Decodability is Not Causality: Dissociating Probe Readouts from Behavioral Drivers via SAE Decomposition

# Decodability is Not Causality: Dissociating Probe Readouts from Behavioral Drivers via SAE Decomposition
Source: [https://arxiv.org/html/2609.18080](https://arxiv.org/html/2609.18080)
Devesh Tiwari††thanks:These authors contributed equally to this work\.Camille Davis11footnotemark:1Affiliation:Phillips Academy AndoverEmail:[deveshtiwari2705@Gmail\.com](mailto:[email protected])Shivank SinhaAffiliation:Dublin High SchoolTalia WeaverAffiliation:Carlmont High SchoolAditya ShahAffiliation:GoogleMaheep Chaudhary††thanks:Senior author\.Affiliation:Independent

###### Abstract

Linear probes can decode safety\-relevant concepts such as truthfulness from language\-model activations, but probe accuracy may show only decodability, not that the features the probe weights causally drive model behavior\. We demonstrate that this gap cannot be closed from the geometry of probe weights alone: the features geometrically aligned with probe direction need not be the ones the model uses, so causal relevance requires intervention\. We introduce a feature\-level diagnostic that decomposes a deployedTrue/Falseprobe into sparse\-autoencoder \(SAE\) features, ranks those features by both probe alignment and by gradient sensitivity of the model’s behavior, and ablates the resulting shared, probe\-only, and random feature sets under a coherence gate\. On the truth probe of[Bürger et al\. \(2024\)](https://arxiv.org/html/2609.18080#bib.bib20)\(TTPD\), applied in the instructed truth/deception setting of[Long et al\. \(2025\)](https://arxiv.org/html/2609.18080#bib.bib9)for Gemma\-2\-9B\-Instruct, the two rankings overlap only weakly \(about12%12\\%, Spearmanρ=0\.10\\rho=0\.10\), and ablation dissociates them sharply: features the probe shares with the model flip the output far more \(up to27%27\\%\) than equally sized probe\-only \(6%6\\%\) or random \(1%1\\%\) features at full coherence, while probe\-only features instead perturb the probe’s own readout\. The dissociation holds across five seeds and a held\-out split, and an activation\-aware selection of features flips behavior nearly three times as often as the probe’s geometric top features \(17\.6%17\.6\\%vs\.6\.1%6\.1\\%\)\. In this setting, therefore, the geometric projection of a probe’s weight vector alone does not identify the features the model causally uses; however, combining probe information with feature activation statistics recovers substantially more behaviorally causal features, and coherence\-gated SAE intervention is needed to separate them from probe readouts\. We make the implementation of our methods accessible at[this URL](https://github.com/cam1lled/causal-validation-sae)\.

## 1Introduction

Linear probes trained on model activations are widely used to identify and predict representations associated with behavioral states\([Alain and Bengio, 2018](https://arxiv.org/html/2609.18080#bib.bib14);[Belinkov, 2022](https://arxiv.org/html/2609.18080#bib.bib13)\)\. However, information that is decodable from a model’s activations is not necessarily causally responsible for the model’s behavior\. Consequently, high probe accuracy alone does not establish that the representations identified by the probe necessarily play a causal role in the model’s decisions\([Hewitt and Liang, 2019](https://arxiv.org/html/2609.18080#bib.bib23);[Belinkov, 2022](https://arxiv.org/html/2609.18080#bib.bib13);[Occhipinti et al\., 2026](https://arxiv.org/html/2609.18080#bib.bib15)\)\. Distinguishing between features that are merely predictive and those that are causally relevant remains an open challenge\.

We investigate whether probe\-identified features are causally involved in the model behaviors associated with the representations they decode\. Using the truthful/deceptive factual\-verification setting introduced by[Long et al\. \(2025\)](https://arxiv.org/html/2609.18080#bib.bib9), we decompose model activations via a sparse autoencoder \(SAE\) and independently rank features according to both probe alignment and gradient sensitivity of the model’s output\. We then perform direct interventions on these feature sets while tracking the output coherence\.

We find that the features the probe weights most and the features the model is sensitive to overlap only weakly, and that this difference is behavioral\. Ablating the features the probe shares with the model flips the model’s output substantially more than ablating equally sized sets of probe\-only or random features, while output coherence is preserved throughout\. Probe\-only features instead perturb the probe’s own readout without changing behavior\. These results suggest that many probe\-weighted features function primarily as diagnostic readouts rather than causal drivers of behavior, and that the geometry of a probe’s weights alone does not identify the features the model causally uses\.

Our work makes three main contributions\. First, we introduce a framework for comparing probe\-aligned and gradient\-sensitive SAE features through direct behavioral interventions\. Second, we quantify the extent to which probe\-ranked features produce coherent behavioral effects, showing that predictive importance and behavioral importance can diverge substantially\. Third, we identify a subset of shared probe\-model features that consistently influence both probe predictions and model behavior, providing stronger evidence of behavioral relevance than probe\-only features\.

![Refer to caption](https://arxiv.org/html/2609.18080v1/main_diagrams/maindig23.drawio.png)Figure 1:We decompose final pre\-generation residual activations into an SAE feature basis, then rank the same SAE features by probe\-weight alignment, indicating features the probe reads, and by gradient sensitivity of the model’sTrue/Falsemargin, indicating features whose perturbation most affects the model’s output\. We then intervene on each feature group, together with random controls, and measure effects on model behavior, probe prediction, and output coherence\.
## 2Related Work

##### Probing, truth representations, and behavioral use\.

Linear probes are widely used to identify information encoded in neural representations\([Alain and Bengio, 2018](https://arxiv.org/html/2609.18080#bib.bib14);[Belinkov, 2022](https://arxiv.org/html/2609.18080#bib.bib13)\), but decodability alone does not establish that the decoded information is used by the model\([Hewitt and Liang, 2019](https://arxiv.org/html/2609.18080#bib.bib23)\)\. Amnesic probing made this distinction explicit by removing probe\-identified information and measuring downstream behavior, finding that conventional probing performance need not correlate with task importance\([Elazar et al\., 2021](https://arxiv.org/html/2609.18080#bib.bib1)\)\. Subsequent work has emphasized that such interventions must be both complete with respect to the targeted property and selective with respect to unrelated information\([Canby et al\., 2025](https://arxiv.org/html/2609.18080#bib.bib2)\)\.

For factual truth, prior work has identified approximately linear truth representations and tested their behavioral relevance through activation interventions\([Marks and Tegmark, 2024](https://arxiv.org/html/2609.18080#bib.bib6)\)\. Bürger et al\. identify a polarity\-aware truth subspace and introduce TTPD\([Bürger et al\., 2024](https://arxiv.org/html/2609.18080#bib.bib20)\); Long et al\. apply this framework under truthful, neutral, and deceptive instructions and show that truth\-related representations change under instructed deception\([Long et al\., 2025](https://arxiv.org/html/2609.18080#bib.bib9)\)\. Related probes have been used to detect or steer chain\-of\-thought unfaithfulness\([Occhipinti et al\., 2026](https://arxiv.org/html/2609.18080#bib.bib15)\), while other studies show that highly accurate probes can instead exploit task\-format confounds\([Sahoo et al\., 2026](https://arxiv.org/html/2609.18080#bib.bib18)\)\. Our work begins from a probe direction that is itself behaviorally causal and asks a finer question: whether the SAE features most geometrically aligned with that direction are the features carrying its behavioral effect\.

##### Sparse autoencoders and causal feature evaluation\.

SAEs decompose model activations into sparse latent features\([Cunningham et al\., 2023](https://arxiv.org/html/2609.18080#bib.bib5);[Lieberum et al\., 2024](https://arxiv.org/html/2609.18080#bib.bib12)\), but reconstruction quality and feature interpretability do not by themselves guarantee causal or task\-level utility\. Task\-grounded evaluations find that unsupervised SAE dictionaries can provide weaker behavioral control than supervised feature dictionaries\([Makelov et al\., 2025](https://arxiv.org/html/2609.18080#bib.bib3)\), struggle to disentangle independently manipulable factual attributes\([Chaudhary and Geiger, 2024](https://arxiv.org/html/2609.18080#bib.bib7)\), and do not consistently improve over non\-SAE probing baselines\([Kantamneni et al\., 2025](https://arxiv.org/html/2609.18080#bib.bib8)\)\. SAEBench similarly finds that improvements on unsupervised proxy metrics do not reliably transfer to downstream interpretability tasks\([Karvonen et al\., 2025](https://arxiv.org/html/2609.18080#bib.bib4)\)\. These results motivate evaluating SAE features through task\-specific interventions and verifying that the studied probe signal is preserved by the SAE reconstruction\.

