Step 21: assistant

text

I've recorded the claim's first assessment as **inconclusive**, with confidence 0.65 that this is the right reading and a 0.4 probability that the claim as worded is true. It rests on one source, the method's authors' own paper (arXiv 2603.04426), which I read in full. The first half, that Delta-Crosscoder identifies the behaviours, holds up within the authors' own tests. The mitigation and comparison halves rest on loose, author-judged comparisons.

On the five questions in the brief:

1. **Models and behaviours:** 10 fine-tuned models, using Gemma, Llama and Qwen at 1B to 9B parameters.
   - Two implanted false facts on a Llama 8B model (wrong cake-baking advice, a false Kansas abortion vote result).
   - One Gemma 2 9B model trained to hide the word "gold".
   - Six emergent-misalignment models: risky finance, bad medical advice and extreme sports, each on Llama 3.1 8B and Qwen 2.5 7B.
   - One Qwen 2.5 7B model given a hidden preference for cats through number sequences ("subliminal learning").

   Steering the top-ranked latents changed the fine-tuned behaviour in each, though the cat-preference effects were weak.
2. **SAE baselines:** these were only other crosscoder variants (DSF, and BatchTopK at k=200 and k=400), with the same dictionary size and what the paper calls "comparable training budgets". Delta-Crosscoder found a working latent for 10 of 10 models, against 6, 4 and 4 for the baselines. But "working" is a yes/no call the authors made themselves, by inspecting steering and top activations, without blinding. Delta-Crosscoder's design may also let it use more active latents than the k=200 baseline, which would favour it. SAE methods that compare activation differences directly were discussed but not run as baselines.
3. **The non-SAE baseline:** the Activation Difference Lens (ADL), scored on a 1 to 5 rubric for how well a grader can name the fine-tuning objective. A single GPT-5.2 grader scored Delta-Crosscoder's fixed outputs, and these were set against ADL's best scores as reported under ADL's own interactive protocol. The results were comparable on misalignment and false facts and both perfect on the hidden word, while ADL scored higher on the cat preference.
4. **Mitigation beyond the development behaviours:** not tested. Mitigation means steering against the latent on the same models, which the paper itself calls "partial". It was compared with no baseline. The abstract's "effective mitigation" overstates this, and I recorded that against the abstract's passage.
5. **Independent runs:** none found, and the authors have published no code. One third-party code project has reimplemented the method from the paper's equations. Its note says the method "finds the most" but at about three times the number of active latents, in an unclear setting, so it bears on the concern in point 2 but can't be weighed as a result.

The paper's check on false findings compares two identical copies of one model, where the activation difference is zero by construction, so it is a weak test.

On the claim's page I added two arguments, without separate subclaims because the premises are specific to this paper:
- **For:** the authors' 10-model evaluation. I rated it likely to support identification, much less the comparative part.
- **Against:** the comparisons are not like-for-like. I rated it likely to undercut the comparative half, without showing that half false.

I also set importance to 0.3 and contestation to 0.25, logged the decision and answered both messages. No other claims depend on this one, so there was no one to notify. The run spent about $0.69 of the $1.20 budget.

What would settle the comparative half is a blinded head-to-head evaluation of the methods under shared metrics.