Representational Simplicity and Circuit Size Dissociate in a Threshold-Dependent Way: A Controlled Test via Adversarial Training
Organizations: Independent Cambridge, MA
Abstract
Sparse-autoencoder decomposability and concentrated feature attribution are increasingly treated as evidence that a model's computation is easier to reverse-engineer. Whether this representational and attributional cleanliness actually predicts a smaller or more tractable causal circuit remains an open question. We test this directly using adversarial training as a controlled instrument: it reliably reshapes internal representations, but this alone does not constitute a test of circuit size. We investigate this question through reverse-engineering complexity: the causal structure required to recover a model's behavior at a fixed level of faithfulness. To our knowledge, this is the first controlled empirical test of whether representational or attributional simplicity translates into causal simplicity at the circuit level. Starting from the same pretrained GPT-2 Small checkpoint, we apply matched standard and adversarial continual training, requiring both conditions to retain competence on indirect object identification and pass independent robustness verification before comparing mechanisms. We then compare the models along three complementary axes: sparse-autoencoder decomposability, SAE feature engagement in task attribution, and the size of faithful circuits recovered from the raw computational graph. The robust model is more SAE-decomposable and engages fewer SAE features in task attribution. Circuit size is regime-dependent: on competence-matched IOI, standard leads or ties below 85% faithfulness, but robust needs substantially fewer edges at high faithfulness (90%, 95%), a pattern established on the primary pair while representational trends generalize across a seven-point sweep and a second corpus.
Figures & tables
| Run | IOI | Gap | GT PD | |||
|---|---|---|---|---|---|---|
| ft-clean | 0 | 0 | .996 | .907 | 1.642 | .671 |
| e050-a02 | .050 | .2 | .994 | .153 | .655 | .609 |
| e050-a05 ∗ | .050 | .5 | .995 | .087 | .494 | .559 |
| e075-a02 | .075 | .2 | .994 | .104 | .556 | .584 |
| e075-a05 ∗ | .075 | .5 | .994 | .057 | .413 | .500 |
| e100-a02 ∗ | .100 | .2 | .995 | .079 | .495 | .554 |
| Metric | Standard | Robust |
|---|---|---|
| Original-space MSE | ||
| Fixed-threshold MSE | 1.1546 | 1.1262 |
| Normalized-space loss | 0.0877 | 0.0768 |
| Dead features | 0 | 0 |
| Model | Task | Candidates | 50% | 80% | 90% |
|---|---|---|---|---|---|
| Standard | IOI | 1,612 | 48 | 193 | 343 |
| Robust | IOI | 1,196 | 43 | 163 | 276 |
| Standard | GT | 563 | 14 | 54 | 90 |
| Robust | GT | 360 | 8 | 33 | 63 |
| 70% | 80% | 85% | 90% | 95% | |
|---|---|---|---|---|---|
| Standard | 512 | 1,000 | 1,000 | 4,000 | 16,000 |
| Robust | 1,000 | 1,000 | 1,000 | 1,000 | 2,000 |
| Model | Recon. MSE | IOI cand. | -ReQ (model) | -ReQ (SAE) | Part. ratio | Edges 85% | ||
|---|---|---|---|---|---|---|---|---|
| ft-clean | 0 | 0 | 1.1528 | 1600.7 | 0.9230 | 0.8074 | 3.815 | 1,000 |
| e050-a02 | .050 | .2 | 1.1315 | 1483 | 0.9465 | 0.8177 | 3.689 | 2,000 |
| e075-a02 | .075 | .2 | 1.1277 | 1408 | 0.9546 | 0.8213 | 3.695 | 1,000 |
| e100-a02 | .100 | .2 | 1.1242 | 1371 | 0.9609 | 0.8239 | 3.681 | 1,000 |
| e050-a05 | .050 | .5 | 1.1432 | 1370 | 0.9644 | 0.8267 | 3.782 | 1,000 |
| e075-a05 | .075 | .5 | 1.1301 | 1266 | 0.9762 | 0.8325 | 3.732 | 1,000 |
| Metric | Standard ( fw-clean ) | Robust ( fw-robust ) |
|---|---|---|
| Recon. MSE | 1.089 | 1.077 |
| IOI candidates | 1549 | 1126 |
| -ReQ (model) | 0.9288 | 0.9943 |
| -ReQ (SAE) | 0.8121 | 0.8434 |
| Edges 85% | 1,000 | 1,000 |
Appendix figures & tables8 assets
Supplementary material from the paper’s appendix.
Appendix
| Hyperparameter | Value |
|---|---|
| Training budget | exactly 1,000,000,000 tokens |
| Updates | 1,907 full updates and one final partial update |
| Global batch | 524,288 tokens per update |
| Micro-batch | 16 sequences, with gradient accumulation |
| Optimizer | AdamW |
| Adam coefficients |
| Partition | Tokens | Provenance note |
|---|---|---|
| Continual training | 1,000,000,000 | 973,424 logged document IDs |
| Robustness evaluation | 100,000,000 | 88,637 reconstructed IDs |
| SAE training | 300,000,000 | post-training stream |
| SAE evaluation | 10,000,000 | subsequent held-out stream |
| Attribution control | 256,000 | 1,000 sequences of length 256 |
| Metric | clean s42 | clean s43 | clean s44 | robust s42 | robust s43 | robust s44 |
| MSE, original residual space (train-mode) | 1.1624 | 1.1579 | 1.1601 | 1.1301 | 1.1295 | 1.1284 |
| MSE, inference-threshold mode | 1.1546 | 1.1511 | 1.1526 | 1.1262 | 1.1265 | 1.1254 |
| Final training loss (normalized space) | 0.0877 | 0.0902 | 0.0869 | 0.0768 | 0.0770 | 0.0788 |
| Dead latents | 0 | 1 | 0 | 0 | 0 | 1 |
| Inference threshold | 0.785 | 0.783 | 0.787 | 0.741 | 0.742 | 0.743 |
| ft-clean (s42/s43/s44) | ft-e100-a05 robust (s42/s43/s44) | |
|---|---|---|
| GT candidate features | 563 / 561 / 533 | 360 / 385 / 357 |
| GT features for 90% | 90 / 78 / 85 | 63 / 61 / 59 |
| IOI candidate features | 1,612 / 1,634 / 1,556 | 1,196 / 1,188 / 1,162 |
| IOI features for 90% | 343 / 363 / 341 | 276 / 280 / 262 |
| Task | Model | Dead (s42/43/44) | Mean (excl.) | Median (excl.) | p90 (excl.) |
|---|---|---|---|---|---|
| GT | Standard | 14/16/15 | 7.4 / 8.3 / 10.7 | 1.0 | 10–14 |
| GT | Robust | 16/16/21 | 7.0 / 6.0 / 9.3 | 0.6–1.1 | 10–12 |
| IOI | Standard | 0/0/0 | 5.4 / 8.5 / 10.9 | 0.9–1.0 | 18–20 |
| IOI | Robust | 0/0/0 | 6.4 / 6.2 / 7.2 | 0.9 | 9–15 |
| 1 | 2 | 4 | 8 | 16 | 32 | 64 | 128 | |
| IOI Standard | ||||||||
| IOI Robust | ||||||||
| GT Standard | 0.00 | 0.00 | 0.00 | 0.00 | 0.15 | 0.38 | 0.66 | 0.88 |
| GT Robust | 0.00 | 0.00 | 0.00 | 0.07 | 0.14 | 0.31 | 0.65 | 0.88 |
Mechanistic Interpretability
Mechanistic interpretability studies how neural networks implement behaviors through internal features, circuits, and causal information flow.
See all 391 papers