Representation Redistribution in Sparse Autoencoders
Organizations: Department of Computer Sciences, University of Wisconsin–Madison
Abstract
Sparse autoencoders (SAEs) decompose language model activations into sparse features, but prompt transformations designed to preserve the underlying request can redistribute activity across them. A feature change observed on one transformed prompt need not recur, and even a recurring change need not affect a downstream computation. We introduce the redistribution sensitivity score (RSS), which identifies large feature responses that recur in a consistent direction, and evaluate the resulting supports on variants excluded from selection. Across 27 pretrained SAEs spanning eight language models, the tested prompt transformations produce a reproducible redistribution profile on these excluded variants. We then separate recurring representation change from signed readout contribution and decision failure. For a fixed linear readout, an exact decomposition shows how response magnitude, readout coefficients, directional alignment, and the clean margin determine downstream consequences. In two frozen safety readouts, combining RSS support erosion with the full clean margin yields recurrent failure AUROCs of 0.935 and 0.958 using median supports of 20 and 19 features, compared with 0.965 and 0.964 using full erosion. RSS therefore provides a way to identify recurring sparse representation changes and quantify their contribution to a downstream readout without equating representation change with failure. Code is available at https://github.com/OpenSAE/Redistribution-Sensitivity-Score
Figures & tables
| Symbol | Meaning |
|---|---|
| , | clean prompt and its th transformed variant |
| change in SAE feature from to | |
| mean absolute feature change used for RSS magnitude ranking | |
| responsive support selected by RSS | |
| MeanRSS | average over the responsive support |
| standardized feature change used by the frozen probe |
| Parameter | Value |
|---|---|
| Selector observations, | 5 |
| Response rate threshold, | 0.8 |
| Directional consistency threshold, | 0.8 |
| Response threshold, | |
| Candidate features, | 400 |
| Support cap, | 20 |
| Model | Layers | SAE checkpoint | Width | Hook | Architecture / sparsity |
|---|---|---|---|---|---|
| GPT-2 Small | 4, 6, 8, 10 | GPT2-Small-SAEs-Reformatted | 24,576 | resid_pre | ReLU, ; L1 coef. |
| Pythia-70M | 1, 3, 5 | pythia-70m-deduped__res-sm | 32,768 | resid_post | ReLU, standard; sparsity n.r. |
| Gemma 3 270M | 5, 9, 12, 15 | gemma-scope-2-270m-pt | 16,384 | resid_post | JumpReLU; at layer 5 and 20 elsewhere |
| Gemma 3 1B | 7, 13, 17, 22 | gemma-scope-2-1b-pt | 16,384 | resid_post | JumpReLU; at layer 7 and 20 elsewhere |
| Gemma 3 4B | 9, 17, 29 | gemma-scope-2-4b-pt | 65,536 | resid_post | JumpReLU; nominal |
| Mistral 7B | 8, 16, 24 | mistral_7b_layer_L | 65,536 | resid_pre | ReLU, ; measured |
| Setting | Available | Mean | Median | |
|---|---|---|---|---|
| Irrelevant context | 27,000 | 19.36 | 20 | 90.3% |
| Distractor context | 27,000 | 18.77 | 20 | 82.1% |
| Metalinguistic wrapper | 27,000 | 19.06 | 20 | 86.6% |
| Format wrapper | 27,000 | 18.56 | 20 | 82.1% |