Prior work has used SAE ablation, patching, and steering to identify causally relevant features and circuits\([Kissane et al\., 2024](https://arxiv.org/html/2609.18080#bib.bib16);[Marks et al\., 2025](https://arxiv.org/html/2609.18080#bib.bib19)\)\. Most directly, Ma et al\. show that contrastively selected SAE reasoning features frequently reflect lexical correlates rather than reasoning computations\([Ma et al\., 2026](https://arxiv.org/html/2609.18080#bib.bib17)\)\.

## 3Methodology

### 3\.1Overview

Our framework proceeds in the following stages: probe replication, SAE feature attribution, gradient\-based sensitivity ranking, causal interventions \(ablation and learned sparse mask\), and overlap and decomposition\.

We track output coherence throughout all interventions to ensure observed effects are interpretable \(Section[3\.7](https://arxiv.org/html/2609.18080#S3.SS7)\)\.

We also run auxiliary diagnostics on an additional deception probe to test whether the same SAE\-based probe\-attribution workflow is suitable for a hardcoded\-code deception probe\.

### 3\.2Stage 1: Probe Replication

We replicate the target probe using the original authors’ procedure, confirming it matches their reported performance \(Appendix[A\.1](https://arxiv.org/html/2609.18080#A1.SS1)\)\.

### 3\.3Stage 2: SAE Feature Attribution

We project the probe’s weight vector into the decoder basis of a pre\-trained SAE to identify which SAE features the probe reads from\.

Let the probePPhave weight vectorw∈ℝdw\\in\\mathbb\{R\}^\{d\}, trained on residual stream activationsh\(ℓ\)∈ℝdh^\{\(\\ell\)\}\\in\\mathbb\{R\}^\{d\}at layerℓ\\ell\. Let the SAE have decoder matrixD∈ℝd×kD\\in\\mathbb\{R\}^\{d\\times k\}, with columnsdid\_\{i\}denoting learned feature directions\. Since the probe’s output can be approximated asw⊤​h≈∑ifi⋅\(w⊤​di\)w^\{\\top\}h\\approx\\sum\_\{i\}f\_\{i\}\\cdot\(w^\{\\top\}d\_\{i\}\), wherefif\_\{i\}is the activation of SAE featureii, the structural contribution of each feature to the probe is:

ci=w⊤​dic\_\{i\}=w^\{\\top\}d\_\{i\}\(1\)Features with large\|ci\|\|c\_\{i\}\|are directions to which the probe is linearly sensitive within the SAE reconstruction\. We rank features by the activation\-free score\|ci\|\|c\_\{i\}\|as the probe\-alignment ranking\.

### 3\.4Stage 3: Gradient\-Based Sensitivity Ranking

To estimate which features the model’s output is most sensitive to, we rank SAE features by a gradient\-based attribution of the model’s behavior with respect to feature activations\. LetAAbe the attribution objective, defined as the gradient of the behavior logit \(or target\-token margin\) with respect to each feature’s activationfiℓf\_\{i\}^\{\\ell\}at layerℓ\\ell, averaged over the dataset:

Ai=𝔼x∈𝒟​\[\|∂ℳ⁡\(x\)∂fiℓ\|\],A\_\{i\}=\\mathbb\{E\}\_\{x\\in\\mathcal\{D\}\}\\left\[\\left\|\\frac\{\\partial\\mathcal\{M\}\(x\)\}\{\\partial f\_\{i\}^\{\\ell\}\}\\right\|\\right\],\(2\)whereℳ⁡\(x\)=logit⁡\(True\)−logit⁡\(False\)\\mathcal\{M\}\(x\)=\\operatorname\{logit\}\(\\mathrm\{True\}\)\-\\operatorname\{logit\}\(\\mathrm\{False\}\)is differentiated with respect to the SAE feature activationsfiℓf\_\{i\}^\{\\ell\}at the final\-token position of layerℓ\\ell, averaged over the dataset\. We retain the top\-ranked features as the gradient\-sensitive feature setℱmodel\\mathcal\{F\}\_\{\\text\{model\}\}\.

### 3\.5Stage 4: Causal Interventions

Having ranked features from both the probe’s perspective and by gradient sensitivity, we validate these attributions through direct intervention\. Under each intervention, we measure the behavior flip rate, defined as the fraction of examples where the model’sTrue/Falseoutput changes relative to the unintervened baseline, and the probe\-readout shift, defined as the relative change in the probe marginw⊤​hw^\{\\top\}h\.

This dual measurement separates a feature’s effect on the probe’s readout from its effect on the model’s behavior, the dissociation at the center of our analysis \(Figure[1](https://arxiv.org/html/2609.18080#S1.F1)\)\.

#### 3\.5\.1Feature Ablation

For a selected feature set𝒮\\mathcal\{S\}, we ablate those features by subtracting their reconstructed contributions from the residual stream at layerℓ\\ell:

h~\(ℓ\)=h\(ℓ\)−∑i∈𝒮fi​di\\tilde\{h\}^\{\(\\ell\)\}=h^\{\(\\ell\)\}\-\\sum\_\{i\\in\\mathcal\{S\}\}f\_\{i\}\\,d\_\{i\}\(3\)and allow the model’s forward pass to continue fromh~\(ℓ\)\\tilde\{h\}^\{\(\\ell\)\}\. We apply this procedure to probe\-attributed features \(ℱprobe\\mathcal\{F\}\_\{\\text\{probe\}\}\), gradient\-sensitive features \(ℱmodel\\mathcal\{F\}\_\{\\text\{model\}\}\), and random control features of matched cardinality\.

#### 3\.5\.2Learned Sparse Mask

We learn a sparse mask over SAE features that selects those contributing most to the probe margin, combining each feature’s decoder alignmentcic\_\{i\}with its activation\. A learnable weightai∈\[0,1\]a\_\{i\}\\in\[0,1\]per feature is optimized with anℓ1\\ell\_\{1\}penalty to reconstruct the probe margin from the weighted feature contributions\. After training, 30 features exceedai\>0\.5a\_\{i\}\>0\.5; we ablate the top 16 to match the size of the other feature sets in Table[4](https://arxiv.org/html/2609.18080#S5.T4)\. This yields an activation\-aware feature setℱmask\\mathcal\{F\}\_\{\\text\{mask\}\}, in contrast to the activation\-free geometric ranking\|ci\|\|c\_\{i\}\|\. Full training details are in Appendix[A\.1\.2](https://arxiv.org/html/2609.18080#A1.SS1.SSS2)\.

### 3\.6Stage 5: Overlap and Decomposition

We compare the probe’s feature ranking against the model’s to characterize the extent to which the two rely on shared features\.

We compute set overlap between the top\-NNprobe\-attributed and gradient\-sensitive features as a function ofNN, and report the Spearman rank correlation as a summary statistic\. Using this analysis, we partition the probe’s features into three groups:Shared, the intersection of the top\-KKprobe\-aligned and top\-KKgradient\-sensitive features, whose sizemmsets the matched size for the other two groups;Probe\-only, comprising the highest probe\-ranked features that are not among the model’s top gradient\-ranked features, size\-matched to the shared set; andRandom, comprising a size\-matched random sample from the remaining features\.

We ablate each group atK∈\{32,64,128,256,512,1024\}K\\in\\\{32,64,128,256,512,1024\\\}top features from each ranking \(yielding shared\-set sizes of 5 to 126\), subtracting reconstructed feature contributions as in Eq\.[3](https://arxiv.org/html/2609.18080#S3.E3), and compare the resulting behavior flip rate, probe\-margin shift, and coherence\. This decomposition isolates the causal contribution of features the probe shares with the model from those unique to the probe\.

