Five shared SAE directions mitigate structurally distinct backdoors

measured in 1 paper

Mahmoud et al. train SAEs on six real backdoored LLMs and use model diffing to find five SAE features shared across six distinct backdoor types [mahmoud-etal-2026-shared-latent-structures-enable-unified-backdoor-detection-and-mitigation-in-llms] Steering along each feature's decoder direction mitigates attack success: F33881 gives 96% on Sentiment-LoRA, 79% on country-conditioned advice, and 44% zero-shot on a held-out Refusal backdoor [mahmoud-etal-2026-shared-latent-structures-enable-unified-backdoor-detection-and-mitigation-in-llms] F25828 gives 100% zero-shot mitigation on the held-out Refusal backdoor [mahmoud-etal-2026-shared-latent-structures-enable-unified-backdoor-detection-and-mitigation-in-llms] A companion training-time method, Concept Ablation Fine-Tuning, ablates the same shared subspace during training [mahmoud-etal-2026-shared-latent-structures-enable-unified-backdoor-detection-and-mitigation-in-llms]

Structure

Linear Direction

Context

a shared latent direction common to multiple structurally distinct backdoor mechanisms, discovered via cross-model SAE model diffing rather than within a single model/backdoor pair, zero-shot causal transfer of a mitigation direction to a structurally different, held-out backdoor type

Confirmed in models

Qwen3-8B · Qwen, Qwen3-14B · Qwen, Qwen3-32B · Qwen, Gemma 3 4B Instruct · Gemma, Gemma 3 12B Instruct · Gemma, Llama-3.1-8B · Llama

Method

Sparse Autoencoders (SAE), Activation Steering (Addition)

Papers

Shared Latent Structures Enable Unified Backdoor Detection and Mitigation in LLMs — Mahmoud, Ahmed, Kassem, Aly, Karimpanal, Thommen George, Semage, Buddhika, Rostamzadeh, Negar, Farnadi, Golnoosh, Rana, Santu2026 · arXiv:2606.07963