=‖∂za​\(T,𝒫\)∂𝐱t‖22,J\_\{a\}\(t,T,\\mathcal\{P\}\):=\\left\\lVert\\frac\{\\partial z\_\{a\}\(T,\\mathcal\{P\}\)\}\{\\partial\\mathbf\{x\}\_\{t\}\}\\right\\rVert\_\{2\}^\{2\},\(4\)Normalizing Eq\. \([4](https://arxiv.org/html/2608.10537#Sx3.E4)\) leads to a valid probability distribution over prefix positions, given a prompt𝒫\\mathcal\{P\}\.

pa\(𝒫\)​\(t\):=Ja​\(t,T,𝒫\)∑t′≤TJa​\(t′,T,𝒫\)\.p\_\{a\}^\{\(\\mathcal\{P\}\)\}\(t\):=\\frac\{J\_\{a\}\(t,T,\\mathcal\{P\}\)\}\{\\sum\_\{t^\{\\prime\}\\leq T\}J\_\{a\}\(t^\{\\prime\},T,\\mathcal\{P\}\)\}\.\(5\)The*per\-prompt nonlocality*of featureaa\(relative to the prompt𝒫\\mathcal\{P\}\) is then defined as the entropy of the feature influence distribution\.

H​\(a,𝒫\):=−∑t=1Tpa\(𝒫\)​\(t\)​log2⁡pa\(𝒫\)​\(t\)H\(a,\\mathcal\{P\}\):=\-\\sum\_\{t=1\}^\{T\}p\_\{a\}^\{\(\\mathcal\{P\}\)\}\(t\)\\log\_\{2\}p\_\{a\}^\{\(\\mathcal\{P\}\)\}\(t\)\(6\)We also define a dataset\-level statistics of the feature nonlocality by averaging Eq\. \([6](https://arxiv.org/html/2608.10537#Sx3.E6)\) over a set of firing events𝒟′:=\{𝒫∈𝒟\|za​\(T,𝒫\)\>τ\}\\mathcal\{D\}^\{\\prime\}:=\\\{\\mathcal\{P\}\\in\\mathcal\{D\}\|z\_\{a\}\(T,\\mathcal\{P\}\)\>\\tau\\\}, so thatH​\(a,𝒟\)≡1\|𝒟′\|​∑𝒫∈𝒟′H​\(a,𝒫\)H\(a,\\mathcal\{D\}\)\\equiv\\tfrac\{1\}\{\|\\mathcal\{D\}^\{\\prime\}\|\}\\sum\_\{\\mathcal\{P\}\\in\\mathcal\{D\}^\{\\prime\}\}H\(a,\\mathcal\{P\}\), where𝒟\\mathcal\{D\}represents some dataset of prompts\.

We build some intuition for Definition[1](https://arxiv.org/html/2608.10537#Thmdefinition1)with the following remarks\. The per\-position influenceJa​\(t,T,𝒫\)J\_\{a\}\(t,T,\\mathcal\{P\}\)of Eq\. \([4](https://arxiv.org/html/2608.10537#Sx3.E4)\) measures how much the feature’s activation at the query position responds to a perturbation of the input embedding at a preceding positiontt; its normalized formpa\(𝒫\)​\(t\)p\_\{a\}^\{\(\\mathcal\{P\}\)\}\(t\)is a probability distribution over prefix positions\. Such a construction effectively measures thecontextual reachof a feature\. This motivates the hypothesis that topically abstract, context\-dependent features have higher FNL than features driven by local lexical or positional cues\. The correlation bewteen FNL and semantic abstractness will be discussed later in Sec\.[Nonlocality and Semantic Abstractness](https://arxiv.org/html/2608.10537#Sx5)\.

The notion of FNL is notably independent of SAE features and can be naturally extended to any linear subspace of the hidden activation vector space\. In particular, replacingza​\(T,𝒫\)z\_\{a\}\(T,\\mathcal\{P\}\)by𝐡T\\mathbf\{h\}\_\{T\}itself, we can compute the nonlocality of the residual stream vector directly, which we denote asH​\(𝐡T\)H\(\\mathbf\{h\}\_\{T\}\)\.

We note that the operational choices in Eqs\. \([5](https://arxiv.org/html/2608.10537#Sx3.E5)\)\-\([6](https://arxiv.org/html/2608.10537#Sx3.E6)\) are not unique\. For example, Eq\. \([5](https://arxiv.org/html/2608.10537#Sx3.E5)\) could be replaced by a softmax over influences, and the Shannon entropy of Eq\. \([6](https://arxiv.org/html/2608.10537#Sx3.E6)\) could be replaced by a Rényi entropy or the inverse participation ratio\. We defer a systematic comparison of these choices to future work\.

Concretely, fixing a particular featureaaof an SAE, we compute its nonlocality with the following steps:

1. 1\.Run forward passes of prompts sampled from some dataset𝒟\\mathcal\{D\}\(e\.g\. GSM8K/WikiText\), gather top\-kkfiring events𝒟′\\mathcal\{D\}^\{\\prime\}of the featureaa\.
2. 2\.Consider a context ofTTtokens preceding each firing event \(inclusive of the firing token\), rerun a backward pass to compute the gradients Eq\. \([4](https://arxiv.org/html/2608.10537#Sx3.E4)\)\.
3. 3\.Postprocess to obtain for each prompt𝒫i∈𝒟′\\mathcal\{P\}\_\{i\}\\in\\mathcal\{D\}^\{\\prime\}a per\-event entropyH​\(a,𝒫i\)H\(a,\\mathcal\{P\}\_\{i\}\)following Eq\. \([6](https://arxiv.org/html/2608.10537#Sx3.E6)\), then average over all events in𝒟′\\mathcal\{D\}^\{\\prime\}to obtainH​\(a\)H\(a\)\.

For experiments in the main text, we fixk=32k=32andT=128T=128unless stated otherwise\. Discussions of the relationship between feature nonlocality and revealed contexts are deferred to the supplementary material\. We also note that the computation can be made parallel for all features in the same layer/SAE with one forward pass over the dataset𝒟\\mathcal\{D\}\.

## Experiments: Initial Investigations

Before validating the mechanistic functions, we first establish FNL as a stable empirical metric: we examine whether FNL is stable across prompt datasets, how its distribution changes with depth, and whether nearby SAE decoder directions exhibit similar FNL\. Throughout this section, we use Gemma\-2\-2B paired with GemmaScope SAEs\(Lieberumet al\.[2024](https://arxiv.org/html/2608.10537#bib.bib2)\)on all\-layer residual streams\. Results for other model\-SAE pairs show consistent findings and are deferred to the supplementary material\.

#### Cross\-dataset stability

We study whether the rank, and absolute values of feature nonlocality are preserved across different corpora\. On Gemma\-2\-2B across several layers, we consider three topically diverse datasets𝒟∈\{WikiText,GSM8K,Code\-Python\}\\mathcal\{D\}\\in\\\{\\text\{WikiText\},\\text\{GSM8K\},\\text\{Code\-Python\}\\\}\(Merityet al\.[2016](https://arxiv.org/html/2608.10537#bib.bib3); Cobbeet al\.[2021](https://arxiv.org/html/2608.10537#bib.bib47); Kocetkovet al\.[2022](https://arxiv.org/html/2608.10537#bib.bib50)\)\. For each jointly activated SAE featureaawe computeH​\(a,𝒟\)H\(a,\\mathcal\{D\}\)\. We then compute the Spearman correlation betweenH​\(a,𝒟WikiText\)H\(a,\\mathcal\{D\}\_\{\\text\{WikiText\}\}\)andH​\(a,𝒟GSM8K\)H\(a,\\mathcal\{D\}\_\{\\text\{GSM8K\}\}\), and similarly for other pairs\. Table[1](https://arxiv.org/html/2608.10537#Sx4.T1)shows high correlation between feature nonlocalities across different datasets across different layers, and the ranking of features by nonlocality is substantially preserved across corpora\.

Table 1:Cross\-corpus stability of feature nonlocality in Gemma\-2\-2B\. Each cell ranks2,0002\{,\}000features independently on WikiText, GSM8k and Code\-Python\. Here we usek=60k=60firing events per feature per corpus and context windowT=128T=128\. Each entry reports the Spearman agreement of per\-featureH​\(a,𝒟\)H\(a,\\mathcal\{D\}\)between pairs of corpora\. The ranking is largely preserved at every depth, although the Spearman correlation fall slightly with depth\.
#### Dependence with layers

For Gemma\-2\-2B and GemmaScope SAEs, we feed a subset of WikiText and extract FNL statistics for layersℓ=0,1,…,25\\ell=0,1,\.\.\.,25\. Progressing deeper into the network, FNL shifts upward and plateaus at around the middle layers \(Fig\.[1](https://arxiv.org/html/2608.10537#Sx4.F1)\), broadly following the corresponding residual\-stream statisticH​\(𝐡T\(ℓ\)\)H\(\\mathbf\{h\}\_\{T\}^\{\(\\ell\)\}\)\. Testing on other model\-SAE pairs over a range of 0\.5B\-9B models in Gemma, Llama, Qwen families; as well as varying the datasets𝒟=\{WikiText,GSM8K,Code\-Python\}\\mathcal\{D\}=\\\{\\text\{WikiText\},\\text\{GSM8K\},\\text\{Code\-Python\}\\\}demonstrates robustness of the rise\-then\-saturate pattern\. This depth\-dependent trend is suggestive, although not conclusive, evidence that later layers tend to process more contextual, semantic information\(Jawaharet al\.[2019](https://arxiv.org/html/2608.10537#bib.bib33)\)\.

![Refer to caption](https://arxiv.org/html/2608.10537v1/figures/fig1.png)Figure 1:GemmaScope feature nonlocality as a function of depth for Gemma\-2\-2B on WikiText \(context windowT=64T=64\)\. Each violin visualizes the distribution of empirically estimatedH​\(a\)H\(a\)at the corresponding layer, overlaid with the per\-layer mean \(orange\) and median \(black\), as well as the residual\-stream baselineH​\(𝐡\)H\(\\mathbf\{h\}\)\(red dashed\)\. The mean nonlocality saturates by the middle layers \(ℓ≈13\\ell\\approx 13–1616\)\.
#### Feature nonlocality and Feature Geometry

In Fig\.[2](https://arxiv.org/html/2608.10537#Sx4.F2)we focus on layer\-12 and show that FNL varies smoothly with local decoder geometry\. Across six anchor features spanning the observed FNL range, their nearest neighbours under decoder cosine similaritysim​\(a,b\):=cos⁡⟨𝐞a,𝐞b⟩\\mathrm\{sim\}\(a,b\):=\\cos\\langle\\mathbf\{e\}\_\{a\},\\mathbf\{e\}\_\{b\}\\rangletend to occupy similar ranges of FNL\. Because decoder cosine characterizes the direction in which a feature writes to the residual stream, we interpret this result as a consistent association between FNL as a read\-side contextual reach measure and write\-side feature geometry\. This supports treating Feature Nonlocality as a stable metric correlating with features’ write\-side mechanistic functionalities\.