### 3\.7Coherence Gating

Interventions that disrupt the model’s ability to produce well\-formed output are not informative about the causal role of specific features\. We therefore track output coherence under all interventions\. We define coherence as the percentage of the responses in which the model responds with eitherTrue/False\. An intervention’s behavioral effect is only interpreted when coherence is maintained, ensuring that observed behavioral effects are attributable to intervention rather than to general degradation of the model’s output\. Beyond output validity, we verify three further conditions\. First, the SAE faithfully represents the activations it decomposes: its reconstruction attains mean cosine similarity0\.890\.89with the original layer\-20 activations \(normalized reconstruction MSE0\.210\.21\), so interventions act in a basis that captures most of the activation signal rather than in reconstruction noise\. Second, the interventions are small targeted perturbations rather than gross corruptions: ablating the shared set removes only5\.7%5\.7\\%of the residual\-stream norm on average, yet produces the behavioral effects reported in Section[5\.2](https://arxiv.org/html/2609.18080#S5.SS2)\. Third, the interventions leave the model’s next\-token distribution largely intact: the mean KL divergence between the baseline and post\-ablation distributions is0\.110\.11nats for the shared set \(0\.050\.05for the geometric top\-16, near zero for random controls;n=600n=600\), indicating that even the behaviorally effective shared\-set ablation is a localized shift of the output distribution rather than a wholesale disruption\.

## 4Experimental Setup

### 4\.1Probe Selection

#### 4\.1\.1Task and Concept

We apply our framework to the instructed deception setting of[Long et al\. \(2025\)](https://arxiv.org/html/2609.18080#bib.bib9)\. A language model is presented with factual statements and prompted under one of three instruction conditions: Truthful, Deceptive, or Neutral\. Under the deceptive condition, the model is instructed to respond incorrectly\.[Long et al\. \(2025\)](https://arxiv.org/html/2609.18080#bib.bib9)train linear probes on the model’s residual stream activations to predict the instructed output under each condition, and find that the output is linearly decodable across all three conditions, with accuracy peaking around layer 14 for LLaMA\-3\.1\-8B\-Instruct and layer 21 for Gemma\-2\-9B\-Instruct\([Long et al\., 2025](https://arxiv.org/html/2609.18080#bib.bib9)\)\.

Appendix[A\.2](https://arxiv.org/html/2609.18080#A1.SS2)reports an auxiliary diagnostic on a reward\-hacking code probe\. The probe is trained on hardcoded versus correct code completions from an MBPP reward\-hacking environment, where the behavior of interest is generated code that passes visible tests while failing hidden tests\.

#### 4\.1\.2Probe Relevance

We select the TTPD probe as our primary case study for several reasons\. First, the task produces a binary output \(True/False\), providing a clean behavioral signal for measuring our intervention effects\. The probe also targets a well\-defined form of deception: truthful versus deceptive instruction\-following in factual verification\. The setup is also technically suitable for our method because it uses fixed pre\-generation residual\-stream activations and has matching GemmaScope SAEs\.

#### 4\.1\.3Model, Dataset and SAE

We useGemma\-2\-9B\-Instruct\([Team et al\., 2024](https://arxiv.org/html/2609.18080#bib.bib21)\)inbfloat16precision\. We use the factual\-statement datasets from[Bürger et al\. \(2024\)](https://arxiv.org/html/2609.18080#bib.bib20)\(as used by[Long et al\. \(2025\)](https://arxiv.org/html/2609.18080#bib.bib9)\)\. We use six affirmative factual\-statement sets \(cities, sp\_en\_trans, inventors, animal\_class, element\_symb, facts\) and their negated counterparts, amounting to twelve sets in total, all under the deceptive instruction condition\. Activations are extracted at the final prompt token of layer 20, adjacent to the layer\-21 accuracy peak reported by[Long et al\. \(2025\)](https://arxiv.org/html/2609.18080#bib.bib9)and the layer with a matching GemmaScope SAE \(SAE for Gemma\-2\-9B\-Instruct with a width of 16,384 features from[Lieberum et al\. \(2024\)](https://arxiv.org/html/2609.18080#bib.bib12)\)\. The behavioral evaluation set comprises 1,600 statements; the held\-out analysis \(Section[5\.2](https://arxiv.org/html/2609.18080#S5.SS2)\) derives the probe direction and feature rankings on one half and measures ablation on the other\.

#### 4\.1\.4Behavioral Signal and Coherence

We define the behavioral signal as

M⁡\(x\)=logit⁡\(True\)−logit⁡\(False\)M\(x\)=\\operatorname\{logit\}\(\\mathrm\{True\}\)\-\\operatorname\{logit\}\(\\mathrm\{False\}\)at the final token of the templated prompt, the position from whichTrue/Falseis generated\.

A behavior flip occurs when the sign of this margin under intervention differs from the unintervened baseline\. Coherence is the fraction of outputs that remain a validTrue/Falsetoken \(Section[3\.7](https://arxiv.org/html/2609.18080#S3.SS7)\)\.

#### 4\.1\.5Intervention Configurations

For feature ablation, we evaluate the following feature sets atK∈\{32,64,128,256,512,1024\}K\\in\\\{32,64,128,256,512,1024\\\}: probe\-attributed \(ℱprobe\\mathcal\{F\}\_\{\\text\{probe\}\}\), gradient\-sensitive \(ℱmodel\\mathcal\{F\}\_\{\\text\{model\}\}\), the learned sparse mask \(ℱmask\\mathcal\{F\}\_\{\\text\{mask\}\}\), shared features, probe\-only features, and size\-matched random controls\.

## 5Results

### 5\.1Probe\-aligned and gradient\-sensitive features exhibit minimal overlap

Two rankings, \(1\) geometric alignment with the probe direction\|w⋅d\|\|w\\cdot d\|and \(2\) gradient sensitivity of theTrue/Falsemargin, identify largely different features\. The top 16, 50, 100, and 200 probe features share only 2, 7, 12, and 22 features with the gradient\-sensitivity ranking, against chance values of 0\.02, 0\.15, 0\.61, and 2\.44 \(Spearmanρ=0\.10\\rho=0\.10\)\. The shared fraction holds close to 11 to 14 percent across scales, one to two orders of magnitude above chance, but a small minority of either set \(Table[1](https://arxiv.org/html/2609.18080#S5.T1)\)\.

Table 1:Overlap between geometric probe ranking and model\-gradient ranking\. Geometric alignment is measured by\|w⋅d\|\\lvert w\\cdot d\\rvert, while model ranking uses gradient sensitivity of theTrue/Falsemargin\. The model ranking correlates weakly with mean absolute SAE feature activation, with Pearsonr=0\.07r=0\.07\.Appendix[A\.1\.3](https://arxiv.org/html/2609.18080#A1.SS1.SSS3)plots the full overlap curve\.

### 5\.2Probe alignment alone does not predict behavioral effect\.

Under ablation at the deceptive prompt, the three feature sets dissociate sharply\. Shared features \(top probe∩\\captop model\) flip theTrue/Falseoutput on 13 to 27 percent of statements \(0\.130 at 16 features, 0\.269 at 54\); an equal number of probe\-only features \(probe\-ranked, with the shared model\-ranked features removed\) flip 6 percent \(0\.061\); random features flip 1 percent \(0\.010\)\. Exemplars of output changes from these interventions are shown in Appendix[A\.1\.5](https://arxiv.org/html/2609.18080#A1.SS1.SSS5)\. Coherence remains 1\.00 throughout, demonstrating answer flips rather than ablation\-induced degradation\. The probe’s own projection shifts most under probe\-only ablation \(relative shift 0\.24 against 0\.05 for shared\), as expected given that probe\-only features are selected for alignment with the probe direction\.

The shared\-ablation effect is non\-monotonic, rising with set size to a peak near9696features before declining as the lowest\-ranked shared features shift the margin in the opposing direction and partially cancel the flip\. The decline reflects sign\-incoherence among these low\-ranked features rather than output degradation: the mean absolute margin remains between1\.71\.7and2\.82\.8throughout, indicating the model continues to emit well\-formed, confidentTrue/Falseoutputs at every ablation count \(Appendix[A\.1\.4](https://arxiv.org/html/2609.18080#A1.SS1.SSS4)\)\. The set\-level numbers we report \(≤54\\leq 54shared features\) lie within the rising regime\.