| Punctuation noise | 27,000 | 18.01 | 20 | 71.1% |
| Typed lexical substitution | 26,996 | 16.18 | 20 | 54.6% |
| Treatment | Gap | 95% CI | Order |
|---|---|---|---|
| Omitted | 0.8740 | [0.8671, 0.8810] | Reference |
| Assigned zero | 0.8741 | [0.8673, 0.8810] | Unchanged |
| Setting | Overlap | Newly active | Inactive | Positive | Negative |
|---|---|---|---|---|---|
| Irrelevant context | 0.383 | 0.462 | 0.469 | 0.368 | 0.632 |
| Distractor context | 0.361 | 0.490 | 0.487 | 0.304 | 0.696 |
| Metalinguistic wrapper | 0.394 | 0.453 | 0.451 | 0.375 | 0.625 |
| Format wrapper | 0.381 | 0.496 | 0.478 | 0.230 | 0.770 |
| Punctuation noise | 0.692 | 0.198 | 0.187 | 0.406 | 0.594 |
| Typed lexical substitution | 0.776 | 0.133 | 0.133 | 0.381 | 0.619 |
| Setting | Normalized MeanRSS |
|---|---|
| Irrelevant context | 1.466 [1.459, 1.474] |
| Distractor context | 1.341 [1.337, 1.346] |
| Metalinguistic wrapper | 1.199 [1.192, 1.205] |
| Format wrapper | 1.159 [1.154, 1.164] |
| Punctuation noise | 0.525 [0.519, 0.532] |
| Typed lexical substitution | 0.309 [0.305, 0.314] |
| Criterion | Prompts | Share |
|---|---|---|
| Context/wrapper mean local-edit mean | 1,000 / 1,000 | 100.0% |
| Every context/wrapper setting both local edits | 997 / 1,000 | 99.7% |
| Setting | Spearman | Minimum | Gap | Mean | Jaccard |
|---|---|---|---|---|---|
| Reference | 1.00 | 1.00 | 0.626 [0.604, 0.646] | 13.2 | 1.00 |
| 1.00 | 0.94 | 0.632 [0.610, 0.652] | 13.8 | 0.90 | |
| 1.00 | 0.77 | 0.595 [0.571, 0.617] | 17.4 | 0.61 | |
| 1.00 | 0.89 | 0.702 [0.680, 0.723] | 8.6 | 0.75 | |
| 1.00 | 0.94 | 0.537 [0.514, 0.558] | 17.5 | 0.89 |
| Criterion | Specifications |
|---|---|
| Full six-setting order preserved | 17 / 25 |
| Top setting preserved | 20 / 25 |
| Bottom setting preserved | 25 / 25 |
| Available | Profile Spearman | Gap | Positive units | |
|---|---|---|---|---|
| 0.001 | 99.99% | 0.943 | 0.835 | 27/27 |
| 0.01 | 99.94% | 0.943 | 0.817 | 27/27 |
| 0.05 | 99.65% | 0.943 | 0.756 | 27/27 |
| 0.1 | 99.40% | 0.943 | 0.706 | 27/27 |
| Setting and level | Definition | Tokens | Edits |
|---|---|---|---|
| Irrelevant context 1 | 4–8 added tokens | 4.00 | 0 |
| Irrelevant context 2 | 12–16 added tokens | 12.00 | 0 |
| Irrelevant context 3 | 24–32 added tokens | 24.00 | 0 |
| Irrelevant context 4 | 48–64 added tokens | 48.00 | 0 |
| Format wrapper 1 | single label or quote | 3.24 | 10.4 |
| Format wrapper 2 | envelope with two fields | 8.92 | 28.2 |
| Sel. | Eval. | Reliability | Profile | Sign | CV | Jac. |
|---|---|---|---|---|---|---|
| 3 | 12 | 0.773 [0.763, 0.782] | 0.805 | 0.960 | 0.221 | 0.393 |
| 5 | 10 | 0.802 [0.792, 0.810] | 0.827 | 0.964 | 0.189 | 0.539 |
| 8 | 7 | 0.714 [0.703, 0.724] | 0.773 | 0.946 | 0.268 | 0.527 |
| 10 | 5 | 0.681 [0.670, 0.691] | 0.765 | 0.946 | 0.279 | 0.654 |
| Method | Sel. | Reliability | Profile | Sign |
|---|---|---|---|---|
| RSS support | 3 | 0.773 | 0.805 | 0.959 |
| RSS support | 5 | 0.802 | 0.827 | 0.964 |
| RSS support | 8 | 0.714 | 0.773 | 0.946 |
| RSS support | 10 | 0.681 | 0.765 | 0.946 |
| Clean support | 3 | 0.772 | 0.809 | 0.921 |
| Clean support | 5 | 0.752 | 0.792 | 0.918 |
| Fold | Avail. | Profile | Gap | Pos. units | Same dir. | Group sign | Pairwise |
