Note: This is a research update sharing preliminary results as part of ongoing work.

Summary & Main Results

Understanding how concepts are represented in LLM internals would be extremely useful for AI safety (generally understanding AI's thinking, AI control and monitoring, retargeting the search). We assume that concepts are represented as directions in activation space (“features”). The most popular feature-finding approach, sparse dictionary learning via sparse autoencoders, suffers from strong dataset dependence (e.g. Heap et al. 2025, Kissane et al. 2024, Heimersheim 2024). It is thus unclear whether the directions they find reflect the model's computations or properties of the training distribution.

Instead, we propose identifying feature directions by perturbing activations along a direction and using the model's response to judge whether the direction corresponds to a feature (following Mack & Turner 2024, Heimersheim & Mendel, 2024). We hypothesize that perturbations into random directions are suppressed, as they only produce interference noise along feature directions, while perturbations into feature directions create a focused perturbation and elicit a strong model response. If this is the case, we should see a longer suppression region for random directions than for feature directions.

Our novel contribution is that we test this hypothesis using contrastive probing/steering vectors. We construct contrastive vectors (difference-of-means) for language (English→Mandarin), programming language (Python→Haskell), and gender (male→female) across different model families (Gemma 2-9B, Llama 3.1-8B, and Qwen 3-1.7B). We then perturb the models into contrastive-, SAE feature- and random directions[1], and compare the model responses shown in Figure 1. We find that contrastive directions indeed elicit a much stronger response, while SAE features and random directions require much larger magnitudes for a similar response strength. To our knowledge, this is the first example of candidate features eliciting qualitatively different model responses. (Though Mack & Turner 2024 previously showed something close to the inverse: that directions which elicit different model responses often behave like steering vectors.)

Figure 2 shows perturbation curves for two additional contrastive vectors (male→female, Python→Haskell) and two additional models (Llama 3.1-8B, Qwen 3-1.7B) which produce equivalent results. In all cases we perturb activations at an early residual stream layer[2]. We keep the activation norm constant and perturb at constant angular speed (following Heimersheim & Mendel, 2024). We measure the model response as the L2 distance between perturbed and unperturbed activations at the second-to-last layer. We show all individual response curves as thin lines, and the median as thick lines.

Across all combinations, we observe that perturbing along the difference-of-means direction breaks through the suppression region at much smaller magnitudes than perturbing along random directions or SAE features. Perturbations into SAE feature directions look similar to random perturbations in most cases.

Interpretation: We see point 1. as our main contribution; points 2. and 3. are consistent with past activation plateau literature.

The fact that contrastive vectors, which are our best guess for some true feature directions, show a different response curve makes us hopeful that this activation perturbation-based agenda has a chance at identifying model features!
Our SAE results (confirming Lee & Heimersheim 2024 and Giglemiani et al. 2024) show that SAE directions aren’t treated specially by the model. This is evidence against SAEs finding the true computational features of a model.
The observation of an initial “activation plateau” (confirming Heimersheim & Mendel, 2024, Janiak et al. 2024, Shinkle & Heimersheim 2025) might be evidence of error correction as proposed by Hänni et al., 2024 (though see @LawrenceC's comment here).

Introduction

Understanding how LLMs represent concepts internally would be extremely useful for AI safety as it would allow for a deeper understanding of model behaviour and better alignment research feedback loops, monitoring model cognition for undesired processes (e.g. sophisticated lie detection, AI control), and potential future alignment ideas (e.g. retarget the search).

We assume that concepts are represented as directions in activation space (Olah, 2024). Under superposition (Elhage et al. 2022), a model represents many more features than it has dimensions. This means that features cannot be fully orthogonal, and hence a perturbation along a feature direction will also have components along other feature directions (“interference”). Hänni et al., 2024 claim that, to perform meaningful computation in superposition, interference must be suppressed, i.e., the model must implement some form of error correction.

The most popular feature-finding approach, sparse dictionary learning via sparse autoencoders, suffers from strong dataset dependence (e.g. Heap et al. 2025, Kissane et al. 2024, Heimersheim 2024). It is unclear whether the directions it finds reflect the model's computations, or properties of the training distribution. This motivates finding a data-independent test for whether directions are computationally meaningful.

If a model implements error correction (or otherwise is robust to interference noise), the sensitivity of activations to perturbations should be anisotropic: perturbations into most directions should be treated as interference noise and hence have little downstream effect, while perturbations specifically targeting a feature direction would have a much larger effect at low magnitudes. Since feature directions are a small fraction of all directions, random directions should behave like interference noise, and hence feature directions should elicit responses at smaller perturbation magnitudes than random directions.