More speculatively, since FNL can be defined for arbitrary linear subspaces, such correlations between contextual reach and decoder geometry are suggestive of an appealing picture that the residual\-stream space may decompose into directions of different contextual reach, and the SAE features form a sparse overcomplete basis of this organization\. We leave related investigations on residual stream geometry to future work\.

![Refer to caption](https://arxiv.org/html/2608.10537v1/figures/fig2.png)Figure 2:Decoder\-cosine geometry pinsH​\(a\)H\(a\)\(Gemma\-2\-2B layer 12\)\. For each of six anchor features we take its top\-10 decoder\-cosine neighbours and plot every feature’sH​\(a\)H\(a\)\. For each individual feature, the computation of FNL samples top\-kk\(k=32k=32\) max\-activation firing events across a sample WikiText corpus; the error bar represents the IQR of FNL statistics\.

## Nonlocality and Semantic Abstractness

In this section, we present evidence that feature nonlocalityH​\(a\)H\(a\)correlates with existing proxy, falsification\-based measures of semantic abstractness\(Maet al\.[2026](https://arxiv.org/html/2608.10537#bib.bib31)\), distinguishing token\-level features from high\-level concept features\. To start, Fig\.[3](https://arxiv.org/html/2608.10537#Sx5.F3)presents representative feature samples from Gemma\-2\-2B layer 12, ranked byH​\(a\)H\(a\)\. Following the auto\-interp description on theyy\-axis, we observe the apparent shift from lexical \(e\.g\. f608 “Robert indicator”\) to contextual \(e\.g\. f13603 “uncertainty marker”\) with increasing nonlocality\. We now make this correlation quantitative\.

![Refer to caption](https://arxiv.org/html/2608.10537v1/figures/fig3.png)Figure 3:Feature nonlocality traces a concrete\-to\-abstract continuum \(Gemma\-2\-2B layer 12,T=128T=128\)\.\(a\)Seven representative features ranked by meanH​\(a\)H\(a\)\(±\\pmstd across activating events\); the three marked \(∗\\ast, red\) are the features shown in panel \(b\)\. Single\-token detectors \(e\.g\. f608, “Robert”\) sit at the low\-nonlocality end and utterance\-level features \(e\.g\. f13603, epistemic hedging\) at the high end\.\(b\)Per\-position influenceJa​\(t′\)J\_\{a\}\(t^\{\\prime\}\)over the top\-three max\-activating contexts of those three features; each token’s background is shaded by\|Ja​\(t′\)\|\|J\_\{a\}\(t^\{\\prime\}\)\|and the activating token is boxed\. Influence is concentrated on a single token for the low\-H​\(a\)H\(a\)feature f608 and grows progressively more diffuse for the mid\-H​\(a\)H\(a\)relative\-clause connector f10360 \(3\.23\.2bits\) and the high\-H​\(a\)H\(a\)epistemic\-uncertainty feature f13603 \(5\.05\.0bits\)\.#### Token injection susceptibility

Genuine high\-level features should*not*be switched on when only the trigger token is present but not the associated semantics\. We conduct token injection experiments over 100 features that fire systematically more frequently in reasoning traces than non\-reasoning text, selected in DeepSeek\-R1\-Distill\-Llama\-8B\. We inherit the methodology from\(Maet al\.[2026](https://arxiv.org/html/2608.10537#bib.bib31)\), which we summarize below for completeness\. For each feature we take its top\-activating unigrams, bigrams and trigrams, splice them into non\-reasoning passages while preserving coherence\. We compare the feature’s activation over injected passages against unmodified passages\. With a truly contextual feature, we expect the activation statistics to remain unmoved by this manipulation\. Let the target feature activations for injected/original passages bezinjz\_\{\\mathrm\{inj\}\}andzorigz\_\{\\mathrm\{orig\}\}, respectively, we measure theactivation recoverybyd:=\(⟨zinj⟩−⟨zorig⟩\)\(Var​\(zinj\)\+Var​\(zorig\)\)/2d:=\\frac\{\(\\langle z\_\{\\mathrm\{inj\}\}\\rangle\-\\langle z\_\{\\mathrm\{orig\}\}\\rangle\)\}\{\\sqrt\{\(\\mathrm\{Var\}\(z\_\{\\mathrm\{inj\}\}\)\+\\mathrm\{Var\}\(z\_\{\\mathrm\{orig\}\}\)\)/2\}\}\(Cohen[1988](https://arxiv.org/html/2608.10537#bib.bib34)\)\. This then classifies features as token\-driven \(d≥0\.8d\\geq 0\.8\), partially token\-driven \(0\.5≤d<0\.80\.5\\leq d<0\.8\), weakly token\-driven \(0\.2≤d<0\.50\.2\\leq d<0\.5\), and context\-dependent \(d<0\.2d<0\.2, or not significant\)\. Strong injection recovery trivializes the feature, in that lexical cues alone suffice to elicit it\. At layer\-19, we reproduced the protocol in\(Maet al\.[2026](https://arxiv.org/html/2608.10537#bib.bib31)\)and independently compute the nonlocalities Eq\. \([6](https://arxiv.org/html/2608.10537#Sx3.E6)\) of the same set of features\. In Table[2](https://arxiv.org/html/2608.10537#Sx5.T2), we find FNL correlates negatively with injection recovery \(ρ=−0\.39\\rho=\-0\.39to−0\.46\-0\.46\) and consistently discriminates token\-driven \(TD\) from context\-dependent \(CD\) features \(AUC 0\.73\-0\.84\)\. Therefore, higher FNL implies lower susceptibility to token\-cue elicitation\.

#### Paraphrase Invariance

Token injection tests for false\-positive activations\. A complementary validation, which aims to test for false\-negatives, relies on the intuition that genuine high\-level features should retain the activation under paraphrases that preserve the semantic information\. We again adapt the pipeline in\(Maet al\.[2026](https://arxiv.org/html/2608.10537#bib.bib31)\)\. Given an SAE featureaa, we collect its firing contexts, and for each firing we compare \(1\) the original activationzorigz\_\{\\mathrm\{orig\}\}; \(2\) a length\-calibrated paraphrase intended to preserve meaningzparaz\_\{\\mathrm\{para\}\}; \(3\) a token shuffle that preserves the tokens while destroying the meaningzshufflez\_\{\\mathrm\{shuffle\}\}; \(4\) activation baseline of a random, unrelated promptzbasez\_\{\\mathrm\{base\}\}\. DefineretentionasRa​\(zpara\):=zpara−zbasezorig−zbaseR\_\{a\}\(z\_\{\\mathrm\{para\}\}\):=\\frac\{z\_\{\\mathrm\{para\}\}\-z\_\{\\mathrm\{base\}\}\}\{z\_\{\\mathrm\{orig\}\}\-z\_\{\\mathrm\{base\}\}\}and similarly forRa​\(zshuffle\)R\_\{a\}\(z\_\{\\mathrm\{shuffle\}\}\), characterizing the \(properly baselined\) fraction of retained activation\. Theparaphrase robustnessscore for the feature is then defined bySa=med​\(Ra​\(zpara\)\)−med​\(Ra​\(zshuffle\)\)S\_\{a\}=\\mathrm\{med\}\(R\_\{a\}\(z\_\{\\mathrm\{para\}\}\)\)\-\\mathrm\{med\}\(R\_\{a\}\(z\_\{\\mathrm\{shuffle\}\}\)\), wheremed\\mathrm\{med\}takes the median from the statistics of all sampled firing events\. Positive values forSaS\_\{a\}imply greater robustness to paraphrasing than to order destruction, while negativeSaS\_\{a\}falsifies the claim thataais semantically abstract\.

We again identify positive correlation of the paraphrase robustnessSaS\_\{a\}with the nonlocality of featureaa\(ρ=0\.27\\rho=0\.27,p=0\.011p=0\.011\), as illustrated in Fig\.[4](https://arxiv.org/html/2608.10537#Sx5.F4)\. We also note that the median ofSaS\_\{a\}increases monotonically across the TD\-CD spectrum, providing independent cross\-validation between lexical susceptibility and paraphrase robustness\.

These two tests probe semantic abstractness from complementary directions\. Intuitively, a feature’s semantic abstractness anticorrelates with its activation susceptibility to token injection, whereas it correlates with robustness under meaning\-preserving paraphrases\. On both axes we report that feature nonlocality, as an independent gradient\-based metric, reproduces those correlations\. Up to modest fluctuations, FNL also successfully distinguishes token\-level vs\. context\-dependent features\. We therefore conclude that FNL, as a measure of contextual dependence of a feature, provides an LLM\-independent correlational measure of a feature’s semantic abstraction level\.

Table 2:On DeepSeek\-R1\-Distill\-Llama\-8B, across four layers and two SAE dictionaries\(Heet al\.[2024](https://arxiv.org/html/2608.10537#bib.bib41); Galichinet al\.[2026](https://arxiv.org/html/2608.10537#bib.bib6)\), we report the Spearman correlationρ\\rhobetween Feature Nonlocality and the activation recovery under token\-injection; AUC measures how well FNL separates token\-driven \(TD\) from context\-dependent \(CD\) features, and is equivalently the probability that a randomly drawn CD feature has higher FNL than a randomly drawn TD feature, with0\.50\.5indicating chance; the final column gives mean FNL in bits for the two classes\.![Refer to caption](https://arxiv.org/html/2608.10537v1/figures/fig4.png)Figure 4:Paraphrase robustnessSaS\_\{a\}versus nonlocality, presentation collapsed to the four token\-injection classes \(median±\\pm68% bootstrap CI on both axes, dashed line fitting through the class medians for readability\)\. Per\-feature Spearman correlation,ρ=\+0\.27\\rho=\+0\.27\(p=0\.011p=0\.011,n=96n=96features\)\.

## Downstream Applications

We demonstrate the use of Feature Nonlocality with two case studies of downstream tasks\. First, we audit the mechanism for a class of jailbreaking\-mitigation features, previously detected via contrastive activation enrichment\(Assogbaet al\.[2026](https://arxiv.org/html/2608.10537#bib.bib30)\)\. We demonstrate that FNL bearsdiagnosticvalue in resolving mechanistic functionalities\. Second, we conduct steering experiments on high\-FNL features and find improvements on reasoning benchmarks at least comparable with a representative feature selected by token\-cue filtering\(Galichinet al\.[2026](https://arxiv.org/html/2608.10537#bib.bib6)\)\. This suggests that FNL offers usefulselectionvalue for effective interventions of high\-level behaviours\.

### Auditing Jailbreaking\-mitigation mechanisms

CC\-Delta\(Assogbaet al\.[2026](https://arxiv.org/html/2608.10537#bib.bib30)\)filters SAE features that defend against wrapper\-based jailbreaking attempts\. Specifically, they construct contrastive plain harmful prompts𝒫\\mathcal\{P\}vs\. the same prompts wrapped for jailbreaking𝒫wrapper​𝒫\\mathcal\{P\}\_\{\\mathrm\{wrapper\}\}\\mathcal\{P\}\. Then the authors select features with drastically different activations on the harmful prompt tokens of the contrastive datasets\. They report that steering on the derived features improves jailbreak defense against out\-of\-distribution, Few\-Shot\-Json attacks \(a type of wrapper attacks, embedding harmful requests inside json\-formatted benign question\-answer pairs\)\.

