Sparse Autoencoder Interventions May Not Fully Suppress Harmful AI Behaviors.

Sparse Autoencoders (SAEs) are increasingly used in AI safety to decompose model activations into interpretable features, allowing for interventions to suppress undesirable behaviors. The common assumption is that by clamping or modifying specific "unsafe" SAE features, harmful model misbehavior can be reliably prevented. However, new research reveals a critical vulnerability: such interventions may only block one visible pathway to a behavior without eradicating the behavior itself. This phenomenon, termed "post-intervention recovery," shows that models can find alternative routes in their residual space to revert to the suppressed behavior, even when the intervention remains active. Experiments across various tasks, including unlearning and refusal steering, confirm that behavior recovery is possible despite successful feature-level intervention. For instance, in safety-critical refusal steering, a 95.8% recovery rate was observed. This suggests that while SAE features enable causal intervention, controlling them does not guarantee comprehensive control over the model's underlying behavior, pointing to the SAE reconstruction residual as a key area for this recovery.