|---|---|---|---|---|---|---|---|
| 0 | 99.985% | 1.000 | 0.909 | 27/27 | 0.940 | 99.92% | 93.49% |
| 1 | 99.985% | 1.000 | 0.896 | 27/27 | 0.957 | 99.86% | 92.00% |
| 2 | 99.989% | 1.000 | 0.897 | 27/27 | 0.959 | 99.87% | 92.15% |
| Support | Absolute response | 95% CI | Same direction | 95% CI |
|---|---|---|---|---|
| RSS | 107.670 | [106.749, 108.597] | 0.952 | [0.951, 0.952] |
| Random, 100 draws | 5.797 | [5.748, 5.846] | 0.758 | [0.758, 0.759] |
| Selection requirement | Available | Same direction | Gap |
|---|---|---|---|
| 4 of 4 operators | 99.42% | 0.894 | 0.925 |
| 3 of 4 operators | 100.00% | 0.848 | 0.896 |
| Model | Unit | Weights | Clean AUROC | Harmful FNR | Benign FPR | |
|---|---|---|---|---|---|---|
| Gemma 3 4B | L17 | 0.01 | 415 | 0.941 [0.914, 0.963] | 23.3% | 7.3% |
| Llama 3.1 8B | L24 | 0.001 | 862 | 0.919 [0.884, 0.949] | 33.3% | 6.0% |
| Model | Setting | Norm. MeanRSS | Erosion | Flip | AUROC |
|---|---|---|---|---|---|
| Gemma 3 4B | Irrelevant context | 1.118 [1.102,1.134] | 0.132 [0.029,0.235] | 6.1% | 0.928 |
| Distractor context | 1.263 [1.244,1.284] | 0.138 [0.024,0.249] | 5.6% | 0.935 | |
| Metalinguistic wrapper | 1.113 [1.098,1.128] | 0.231 [0.121,0.344] | 6.6% | 0.926 | |
| Format wrapper | 1.190 [1.172,1.208] | 0.037 [-0.084,0.152] | 8.0% | 0.935 | |
| Punctuation noise | 0.524 [0.506,0.541] | 0.158 [0.098,0.218] | 4.2% | 0.933 | |
| Typed lexical substitution | 0.792 [0.759,0.825] | 0.146 [0.068,0.223] | 4.6% | 0.938 |
| Model | Setting | Eligible | MeanRSS | MeanRSS mono. | Erosion | Erosion mono. |
|---|---|---|---|---|---|---|
| Gemma 3 4B | Irrelevant context | 300 | 0.8 | 78/254 | 0.4 | 51/254 |
| Format wrapper | 300 | 1.0 | 203/254 | 0.4 | 63/254 | |
| Punctuation noise | 265 | 1.0 | 137/222 | 0.4 | 37/222 | |
| Llama 3.1 8B | Irrelevant context | 300 | 0.8 | 67/241 | 0.2 | 39/241 |
| Format wrapper | 300 | 1.0 | 192/241 | 0.4 | 51/241 | |
| Punctuation noise | 265 | 1.0 | 138/212 | 0.6 | 62/212 |
| Model | Risk signal | Erosion | Failure AUROC | AP |
|---|---|---|---|---|
| Gemma 3 4B | Clean margin | -0.282 [-0.370,-0.192] | 0.863 [0.821,0.900] | 0.294 |
| Full | 0.101 [0.025,0.173] | 0.520 [0.444,0.595] | 0.072 | |
| Full cosine | 0.083 [0.006,0.157] | 0.486 [0.398,0.572] | 0.063 | |
| MeanRSS | 0.116 [0.040,0.188] | 0.526 [0.446,0.599] | 0.069 | |
| Probe exposure | 0.104 [0.029,0.178] | 0.597 [0.510,0.683] | 0.107 | |
| MeanRSS exposure | 0.130 [0.049,0.210] | 0.606 [0.524,0.689] | 0.091 |
| Model | RSS | Magnitude only |
|---|---|---|
| Gemma 3 4B | 0.876 [0.872, 0.879] | 0.816 [0.810, 0.822] |
| Llama 3.1 8B | 0.871 [0.867, 0.874] | 0.794 [0.788, 0.800] |
| Model | RSS contribution | Matched contribution | Difference | Direction agreement |
|---|---|---|---|---|
| Gemma 3 4B | 0.2397 | 0.0221 | 0.2177 [0.2005, 0.2356] | 97.4% |
| Llama 3.1 8B | 0.3702 | 0.0220 | 0.3483 [0.3235, 0.3739] | 97.1% |
| Model | RSS | Mismatched RSS | |
|---|---|---|---|
| Gemma 3 4B | 0.430 [0.411, 0.450] | 0.326 [0.308, 0.346] | 0.942 [0.936, 0.948] |
| Llama 3.1 8B | 0.562 [0.547, 0.577] | 0.435 [0.417, 0.453] | 0.919 [0.912, 0.925] |
| Model | Feature set | Erosion | Failure AUROC |
|---|---|---|---|
