{"id":"e7294150-d70c-419e-903f-5dbe21bec462","arxiv_id":"2602.12418","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":7,"one_line_summary":"CC-Delta defends LLMs against jailbreaks by statistically selecting and steering sparse-SAEs features that change when harmful prompts are embedded in jailbreak contexts, outperforming dense activation steering across four models and twelve attacks.","lead":"This paper introduces an inference-time jailbreak defense that steers a small set of sparse-autoencoder features chosen by comparing harmful prompts with and without jailbreak wrappers. Across four open LLMs and twelve attacks it reports better safety-utility tradeoffs than dense activation steering, especially on unseen attack types.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"No validation split for Eq. (3): phi* is chosen on the same evaluation set used to plot safety–utility curves, so CC-Delta's reported OOD advantage over CAA may be a selection artifact.","rationale":"The paper has genuine strengths: a clear method, multi-model evaluation, ablations, and use of publicly available SAEs. The central comparison, however, depends on selecting inference-time hyperparameters on the same evaluation set used to draw the safety–utility curves. This is not a limitation acknowledged in Section 8; it is a methodological gap that directly inflates the headline 'clearly outperforms' and the OOD generalization claim. The reader flagged this as a weakest assumption, and I agree. I also considered other potential issues—dependence in the Wilcoxon tests due to repeated harmful requests across wrappers, possible base/instruct SAE mismatch, and absence of error bars—but the selection-on-test issue is the most load-bearing because it alone could explain the reported advantage over CAA. The proposed test is straightforward and would settle the concern. The appropriate verdict remains CONDITIONAL: the method deserves follow-up validation with a proper validation split and, ideally, adaptive attacks and released code.","tokens_in":23426,"tokens_out":5044,"duration_ms":47817,"concrete_test":"Create a validation split from the existing test set (or collect fresh attacks) with the same attack-type mix. For each threshold v, select phi* on the validation set using Eq. (3) (for CC-Delta, CAA, and LinearAcT), then evaluate once on the held-out test set. Compare CC-Delta vs CAA OOD safety at matched utility. If CC-Delta still exceeds CAA by a meaningful margin (e.g., ≥5pp safety at ≤5pp utility loss) on the never-seen test set, the central claim holds; otherwise the reported advantage is a selection artifact.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 4.2 defines phi* via Eq. (3) as the configuration maximizing safety subject to a utility-degradation bound, with no held-out validation set described. The reported safety–utility curves (Figures 1–3, Table 2) are therefore in-sample upper envelopes: safety and utility are measured on the test prompts used to select phi*. CC-Delta explores a 2D grid (feature count × strength, Section 5.3) while CAA has a single strength parameter, so the selection bias is larger for CC-Delta. The OOD claim is most exposed: phi* is selected using OOD safety/utility on the same one held-out wrapper and six re-writer attacks that are then reported as generalization. Section 8 further notes adaptive/optimized attacks are excluded. If phi* were chosen on a separate validation split, the 'clearly outperforms' gap could shrink or disappear.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes CC-Delta, an inference-time jailbreak defense that operates in sparse autoencoder (SAE) latent space. Feature selection is performed by comparing token-matched activations of the same harmful request with and without a jailbreak wrapper, applying a ubiquity filter, one-sided Wilcoxon tests with BH-FDR correction, and ranking by standardized median shift. At inference, the selected SAE features are shifted by the mean paired difference, scaled by a multiplier. The method is evaluated on four instruction-tuned models and twelve attacks from StrongReject/AdvBench, with one wrapper and all re-writer attacks held out for OOD evaluation. Baselines include dense activation steering (CAA, LinearAcT), fine-tuning defenses (CB, LAT), and a prompt defense (Self-Reminder). The paper reports comparable-or-better safety–utility tradeoffs than dense steering and a particular advantage on OOD attacks.","tokens_in":23663,"tokens_out":7327,"duration_ms":69682,"significance":"If the empirical claims hold, the paper shows that off-the-shelf interpretability SAEs can be repurposed as practical inference-time jailbreak defenses without task-specific training, and that sparse-space steering can generalize to attack types not used for feature selection. The work is timely and relevant to the safety community. Strengths include the systematic evaluation across four models and several SAE architectures, a clear ablation isolating the token-matching and statistical-ranking components, a documented parameter sweep, and an unusually candid limitations section. The central comparison, however, depends on a configuration-selection protocol that appears to use the test set for both selection and reporting, and the OOD evidence is narrower than the abstract suggests. These issues are fixable but currently make the headline comparison difficult to interpret.","major_comments":[{"comment":"The configuration phi* is selected by maximizing Safety(phi) subject to a utility-degradation bound, but the paper describes no validation split: it only states a 50/50 train/test split (§4.1). If Eq. (3) is evaluated on the same test set that is then used to draw the safety–utility curves in Figures 1–3 and Table 2, those curves are in-sample upper envelopes. Because CC-Delta explores a 2D grid (feature count × strength, §5.3) while CAA and LinearAcT have a single strength parameter, selection bias is greater for CC-Delta. This is most damaging for the OOD claim: if the Safety term in Eq. (3) is computed over the one held-out wrapper and six re-writer attacks that are later reported as OOD generalization, the reported OOD advantage is partly a selection artifact. Please select phi* on a separate validation split and report test-set results for that phi*, or report both validation-select","section":"§4.2, Eq. (3)"},{"comment":"The OOD generalization claim is based on a narrow set of attack templates: one held-out wrapper and six re-writer attacks, five of which are variants of the same PAP persuasion family. Section 8 explicitly excludes adaptive, gradient-based, or optimized attacks. The abstract's statement that CC-Delta 'clearly outperforms' dense mean-shift steering 'particularly against out-of-distribution attacks' is stronger than this evidence