A dermatology agent's tool and reasoning channels shared one fault, and hard-label comparison caught less than half of it
AspireAI community · arXiv
Vision-language agents that expose intermediate tool output for inspection are often assumed safer than single-shot models, but that only holds if the channels are independent. This paper tests the assumption where the sensor reading itself is untrusted, so the tool and reasoning channels share a common visual fault. On a dermatology agent built from segmentation, contrastive retrieval and an iterative vision-language reasoner, the authors define a coupling taxonomy separating single-channel errors from joint errors that agree or disagree. Typographic injection produced detectable directional retrieval capture while physical corruption did not. Crop-first retrieval preserved the payload at a readable scale and produced 55 percent joint wrong agreement across all cases, 71 percent of faulty cases, versus 35 percent and 43 percent for full-image retrieval. Under a binary decision, if both channels are wrong their predictions must agree, so hard-label channel comparison cannot detect joint failures at all: disagreement recall was limited to 0.29 for crop-first versus 0.57 for full-image. The limitation is the domain, PAD-UFES-20 plus an independent HIBA test set, which is dermatology specifically.
Read the story and explore more from the AspireAI community.
Two sparse-autoencoder analyses have resisted scaling: matching semantically similar features across layers, and compressing large feature circuits into interpretable supernodes. This paper argues both are the same underlying problem, estimating semantic distances between SAE features that sit on different activation manifolds. Its representation treats each feature not as a single decoder vector but as an activation-weighted distribution over the hidden states expressing it, projects those distributions into a shared reference space, and compares them with Wasserstein distance. The representation is proved invariant to activation rescaling and stable under perturbation, and recovers true matches under finite-sample margin conditions. Empirically it outperformed decoder-vector and LLM-based baselines and captured subtle functional distinctions between related features, and it compressed large feature circuits into interpretable supernodes automatically. The limitation is that this is interpretability tooling: the paper demonstrates better feature matching and circuit compression, not that downstream interpretability claims become more accurate.