After reproducing their feature selection pipelines on the same model \(DeepSeek\-R1\-Distill\-Llama\-8B\) and SAE \(LlamaScope\(Heet al\.[2024](https://arxiv.org/html/2608.10537#bib.bib41)\), layer\-17 residual stream\), we further compute their nonlocality via backward passes over the same dataset\. Strikingly, we found that 21 of the 25 selected features have 0 nonlocality\. They activate almost exclusively at position\-0 of the plain harmful prompt \(but not on the same prompt tokens when they are wrapped\), giving zero contextual reach by definition\. The remaining 4 features are content\-aware and exhibit nontrivial FNL\. Steering over the positional/attention\-sink\-like features\(Xiaoet al\.[2024](https://arxiv.org/html/2608.10537#bib.bib32)\)vs\. content\-aware features separately, we find only the positional features lead to substantial improvements for OOD jailbreaking mitigation, whereas steering on the content feature subset stays near the unsteered baseline \(Table[3](https://arxiv.org/html/2608.10537#Sx6.T3)\)\.

Through the lens of Feature Nonlocality, we may sharpen the mechanism of jailbreak\-mitigating features as follows\. While successfully eliciting OOD jailbreak defense, these effective features are typically positional and have low FNL\. Thus the features should be understood as surface\-level, beginning\-of\-sequence \(BOS\) indicators rather than encoding the computation for recognizing harmful intents\. A robust mechanistic account of these features is left to future work\.

Table 3:Steering utility of CC\-Delta\-selected features\. The 25 features split into a size\-21 positional subset and a size\-4 contextual subset\. We steer each subset with per\-group optimized steering strengths∥v∥\\lVert v\\rVert\. The “held\-out” column reports safety under the Few\-Shot\-Json wrapper attack and the “plain” column safety on the unwrapped harmful requests, both measuring successful defense rate over the same404404StrongReject requests\(Soulyet al\.[2024](https://arxiv.org/html/2608.10537#bib.bib53)\)The positional subset accounts for most of the improvement\.
### FNL\-Guided Steering

As a supplementary study, we further conduct steering experiments using feature nonlocality as a selection criterion, to see whether intervening on high\-FNL features positively affects the model’s reasoning capabilities\. We steer DeepSeek\-R1\-Distill\-Llama\-8B at layer 19 and paired residual\-stream SAEs\(Galichinet al\.[2026](https://arxiv.org/html/2608.10537#bib.bib6)\)with 65,536 features per layer\. Feature nonlocality values are computed with the dataset OpenThoughts\-114k\(Guhaet al\.[2025](https://arxiv.org/html/2608.10537#bib.bib7)\)\. In the steering experiment, we select the top 20% features ranked by their feature nonlocalities, and steer by simultaneously clamping all features in the subset with strengthγ\\gammac\.f\. Eq\. \([3](https://arxiv.org/html/2608.10537#Sx2.E3)\)\. To find the steering strength, we perform pilot sweeps over steering strengthsγ∈\[1\.0,1\.2\]\\gamma\\in\[1\.0,1\.2\]and postselect the best\-performingγ\\gammafor a held\-out subset of MATH\-500\(Lightmanet al\.[2023](https://arxiv.org/html/2608.10537#bib.bib49); Hendryckset al\.[2021](https://arxiv.org/html/2608.10537#bib.bib48)\)\. For benchmark evaluations, we collect steered model rollouts on MATH\-500, which are subsequently graded by a local Llama\-3\.3\-70B judge and report the average score over 4 rollouts\.

We consider various baseline steering approaches, including \(1\)Unsteered Baseline; \(2\)Low nonlocality: Steering thebottom20% features ranked by feature nonlocality; \(3\)Random: Steering a random subset of features, with the same size as the high/low nonlocality arms; \(4\)Representative single feature: Steering one feature individually at strengthγ=2\\gamma=2selected by ReasonScore\(Galichinet al\.[2026](https://arxiv.org/html/2608.10537#bib.bib6)\), which filters for reasoning features via token\-level cues\.

The results are summarized in Table[4](https://arxiv.org/html/2608.10537#Sx6.T4)\. All steered models beat the baseline by a nontrivial margin, and the high\-FNL envelope is the best\-scoring arm while also producing the shortest thinking traces among the envelope arms\. Note that our feature selection criterion is based entirely on nonlocality, with no token\-level or activation\-based filters\.

The supplementary material extends these experiments to layers 10–12 of the same model and to Gemma\-2\-9B and Qwen3\-8B\. Steering high\-FNL features generically beats steering low\-FNL ones, but outside DeepSeek\-R1\-Distill\-Llama\-8B both arms fall below the unsteered and random\-feature baselines\. We therefore present the experiment as a proof of concept rather than evidence that FNL reliably predicts steering utility\.

Table 4:Steered model performance evaluated on MATH\-500, graded by a local Llama\-3\.3\-70B judge; entries are avg@4 \(mean accuracy over four rollouts\)\. The last row steers a single representative feature, f3466, individually at strengthγ=2\\gamma=2following\(Galichinet al\.[2026](https://arxiv.org/html/2608.10537#bib.bib6)\)\. We observe that collectively steering high\-FNL features outperforms representative features selected via curated token\-level filters\.

## Conclusion

We introduced feature nonlocality \(FNL\), the entropy of an SAE feature’s per\-position influence over the causal prefix, as a label\-free measure of how much context a feature actually reads\. The measure requires no contrastive datasets or interventions, yet it is demonstrated to quantitatively correlate with the semantic abstractness of features\.

Such a quantity is helpful for pursuing a fine\-grained mechanistic understanding of LLMs’ emergent, abstract behaviours, now increasingly perceived as an urgent task in AI safety\. The distinction we advocate is between what an intervention achieves and what the intervened feature represents: the former is validated by steering utility as in various interpretability works, while the latter requires additional evidence which we supply in this paper\. Applied downstream, we used FNL to audit the mechanism of jailbreak defense, revealing that its selected features read a positional artifact rather than harmful content; and, as a proof of concept, selected features for envelope steering that improve reasoning\-benchmark accuracy over the unsteered baseline on a reasoning\-finetuned model without any supervision\.

## Data and Code Availability

The data and codes associated with this work are published in the repositoryhttps://github\.com/lccqqqqq/sae\-feature\-nonlocality\(releasev1\.0\.0\), which is also the Agentic Publication Protocol \(APP\) paper repository, following the specifications in\(Lu and Qi[2026](https://arxiv.org/html/2608.10537#bib.bib1)\)\. All figures and tables in this work are reproducible in CPU minutes\. The codes for generating the raw data for each experiment are also included\.

## Supplementary Material

## Appendix AFeature Nonlocality as a Feature\-level Measure

This section reports supplementary experiments on nonlocality as a feature\-level measure\. We present additional results on the cross\-corpus stability of FNL across a wider range of open\-source models and layers, and on the depth\-dependence of FNL\. We also study how FNL depends on the revealed context, i\.e\. how feature nonlocalities change as we gradually reveal more of it\. Finally, in the context of reasoning features, we present a study of how FNL correlates with other established measures obtained from keyword filtering\(Galichinet al\.[2026](https://arxiv.org/html/2608.10537#bib.bib6)\)or activation differences\(Venhoffet al\.[2025](https://arxiv.org/html/2608.10537#bib.bib55); Assogbaet al\.[2026](https://arxiv.org/html/2608.10537#bib.bib30)\)\.

### Supplemental Experiments for Cross\-dataset stability of Feature Nonlocalities

Table[1](https://arxiv.org/html/2608.10537#Sx4.T1)of the main text reports that per\-feature nonlocality rankings agree across topically dissimilar corpora in Gemma\-2\-2B\. We extend that measurement to Llama\-3\-8B and Qwen3\-8B, at three depths each\. We note that the raw Spearmanρ\\rhoin Table[S1](https://arxiv.org/html/2608.10537#A1.T1)is computed between themeanFeature Nonlocality given a set of firing events within their respective corpora\. To account for fluctuations of the mean, we consider a baseline, characterizing the ceiling of attainable Spearman correlation as follow: within a single corpus we split each feature’s firing events into two disjoint halves and correlate the rankings computed on each half, giving the split\-half reliabilityr𝒟r\_\{\\mathcal\{D\}\}; for a pair of corpora the agreement attainable by a perfectly corpus\-invariant measure isr𝒟1​r𝒟2\\sqrt\{r\_\{\\mathcal\{D\}\_\{1\}\}r\_\{\\mathcal\{D\}\_\{2\}\}\}\(Spearman[1904](https://arxiv.org/html/2608.10537#bib.bib56)\)\. We report the disattenuated cross\-dataset agreement in the last column of Table[S1](https://arxiv.org/html/2608.10537#A1.T1)\.

Table S1:Cross\-corpus stability of the nonlocality ranking, measured against its own reliability ceiling\. The columnρraw\\rho\_\{\\mathrm\{raw\}\}is the Spearman correlation of per\-featureH​\(a,𝒟\)H\(a,\\mathcal\{D\}\)averaged over the three corpus pairs drawn from WikiText, GSM8K and Code\-Python\(Merityet al\.[2016](https://arxiv.org/html/2608.10537#bib.bib3); Cobbeet al\.[2021](https://arxiv.org/html/2608.10537#bib.bib47); Kocetkovet al\.[2022](https://arxiv.org/html/2608.10537#bib.bib50)\)\.ρceiling\\rho\_\{\\mathrm\{ceiling\}\}is the agreement attainable if the measure were perfectly corpus\-invariant, estimated from split\-half reliability within each corpus\.ρ~:=ρraw/ρceiling\\tilde\{\\rho\}:=\\rho\_\{\\mathrm\{raw\}\}/\\rho\_\{\\mathrm\{ceiling\}\}is the disattenuated correlation, which we report as a properly baselined cross\-dataset agreement metric\. Each cell ranks the same2,0002\{,\}000features, sampled once from those carrying enough firing events on all three corpora, on up tok=60k=60events per corpus with context windowT=128T=128\. Dictionaries used are GemmaScope\(Lieberumet al\.[2024](https://arxiv.org/html/2608.10537#bib.bib2)\), Llama Scope\(Heet al\.[2024](https://arxiv.org/html/2608.10537#bib.bib41)\)and Qwen\-Scope\(Denget al\.[2026](https://arxiv.org/html/2608.10537#bib.bib52)\)\.Measured against this ceiling, the ranking retains the majority of its attainable agreement at every model and depth, extending the cross\-corpus stability of Table[1](https://arxiv.org/html/2608.10537#Sx4.T1)beyond the model family of the main text\.

### Depth profile across models and corpora

Figure[S1](https://arxiv.org/html/2608.10537#A1.F1)repeats the depth sweep behind Fig\.[1](https://arxiv.org/html/2608.10537#Sx4.F1)of the main text on three corpora for the three largest models of our pool: in every panel nonlocality rises over the first half of the network and then saturates, with the three corpus profiles nearly coincident, so the rise\-then\-saturate shape is an intrinsic property of FNL rather than of any one model, dictionary, or input distribution\.