![Refer to caption](https://arxiv.org/html/2609.18080v1/updated_images/bflip_plotly.png)\(a\)Behavior flip rate\. Ablating shared features \(top probe∩\\captop gradient\) flips theTrue/Falseoutput far more than probe\-only or random sets of equal size\.
![Refer to caption](https://arxiv.org/html/2609.18080v1/updated_images/readoutplotly2.png)\(b\)Relative shift in the probe’s readout,\|Δ​projection\|baseline\\frac\{\|\\Delta\\mathrm\{projection\}\|\}\{\\mathrm\{baseline\}\}\. Probe\-only ablation perturbs the readout most, consistent with these features being selected for alignment with the probe direction\.
![Refer to caption](https://arxiv.org/html/2609.18080v1/updated_images/coherence_plotly.png)\(c\)Coherence, the fraction of outputs that remain a validTrue/Falsetoken, stays at1\.001\.00across all sets, indicating flips are genuine rather than degradation\.

Figure 2:Causal effects of ablating shared, probe\-only, and random SAE feature sets\.The shared\>\>probe\-only\>\>random ordering holds across all five seeds and under a held\-out split where rankings are derived on one half and ablation measured on the other \(Table[2](https://arxiv.org/html/2609.18080#S5.T2)\), indicating the dissociation is stable rather than an artifact of overfitting to the ranking data\.

Table 2:Robustness of the ablation dissociation across seed/data resamples and a held\-out split\. The shared set contains 23 features \(five\-seed row,K=256K\{=\}256\) and 28 features \(held\-out row,K=256K\{=\}256on half the data\)\.The flips are directional rather than truth\-restoring\. On 800 statements \(at the matched 16\-feature set size\), shared\-feature ablation changes the outputTrue→\\toFalseon 86 cases andFalse→\\toTrueon only 4 \(Table[3](https://arxiv.org/html/2609.18080#S5.T3)\), shifting the decision variable consistently towardFalserather than toward the factually correct answer; baseline accuracy under the deceptive prompt is0\.400\.40and does not increase under ablation\. This is expected as the shared features carry the truth\-direction signaltGt\_\{G\}that the probe reads, so removing them withdraws positive evidence forTrueand biases the margin negative\. The effect is therefore one of causal control over the model’s output, not a restoration of honesty, and it is precisely this directional consistency \(rather than random sign changes\) that marks these features as causal\. Crucially, the effect is not a trivial consequence of removing probe\-aligned features: the most probe\-aligned set \(geometric top\-16, Section[5\.3](https://arxiv.org/html/2609.18080#S5.SS3)\) produces far weaker behavioral movement despite larger probe\-readout shifts, so directional output control is specific to the features the model also uses, not to probe alignment per se\.

Shared\-feature ablation flips behavior in ten of twelve categories \(overall0\.0810\.081on840840balanced statements,7070per category\), exceeding ten percent in five spanning four base families, with theTrue→\\toFalsedirection dominant in nearly all and only two categories showing no flips\. The effect is therefore reasonably broad rather than driven by any single category \(Appendix[A\.1\.7](https://arxiv.org/html/2609.18080#A1.SS1.SSS7)\)\.

Output transitionCountRateTrue→\\toFalse\(flip\)860\.1070\.107False→\\toTrue\(flip\)40\.0050\.005True→\\toTrue\(unchanged\)6240\.7800\.780False→\\toFalse\(unchanged\)860\.1080\.108Baseline accuracy—0\.4030\.403Post\-ablation accuracy—0\.3300\.330Table 3:Output transitions under shared\-feature ablation \(n=800n=800, shared setm=16m=16\)\. Of 800 statements, 90 flip \(86True→\\toFalse, 4False→\\toTrue\) and 710 are unchanged\. Flips are overwhelminglyTrue→\\toFalse: ablation biases the decision variable towardFalserather than restoring factual correctness, consistent with the shared features carrying the probe’s truth\-direction signal\. A confusion matrix is attached in Appendix[A\.1\.6](https://arxiv.org/html/2609.18080#A1.SS1.SSS6)\.
### 5\.3Geometric probe attribution understates behavioral relevance\.

The geometric ranking\|w⋅d\|\\lvert w\\cdot d\\rvertmeasures only how well a feature’s decoder direction aligns with the probe, ignoring how strongly the feature actually fires, and it is a poor guide to which features move behavior\. We compare it against an activation\-aware set: a learned sparse mask that selects the SAE features contributing most to the probe margin, where each feature’s contribution combines its decoder alignment with its activation\. This set overlaps the geometric top\-16 by only 3 of 16 features, yet across five seeds it flips behavior on17\.6±0\.717\.6\\pm 0\.7percent of statements, above the shared set \(12\.1±1\.012\.1\\pm 1\.0\) and nearly three times the geometric top\-16 \(6\.1±0\.56\.1\\pm 0\.5\), with the random control near zero \(0\.8±0\.60\.8\\pm 0\.6\) and coherence at 100 percent throughout\. The probe\-readout shift dissociates from behavior in the opposite direction: the geometric top\-16 perturbs the probe’s own margin more than the shared set \(0\.16 versus 0\.05\) while flipping behavior less, indicating that geometric alignment tracks how strongly a feature moves the probe rather than how strongly it moves the model\. Features most strongly aligned with the probe direction thus act primarily as probe readouts with weak behavioral effects, whereas an activation\-aware selection of equal size moves behavior substantially more\. The dissociation is not an artifact of perturbation magnitude: the geometric top\-16 removes more than twice the residual\-stream norm of the shared set \(13\.9%13\.9\\%versus5\.7%5\.7\\%\) while flipping behavior less, indicating that behavioral relevance depends on which features are removed, not how much of the activation is perturbed\. The mask’s success shows that probe\-derived information can identify causally effective features when combined with activation magnitudes; the failure is specific to activation\-free geometric alignment, not to probe\-based attribution in general\.

Table 4:Behavioral and probe\-readout effects of ablating size\-matched feature sets \(five\-seed means±\\pmstd,n=600n=600per seed; coherence100%100\\%throughout\)\. All sets are size\-matched at 16 features\.Features ranked highest under gradient attribution alone \(gradient\-top\) flip behavior weakly \(0\.054±0\.0090\.054\\pm 0\.009\), comparable to the geometric top\-16\. This is consistent with previous work: gradient sensitivity is a local, first\-order signal and an imperfect proxy for the effect of ablation in nonlinear models\([Li and Janson, 2024](https://arxiv.org/html/2609.18080#bib.bib22)\)\. In our setting, a high\-gradient feature may carry the wrong sign, be near\-zero in practice, or lie off the manifold the model actually visits\. This failure mode is known beyond our setting: prior work shows that standard\-model input gradients can highlight non\-discriminative or non\-instance\-specific features, a phenomenon termed*feature leakage*\([Shah et al\., 2021](https://arxiv.org/html/2609.18080#bib.bib10)\)\. Probe alignment, conversely, ignores whether a feature fires\. The intersection retains only features that are both active and aligned, which is why it concentrates causal effect that neither single ranking achieves alone, confirming our framework does not merely rediscover gradient attribution\. As Table[4](https://arxiv.org/html/2609.18080#S5.T4)shows at matched set size, the shared set and the activation\-aware mask move behavior most, the single\-ranking sets are weak handles, and the probe\-readout shift runs opposite to behavior, with the probe\-aligned geometric set perturbing the readout far more than it moves the model\.

### 5\.4The probe direction is causal, and the shared features localize it

The preceding results show*which*features carry the probe’s behavioral effect, but not whether the probe direction is causally load\-bearing in the first place\. To establish this, and to test whether the SAE decomposition localizes the direction’s causal effect, we ablate the full TTPD directiontGt\_\{G\}by projecting it out of the residual stream at layer 20, and compare against feature\-set ablations on the same statements\. Removing the entire direction flips behavior on18\.1±1\.118\.1\\pm 1\.1percent of statements \(Table[5](https://arxiv.org/html/2609.18080#S5.T5)\)\. The shared set, just1616of16,38416\{,\}384SAE features, recovers two\-thirds of this effect \(12\.1±1\.112\.1\\pm 1\.1percent\), whereas the probe’s own geometric top\-1616recovers roughly a third \(6\.8±0\.66\.8\\pm 0\.6percent\) and random features near zero \(0\.7±0\.10\.7\\pm 0\.1percent\)\. The probe direction therefore carries a causal effect, and at matched small size that effect is substantially recovered by the features that are both probe\-aligned and gradient\-sensitive, rather than by the features most aligned with the direction\. This confirms the premise of our analysis and indicates the decomposition concentrates the direction’s causal effect within the shared features rather than diluting it\.

