Sparse Autoencoder Interventions Unreliable for AI Safety, Behavior Recovers

Sparse Autoencoders (SAEs) are often used in mechanistic interpretability to break down neural network activations into understandable features. A common assumption in AI safety is that if an "unsafe" SAE feature is identified and suppressed, the corresponding harmful model behavior will be reliably prevented. However, new research challenges this assumption, showing that clamping a specific feature might only block one visible route to a behavior without eliminating the behavior itself. This phenomenon, termed "post-intervention recovery," means that even with an intervention active, the model can find alternative pathways to exhibit the suppressed behavior. The study formulates this as an optimization problem, demonstrating that recovery is possible even under strong threat models. It highlights that controlling SAE features does not guarantee complete control over the underlying model behavior, particularly in safety-critical applications like refusal steering, where a high recovery rate was observed despite feature-level intervention.