![Refer to caption](https://arxiv.org/html/2608.10537v1/figures/fig5.png)Figure S1:Nonlocality against depth for three models \(rows\) measured independently on three corpora \(columns\)\. Each violin is the distribution of per\-feature mean nonlocality at one layer; the black line traces the per\-layer mean\. Within every row the three profiles nearly coincide, while the residual separation is a small systematic shift by corpus, GSM8K highest and Python code lowest\. The horizontal axis spans each model’s true layer range\. They uniformly show the same rise\-then\-saturate shape\.
### Dependence on the revealed context length

Feature nonlocality naturally depends on how much context is revealed in the feature’s “past lightcone”\. To measure this dependence we sweep the revealed windowTTfrom a few tokens to a few thousand on a single coherent FineWeb\-Edu document\(Lozhkovet al\.[2024](https://arxiv.org/html/2608.10537#bib.bib54)\), recomputing every active feature’s nonlocality at eachTT, for all layers of Gemma\-2\-2B and 11 layers of Llama\-3\-8B; Figure[S2](https://arxiv.org/html/2608.10537#A1.F2)shows every such feature at one mid\-depth layer of each model\. In both models nonlocality first rises with the revealed context and then saturates\. Comparisons at a fixed window, which are the only comparisons the main text makes, are thus sound for Gemma\-2\-2B and Llama\-3\-8B, and are expected to generalize to other models\.

![Refer to caption](https://arxiv.org/html/2608.10537v1/figures/fig6.png)Figure S2:Nonlocality against the revealed context lengthTT, on one coherent FineWeb\-Edu document, at one mid\-depth layer per model\. Coloured curves are the eight strongest\-firing features, grey curves every other feature active across the sweep, and the dashed curve the uniform\-influence ceilinglog2⁡T\\log\_\{2\}T\.\(a\)Gemma\-2\-2B layer 12;\(b\)Llama\-3\-8B layer 18\. Features separate by several bits and hold their values as the window grows, settling at intrinsic reaches well below the ceiling\.
### Nonlocality tracks decoder geometry rather than semantic similarity

Figure[2](https://arxiv.org/html/2608.10537#Sx4.F2)of the main text shows that features close together under decoder cosine similarity occupy similar ranges of nonlocality\. We consider a semantically more direct measure of similarity, from the auto\-interpretation descriptions\(Billset al\.[2023](https://arxiv.org/html/2608.10537#bib.bib13); Pauloet al\.[2025](https://arxiv.org/html/2608.10537#bib.bib24)\)\. Each description is embedded with the BGE\-large\-en\-v1\.5 text\-embedding model\(Xiaoet al\.[2023](https://arxiv.org/html/2608.10537#bib.bib59)\), and semantic similarity is the cosine between the embeddings\. Figure[S3](https://arxiv.org/html/2608.10537#A1.F3)draws the six anchor features of the main text’s figure under both notions in the same format, and Table[S2](https://arxiv.org/html/2608.10537#A1.T2)lists the nearest neighbours’ descriptions\. Under decoder cosine \(panel a\) each cluster occupies a narrow band of the nonlocality axis, although its members’ descriptions share might not be obviously related\. Under description embedding cosine \(panel b\) the neighbourhoods of the same anchors are topically uniform almost to the word, yet each spreads across most of the axis\. Thus, we conclude that the decoder cosine similarity, as a metric defined on the write\-side, correlates better with nonlocality than semantic similarity\. In retrospect, this result makes sense because semantically similar concepts may require the feature to attend to different ranges of text\. For example, two features may both be described as concerning “beauty”, while one fires on the word itself, a lexical read with no contextual reach, and the other recognizes a described scene as beautiful, a judgement that requires reading a span of context\.

![Refer to caption](https://arxiv.org/html/2608.10537v1/figures/fig7.png)Figure S3:The six anchor features of the main text’s Fig\.[2](https://arxiv.org/html/2608.10537#Sx4.F2)under two notions of similarity, drawn in the format of that figure\.\(a\)Each anchor’s ten nearest neighbours by decoder cosine, reproducing the main text’s figure: dots are per\-feature median nonlocality with IQR whiskers over the feature’s firing events, the black\-ringed dot is the anchor, and the row label gives the cluster meanμ\\mu\. This is an exact recapitulation of Figure 2 in the main text\.\(b\)The same anchors with their ten nearest neighbours by cosine similarity between sentence embeddings of the auto\-interpretation descriptions, on the same rows and the same axis; embeddings are computed with the BGE\-large\-en\-v1\.5 text\-embedding model\(Xiaoet al\.[2023](https://arxiv.org/html/2608.10537#bib.bib59)\)\. The three nearest members of every cluster under each notion are listed in Table[S2](https://arxiv.org/html/2608.10537#A1.T2)\.similarityfeatureH​\(a\)H\(a\)median \[IQR\] \(bits\)auto\-interpretation descriptionf4248\(anchor,H​\(a\)=1\.50H\(a\)=1\.50bits\):phrases that signify quality, reliability, or suitabilitydecoderf20541\.551\.55\[1\.27,1\.81\]\[1\.27,1\.81\]positive affirmations and expressions of approvalf28291\.401\.40\[1\.18,1\.57\]\[1\.18,1\.57\]contexts where improvement, enhancement, or optimization is being discussedf4111\.531\.53\[1\.40,1\.86\]\[1\.40,1\.86\]references to the concept of “best” or “optimal” in various contextssemanticf18203\.933\.93\[3\.51,4\.28\]\[3\.51,4\.28\]phrases related to assurance, quality control, and meeting standardsf62674\.074\.07\[3\.64,4\.28\]\[3\.64,4\.28\]phrases that describe suitability and appropriateness in various contextsf24314\.524\.52\[3\.77,4\.71\]\[3\.77,4\.71\]phrases related to product selection and suitabilityf608\(anchor,H​\(a\)=0\.98H\(a\)=0\.98bits\):references to individuals named Robertdecoderf151761\.811\.81\[1\.59,2\.29\]\[1\.59,2\.29\]terms and phrases related to smoking and its impact on healthf54301\.001\.00\[0\.81,1\.68\]\[0\.81,1\.68\]mentions of the name “Robert\.”f114101\.501\.50\[1\.22,1\.78\]\[1\.22,1\.78\]instances of the word “once”semanticf54301\.001\.00\[0\.81,1\.68\]\[0\.81,1\.68\]mentions of the name “Robert\.”f99954\.764\.76\[4\.14,5\.17\]\[4\.14,5\.17\]references to specific individuals or namesf112503\.623\.62\[3\.45,4\.54\]\[3\.45,4\.54\]references to specific individuals or namesf6240\(anchor,H​\(a\)=3\.01H\(a\)=3\.01bits\):temporal references indicating events relative to each otherdecoderf63893\.543\.54\[3\.11,3\.88\]\[3\.11,3\.88\]references to distance and locationf42702\.712\.71\[2\.22,2\.99\]\[2\.22,2\.99\]terms related to time duration or intervalsf155043\.423\.42\[3\.09,3\.58\]\[3\.09,3\.58\]verbs that indicate development or progress in various contextssemanticf145393\.873\.87\[3\.62,4\.26\]\[3\.62,4\.26\]temporal references concerning events and their sequencesf43584\.334\.33\[3\.94,4\.69\]\[3\.94,4\.69\]temporal references and dates related to eventsf3803\.863\.86\[3\.38,4\.20\]\[3\.38,4\.20\]temporal references to durations and past eventsf10360\(anchor,H​\(a\)=3\.11H\(a\)=3\.11bits\):clauses that introduce relative clauses or provide additional informationdecoderf93633\.463\.46\[3\.15,3\.95\]\[3\.15,3\.95\]words that refer to or describe individuals, particularly in the context of actions and relationshipsf139652\.152\.15\[2\.00,2\.43\]\[2\.00,2\.43\]possessive forms and statements of ownership or existencef140784\.224\.22\[3\.49,4\.60\]\[3\.49,4\.60\]references to specific claims or statements about the nature of thingssemanticf113554\.594\.59\[4\.21,4\.87\]\[4\.21,4\.87\]clauses that introduce additional information or elaborate on preceding statementsf74094\.284\.28\[3\.90,4\.66\]\[3\.90,4\.66\]conjunctions and relative clauses that indicate relationships or conditionsf133004\.294\.29\[3\.99,4\.67\]\[3\.99,4\.67\]conjunctions and phrases indicating additional information or contrastsf13603\(anchor,H​\(a\)=5\.09H\(a\)=5\.09bits\):conditional language and uncertainty expressionsdecoderf7965\.305\.30\[4\.96,5\.52\]\[4\.96,5\.52\]phrases related to medical procedures and their effectivenessf117415\.415\.41\[4\.94,5\.59\]\[4\.94,5\.59\]inclusive language and sentiments inviting participation or collective experiencef16113\.583\.58\[3\.20,4\.17\]\[3\.20,4\.17\]emotional expressions and reactions related to disappointment and frustrationsemanticf122873\.203\.20\[2\.67,3\.50\]\[2\.67,3\.50\]conditional statements and expressions of uncertaintyf64093\.363\.36\[2\.83,3\.79\]\[2\.83,3\.79\]conditional statements and expressions of uncertainty or potential outcomesf33431\.441\.44\[1\.27,1\.70\]\[1\.27,1\.70\]conditional language indicating possibility or potential outcomesf6900\(anchor,H​\(a\)=5\.10H\(a\)=5\.10bits\):mentions of competition and achievementsdecoderf118135\.545\.54\[5\.23,5\.73\]\[5\.23,5\.73\]structured data representations and definitionsf89585\.135\.13\[4\.92,5\.37\]\[4\.92,5\.37\]occurrences of vehicle\-related crashes and their contextsf91715\.025\.02\[4\.57,5\.26\]\[4\.57,5\.26\]references to serum levels and indicators of medical conditionssemanticf98163\.833\.83\[3\.50,4\.52\]\[3\.50,4\.52\]references to achievements and accolades in contexts related to performance or competitionsf77564\.504\.50\[4\.19,4\.88\]\[4\.19,4\.88\]references to competitions, awards, and sporting eventsf1193\.883\.88\[3\.30,4\.44\]\[3\.30,4\.44\]references to athletic achievements and performancesTable S2:For each anchor feature of Fig\.[S3](https://arxiv.org/html/2608.10537#A1.F3), its three nearest neighbours by decoder cosine and its three nearest by auto\-interp embedding cosine, with each feature’s median nonlocality over its firing events and the interquartile range in brackets\. The semantic neighbours are near\-paraphrases of the anchor’s description yet spread widely in nonlocality; the decoder neighbours need not share the anchor’s topic yet sit close to it on the axis\.
### Relation of FNL to token\-cue and corpus\-contrast selectors

A natural objection to FNL is that it might be a repackaging of a selection signal already in use\. We test it against the two candidates directly, on the same model and layer\. Both candidates are activation\-based feature\-filtering methods from the reasoning\-features literature discussed in the related work of the main text, and we include the definitions for completeness\. ReasonScore\(Galichinet al\.[2026](https://arxiv.org/html/2608.10537#bib.bib6)\)scores each feature by its average activation mass on a curated vocabulary of reasoning cue words, so features firing on reasoning\-flavoured tokens rank highly\.

