Cyclic Ablation: Testing Concept Localization against Functional Regeneration in AI
On the map: Mechanistic interpretability → Probing deception, bias and beliefs
Abstract (arXiv)
Safety and controllability are critical for large language models. A central question is whether undesirable behaviors like deception are localized functions that can be removed, or if they are deeply intertwined with a model's core cognitive abilities. We introduce "cyclic ablation," an iterative method to test this. By combining sparse autoencoders, targeted ablation, and adversarial training on DistilGPT-2, we attempted to eliminate the concept of deception. We found that, contrary to the localization hypothesis, deception was highly resilient. The model consistently recovered its deceptive behavior after each ablation cycle via adversarial training, a process we term functional regeneration. Crucially, every attempt at this "neurosurgery" caused a gradual but measurable decay in general linguistic performance, reflected by a consistent rise in perplexity. These findings are consistent with the view that complex concepts are distributed and entangled, underscoring the limitations of direct model editing through mechanistic interpretability.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Probing deception, bias and beliefs, one of 13 directions in Mechanistic interpretability. Builds on 6 of its 9 references that are in the map. First posted on arXiv 23 Sep 2025.
Builds on
6 of 9 references.
References · 6
- 2023GPT-4 Technical Reportcited by 18,396
- 2019DistilBERT, a distilled version of BERT: smaller, faster, cheaper and lightercited by 4,307
- 2022Locating and Editing Factual Associations in GPTcited by 2,691
- 2023Sparse Autoencoders Find Highly Interpretable Features in Language Modelscited by 1,420
- 2022Mass-Editing Memory in a Transformercited by 1,001
- 2023The Hydra Effect: Emergent Self-repair in Language Model Computationscited by 156
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2026ARREST: Adversarial Resilient Regulation Enhancing Safety and Truth in Large Language Models
- 2025Adversarial Activation Patching: A Framework for Detecting and Mitigating Emergent Deception in Safety-Aligned Transformers
- 2026Silencing the Guardrails: Inference-Time Jailbreaking via Dynamic Contextual Representation Ablation
- 2026Decodability is Not Causality: Dissociating Probe Readouts from Behavioral Drivers via SAE Decomposition
- 2025Lessons from Neuroscience for AI: How integrating Actions, Compositional Structure and Episodic Memory could enable Safe, Interpretable and Human-Like AI
- 2026Mitigating Adaptive Attacks against Reasoning Models with Activation Consistency Training
- 2026Linear Separability of Activation Representations after Supervised Fine-Tuning on Incorrect Responses: A Study of Synthetic Dishonesty in Large Language Models
- 2025Neural Chameleons: Language Models Can Learn to Hide Their Thoughts from Unseen Activation Monitors