| Gemma 3 4B | Full readout | 0.923 [0.909, 0.935] | 0.785 [0.721, 0.842] |
| RSS support | 0.737 [0.700, 0.771] | 0.753 [0.686, 0.815] | |
| Llama 3.1 8B | Full readout | 0.896 [0.878, 0.911] | 0.705 [0.639, 0.766] |
| RSS support | 0.793 [0.761, 0.820] | 0.735 [0.666, 0.797] |
| Model | Feature set | Residual | Residual AUROC |
|---|---|---|---|
| Gemma 3 4B | Full readout | 0.169 [0.077, 0.261] | 0.965 [0.939, 0.982] |
| RSS support | 0.009 [-0.081, 0.105] | 0.935 [0.901, 0.961] | |
| Llama 3.1 8B | Full readout | 0.152 [0.065, 0.243] | 0.964 [0.940, 0.982] |
| RSS support | 0.080 [-0.006, 0.171] | 0.958 [0.924, 0.981] |
| Model | Feature set | Size | Erosion | Residual AUROC | Errors | Harmful FN |
|---|---|---|---|---|---|---|
| Gemma 3 4B | Full readout | 415 | 0.923 | 0.965 | 94.1% | 90.9% |
| RSS support | 20 | 0.737 | 0.935 | 89.2% | 87.3% | |
| Llama 3.1 8B | Full readout | 862 | 0.896 | 0.964 | 91.9% | 93.5% |
| RSS support | 19 | 0.793 | 0.958 | 92.8% | 94.4% |
| Layer | Same direction | MCR | Residual AUROC | Restoration | ||
|---|---|---|---|---|---|---|
| 8 | 20 | 0.960 | 0.628 | 0.905 | 0.814 | 0.566 |
| 16 | 20 | 0.970 | 0.578 | 0.806 | 0.692 | 0.807 |
| Model | Support | Size | Errors reversed | ||
|---|---|---|---|---|---|
| Gemma 3 4B | RSS support | 20 | 0.579 [0.532, 0.621] | 0.722 [0.635, 0.803] | 0.618 |
| Mismatched setting | 20 | 0.438 [0.386, 0.481] | 0.603 [0.512, 0.683] | 0.368 | |
| Global instability | 20 | 0.017 [-0.008, 0.035] | 0.067 [0.018, 0.151] | 0.000 | |
| Random matched | 20 | 0.014 [-0.006, 0.022] | 0.012 [0.002, 0.026] | 0.002 | |
| Llama 3.1 8B | RSS support | 19 | 0.627 [0.568, 0.675] | 0.718 [0.610, 0.807] | 0.800 |
| Mismatched setting | 19 | 0.490 [0.406, 0.560] | 0.611 [0.487, 0.721] | 0.590 |
| Ranking signal | Capture@10 | Capture@20 | Harmful FN@20 | Residual error | pAURC |
|---|---|---|---|---|---|
| Residual margin | 85.1% | 94.1% | 90.9% | 0.25% | +0.0276 [0.0175,0.0385] |
| Low clean margin | 41.3% | 68.9% | 60.9% | 1.30% | +0.0186 [0.0117,0.0267] |
| + probe weights | 32.1% | 47.6% | 49.5% | 2.20% | +0.0109 [0.0046,0.0180] |
| MeanRSS | 11.0% | 18.8% | 18.2% | 3.40% | +0.0007 [-0.0026,0.0046] |
| Model | Ranking signal | Errors | Harmful FN |
|---|---|---|---|
| Gemma 3 4B | Residual margin | 94.1 [90.2, 96.5] | 90.9 [81.9, 95.7] |
| RSS residual margin | 89.2 [81.8, 93.5] | 87.3 [72.4, 94.9] | |
| Mismatched RSS residual | 86.5 [78.7, 92.0] | 85.9 [69.8, 93.5] | |
| Margin erosion | 63.6 [49.3, 74.8] | 62.3 [35.4, 78.2] | |
| RSS margin erosion | 64.2 [50.1, 75.0] | 66.8 [44.4, 81.1] | |
| Llama 3.1 8B | Residual margin | 91.9 [87.6, 95.6] | 93.5 [88.7, 97.4] |
| Model | Method | Clean | Mean | Worst | Worst FNR | Gap |
|---|---|---|---|---|---|---|
| Gemma 3 4B | MeanRSS sampling | 0.945 | 0.943 | 0.938 | 0.191 | 0.0067 |
| Gemma 3 4B | Uniform | 0.933 | 0.934 | 0.926 | 0.238 | 0.0071 |
| Llama 3.1 8B | MeanRSS sampling | 0.911 | 0.910 | 0.901 | 0.256 | 0.0100 |
| Llama 3.1 8B | Uniform | 0.915 | 0.913 | 0.907 | 0.263 | 0.0082 |
Sparse Autoencoders
Sparse autoencoders decompose neural network activations into sparse features to study, interpret, and control learned representations.
See all 218 papers