Corpus\-contrast enrichment compares a feature’s firing rates on a reasoning corpusRR\(OpenThoughts\-114k\) and a general chat corpusCC\(LMSYS\-Chat\), both under the same chat template\. Writingra​\(⋅\)r\_\{a\}\(\\cdot\)for the fraction of corpus tokens at which featureaa’s activation exceeds a thresholdτ=0\.2\\tau=0\.2, the contrastive enrichment isenricha=ra​\(R\)/max⁡\(ra​\(C\),1/nC\)\\mathrm\{enrich\}\_\{a\}=r\_\{a\}\(R\)/\\max\\\!\\big\(r\_\{a\}\(C\),\\,1/n\_\{C\}\\big\), wherenCn\_\{C\}is the number of tokens inCCand the regularization by1/nC1/n\_\{C\}in the denominator gives features that never fire on chat a finite score\. A feature is reasoning\-enriched whenenricha≫1\\mathrm\{enrich\}\_\{a\}\\gg 1, meaning it fires almost exclusively on reasoning text\.

For ReasonScore\(Galichinet al\.[2026](https://arxiv.org/html/2608.10537#bib.bib6)\)we compute the correlation between FNL and ReasonScore across9898features carrying both quantities, and found these two metric are close to being orthogonal with Spearmanρ=−0\.214\\rho=\-0\.214\(p=0\.035p=0\.035\)\. This suggests FNL is not a token\-frequency statistic in disguise, and a feature selected as reasoning\-relevant by vocabulary is not thereby high in nonlocality\. Corpus\-contrast enrichment, on the other hand, shows a mild positive correlation with the feature nonlocality: the212212features enriched by a factor of100100or more average5\.565\.56bits, against a dictionary\-wide mean of5\.055\.05bits\. Figure[S4](https://arxiv.org/html/2608.10537#A1.F4)plots enrichment against the two other axes over the full scored dictionary to visualize the correlations between those metrics\.

![Refer to caption](https://arxiv.org/html/2608.10537v1/figures/fig8.png)Figure S4:Contrastive enrichment against the two other selection axes, over the5,3585\{,\}358dictionary features carrying both a valid nonlocality and an enrichment score \(DeepSeek\-R1\-Distill\-Llama\-8B layer 19; red curves are binned medians; axes clipped to the central98%98\\%of each variable\)\.*Top:*log10\\log\_\{10\}enrichment against FNL\.*Bottom:*against ReasonScore\. Nonlocality is a stronger correlator of the two with higher correlation and wider ranges, whereas for ReasonScore most features cluster at zero value\.
### FNL and auto\-interpretation

Figure[3](https://arxiv.org/html/2608.10537#Sx5.F3)of the main text shows seven features and three influence maps to illustrate the association between verbal abstractness and feature nonlocality\. Figure[S5](https://arxiv.org/html/2608.10537#A1.F5)expands this comparison to sixteen Gemma\-2\-2B layer\-12 features ordered by nonlocality, each with its auto\-interpretation label, the full distribution of its nonlocality across its firing events, and two of its maximally activating passages with every token shaded by its per\-position influence and the activating token boxed\.

![Refer to caption](https://arxiv.org/html/2608.10537v1/figures/fig9.png)Figure S5:Sixteen Gemma\-2\-2B layer\-12 features ordered by feature nonlocality, from1\.111\.11to4\.994\.99bits\. Each block gives the feature index, its auto\-interpretation label, and its mean nonlocality with the standard deviation across the feature’s activating events, followed by two maximally activating passages\. Within a passage, each token’s background is shaded by its per\-position influenceJa​\(t\)J\_\{a\}\(t\)on the feature’s activation \(darker is more influential\) and the activating token is boxed in red\. Passages are truncated to the tail of the128128\-token measurement window for legibility\. At the right of each block, a histogram gives the full distribution of that feature’s nonlocality over its activating events, drawn on a common axis from0to the ceilinglog2⁡128=7\\log\_\{2\}128=7bits, so the distributions are directly comparable down the page\. Influence is concentrated on the activating token itself at the top of the figure and spreads across the passage towards the bottom, and the histogram mass moves rightward correspondingly\. Features f608 and f10360 also appear in Fig\.[3](https://arxiv.org/html/2608.10537#Sx5.F3)of the main text with identical values\.

## Appendix BEnvelope Steering Across Layers, Models, and Dictionaries

This section reports the full envelope\-steering grid, extending the proof\-of\-concept experiments of the main text\. The grid covers the following setups, withγ\\gammathe multiplicative gain applied to a selected feature’s activation whenever it is active and “high” / “low” the envelope built from the highest\- or lowest\-FNL fraction of the dictionary\.

- –*Models, dictionaries, layers:*DeepSeek\-R1\-Distill\-Llama\-8B with the 65k dictionary ofGalichinet al\.\([2026](https://arxiv.org/html/2608.10537#bib.bib6)\)at layer 19 and with Llama Scope\(Heet al\.[2024](https://arxiv.org/html/2608.10537#bib.bib41)\)R1\-distill dictionaries at layers 10–12; Gemma\-2\-9B \(base\) with Gemma Scope\(Lieberumet al\.[2024](https://arxiv.org/html/2608.10537#bib.bib2)\)at layers 9, 20, 31; Qwen3\-8B \(thinking\) with Qwen\-Scope\(Denget al\.[2026](https://arxiv.org/html/2608.10537#bib.bib52)\)at layers 9, 18, 27, after verifying that the base\-trained dictionary transfers to the post\-trained checkpoint\.
- –*Envelopes:*top, bottom, or size\-matched random fraction \(20%20\\%,10%10\\%,5%5\\%\) of the dictionary by FNL\.
- –*Steering gain:*γ∈\[1\.05,5\]\\gamma\\in\[1\.05,5\], calibrated per layer on held\-out tuning problems as the largest gain introducing no generation failures absent from the unsteered model via a pilot steering strength sweep on 20 held\-out MATH\-500 questions\. All steering experiments use the clamping strategy explained in the main text\.
- –*Evaluation:*MATH\-500\(Lightmanet al\.[2023](https://arxiv.org/html/2608.10537#bib.bib49); Hendryckset al\.[2021](https://arxiv.org/html/2608.10537#bib.bib48)\)with four sampled rollouts atT=0\.6T\{=\}0\.6, majority vote of four, graded by a local Llama\-3\.3\-70B judge; MMLU\-Pro\(Wanget al\.[2024](https://arxiv.org/html/2608.10537#bib.bib42)\)zero\-shot chain of thought \(majority of four\) for the reasoning models and the published five\-shot greedy protocol \(n=1400n\{=\}1400\) for Gemma, whose unsteered accuracy reproduces the published reference; all generation through the LM Evaluation Harness on vLLM\.

Table[S3](https://arxiv.org/html/2608.10537#A2.T3)collects the grid cells behind the two claims of the main text, and Table[S4](https://arxiv.org/html/2608.10537#A2.T4)the interval\-backed contrasts\.

We now report extensive steering experiment over the above setups as further validations for results in the main text\. Firstly, feature nonlocality carries some selective power over an arbitrary envelope of the same size on the Llama\-family reasoning model in improving reasoning performance, although the selection effect is weaker when transferring to other models\. Table[S4](https://arxiv.org/html/2608.10537#A2.T4)shows that at layer 19 the high\-FNL envelope beats the size\-matched random envelope; the same contrast is positive but less robust at Llama Scope layer 12 and runs negative on Gemma\. Secondly, we find that steering high\-FNL features is better than steering low\-FNL features across the models we test\. The high\-vs\-low contrast is significantly visible on the reasoning\-distilled model and on Gemma, where low\-FNL arm may collapse and degrade reasoning to random guessing at high steering strengths, while the high\-FNL arm stays near baseline consistently\. Similar results in Qwen3\-8B are also reported in Table[S3](https://arxiv.org/html/2608.10537#A2.T3)\. The asymmetry is attributable to nonlocality rather than to activation statistics, since a control envelope selected by activation magnitude alone, injecting more perturbation than the low arm, is significantly less harmful\.

cellfractionγ\\gammannunsteeredhighlowrandomhigh−\-low*DeepSeek\-R1\-Distill\-Llama\-8B, layer 19, 65k SAE; MATH\-500, majority of 4*L1920%1\.104800\.8810\.9420\.9230\.940\+0\.019\+0\.019L1920%1\.101000\.8500\.9300\.8700\.910\+0\.060\+0\.060L1910%1\.201000\.8500\.9100\.8900\.933\+0\.020\+0\.020L195%1\.401000\.8500\.9300\.9200\.923\+0\.010\+0\.010*Same model, Llama Scope R1\-distill dictionaries; MATH\-500, majority of 4, shared unsteered control*L1010%1\.44800\.8810\.9380\.9270\.932\+0\.011\+0\.011L1110%1\.84800\.8810\.9290\.9380\.932−0\.009\-0\.009L1220%1\.14800\.8810\.9440\.9310\.935\+0\.013\+0\.013*Same model, layer 19; MMLU\-Pro, majority of 4*L1920%1\.101200\.5330\.5670\.5250\.608\+0\.042\+0\.042*Gemma\-2\-9B \(base\), Gemma Scope; MMLU\-Pro, greedy*L920%214000\.4400\.4360\.4320\.431\+0\.004\+0\.004L2020%214000\.4400\.4240\.3880\.437\+0\.036\+0\.036L2010%314000\.4400\.4130\.3210\.424\+0\.092\+0\.092L205%514000\.4400\.4070\.0830\.415\+0\.324\+0\.324*Qwen3\-8B \(thinking\), Qwen\-Scope layers 9/18/27 of 36; MMLU\-Pro, majority of 4, shared unsteered control*L920%1\.26000\.7520\.7520\.7400\.743\+0\.012\+0\.012L1820%1\.16000\.7520\.7470\.7520\.755†−0\.005\-0\.005L2720%2\.06000\.7520\.7530\.7450\.737†\+0\.008\+0\.008Table S3:Envelope\-steering cells supporting the two claims of the main text, selected from the full sweep\. “High / “low are the envelopes over the highest\- / lowest\-FNL fraction of the dictionary; “random is the mean over 3–10 size\-matched random draws, except where marked†\(a single draw, on dose\-curve rows that reuse the primary cell’s control\)\.nnis the number of scored problems per condition; bold marks cells where the high\-FNL envelope is the best\-scoring condition\. The panels divide by whether the unsteered model degenerates: on the two R1\-distilled stacks every high\-FNL cell beats the unsteered control by\+4\.6\+4\.6to\+8\.0\+8\.0points, while on the base model and the native reasoning model \(lower panels\), where the unsteered model has no degenerate failure mode, no condition beats the control\. The low\-FNL envelope on Gemma Scope is the only arm that is significantly harmful\.Table S4:Statistical significance illustration for the two claims in the main text\. maj@4 / avg@4 are majority\-vote and mean accuracy over four rollouts; “greedy” is single\-sample greedy accuracy \(n=1400n\{=\}1400\)\. Every interval is a10,00010\{,\}000\-resample paired bootstrap over problems at a fixed seed; contrasts against the random envelope additionally resample the random draws\.
## Appendix CReproduction Details of Reference Papers

### Token\-injection pipeline ofMaet al\.\([2026](https://arxiv.org/html/2608.10537#bib.bib31)\)

BecauseMaet al\.\([2026](https://arxiv.org/html/2608.10537#bib.bib31)\)release code but no per\-feature results, we re\-ran their pipeline in full \(contrastive selection of the top 100 features, eight injection strategies per feature, classification by the best strategy’s effect size\) and reproduce their published classification nearly exactly: class counts of46/12/21/2146/12/21/21against their46/12/19/2346/12/19/23, with matching injection effect sizes and winning\-strategy fractions\. The only quantity that does not reconcile is the detection\-stage effect size, which we attribute to a normalization difference in their reporting, since every quantity downstream of it agrees\.