Table 5:Direction\-level baseline \(five\-seed means±\\pmstd,n=600n=600per seed\)\. Ablating the full TTPD direction flips behavior on18\.1%18\.1\\%of statements; the 16\-feature shared set recovers two\-thirds of this effect, while the probe’s geometric top\-16 recovers roughly a third, indicating the SAE decomposition localizes the direction’s causal effect into the shared features rather than dispersing it\.

## 6Conclusion

We introduce a causal\-validation framework for testing whether probe\-attributed SAE features are also behaviorally relevant\. Applied to aTrue/Falsetruth probe, the features most aligned with the probe diverged from those most relevant to the model’s output: shared probe–model features produced larger coherent behavior changes, while probe\-only features primarily affected the probe readout\. These results demonstrate that the geometric projection of probe weights alone is insufficient for identifying the features a model causally uses; the failure is specific to activation\-free geometric alignment, since an activation\-aware selection that combines probe information with feature activations recovers substantially more behaviorally causal features\. Feature\-level interventions should therefore be used to separate diagnostic readouts from behavioral causes\.

## 7Limitations

Our analysis focuses primarily on a single model, layer, sparse autoencoder, and behavioral setting\. While the truthful/deceptive factual\-verification task provides a controlled environment for studying the relationship between probe\-attributed and behaviorally relevant features, it remains unclear whether the observed probe\-behavior dissociation generalizes across other model families, layers, SAE architectures, and behavioral domains\. Although we include auxiliary diagnostics on an obfuscation probe, the majority of our causal analysis is derived from a single primary case study\.

Additionally, our gradient\-sensitivity ranking is based on gradient\-derived feature importance and our causal validation relies on feature ablations\. These methods identify features that influence the model’sTrue/Falsebehavior in the studied setting, but they do not by themselves establish that the identified features implement deception as a general computational mechanism\. Future work should evaluate alternative attribution methods, intervention strategies, and behavioral settings to determine the extent to which the observed distinctions between probe\-attributed and behaviorally relevant features hold more broadly\.