Previous work (Heimersheim & Mendel, 2024, Janiak et al. 2024, Shinkle & Heimersheim 2025) has observed that the downstream response to perturbations of a transformer's activations is in fact suppressed for small perturbation magnitudes ("activation plateaus"). Lee & Heimersheim 2024 found that perturbations into SAE directions are also suppressed. Mack & Turner 2024 directly optimized directions to have a large downstream effect, and found them to act as steering vectors. Here we attempt to find other directions with a large downstream effect (features), without directly optimizing for such an effect.

Setup

We perturb model activations along candidate directions at an early layer and measure the downstream response at a late layer. We compare three types of directions: contrastive (difference-of-means), SAE features, and random. We now describe the experimental setup in detail.

Models, layers and metrics. We run experiments on three models from different families: Gemma 2-9B, Llama 3.1-8B, and Qwen 3-1.7B. We perturb their activations at an early residual stream layer: layer 2 for Gemma and Llama, layer 7 for Qwen. These are the earliest layers for which we had access to SAEs for each model. It is desirable to perturb as early as possible as prior work has shown that the suppression effect is more pronounced the more layers there are between perturbation and measurement (Shinkle & Heimersheim, 2025). For all models we measure the downstream response at the second-to-last residual stream layer as the L2 distance between perturbed and unperturbed activations.

Perturbation method. All perturbations are performed on a hypersphere, i.e., keeping the activation norm constant, to isolate the effect of direction from that of norm. We perturb at constant angular speed: the x-axis of our plots shows the angle (in degrees) between the original and perturbed activation. We always perturb at the last token position.

Contrastive directions. We construct contrastive vectors as the difference of mean activations between two classes of thirty semantically matched prompts, i.e., prompts that differ only along one concept (e.g., "The sun rises in the" in English and Mandarin). We do this for English vs. Mandarin text, Python vs. Haskell code, and male vs. female. We then perturb activations of ten held-out prompts from one class along the contrastive direction toward the other (e.g., English activations perturbed toward Mandarin).

SAE directions. For each held-out activation (e.g., an English prompt), we identify the SAE features that activate most strongly on that input and perturb along ten of them. We also tested SAE features selected at random from the full dictionary, and features that activate strongly on the opposite class (e.g., Mandarin-activating features applied to English activations); the results were similar.

Random directions. We construct random directions as differences between activations of randomly sampled FineWeb prompts. Random directions constructed in this way are biased towards high-variance directions in activation space, making them a stronger baseline than uniformly sampled random vectors in activation space (Heimersheim & Mendel 2024).

Extra Results & Robustness Checks

Our main results are described in the Summary & Main Results section. Here, we present variations and ablations on the experimental setup to confirm our results are robust to these choices.

First, we perform additive perturbations rather than spherical, i.e., without keeping the norm fixed and at constant linear step size rather than constant angular step size. In Figure 3 we show that our results hold across this variation, suggesting that activation norm dynamics were not driving the effect.

Second, we measure the downstream effect using metrics other than L² distance in activation space: KL-divergence in logits, and cosine distance at the same residual stream layer (defined as 1 - cosine similarity). KL-divergence measures the effect on the model's output distribution rather than on internal activations, while cosine distance isolates the directional component of the downstream change from its magnitude. Again our results remain consistent, as shown in Figure 4.

Finally, we perturb at a later layer, namely layer 8 rather than layer 2. Prior work has shown that the suppression effect sharpens the more layers there are between perturbation and measurement (Shinkle & Heimersheim, 2025). As expected, we find that perturbing at layer 2 yields stronger plateaus than perturbing at layer 8, but the difference between contrastive and other directions remains clear (Figure 5).

The results remain consistent across all variations, supporting the robustness of our findings.

Code and Data

All code and data supporting this post are available at github.com/FranciscoHS/contrastive-vs-sae-perturbation.

Future Work

We're excited about following up on this work along three main directions:

We might have a test for whether a direction is a feature. What can we do with it? An obvious example is using our test as an unsupervised optimization criterion for finding feature-like directions (e.g. additional SAE loss terms; MELBO extensions). We’re keen on other ways to make use of this test!
We've looked at our results from an error correction perspective. Can we distinguish the error correction explanation (in the Computation in Superposition sense) from other robustness explanations (e.g. @LawrenceC's comment here)? Can we test theories of computation in neural networks? Does error correction predict scaling laws, e.g. for the model response as a function of the number of perturbed features?
Can we test assumptions about the geometry of activation space, in the context of activation plateaus? Are feature representations discrete (e.g. binary) or continuous? Does the set of activations lie on a vector space or a (non-Euclidean) manifold?

Acknowledgements

This work was funded by the Pivotal Fellowship.

Thanks to Ariel Gil, Reilly Haskins, Arnau Marin-Llobet, Motahareh Sohrabi, Zheng (Zack) Hui and Andrew Mack for helpful discussions.

^{^}
We construct random directions by randomly sampling FineWeb prompts and computing the difference between their activations.
^{^}
Layer 2 for the Gemma and Llama models, 7 for Qwen. Layer 7 is the earliest layer for which we had access to an SAE for the Qwen model.