### Steering defence ofAssogbaet al\.\([2026](https://arxiv.org/html/2608.10537#bib.bib30)\)

Before auditing the jailbreaking\-mitigation features, we reproduced their CC\-delta pipeline and verified their out\-of\-distribution jailbreaking mitigation result\. Against the held\-out Few\-Shot\-JSON attack the sparse feature\-steering direction raises safety from0\.5110\.511unsteered to0\.7530\.753at∥v∥=1\.6\\lVert v\\rVert=1\.6and0\.8950\.895at∥v∥=3\.2\\lVert v\\rVert=3\.2, over the same404404requests, while a dense contrastive\-activation direction at matched strength reaches only0\.3430\.343and a random direction0\.5670\.567\.

## Appendix DReproducibility Details

### Computing infrastructure

All experiments ran on single compute nodes of an HPC cluster\. GPU jobs used NVIDIA H200 NVL \(141 GB\), A100 80 GB PCIe, RTX 6000 Ada \(48 GB\), and RTX 4090 \(24 GB\); the sub\-2B models fit on the 24 GB card, the 8B–9B models with10410^\{4\}–10510^\{5\}\-feature dictionaries ran on the H200 or A100, and benchmark generation used three or four GPUs per job, one or two of them serving the grading model\. The recorded total runtime is on the order of1,0001\{,\}000GPU\-hours, dominated by the dictionary\-scale nonlocality scans and the steered benchmark generation\.

### Datasets

No novel dataset is introduced\. The text corpora used include WikiText\(Merityet al\.[2016](https://arxiv.org/html/2608.10537#bib.bib3)\), GSM8K\(Cobbeet al\.[2021](https://arxiv.org/html/2608.10537#bib.bib47)\), Python code from The Stack\(Kocetkovet al\.[2022](https://arxiv.org/html/2608.10537#bib.bib50)\), FineWeb\-Edu\(Lozhkovet al\.[2024](https://arxiv.org/html/2608.10537#bib.bib54)\), The Pile\(Gaoet al\.[2020](https://arxiv.org/html/2608.10537#bib.bib51)\), OpenThoughts\-114k\(Guhaet al\.[2025](https://arxiv.org/html/2608.10537#bib.bib7)\), and LMSYS\-Chat\-1M\(Zhenget al\.[2023](https://arxiv.org/html/2608.10537#bib.bib60)\)\. For benchmarks we used MATH\-500\(Lightmanet al\.[2023](https://arxiv.org/html/2608.10537#bib.bib49); Hendryckset al\.[2021](https://arxiv.org/html/2608.10537#bib.bib48)\), MMLU\-Pro\(Wanget al\.[2024](https://arxiv.org/html/2608.10537#bib.bib42)\), and the404404\-request jailbreak evaluation set with its held\-out Few\-Shot\-JSON wrapper\(Assogbaet al\.[2026](https://arxiv.org/html/2608.10537#bib.bib30)\)\.

### Runtimes and number of runs

Wall\-clock times below are the recorded maxima for each job family, taken from the run logs\. They are single\-node figures on the hardware described above and are intended to let a reader budget a replication\.

*Measurement\.*A dictionary\-scale nonlocality scan is the dominant cost\. Over a full10410^\{4\}–10510^\{5\}\-feature dictionary would be around 7\-8 hours on four H200 cards\. The depth sweep costs4\.54\.5–5\.55\.5hours per layer for Gemma\-2\-2B\.

*Generation and grading\.*Steered benchmark generation for MATH\-500 takes around 4 hours for 7B\-8B models

*Number of runs\.*Nonlocality values are means over1616–6060firing events per feature, stated per experiment and default tok=32k=32\. Benchmark accuracies on the reasoning models are means or majority votes over four sampled rollouts per problem; Gemma cells are single\-sample greedy\. Random\-envelope arms are33–1010independent draws, pooled per problem, with the count given per cell in Table[S3](https://arxiv.org/html/2608.10537#A2.T3)\.

### Random seeds

Four distinct sources of randomness enter the results, and each is seeded from an explicit command\-line argument with a fixed default, recorded in the output file of every run\.

*Corpus sampling\.*Which documents and which firing events enter a nonlocality measurement is drawn from a NumPy generator seeded per experiment \(defaults 260705, 260706, 260720 for the injection, paraphrase and cross\-corpus runs respectively\)\.

*Envelope construction\.*The size\-matched random envelopes are drawn from a generator seeded at 260622; where a cell reports a mean over several random draws, drawkkuses seed260622\+k260622\+k, so the reported spread is over reproducible draws rather than over an unrecorded sequence\.

*Benchmark decoding\.*Every generation arm passes a fixed engine seed \(260621\) to vLLM, so the four sampled rollouts per problem are reproducible given the same engine version and GPU count\. We note the standard caveat that batched GPU inference is not bit\-reproducible across different hardware or batch schedules even at a fixed seed, so exact per\-rollout texts may differ on a different allocation while the aggregate accuracies do not\.

*Bootstrap resampling\.*All confidence intervals are paired bootstraps over problems with10,00010\{,\}000resamples at seed 260622 \(260621 for the majority\-vote analyses\), so the reported interval endpoints are exactly reproducible from the stored per\-problem scores without rerunning any generation\.

### Hyperparameters: values tried and how the final ones were chosen

Table[S5](https://arxiv.org/html/2608.10537#A4.T5)lists the hyperparameter choices\. We note that this table is for bookkeeping as the specifications have been stated near each experiment\. We record the range explored, the value used for the reported results if selected, and the criterion that guides the selection if applicable, across the experiments conducted\. The steering gain is the only hyperparameter selected against a performance signal, calibrated on held\-out tuning problems disjoint from the reported ones\.

QuantityRange triedUsedCriterionContext windowTT8–2048128 / 64approximate saturation ofHHEvents/featurekk8–6032 / 60estimator stabilityFiring thresh\.τ\\tau0, 0\.20, 0\.2SAE gate, ReLU or JumpReLUEnvelope fraction5/10/20%5/10/20%N/ASteering gainγ\\gamma1\.05–5per celllargest gain with no new failures on the held\-out pilotDecoding temp\.0/0\.6/0\.80\.6model cardDecoding top\-pp0\.95, 10\.95model cardRollouts per problem1, 44majority voteMax gen\. tokens16,38416,384no truncationTable S5:Hyperparameters varied during development, with the value used for the reported results and the criterion that fixed it\. The first group record the general settings used when computing feature nonlocalities\. The second group include the steering experiments setups, and the last group contains details on rollout generations and evaluation procedures\.
### Beginning\-of\-sequence convention

The nonlocality measurements in this work cut windows without a beginning\-of\-sequence token and exclude the window\-initial position, which hosts the attention sink, from the influence support; both choices shift absolute values without disturbing any ordering the paper uses, so absolute values are comparable only across studies adopting the same convention\.

