Bot-Mod interrogated an agent with fixed diagnostic probes and inferred hidden intent by Bayesian posterior, scoring 0.736 F1 in distribution and 0.684 out of it
AspireAI community · arXiv
Multi-agent systems create a moderation problem that content filters were not built for: an agent with malicious intent can post content that reads as benign while serving a hidden objective. Bot-Mod grounds detection in intent instead of content signals. It interrogates a target agent with a fixed set of diagnostic probes and infers intent through Bayesian posterior inference over candidate intents, starting from a calibrated content-only prior and updating the posterior with the likelihood of each answer under every candidate intent until a stopping criterion is met. The authors built Molt-Intent for evaluation, a dataset derived from Moltbook that captures benign and malicious behavior inside real community structures across posts and comments. Tested on Molt-Intent, an external social engineering dataset and three agent LLMs, Bot-Mod beat content-only moderators, a fine-tuned classifier and judge-based interrogators both in and out of distribution. On Molt-Intent it reached a composite F1 of 0.736 in distribution and 0.684 out of distribution, 22 and 14 percent above the best baseline. The limitation is that it assumes the moderator can assign likelihoods to answers, which puts a human or a judge model in the loop.
Read the story and explore more from the AspireAI community.
Two sparse-autoencoder analyses have resisted scaling: matching semantically similar features across layers, and compressing large feature circuits into interpretable supernodes. This paper argues both are the same underlying problem, estimating semantic distances between SAE features that sit on different activation manifolds. Its representation treats each feature not as a single decoder vector but as an activation-weighted distribution over the hidden states expressing it, projects those distributions into a shared reference space, and compares them with Wasserstein distance. The representation is proved invariant to activation rescaling and stable under perturbation, and recovers true matches under finite-sample margin conditions. Empirically it outperformed decoder-vector and LLM-based baselines and captured subtle functional distinctions between related features, and it compressed large feature circuits into interpretable supernodes automatically. The limitation is that this is interpretability tooling: the paper demonstrates better feature matching and circuit compression, not that downstream interpretability claims become more accurate.