## References

- Alain and Bengio \(2018\)G\. Alain and Y\. BengioUnderstanding intermediate layers using linear classifier probes\.External Links:1610\.01644,[Link](https://arxiv.org/pdf/1610.01644)Cited by:[§1](https://arxiv.org/html/2609.18080#S1.p1.1),[§2](https://arxiv.org/html/2609.18080#S2.SS0.SSS0.Px1.p1.1)\.
- Belinkov \(2022\)Y\. BelinkovProbing classifiers: promises, shortcomings, and advances\.Computational Linguistics48\(1\),pp\. 207–219\.External Links:[Link](https://aclanthology.org/2022.cl-1.7/),[Document](https://dx.doi.org/10.1162/coli%5Fa%5F00422)Cited by:[§1](https://arxiv.org/html/2609.18080#S1.p1.1),[§2](https://arxiv.org/html/2609.18080#S2.SS0.SSS0.Px1.p1.1)\.
- Bürgeret al\.\(2024\)L\. Bürger, F\. A\. Hamprecht, and B\. NadlerTruth is universal: robust detection of lies in llms\.InAdvances in Neural Information Processing Systems,Note:PosterExternal Links:[Link](https://arxiv.org/abs/2407.12831)Cited by:[§A\.1](https://arxiv.org/html/2609.18080#A1.SS1),[§A\.1\.1](https://arxiv.org/html/2609.18080#A1.SS1.SSS1.p1.1),[§A\.1\.1](https://arxiv.org/html/2609.18080#A1.SS1.SSS1.p2.1),[§2](https://arxiv.org/html/2609.18080#S2.SS0.SSS0.Px1.p2.1),[§4\.1\.3](https://arxiv.org/html/2609.18080#S4.SS1.SSS3.p1.1),[Abstract](https://arxiv.org/html/2609.18080#abstract1.1)\.
- Canbyet al\.\(2025\)M\. E\. Canby, A\. Davies, C\. Rastogi, and J\. HockenmaierHow reliable are causal probing interventions?\.InProceedings of the 14th International Joint Conference on Natural Language Processing and the 4th Conference of the Asia\-Pacific Chapter of the Association for Computational Linguistics,pp\. 857–878\.External Links:[Document](https://dx.doi.org/10.18653/v1/2025.ijcnlp-long.47),[Link](https://aclanthology.org/2025.ijcnlp-long.47/)Cited by:[§2](https://arxiv.org/html/2609.18080#S2.SS0.SSS0.Px1.p1.1)\.
- Chaudhary and Geiger \(2024\)M\. Chaudhary and A\. GeigerEvaluating open\-source sparse autoencoders on disentangling factual knowledge in GPT\-2 small\.External Links:2409\.04478,[Document](https://dx.doi.org/10.48550/arXiv.2409.04478),[Link](https://arxiv.org/abs/2409.04478)Cited by:[§2](https://arxiv.org/html/2609.18080#S2.SS0.SSS0.Px2.p1.1)\.
- Cunninghamet al\.\(2023\)H\. Cunningham, A\. Ewart, L\. Riggs, R\. Huben, and L\. SharkeySparse autoencoders find highly interpretable features in language models\.External Links:2309\.08600,[Document](https://dx.doi.org/10.48550/arXiv.2309.08600),[Link](https://arxiv.org/abs/2309.08600)Cited by:[§2](https://arxiv.org/html/2609.18080#S2.SS0.SSS0.Px2.p1.1)\.
- Elazaret al\.\(2021\)Y\. Elazar, S\. Ravfogel, A\. Jacovi, and Y\. GoldbergAmnesic probing: behavioral explanation with amnesic counterfactuals\.Transactions of the Association for Computational Linguistics9,pp\. 160–175\.External Links:[Document](https://dx.doi.org/10.1162/tacl%5Fa%5F00359),[Link](https://aclanthology.org/2021.tacl-1.10/)Cited by:[§2](https://arxiv.org/html/2609.18080#S2.SS0.SSS0.Px1.p1.1)\.
- Hewitt and Liang \(2019\)J\. Hewitt and P\. LiangDesigning and interpreting probes with control tasks\.InProceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing \(EMNLP\-IJCNLP\),pp\. 2733–2743\.External Links:[Document](https://dx.doi.org/10.18653/v1/D19-1275),[Link](https://aclanthology.org/D19-1275/)Cited by:[§1](https://arxiv.org/html/2609.18080#S1.p1.1),[§2](https://arxiv.org/html/2609.18080#S2.SS0.SSS0.Px1.p1.1)\.
- Kantamneniet al\.\(2025\)S\. Kantamneni, J\. Engels, S\. Rajamanoharan, M\. Tegmark, and N\. NandaAre sparse autoencoders useful? A case study in sparse probing\.InProceedings of the 42nd International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.267,pp\. 29018–29049\.External Links:[Link](https://proceedings.mlr.press/v267/kantamneni25a.html)Cited by:[§2](https://arxiv.org/html/2609.18080#S2.SS0.SSS0.Px2.p1.1)\.
- Karvonenet al\.\(2025\)A\. Karvonen, C\. Rager, J\. Lin, C\. Tigges, J\. I\. Bloom, D\. Chanin, Y\. Lau, E\. Farrell, C\. S\. McDougall, K\. Ayonrinde, D\. Till, M\. Wearden, A\. Conmy, S\. Marks, and N\. NandaSAEBench: a comprehensive benchmark for sparse autoencoders in language model interpretability\.InProceedings of the 42nd International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.267,pp\. 29223–29264\.External Links:[Link](https://proceedings.mlr.press/v267/karvonen25a.html)Cited by:[§2](https://arxiv.org/html/2609.18080#S2.SS0.SSS0.Px2.p1.1)\.
- Kissaneet al\.\(2024\)C\. Kissane, R\. Krzyzanowski, J\. I\. Bloom, A\. Conmy, and N\. NandaInterpreting attention layer outputs with sparse autoencoders\.External Links:2406\.17759,[Link](https://arxiv.org/abs/2406.17759)Cited by:[§2](https://arxiv.org/html/2609.18080#S2.SS0.SSS0.Px2.p2.1)\.
- Li and Janson \(2024\)M\. Li and L\. JansonOptimal ablation for interpretability\.External Links:2409\.09951,[Link](https://arxiv.org/abs/2409.09951)Cited by:[§5\.3](https://arxiv.org/html/2609.18080#S5.SS3.p2.1)\.
- Lieberumet al\.\(2024\)T\. Lieberum, S\. Rajamanoharan, A\. Conmy, L\. Smith, N\. Sonnerat, V\. Varma, J\. Kramár, A\. Dragan, R\. Shah, and N\. NandaGemma scope: open sparse autoencoders everywhere all at once on gemma 2\.External Links:2408\.05147,[Link](https://arxiv.org/abs/2408.05147)Cited by:[§2](https://arxiv.org/html/2609.18080#S2.SS0.SSS0.Px2.p1.1),[§4\.1\.3](https://arxiv.org/html/2609.18080#S4.SS1.SSS3.p1.1)\.
- Longet al\.\(2025\)X\. Long, Y\. Fu, R\. Li, M\. Sheng, H\. Yu, X\. Han, and P\. LiWhen truthful representations flip under deceptive instructions?\.InProceedings of the 2025 Conference on Empirical Methods in Natural Language Processing,Suzhou, China,pp\. 16315–16335\.External Links:[Link](https://aclanthology.org/2025.emnlp-main.826/),[Document](https://dx.doi.org/10.18653/v1/2025.emnlp-main.826)Cited by:[Figure 3](https://arxiv.org/html/2609.18080#A1.F3),[§A\.1](https://arxiv.org/html/2609.18080#A1.SS1),[§A\.1\.1](https://arxiv.org/html/2609.18080#A1.SS1.SSS1.p1.1),[§A\.1\.1](https://arxiv.org/html/2609.18080#A1.SS1.SSS1.p2.1),[§1](https://arxiv.org/html/2609.18080#S1.p2.1),[§2](https://arxiv.org/html/2609.18080#S2.SS0.SSS0.Px1.p2.1),[§4\.1\.1](https://arxiv.org/html/2609.18080#S4.SS1.SSS1.p1.1),[§4\.1\.3](https://arxiv.org/html/2609.18080#S4.SS1.SSS3.p1.1),[Abstract](https://arxiv.org/html/2609.18080#abstract1.1)\.
- Maet al\.\(2026\)G\. Ma, Z\. Liang, I\. Y\. Chen, and S\. SojoudiDo sparse autoencoders identify reasoning features in language models?\.External Links:2601\.05679,[Link](https://arxiv.org/abs/2601.05679)Cited by:[§2](https://arxiv.org/html/2609.18080#S2.SS0.SSS0.Px2.p2.1)\.
- Makelovet al\.\(2025\)A\. Makelov, G\. Lange, and N\. NandaTowards principled evaluations of sparse autoencoders for interpretability and control\.InThe Thirteenth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=1Njl73JKjB)Cited by:[§2](https://arxiv.org/html/2609.18080#S2.SS0.SSS0.Px2.p1.1)\.
- Markset al\.\(2025\)S\. Marks, C\. Rager, E\. J\. Michaud, Y\. Belinkov, D\. Bau, and A\. MuellerSparse feature circuits: discovering and editing interpretable causal graphs in language models\.InThe Thirteenth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=I4e82CIDxv)Cited by:[§2](https://arxiv.org/html/2609.18080#S2.SS0.SSS0.Px2.p2.1)\.
- Marks and Tegmark \(2024\)S\. Marks and M\. TegmarkThe geometry of truth: emergent linear structure in large language model representations of true/false datasets\.Note:Conference on Language ModelingExternal Links:2310\.06824,[Document](https://dx.doi.org/10.48550/arXiv.2310.06824),[Link](https://arxiv.org/abs/2310.06824)Cited by:[§2](https://arxiv.org/html/2609.18080#S2.SS0.SSS0.Px1.p2.1)\.
- Occhipintiet al\.\(2026\)G\. M\. Occhipinti, A\. Abate, and N\. SchootsProbing and steering chain\-of\-thought unfaithfulness in language models\.InICLR 2026 Test\-Time Updates \(TTU\) Workshop,External Links:[Link](https://openreview.net/pdf?id=LocRunEIxK)Cited by:[§1](https://arxiv.org/html/2609.18080#S1.p1.1),[§2](https://arxiv.org/html/2609.18080#S2.SS0.SSS0.Px1.p2.1)\.
- Sahooet al\.\(2026\)S\. Sahoo, V\. Jain, A\. Chadha, and D\. ChaudharyLinear probes detect task format, not reasoning mode in language model hidden states\.External Links:2606\.02907,[Link](https://arxiv.org/abs/2606.02907)Cited by:[§2](https://arxiv.org/html/2609.18080#S2.SS0.SSS0.Px1.p2.1)\.
- Shahet al\.\(2021\)H\. Shah, P\. Jain, and P\. NetrapalliDo input gradients highlight discriminative features?\.External Links:2102\.12781,[Link](https://arxiv.org/abs/2102.12781)Cited by:[§5\.3](https://arxiv.org/html/2609.18080#S5.SS3.p2.1)\.
- Taufeequeet al\.\(2026\)M\. Taufeeque, S\. Heimersheim, A\. Gleave, and C\. CundyThe Obfuscation Atlas: Mapping Where Honesty Emerges in RLVR with Deception Probes\.External Links:2602\.15515,[Link](https://arxiv.org/abs/2602.15515)Cited by:[§A\.2](https://arxiv.org/html/2609.18080#A1.SS2.p1.1),[§A\.2](https://arxiv.org/html/2609.18080#A1.SS2.p2.1)\.
- Teamet al\.\(2024\)G\. Team, M\. Riviere, S\. Pathak, P\. G\. Sessa, C\. Hardin, S\. Bhupatiraju, L\. Hussenot, T\. Mesnard, B\. Shahriari, A\. Ramé, J\. Ferret, P\. Liu, P\. Tafti, A\. Friesen, M\. Casbon, S\. Ramos, R\. Kumar, C\. L\. Lan, S\. Jerome, A\. Tsitsulin, N\. Vieillard, P\. Stanczyk, S\. Girgin, N\. Momchev, M\. Hoffman, S\. Thakoor, J\. Grill, B\. Neyshabur, O\. Bachem, A\. Walton, A\. Severyn, A\. Parrish, A\. Ahmad, A\. Hutchison, A\. Abdagic, A\. Carl, A\. Shen, A\. Brock, A\. Coenen, A\. Laforge, A\. Paterson, B\. Bastian, B\. Piot, B\. Wu, B\. Royal, C\. Chen, C\. Kumar, C\. Perry, C\. Welty, C\. A\. Choquette\-Choo, D\. Sinopalnikov, D\. Weinberger, D\. Vijaykumar, D\. Rogozińska, D\. Herbison, E\. Bandy, E\. Wang, E\. Noland, E\. Moreira, E\. Senter, E\. Eltyshev, F\. Visin, G\. Rasskin, G\. Wei, G\. Cameron, G\. Martins, H\. Hashemi, H\. Klimczak\-Plucińska, H\. Batra, H\. Dhand, I\. Nardini, J\. Mein, J\. Zhou, J\. Svensson, J\. Stanway, J\. Chan, J\. P\. Zhou, J\. Carrasqueira, J\. Iljazi, J\. Becker, J\. Fernandez, J\. van Amersfoort, J\. Gordon, J\. Lipschultz, J\. Newlan, J\. Ji, K\. Mohamed, K\. Badola, K\. Black, K\. Millican, K\. McDonell, K\. Nguyen, K\. Sodhia, K\. Greene, L\. L\. Sjoesund, L\. Usui, L\. Sifre, L\. Heuermann, L\. Lago, L\. McNealus, L\. B\. Soares, L\. Kilpatrick, L\. Dixon, L\. Martins, M\. Reid, M\. Singh, M\. Iverson, M\. Görner, M\. Velloso, M\. Wirth, M\. Davidow, M\. Miller, M\. Rahtz, M\. Watson, M\. Risdal, M\. Kazemi, M\. Moynihan, M\. Zhang, M\. Kahng, M\. Park, M\. Rahman, M\. Khatwani, N\. Dao, N\. Bardoliwalla, N\. Devanathan, N\. Dumai, N\. Chauhan, O\. Wahltinez, P\. Botarda, P\. Barnes, P\. Barham, P\. Michel, P\. Jin, P\. Georgiev, P\. Culliton, P\. Kuppala, R\. Comanescu, R\. Merhej, R\. Jana, R\. A\. Rokni, R\. Agarwal, R\. Mullins, S\. Saadat, S\. M\. Carthy, S\. Cogan, S\. Perrin, S\. M\. R\. Arnold, S\. Krause, S\. Dai, S\. Garg, S\. Sheth, S\. Ronstrom, S\. Chan, T\. Jordan, T\. Yu, T\. Eccles, T\. Hennigan, T\. Kocisky, T\. Doshi, V\. Jain, V\. Yadav, V\. Meshram, V\. Dharmadhikari, W\. Barkley, W\. Wei, W\. Ye, W\. Han, W\. Kwon, X\. Xu, Z\. Shen, Z\. Gong, Z\. Wei, V\. Cotruta, P\. Kirk, A\. Rao, M\. Giang, L\. Peran, T\. Warkentin, E\. Collins, J\. Barral, Z\. Ghahramani, R\. Hadsell, D\. Sculley, J\. Banks, A\. Dragan, S\. Petrov, O\. Vinyals, J\. Dean, D\. Hassabis, K\. Kavukcuoglu, C\. Farabet, E\. Buchatskaya, S\. Borgeaud, N\. Fiedel, A\. Joulin, K\. Kenealy, R\. Dadashi, and A\. AndreevGemma 2: improving open language models at a practical size\.External Links:2408\.00118,[Link](https://arxiv.org/abs/2408.00118)Cited by:[§4\.1\.3](https://arxiv.org/html/2609.18080#S4.SS1.SSS3.p1.1)\.