## References

- N\. Alon, T\. F\. Bloom, W\. T\. Gowers, D\. Litt, W\. Sawin, A\. Shankar, J\. Tsimerman, V\. Wang, and M\. M\. Wood \(2026\)Remarks on the disproof of the unit distance conjecture\.External Links:2605\.20695,[Link](https://arxiv.org/abs/2605.20695)Cited by:[Introduction](https://arxiv.org/html/2608.10537#Sx1.p1.1)\.
- D\. Arad, A\. Mueller, and Y\. Belinkov \(2025\)Saes are good for steering–if you select the right features\.InProceedings of the 2025 Conference on Empirical Methods in Natural Language Processing,pp\. 10241–10259\.Cited by:[Introduction](https://arxiv.org/html/2608.10537#Sx1.p2.1),[Introduction](https://arxiv.org/html/2608.10537#Sx1.p6.3),[Feature Selection/Validation in SAEs](https://arxiv.org/html/2608.10537#Sx2.SS0.SSS0.Px3.p2.1)\.
- A\. Arditi, O\. Obeso, A\. Syed, D\. Paleka, N\. Panickssery, W\. Gurnee, and N\. Nanda \(2024\)Refusal in language models is mediated by a single direction\.InAdvances in Neural Information Processing Systems 37 \(NeurIPS\),Cited by:[Introduction](https://arxiv.org/html/2608.10537#Sx1.p1.1)\.
- Y\. Assogba, J\. Cortellazzi, J\. Abad, P\. Rodriguez, X\. Suau, and A\. Blaas \(2026\)Sparse autoencoders are capable LLM jailbreak mitigators\.Note:Mechanistic Interpretability Workshop, ICML 2026External Links:2602\.12418,[Link](https://arxiv.org/abs/2602.12418)Cited by:[Appendix A](https://arxiv.org/html/2608.10537#A1.p1.1),[Appendix C](https://arxiv.org/html/2608.10537#A3.SSx2),[Appendix D](https://arxiv.org/html/2608.10537#A4.SSx2.p1.1),[Introduction](https://arxiv.org/html/2608.10537#Sx1.p2.1),[Introduction](https://arxiv.org/html/2608.10537#Sx1.p6.3),[Feature Selection/Validation in SAEs](https://arxiv.org/html/2608.10537#Sx2.SS0.SSS0.Px3.p2.1),[Auditing Jailbreaking\-mitigation mechanisms](https://arxiv.org/html/2608.10537#Sx6.SSx1.p1.2),[Downstream Applications](https://arxiv.org/html/2608.10537#Sx6.p1.1)\.
- S\. Bills, N\. Cammarata, D\. Mossing, H\. Tillman, L\. Gao, G\. Goh, I\. Sutskever, J\. Leike, J\. Wu, and W\. Saunders \(2023\)Language models can explain neurons in language models\.OpenAI Blog\.Note:https://openaipublic\.blob\.core\.windows\.net/neuron\-explainer/paper/index\.htmlCited by:[Appendix A](https://arxiv.org/html/2608.10537#A1.SSx4.p1.1),[Introduction](https://arxiv.org/html/2608.10537#Sx1.p2.1),[Feature Selection/Validation in SAEs](https://arxiv.org/html/2608.10537#Sx2.SS0.SSS0.Px3.p3.1)\.
- R\. Chen, A\. Arditi, H\. Sleight, O\. Evans, and J\. Lindsey \(2025\)Persona vectors: monitoring and controlling character traits in language models\.External Links:2507\.21509,[Link](https://arxiv.org/abs/2507.21509)Cited by:[Introduction](https://arxiv.org/html/2608.10537#Sx1.p1.1)\.
- S\. Cho, Z\. Wu, and A\. Koshiyama \(2025\)CorrSteer: generation\-time llm steering via correlated sparse autoencoder features\.arXiv preprint arXiv:2508\.12535\.Cited by:[Feature Selection/Validation in SAEs](https://arxiv.org/html/2608.10537#Sx2.SS0.SSS0.Px3.p2.1)\.
- K\. Cobbe, V\. Kosaraju, M\. Bavarian, M\. Chen, H\. Jun, L\. Kaiser, M\. Plappert, J\. Tworek, J\. Hilton, R\. Nakano, C\. Hesse, and J\. Schulman \(2021\)Training verifiers to solve math word problems\.arXiv preprint arXiv:2110\.14168\.Cited by:[Table S1](https://arxiv.org/html/2608.10537#A1.T1),[Appendix D](https://arxiv.org/html/2608.10537#A4.SSx2.p1.1),[Cross\-dataset stability](https://arxiv.org/html/2608.10537#Sx4.SS0.SSS0.Px1.p1.5)\.
- J\. Cohen \(1988\)Statistical power analysis for the behavioral sciences\.2nd edition,Lawrence Erlbaum Associates,Hillsdale, NJ\.Cited by:[Token injection susceptibility](https://arxiv.org/html/2608.10537#Sx5.SS0.SSS0.Px1.p1.9)\.
- H\. Cunningham, A\. Ewart, L\. Riggs, R\. Huben, and L\. Sharkey \(2024\)Sparse autoencoders find highly interpretable features in language models\.InThe Twelfth International Conference on Learning Representations \(ICLR\),Cited by:[Introduction](https://arxiv.org/html/2608.10537#Sx1.p2.1)\.
- B\. Deng, X\. Wang, Y\. Wang, Y\. Wan, Y\. Ma, B\. Yang, H\. Wei, J\. Tang, H\. Lin, R\. Gao, T\. Li, Q\. Cao, X\. Ren, X\. Deng, A\. Yang, F\. Huang, D\. Liu, and J\. Zhou \(2026\)Qwen\-scope: turning sparse features into development tools for large language models\.arXiv preprint arXiv:2605\.11887\.Cited by:[Table S1](https://arxiv.org/html/2608.10537#A1.T1),[1st item](https://arxiv.org/html/2608.10537#A2.I1.i1.p1.1)\.
- N\. Elhage, T\. Hume, C\. Olsson, N\. Schiefer, T\. Henighan, S\. Kravec, Z\. Hatfield\-Dodds, R\. Lasenby, D\. Drain, C\. Chen, R\. Grosse, S\. McCandlish, J\. Kaplan, D\. Amodei, M\. Wattenberg, and C\. Olah \(2022\)Toy models of superposition\.Transformer Circuits Thread\.Note:https://transformer\-circuits\.pub/2022/toy\_model/index\.htmlCited by:[Introduction](https://arxiv.org/html/2608.10537#Sx1.p1.1)\.
- Y\. Fang, W\. Wang, M\. Xue, B\. Deng, F\. Xu, D\. Liu, and F\. Feng \(2026\)Controllable llm reasoning via sparse autoencoder\-based steering\.External Links:2601\.03595,[Link](https://arxiv.org/abs/2601.03595)Cited by:[Introduction](https://arxiv.org/html/2608.10537#Sx1.p2.1),[Feature Selection/Validation in SAEs](https://arxiv.org/html/2608.10537#Sx2.SS0.SSS0.Px3.p2.1)\.
- A\. Galichin, A\. Dontsov, P\. Druzhinina, A\. Razzhigaev, O\. Y\. Rogov, E\. Tutubalina, and I\. Oseledets \(2026\)I have covered all the bases here: interpreting reasoning features in large language models via sparse autoencoders\.InProceedings of the AAAI Conference on Artificial Intelligence,Vol\.40,pp\. 30771–30779\.Cited by:[Appendix A](https://arxiv.org/html/2608.10537#A1.SSx5.p1.1),[Appendix A](https://arxiv.org/html/2608.10537#A1.SSx5.p3.7),[Appendix A](https://arxiv.org/html/2608.10537#A1.p1.1),[1st item](https://arxiv.org/html/2608.10537#A2.I1.i1.p1.1),[Introduction](https://arxiv.org/html/2608.10537#Sx1.p1.1),[Introduction](https://arxiv.org/html/2608.10537#Sx1.p2.1),[Introduction](https://arxiv.org/html/2608.10537#Sx1.p6.3),[Feature Selection/Validation in SAEs](https://arxiv.org/html/2608.10537#Sx2.SS0.SSS0.Px3.p2.1),[Table 2](https://arxiv.org/html/2608.10537#Sx5.T2),[FNL\-Guided Steering](https://arxiv.org/html/2608.10537#Sx6.SSx2.p1.3),[FNL\-Guided Steering](https://arxiv.org/html/2608.10537#Sx6.SSx2.p2.1),[Table 4](https://arxiv.org/html/2608.10537#Sx6.T4),[Downstream Applications](https://arxiv.org/html/2608.10537#Sx6.p1.1)\.
- L\. Gao, S\. Biderman, S\. Black, L\. Golding, T\. Hoppe, C\. Foster, J\. Phang, H\. He, A\. Thite, N\. Nabeshima, S\. Presser, and C\. Leahy \(2020\)The Pile: an 800GB dataset of diverse text for language modeling\.arXiv preprint arXiv:2101\.00027\.Cited by:[Appendix D](https://arxiv.org/html/2608.10537#A4.SSx2.p1.1)\.
- L\. Gao, T\. D\. la Tour, H\. Tillman, G\. Goh, R\. Troll, A\. Radford, I\. Sutskever, J\. Leike, and J\. Wu \(2024\)Scaling and evaluating sparse autoencoders\.External Links:2406\.04093,[Link](https://arxiv.org/abs/2406.04093)Cited by:[Introduction](https://arxiv.org/html/2608.10537#Sx1.p2.1)\.
- B\. Geshkovski, C\. Letrouit, Y\. Polyanskiy, and P\. Rigollet \(2025\)A mathematical perspective on transformers\.External Links:2312\.10794,[Link](https://arxiv.org/abs/2312.10794)Cited by:[Introduction](https://arxiv.org/html/2608.10537#Sx1.p4.1)\.
- E\. Guha, R\. Marten, S\. Keh, N\. Raoof, G\. Smyrnis, H\. Bansal,et al\.\(2025\)OpenThoughts: data recipes for reasoning models\.arXiv preprint arXiv:2506\.04178\.Cited by:[Appendix D](https://arxiv.org/html/2608.10537#A4.SSx2.p1.1),[FNL\-Guided Steering](https://arxiv.org/html/2608.10537#Sx6.SSx2.p1.3)\.
- Z\. He, W\. Shu, X\. Ge, L\. Chen, J\. Wang, Y\. Zhou, F\. Liu, Q\. Guo, X\. Huang, Z\. Wu, Y\. Jiang, and X\. Qiu \(2024\)Llama scope: extracting millions of features from llama\-3\.1\-8b with sparse autoencoders\.arXiv preprint arXiv:2410\.20526\.Cited by:[Table S1](https://arxiv.org/html/2608.10537#A1.T1),[1st item](https://arxiv.org/html/2608.10537#A2.I1.i1.p1.1),[Table 2](https://arxiv.org/html/2608.10537#Sx5.T2),[Auditing Jailbreaking\-mitigation mechanisms](https://arxiv.org/html/2608.10537#Sx6.SSx1.p2.1)\.
- Z\. He, M\. Jin, B\. Shen, A\. Payani, Y\. Zhang, and M\. Du \(2025\)SAE\-SSV: supervised steering in sparse representation spaces for reliable control of language models\.arXiv preprint arXiv:2505\.16188\.Cited by:[Activation Steering](https://arxiv.org/html/2608.10537#Sx2.SS0.SSS0.Px2.p1.3)\.
- D\. Hendrycks, C\. Burns, S\. Kadavath, A\. Arora, S\. Basart, E\. Tang, D\. Song, and J\. Steinhardt \(2021\)Measuring mathematical problem solving with the MATH dataset\.arXiv preprint arXiv:2103\.03874\.Cited by:[4th item](https://arxiv.org/html/2608.10537#A2.I1.i4.p1.2),[Appendix D](https://arxiv.org/html/2608.10537#A4.SSx2.p1.1),[FNL\-Guided Steering](https://arxiv.org/html/2608.10537#Sx6.SSx2.p1.3)\.
- J\. Huang, A\. Geiger, K\. D’Oosterlinck, Z\. Wu, and C\. Potts \(2023\)Rigorously assessing natural language explanations of neurons\.External Links:2309\.10312,[Link](https://arxiv.org/abs/2309.10312)Cited by:[Introduction](https://arxiv.org/html/2608.10537#Sx1.p3.1)\.
- G\. Jawahar, B\. Sagot, and D\. Seddah \(2019\)What does bert learn about the structure of language?\.InProceedings of the 57th annual meeting of the association for computational linguistics,pp\. 3651–3657\.Cited by:[Dependence with layers](https://arxiv.org/html/2608.10537#Sx4.SS0.SSS0.Px2.p1.3)\.
