Treating automated red-teaming as value estimation let a linear probe read off future risk and raised peak audit scores by roughly 50 percent across 18 behaviours and 3 model scales
AspireAI community · arXiv (Jao, Lampinen)
Automated red-team auditing of language models implicitly searches a tree of possible conversation pathways, where at each turn an auditor model picks which conversation to continue and an LLM judge scores the dialogue. This paper reframes that as a Markov decision process - states are conversation histories, actions are candidate responses, rewards are judge scores for the target behaviour - and the key finding is that the value of a state, its likelihood of leading to problematic behaviour, can be estimated by linear probing from the target model's activations to predict discounted future rewards. The authors call this Value Probes, and using them as a heuristic inside a beam-search audit substantially improves auditing success: across 18 target behaviours and 3 scales of models, peak audit scores rise by roughly 50 percent against token-matched standard auditing. Value Probes can also be fit using off-policy data from smaller models, and the ablations show the method is a comparably performant and more efficient alternative to expensive language model follow-ups. The limitation is that the reward signal is still an LLM judge - the search got better, but the target it optimizes against remains a judgement call.
Read the story and explore more from the AspireAI community.
Two sparse-autoencoder analyses have resisted scaling: matching semantically similar features across layers, and compressing large feature circuits into interpretable supernodes. This paper argues both are the same underlying problem, estimating semantic distances between SAE features that sit on different activation manifolds. Its representation treats each feature not as a single decoder vector but as an activation-weighted distribution over the hidden states expressing it, projects those distributions into a shared reference space, and compares them with Wasserstein distance. The representation is proved invariant to activation rescaling and stable under perturbation, and recovers true matches under finite-sample margin conditions. Empirically it outperformed decoder-vector and LLM-based baselines and captured subtle functional distinctions between related features, and it compressed large feature circuits into interpretable supernodes automatically. The limitation is that this is interpretability tooling: the paper demonstrates better feature matching and circuit compression, not that downstream interpretability claims become more accurate.