## Appendix AAppendix

### A\.1TTPD Probe[Bürger et al\. \(2024\)](https://arxiv.org/html/2609.18080#bib.bib20),[Long et al\. \(2025\)](https://arxiv.org/html/2609.18080#bib.bib9)

#### A\.1\.1Replication

We replicate the probe of[Long et al\. \(2025\)](https://arxiv.org/html/2609.18080#bib.bib9)using their released code and the associated factual\-statement datasets\. Following[Bürger et al\. \(2024\)](https://arxiv.org/html/2609.18080#bib.bib20), the probe is the general truth directiontGt\_\{G\}: centered layer\-20 activations are regressed on the statement’s truth label and its affirmative/negated polarity, and the truth component is retained; statements are then classified by the sign of the projection ontotGt\_\{G\}\(the TTPD probe\)\. Ongemma\-2\-9b\-instruct, our reproducedtGt\_\{G\}separates true from false statements on the deceptive\-instruction activations with AUROC0\.980\.98\. We use thistGt\_\{G\}direction as the probewwthroughout the main evaluation\.

![Refer to caption](https://arxiv.org/html/2609.18080v1/updated_images/replicate_deceptive_plotly.png)\(a\)Deceptive prompt\.
![Refer to caption](https://arxiv.org/html/2609.18080v1/updated_images/replicate_neutral_plotly.png)\(b\)Neutral prompt\.
![Refer to caption](https://arxiv.org/html/2609.18080v1/updated_images/replicate_truthful_plotly.png)\(c\)Truthful prompt\.

Figure 3:Layer\-wise probing accuracy for Gemma\-2\-9B\-Instruct under deceptive, neutral, and truthful instructions\. LR and TTPD probes predict the instructedTrue/Falseoutput from final pre\-generation residual\-stream activations\. Across all three conditions, accuracy rises from chance in early layers to a high\-accuracy plateau near the selected analysis layer\. The dashed line marks layer 21, the accuracy peak reported by[Long et al\. \(2025\)](https://arxiv.org/html/2609.18080#bib.bib9)\. We analyze layer 20 in our experiments due to SAE constraints\.[Long et al\. \(2025\)](https://arxiv.org/html/2609.18080#bib.bib9)additionally report a logistic\-regression \(LR\) probe, using the unregularized configuration in the released code \(penalty=None\\texttt\{penalty\}=\\texttt\{None\}\)\. We exclude the LR probe from the main evaluation for methodological reasons rather than for reasons of accuracy\. As a classifier, the LR probe performs well, with training accuracy remaining between0\.9800\.980and1\.0001\.000across regularization strengths \(C∈\{0\.01,0\.1,1\.0,∞\}C\\in\\\{0\.01,0\.1,1\.0,\\infty\\\}\)\. However, the features receiving the largest weights are highly sensitive to the choice of regularization\. The top\-3030features overlap with those of the unregularized solution with Jaccard indices of only0\.620\.62,0\.430\.43, and0\.070\.07atC=1\.0,0\.1,0\.01C=1\.0,\\ 0\.1,\\ 0\.01, respectively\. Thus, the notion of “the features the LR probe relies on” is not well\-defined unless one arbitrarily fixes a regularization hyperparameter\. Because our analysis attributes behavior to specific features, it requires a probe direction that is fixed rather than hyperparameter\-dependent\. The TTPD directiontGt\_\{G\}is hyperparameter\-free and is the canonical truth probe of[Bürger et al\. \(2024\)](https://arxiv.org/html/2609.18080#bib.bib20); therefore, we use it for all attribution analyses and omit the LR probe from the main experiments\.

#### A\.1\.2Learned Sparse Mask Details

For each SAE featureii, a learnable parameterθi\\theta\_\{i\}produces a soft mask weightai=σ⁡\(θi\)a\_\{i\}=\\sigma\(\\theta\_\{i\}\), initialized atθi=0\\theta\_\{i\}=0so that all features begin atai=0\.5a\_\{i\}=0\.5\. The masked probe margin ism^​\(x\)=∑iai⋅fi⋅ciraw\\hat\{m\}\(x\)=\\sum\_\{i\}a\_\{i\}\\cdot f\_\{i\}\\cdot c\_\{i\}^\{\\text\{raw\}\}, whereciraw=𝐰⊤​𝐝ic\_\{i\}^\{\\text\{raw\}\}=\\mathbf\{w\}^\{\\top\}\\mathbf\{d\}\_\{i\}uses unnormalized decoder columns\. We minimizeℒ=MSE​\(m^/s,m/s\)\+λ​∑iai\\mathcal\{L\}=\\text\{MSE\}\(\\hat\{m\}/s,\\;m/s\)\+\\lambda\\sum\_\{i\}a\_\{i\}, wheremmis the true probe margin,ssis its standard deviation across the dataset, andλ=0\.01\\lambda=0\.01\. The mask is optimized with Adam \(lr=0\.1=0\.1\) for 400 steps on the full deceptive\-prompt activation matrix\. After training, features are ranked byaia\_\{i\}descending\.

#### A\.1\.3Gradient and probe overlap

Figure[4](https://arxiv.org/html/2609.18080#A1.F4)\.

![Refer to caption](https://arxiv.org/html/2609.18080v1/updated_images/feature_overlap.png)Figure 4:Fraction of top\-NNfeatures shared between the probe ranking \(\|w⋅d\|\|w\\cdot d\|\) and the model’s gradient ranking, as a function ofNNon a log scale\. The observed overlap exceeds the chance baseline \(dashed line\) by one to two orders of magnitude for smallNN\. Both curves approach11asNNapproaches the full dictionary, corresponding to the trivial limit\.
#### A\.1\.4Margin dip

The effect of ablating the shared probe–model features is non\-monotonic in the number of features removed\. Cumulatively ablating the top\-NNshared features, ordered by importance, raises the behavioral flip rate to a peak of0\.310\.31atN=96N\{=\}96, after which it falls to0\.100\.10once all126126shared features are ablated \(Figure[5\(a\)](https://arxiv.org/html/2609.18080#A1.F5.sf1)\)\. The signed probe margin mirrors this trajectory: it declines from a baseline of2\.282\.28to0\.100\.10atN=96N\{=\}96and then rebounds to1\.871\.87atN=126N\{=\}126\(Figure[5\(b\)](https://arxiv.org/html/2609.18080#A1.F5.sf2)\)\.

This recovery is not a breakdown of model coherence\. The mean absolute margin remains between1\.71\.7and2\.82\.8across the entire sweep, so the model continues to emit confident, well\-formed True/False outputs at every ablation count\. The dip instead reflects sign\-incoherence among the lowest\-ranked shared features: ablating them shifts the margin in the opposite direction to the higher\-ranked features and partially cancels the flip\. The features responsible for the behavioral effect are therefore concentrated near the top of the ranking, which is why the main analysis confines its causal claims to the leading features, where the effect is monotone\.