- D\. Kocetkov, R\. Li, L\. Ben Allal, J\. Li, C\. Mou, C\. Muñoz Ferrandis, Y\. Jernite, M\. Mitchell, S\. Hughes, T\. Wolf, D\. Bahdanau, L\. von Werra, and H\. de Vries \(2022\)The stack: 3 TB of permissively licensed source code\.arXiv preprint arXiv:2211\.15533\.Cited by:[Table S1](https://arxiv.org/html/2608.10537#A1.T1),[Appendix D](https://arxiv.org/html/2608.10537#A4.SSx2.p1.1),[Cross\-dataset stability](https://arxiv.org/html/2608.10537#Sx4.SS0.SSS0.Px1.p1.5)\.
- K\. Li, O\. Patel, F\. Viégas, H\. Pfister, and M\. Wattenberg \(2023\)Inference\-time intervention: eliciting truthful answers from a language model\.InAdvances in Neural Information Processing Systems 36 \(NeurIPS\),Cited by:[Introduction](https://arxiv.org/html/2608.10537#Sx1.p1.1)\.
- T\. Lieberum, S\. Rajamanoharan, A\. Conmy, L\. Smith, N\. Sonnerat, V\. Varma, J\. Kramár, A\. Dragan, R\. Shah, and N\. Nanda \(2024\)Gemma Scope: open sparse autoencoders everywhere all at once on Gemma 2\.arXiv preprint arXiv:2408\.05147\.Cited by:[Table S1](https://arxiv.org/html/2608.10537#A1.T1),[1st item](https://arxiv.org/html/2608.10537#A2.I1.i1.p1.1),[Experiments: Initial Investigations](https://arxiv.org/html/2608.10537#Sx4.p1.1)\.
- H\. Lightman, V\. Kosaraju, Y\. Burda, H\. Edwards, B\. Baker, T\. Lee, J\. Leike, J\. Schulman, I\. Sutskever, and K\. Cobbe \(2023\)Let’s verify step by step\.arXiv preprint arXiv:2305\.20050\.Cited by:[4th item](https://arxiv.org/html/2608.10537#A2.I1.i4.p1.2),[Appendix D](https://arxiv.org/html/2608.10537#A4.SSx2.p1.1),[FNL\-Guided Steering](https://arxiv.org/html/2608.10537#Sx6.SSx2.p1.3)\.
- A\. Lozhkov, L\. Ben Allal, L\. von Werra, and T\. Wolf \(2024\)FineWeb\-edu: the finest collection of educational content\.Hugging Face\.Note:https://huggingface\.co/datasets/HuggingFaceFW/fineweb\-eduCited by:[Appendix A](https://arxiv.org/html/2608.10537#A1.SSx3.p1.2),[Appendix D](https://arxiv.org/html/2608.10537#A4.SSx2.p1.1)\.
- S\. Lu and X\. Qi \(2026\)Agentic publication protocol: an attempt to modernize scientific publication\.arXiv preprint arXiv:2606\.27386\.Cited by:[Introduction](https://arxiv.org/html/2608.10537#Sx1.p8.1),[Data and Code Availability](https://arxiv.org/html/2608.10537#Sx8.p1.1)\.
- G\. Ma, Y\. Liang, Y\. Chen, and S\. Sojoudi \(2026\)Do sparse autoencoders identify reasoning features in language models?\.External Links:2601\.05679,[Link](https://arxiv.org/abs/2601.05679)Cited by:[Appendix C](https://arxiv.org/html/2608.10537#A3.SSx1),[Appendix C](https://arxiv.org/html/2608.10537#A3.SSx1.p1.2),[Introduction](https://arxiv.org/html/2608.10537#Sx1.p5.4),[Feature Selection/Validation in SAEs](https://arxiv.org/html/2608.10537#Sx2.SS0.SSS0.Px3.p3.1),[Token injection susceptibility](https://arxiv.org/html/2608.10537#Sx5.SS0.SSS0.Px1.p1.9),[Paraphrase Invariance](https://arxiv.org/html/2608.10537#Sx5.SS0.SSS0.Px2.p1.12),[Nonlocality and Semantic Abstractness](https://arxiv.org/html/2608.10537#Sx5.p1.3)\.
- A\. Makelov, G\. Lange, and N\. Nanda \(2023\)Is this the subspace you are looking for? an interpretability illusion for subspace activation patching\.External Links:2311\.17030,[Link](https://arxiv.org/abs/2311.17030)Cited by:[Introduction](https://arxiv.org/html/2608.10537#Sx1.p3.1)\.
- J\. Maldacena \(1999\)The large\-n limit of superconformal field theories and supergravity\.International journal of theoretical physics38\(4\),pp\. 1113–1133\.Cited by:[Introduction](https://arxiv.org/html/2608.10537#Sx1.p4.1)\.
- S\. Merity, C\. Xiong, J\. Bradbury, and R\. Socher \(2016\)Pointer sentinel mixture models\.arXiv preprint arXiv:1609\.07843\.Cited by:[Table S1](https://arxiv.org/html/2608.10537#A1.T1),[Appendix D](https://arxiv.org/html/2608.10537#A4.SSx2.p1.1),[Cross\-dataset stability](https://arxiv.org/html/2608.10537#Sx4.SS0.SSS0.Px1.p1.5)\.
- N\. Muennighoff, Z\. Yang, W\. Shi, X\. L\. Li, L\. Fei\-Fei, H\. Hajishirzi, L\. Zettlemoyer, P\. Liang, E\. Candès, and T\. Hashimoto \(2025\)S1: simple test\-time scaling\.External Links:2501\.19393,[Link](https://arxiv.org/abs/2501.19393)Cited by:[Introduction](https://arxiv.org/html/2608.10537#Sx1.p3.1)\.
- K\. Park, Y\. J\. Choe, and V\. Veitch \(2024\)The linear representation hypothesis and the geometry of large language models\.InProceedings of the 41st International Conference on Machine Learning \(ICML\),Cited by:[Introduction](https://arxiv.org/html/2608.10537#Sx1.p1.1)\.
- G\. Paulo, A\. Mallen, C\. Juang, and N\. Belrose \(2025\)Automatically interpreting millions of features in large language models\.External Links:2410\.13928,[Link](https://arxiv.org/abs/2410.13928)Cited by:[Appendix A](https://arxiv.org/html/2608.10537#A1.SSx4.p1.1),[Feature Selection/Validation in SAEs](https://arxiv.org/html/2608.10537#Sx2.SS0.SSS0.Px3.p3.1)\.
- N\. Rimsky, N\. Gabrieli, J\. Schulz, M\. Tong, E\. Hubinger, and A\. M\. Turner \(2024\)Steering Llama 2 via contrastive activation addition\.InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics \(ACL\),pp\. 15504–15522\.Cited by:[Activation Steering](https://arxiv.org/html/2608.10537#Sx2.SS0.SSS0.Px2.p1.2)\.
- L\. Sharkey, B\. Chughtai, J\. Batson, J\. Lindsey, J\. Wu, L\. Bushnaq, N\. Goldowsky\-Dill, S\. Heimersheim, A\. Ortega, J\. Bloom, S\. Biderman, A\. Garriga\-Alonso, A\. Conmy, N\. Nanda, J\. Rumbelow, M\. Wattenberg, N\. Schoots, J\. Miller, E\. J\. Michaud, S\. Casper, M\. Tegmark, W\. Saunders, D\. Bau, E\. Todd, A\. Geiger, M\. Geva, J\. Hoogland, D\. Murfet, and T\. McGrath \(2025\)Open problems in mechanistic interpretability\.External Links:2501\.16496,[Link](https://arxiv.org/abs/2501.16496)Cited by:[Introduction](https://arxiv.org/html/2608.10537#Sx1.p1.1)\.
- S\. Soo, G\. Chen, W\. Teng, C\. Balaganesh, G\. Tan, and M\. Yan \(2025\)Interpretable steering of large language models with feature guided activation additions\.arXiv preprint arXiv:2501\.09929\.Cited by:[Activation Steering](https://arxiv.org/html/2608.10537#Sx2.SS0.SSS0.Px2.p1.3)\.
- A\. Souly, Q\. Lu, D\. Bowen, T\. Trinh, E\. Hsieh, S\. Pandey, P\. Abbeel, J\. Svegliato, S\. Emmons, O\. Watkins, and S\. Toyer \(2024\)A StrongREJECT for empty jailbreaks\.arXiv preprint arXiv:2402\.10260\.Cited by:[Table 3](https://arxiv.org/html/2608.10537#Sx6.T3)\.
- C\. Spearman \(1904\)The proof and measurement of association between two things\.The American Journal of Psychology15\(1\),pp\. 72–101\.Cited by:[Appendix A](https://arxiv.org/html/2608.10537#A1.SSx1.p1.3)\.
- A\. Templeton, T\. Conerly, J\. Marcus, J\. Lindsey, T\. Bricken, B\. Chen, A\. Pearce, C\. Citro, E\. Ameisen, A\. Jones, H\. Cunningham, N\. L\. Turner, C\. McDougall, M\. MacDiarmid, C\. D\. Freeman, T\. R\. Sumers, E\. Rees, J\. Batson, A\. Jermyn, S\. Carter, C\. Olah, and T\. Henighan \(2024\)Scaling monosemanticity: extracting interpretable features from Claude 3 Sonnet\.Transformer Circuits Thread\.Note:https://transformer\-circuits\.pub/2024/scaling\-monosemanticity/index\.htmlCited by:[Activation Steering](https://arxiv.org/html/2608.10537#Sx2.SS0.SSS0.Px2.p1.2)\.
- A\. M\. Turner, L\. Thiergart, G\. Leech, D\. Udell, J\. J\. Vazquez, U\. Mini, and M\. MacDiarmid \(2023\)Steering language models with activation engineering\.arXiv preprint arXiv:2308\.10248\.Cited by:[Activation Steering](https://arxiv.org/html/2608.10537#Sx2.SS0.SSS0.Px2.p1.2)\.
- C\. Venhoff, I\. Arcuschin, P\. Torr, A\. Conmy, and N\. Nanda \(2025\)Understanding reasoning in thinking language models via steering vectors\.arXiv preprint arXiv:2506\.18167\.Cited by:[Appendix A](https://arxiv.org/html/2608.10537#A1.p1.1)\.
- Y\. Wang, X\. Ma, G\. Zhang, Y\. Ni, A\. Chandra, S\. Guo, W\. Ren, A\. Arulraj, X\. He, Z\. Jiang, T\. Li, M\. Ku, K\. Wang, A\. Zhuang, R\. Fan, X\. Yue, and W\. Chen \(2024\)MMLU\-pro: a more robust and challenging multi\-task language understanding benchmark\.InAdvances in Neural Information Processing Systems 37 \(Datasets and Benchmarks Track\),Cited by:[4th item](https://arxiv.org/html/2608.10537#A2.I1.i4.p1.2),[Appendix D](https://arxiv.org/html/2608.10537#A4.SSx2.p1.1)\.
- J\. Ward, C\. Lin, C\. Venhoff, and N\. Nanda \(2025\)Reasoning\-finetuning repurposes latent representations in base models\.External Links:2507\.12638,[Link](https://arxiv.org/abs/2507.12638)Cited by:[Introduction](https://arxiv.org/html/2608.10537#Sx1.p3.1)\.
- G\. Xiao, Y\. Tian, B\. Chen, S\. Han, and M\. Lewis \(2024\)Efficient streaming language models with attention sinks\.InInternational Conference on Learning Representations \(ICLR\),Cited by:[Auditing Jailbreaking\-mitigation mechanisms](https://arxiv.org/html/2608.10537#Sx6.SSx1.p2.1)\.
- S\. Xiao, Z\. Liu, P\. Zhang, and N\. Muennighoff \(2023\)C\-pack: packaged resources to advance general chinese embedding\.arXiv preprint arXiv:2309\.07597\.Cited by:[Figure S3](https://arxiv.org/html/2608.10537#A1.F3),[Appendix A](https://arxiv.org/html/2608.10537#A1.SSx4.p1.1)\.
- L\. Zheng, W\. Chiang, Y\. Sheng, T\. Li, S\. Zhuang, Z\. Wu, Y\. Zhuang, Z\. Li, Z\. Lin, E\. P\. Xing, J\. E\. Gonzalez, I\. Stoica, and H\. Zhang \(2023\)LMSYS\-Chat\-1M: a large\-scale real\-world LLM conversation dataset\.arXiv preprint arXiv:2309\.11998\.Cited by:[Appendix D](https://arxiv.org/html/2608.10537#A4.SSx2.p1.1)\.
- A\. Zou, L\. Phan, S\. Chen, J\. Campbell, P\. Guo, R\. Ren, A\. Pan, X\. Yin, M\. Mazeika, A\. Dombrowski, S\. Goel, N\. Li, M\. J\. Byun, Z\. Wang, A\. Mallen, S\. Basart, S\. Koyejo, D\. Song, M\. Fredrikson, J\. Z\. Kolter, and D\. Hendrycks \(2023\)Representation engineering: a top\-down approach to ai transparency\.arXiv preprint arXiv:2310\.01405\.Cited by:[Activation Steering](https://arxiv.org/html/2608.10537#Sx2.SS0.SSS0.Px2.p1.2)\.