Sparse Feature Interventions for LLM Safety: A Localized Evaluation.

The use of sparse autoencoder (SAE) features for controlling safety-relevant behaviors in large language models (LLMs) is a promising area, but accurately assessing when these interventions are truly localized and effective is challenging. Apparent success can be misleading, stemming from weak interventions, mismatched baselines, model robustness, or degenerate outputs that are flagged as unsafe without representing meaningful harmful compliance. To address these evaluation difficulties, researchers developed a matched coherence-gated evaluation protocol. This protocol compares intervention methods at equivalent target-effect points and primarily measures harmful compliance only when an output is both judged unsafe and remains coherent. Applying this rigorous method to Gemma-2-9B-it with a Gemma Scope layer-20 residual SAE across three prompt splits revealed that SAE feature ablation operates within a narrow useful regime. Specifically, intervening on the top 800 SAE features achieved a low-to-mid target effect with less perturbation and competitive utility. However, expanding to the top 1600 features resulted in a loss of utility compared to a matched dense refusal-direction baseline, and using the top 3200 features primarily caused coherence collapse. Human audits confirmed that coherence gating effectively filtered out unsafe-only artifacts. Feature diagnostics indicated that the effective regime is driven by a stable set of refusal-aligned features whose activation separation rapidly diminishes with rank, suggesting that SAE-based safety interventions should be viewed as regime-dependent control mechanisms rather than uniformly localized.