![Refer to caption](https://arxiv.org/html/2609.18080v1/updated_images/diagflip_plotly.png)\(a\)Flip rate under cumulative ablation of the top\-NNshared features\. The rate climbs to0\.310\.31atN=96N\{=\}96and then falls to0\.100\.10once all126126shared features are removed\.
![Refer to caption](https://arxiv.org/html/2609.18080v1/updated_images/diagmargin2_plotly.png)\(b\)Probe margin under the same ablation\. The signed mean margin \(blue\) drops from the baseline \(2\.282\.28\) to0\.100\.10atN=96N\{=\}96and rebounds to1\.871\.87atN=126N\{=\}126, while the mean absolute margin \(orange\) stays between1\.71\.7and2\.82\.8\.

Figure 5:Non\-monotonic effect of cumulatively ablating the shared probe–model features ongemma\-2\-9b\-instruct, ordered by importance\. The dip and recovery in flip rate and signed margin coincide, but the model’s confidence \(absolute margin\) is preserved throughout, indicating the recovery is driven by sign\-incoherent low\-ranked features rather than a loss of coherence\.
#### A\.1\.5Behavior Flip Exemplars

Figure[6](https://arxiv.org/html/2609.18080#A1.F6)\.

Factual label: TrueInventors“Orville and Wilbur Wright lived in the U\.S\.”Baseline \(deceptive prompt\)True✓Shared probe–model ablationFalse✗True→\\toFalse· toward deceptionProbe\-only ablationTrue✓unchanged

Factual label: TrueSpanish–English translation \(negated\)“The Spanish word ‘edad’ does not mean ‘clock’\.”Baseline \(deceptive prompt\)True✓Shared probe–model ablationFalse✗True→\\toFalse· toward deceptionProbe\-only ablationTrue✓unchanged

Factual label: FalseSpanish–English translation“The Spanish word ‘llevar’ means ‘end’\.”Baseline \(deceptive prompt\)True✗Shared probe–model ablationFalse✓True→\\toFalse· toward truthProbe\-only ablationTrue✗unchanged

Figure 6:Intervention exemplars on theTrue/Falsefactual\-verification task\.Under a deceptive instruction, the model emits a singleTrue/Falseanswer\. Each panel reports the baseline output and the output after ablating two feature sets: \(1\) shared probe–model features \(ranked highly by both the linear probe and model\-gradient attribution\) and \(2\) probe\-only features \(ranked highly by the probe but not by gradient attribution\)\. The small mark denotes factual correctness \(✓/✗\); the tag gives the output transition and its directional reading\. Ablating the shared features flips the output in every case, and the flip is alwaysTrue→\\toFalse: it removes the probe’s truth\-direction signal and biases the decision towardFalse\. On factually true statements \(Examples 1–2\), this makes the model abandon a correct answer and comply with the deceptive instruction; on a factually false statement \(Example 3\), the*same*True→\\toFalseshift instead overturns the model’s deceptive compliance and restores the correct answer\. The fixed output bias, not factual correctness, is what the shared features control\. Across the full evaluation set, theseTrue→\\toFalseflips dominate, and net accuracy falls \(Table[3](https://arxiv.org/html/2609.18080#S5.T3)\)\. Probe\-only ablation leaves the output unchanged in all three cases, consistent with those features acting as probe readouts rather than behavioral drivers\.
#### A\.1\.6Directional breakdown of shared\-feature ablation

Figure[7](https://arxiv.org/html/2609.18080#A1.F7)\.

![Refer to caption](https://arxiv.org/html/2609.18080v1/updated_images/directional_confusion.png)Figure 7:Confusion matrix of baseline versus post\-ablationTrue/Falseoutput under shared\-feature ablation \(n=800n=800, shared setm=16m=16\)\. Rows are the baseline output, columns the output after ablation; diagonal cells are unchanged statements and off\-diagonal cells are flips\. Flips are concentrated in theTrue→\\toFalsecell \(8686versus44forFalse→\\toTrue\), showing that ablation drives the decision variable towardFalserather than toward the factually correct answer\. This is the per\-cell view of the transition counts in Table[3](https://arxiv.org/html/2609.18080#S5.T3)\.
#### A\.1\.7Category Breakdown

Table[6](https://arxiv.org/html/2609.18080#A1.T6)reports the per\-category breakdown of shared\-feature ablation\. The effect appears in ten of twelve categories, ranging from0\.0140\.014to0\.2430\.243, with the strongest movement in translation \(Sp–En,0\.2430\.243\) and inventor \(0\.1860\.186\) statements\. TheTrue→\\toFalsedirection dominates within nearly every category \(6161versus77aggregate\), matching the directional pattern of Table[3](https://arxiv.org/html/2609.18080#S5.T3)\. Two categories \(animal class, negated inventors\) show no flips at the matched1616\-feature size, consistent with categories whose baselineTrue/Falsemargin is large enough that a small ablation does not cross the decision boundary\. The breadth across categories indicates the shared features are not a category\-specific artifact, while the heterogeneity in magnitude likely reflects per\-category differences in baseline decision confidence\.

Table 6:Shared\-feature ablation flip rate by dataset category \(n=70n=70per category, balanced sampling so rates are comparable; shared setm=16m=16\)\. Categories ordered by flip rate\.

### A\.2Probe from Taufeeque et al\.

As discussed in[Taufeeque et al\. \(2026\)](https://arxiv.org/html/2609.18080#bib.bib11),

As an auxiliary diagnostic, we tested whether the same SAE attribution workflow transfers to a reward\-hacking code probe from[Taufeeque et al\. \(2026\)](https://arxiv.org/html/2609.18080#bib.bib11)\. We use the releasedAlignmentResearch/diverse\-deception\-probe\-qwen3\-8bcheckpoint, taking thelast\-token\-generationlinear probe at layer 20 ofQwen/Qwen3\-8B\. The probe is applied to MBPP\-Honeypot\-style examples, contrasting correct code with hardcoded visible\-test solutions, and we use the probe weight vector aswwfor SAE attribution with the matching Qwen\-Scope layer\-20 residual\-stream SAE\.

It did not pass the SAE\-substrate verification\. Only 26% of the raw probe margin was preserved by the SAE reconstruction, while 74% lay in the reconstruction error\. Consequently, ablating probe\-aligned or sparse\-mask SAE features changed reconstruction\-space predictions but left raw\-activation probe predictions nearly unchanged\. We therefore treat this setting as a boundary case: before interpreting SAE\-feature interventions causally, one must verify that the probe signal is actually represented in the SAE feature basis\.

Table 7:Probe margin decomposition for the reward\-hacking code probe diagnostic\. The raw probe margin is compared against the margin preserved by the SAE reconstruction and the margin carried by the SAE reconstruction error\.As Figure[8](https://arxiv.org/html/2609.18080#A1.F8)shows, ablating probe\-aligned SAE features flips about one third of predictions when the probe is evaluated on the SAE reconstruction, but produces near zero flips on the raw activation\. Therefore, the selected SAE features explain the portion of the probe readout that lives in reconstructed SAE space, but they are not necessary for the original probe’s prediction on the full residual stream\.

![Refer to caption](https://arxiv.org/html/2609.18080v1/updated_images/aligned_plotly.png)Figure 8:Probe\-aligned SAE feature ablations affect the reconstructed probe readout but leave the raw published probe nearly unchanged\. Features are ranked byci=w⊤​dic\_\{i\}=w^\{\\top\}d\_\{i\}\. Ablating top\-KKdecoded feature contributions flips approximately one third of probe predictions when evaluated on the SAE reconstruction, but produces near\-zero flip rates on raw activations\.![Refer to caption](https://arxiv.org/html/2609.18080v1/updated_images/sparse_plotly.png)Figure 9:Sparse\-mask ablations strongly affect reconstruction\-space probe predictions but have little effect on raw probe predictions\. The sparse mask was trained to reproduce the probe logit from SAE features\.Similarly, ablating the top\-50 sparse\-mask features flips32\.7%32\.7\\%of SAE\-reconstruction predictions, but only2\.1%2\.1\\%of raw\-activation predictions\. The raw flip rate remains small for larger masks, peaking at4\.5%4\.5\\%for top\-100 features before returning near2%2\\%\. This indicates that the learned sparse mask successfully identifies features that support the reconstructed probe readout, but these features do not account for most of the discriminative signal used by the raw probe\.