mlsanityData to 7 Oct 2026

Exemplar Partitioning for Mechanistic Interpretability

arXiv 2605.14347 ↗First posted 14 May 2026cs.LGcited by 0

On the map: LLM safety and security → Machine unlearning

Abstract (arXiv)

We introduce Exemplar Partitioning (EP), an unsupervised method for building interpretable feature dictionaries from large language model activations. An EP dictionary is a Voronoi partition of activation space, built by leader-clustering streamed activations within a distance threshold. Each region is defined by an observed exemplar and an average of its member activations, which define region membership and provide directions for intervention. Dictionary size is determined by the activation stream at the chosen threshold rather than pre-selected. Exemplars link regions to observed inputs, allowing dictionaries built from the same input stream to be compared across layers, training checkpoints, and architectures. We demonstrate how EP can be used to interpret and intervene on model behaviour, track changes in activation space through training, and detect hidden concepts. Comparing EP dictionaries on base and instruction-tuned Gemma-2-2B and Llama-3.1-8B reveals that instruction tuning reorganises harmful prompt activations similarly across the two models, but at different granularities. Interventions on these regions make both models answer harmful requests they previously refused. In 19 of 21 Taboo models trained to hide a secret word, EP finds new regions that do not exist in the base model, whose decoded tokens relate to the known secret on inspection. Although EP assigns each token to a single region, linear probes built from EP regions achieve up to 90.5% of full-activation probe accuracy. On AxBench concept detection at Gemma-2-2B-it layer 20, EP achieves the highest mean AUROC of all unsupervised methods (0.937), outperforming SAE-A (0.911) and approaching supervised probes (0.946). Building EP dictionaries is fast and cheap: EP uses ~ 103 times fewer construction tokens than comparable SAEs.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Machine unlearning, one of 12 directions in LLM safety and security. Builds on 39 of its 55 references that are in the map. First posted on arXiv 14 May 2026.

Builds on

39 of 55 references.

References · 39

  1. 2017Neural Discrete Representation Learningcited by 4,650
  2. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  3. 2020The Pile: An 800GB Dataset of Diverse Text for Language Modelingcited by 2,346
  4. 2018A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attackscited by 1,472
  5. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  6. 2020Energy-based Out-of-distribution Detectioncited by 1,296
  7. 2016Understanding intermediate layers using linear classifier probescited by 1,279
  8. 2023Representation Engineering: A Top-Down Approach to AI Transparencycited by 1,239
  9. 2022Interpretability in the Wild: a Circuit for Indirect Object Identification in GPT-2 smallcited by 1,130
  10. 2023Steering Llama 2 via Contrastive Activation Additioncited by 1,009
  11. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 960
  12. 2021Probing Classifiers: Promises, Shortcomings, and Advancescited by 831
27 more
  1. 2019Generalization through Memorization: Nearest Neighbor Language Modelscited by 788
  2. 2019How Contextual are Contextualized Word Representations? Comparing the Geometry of BERT, ELMo, and GPT-2 Embeddingscited by 770
  3. 2023Towards Automated Circuit Discovery for Mechanistic Interpretabilitycited by 700
  4. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 494
  5. 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generationcited by 439
  6. 2024Mechanistic Interpretability for AI Safety -- A Reviewcited by 415
  7. 2024Gemma Scope: Open Sparse Autoencoders Everywhere All At Once on Gemma 2cited by 381
  8. 2024A StrongREJECT for Empty Jailbreakscited by 352
  9. 2024Jumping Ahead: Improving Reconstruction Fidelity with JumpReLU Sparse Autoencoderscited by 283
  10. 2024Not All Language Model Features Are One-Dimensionally Linearcited by 201
  11. 2025AxBench: Steering LLMs? Even Simple Baselines Outperform Sparse Autoencoderscited by 199
  12. 2022Relative representations enable zero-shot latent space communicationcited by 175
  13. 2025Open Problems in Mechanistic Interpretabilitycited by 173
  14. 2021All Bark and No Bite: Rogue Dimensions in Transformer Language Models Obscure Representational Qualitycited by 150
  15. 2025SAEBench: A Comprehensive Benchmark for Sparse Autoencoders in Language Model Interpretabilitycited by 118
  16. 2025The Geometry of Refusal in Large Language Models: Concept Cones and Representational Independencecited by 104
  17. 2025Sparse Autoencoders Trained on the Same Data Learn Different Featurescited by 86
  18. 2025LLMs Encode Harmfulness and Refusal Separatelycited by 75
  19. 2024The Geometry of Concepts: Sparse Autoencoder Feature Structurecited by 52
  20. 2025Overcoming Sparsity Artifacts in Crosscoders to Interpret Chat-Tuningcited by 31
  21. 2024Refusal in LLMs is an Affine Functioncited by 26
  22. 2024Quantifying Feature Space Universality Across Large Language Models via Sparse Autoencoderscited by 25
  23. 2025Eliciting Secret Knowledge from Language Modelscited by 23
  24. 2024Mechanistic Permutability: Match Features Across Layerscited by 21
  25. 2026Cross-Architecture Model Diffing with Crosscoders: Unsupervised Discovery of Differences Between LLMscited by 12
  26. 2026From Directions to Regions: Decomposing Activations in Language Models via Local Geometrycited by 10
  27. 2026Understanding Unreliability of Steering Vectors in Language Models: Geometric Predictors and the Limits of Linear Approximationscited by 3

Built on by

Not cited yet.