supports. The limitation is acknowledged, but the headline should be tempered or the evaluation extended to at least one additional structurally distinct held-out attack family and, ideally, a non-adaptive but optimized attack baseline.","section":"§5.2 and §8"},{"comment":"No uncertainty quantification is provided anywhere in the empirical results: no error bars, confidence intervals, multiple seeds, or statistical tests over prompt subsets. Some of the reported advantages are small (e.g., Table 2, gemma-2-2b-it: cc-delta@10 vs caa@10 differ by 2.9 safety points while utility differs by 0.2 points). Without error bars it is not possible to determine whether the differences central to the paper's claims are meaningful. Please add bootstrap confidence intervals over prompts or repeated evaluations (e.g., different random seeds for sampling and generation), and use them in the comparisons.","section":"§4.2, Table 2, Figures 1–3"}],"minor_comments":[{"comment":"The abstract says CC-Delta 'clearly outperforms dense mean-shift steering on all four models,' but Appendix D.2 states CAA outperforms CC-Delta for in-distribution attacks on Gemma-2-9b-it. This ambiguity should be resolved by specifying that the claim refers to overall or OOD settings, or by adjusting the wording.","section":"Abstract / §D.2"},{"comment":"The first sentence says 'We use the following six wrapper jailbreak attacks' but the section is about re-writer attacks; this should be corrected.","section":"§B.2"},{"comment":"The threshold list '{.05, .10,0.15, .20, .30. . . ,1.0}' has inconsistent spacing and is missing the intermediate threshold .25 if the intention was a uniform grid; please clarify the exact set.","section":"§4.2"},{"comment":"The notation D is used both for the 'dataset of paired differences' and as the collection {D_f} of per-feature differences; this is confusing. Use a different symbol for the dataset, e.g., {d^{(i)}}, to keep the description of the Wilcoxon test and the mean-shift vector unambiguous.","section":"§3.1, Eq. (1)"},{"comment":"The two 'Anonymous' concurrent ICML submissions (Anonymous, 2026a;b) should be resolved or removed in a non-anonymized venue; citing anonymous works as related work prevents readers from assessing novelty overlap.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is likely from the same group as the LinearAcT baseline (Rodriguez et al., 2025a), since three of the present authors are co-authors of that paper. This is not disqualifying, but the comparison should be described with an explicit conflict-of-interest note. Additionally, the two 'Anonymous' concurrent ICML submissions cited in Section 6 are likely the authors' own work; in a non-anonymous venue this should be disclosed. Finally, although the paper does not promise code release, providing code and a validation-split protocol would substantially increase the confidence in the empirical claims."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Read this one. CC-Delta is a genuinely practical idea: use off-the-shelf SAEs, find features whose activations shift when a harmful request is wrapped in a jailbreak, and steer on those at inference time. The feature-selection pipeline — paired token-level differences, ubiquity filtering, directional Wilcoxon tests with FDR, and standardized median ranking — is new and clearly explained. The ablations are the best part: they show both the token matching and the statistical ranking matter, and that applying the same token-conditioning to dense CAA does not help. That tells you the sparse space is doing real work, not just the selection rule.\n\nThe empirical breadth is decent: four models, twelve attacks, and a systematic 2D parameter sweep. The finding that effective mitigation requires tens to hundreds of features is useful and helps reconcile with earlier negative SAE-steering results. The paper is honest about its limitations — no adaptive attacks, substring constraint for training, and the feature interpretability table is refreshingly candid about how unmysterious the selected features look.\n\nWhere I would push back: the evaluation protocol for the safety-utility curves is in-sample. Equation (3) chooses the configuration phi* on the same evaluation set that is then used to plot the curves, and no validation split is described. Since CC-Delta sweeps a 2D grid while CAA sweeps a single strength parameter, the selection bias is larger for CC-Delta. The OOD claim is the most exposed: the one held-out wrapper and six re-writer attacks are used both to select phi* and to report generalization. I don't think the headline effect is fake — the gap is large and consistent across four models — but the magnitude is probably optimistic without a held-out validation split or error bars. Also, the abstract's 'without task-specific training' overstates things; the method does require a set of paired harmful/jailbreak prompts. And the related-work citation of two anonymous concurrent ICML submissions plus a baseline from the same group (LinearAcT) is worth flagging to the authors — likely fine, but it needs transparency.\n\nNet: this is a real contribution that deserves referee time. I'd ask for a validation split for hyperparameter selection, error bars or multiple seeds, and ideally an adaptive-attack evaluation before publication. Those are fixes, not flaws in the core idea.","headline":"CC-Delta is a solid, useful extension of mean-shift steering into SAE space with a novel statistical feature-selection step; the OOD advantage is plausible but likely somewhat inflated by selecting operating points on the same test set.","tokens_in":24171,"tokens_out":2188,"would_cite":true,"duration_ms":22096,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Steering sparse SAE features outdoes dense jailbreak defenses","keywords":["sparse autoencoders","jailbreak defense","activation steering","inference-time intervention","feature selection","statistical testing","out-of-distribution generalization","safety-utility tradeoff"],"falsifier":"Run CC-Delta against an adversarial/optimized jailbreak (e.g., a gradient-based or adaptive attack) on a held-out model, with parameters selected on a separate validation set. If safety gains vanish without severe utility loss, the OOD generalization claim is falsified.","tokens_in":23317,"feed_emoji":"🛡️","tokens_out":4343,"duration_ms":39457,"temperature":0.7,"pith_summary":"This paper argues that jailbreak attacks on instruction-tuned LLMs can be mitigated at inference time by steering in sparse autoencoder (SAE) feature space rather than in the models' dense activation space. It introduces CC-Delta, which selects features by statistically comparing token-level SAE activations of the same harmful request with and without jailbreak context, then applies a mean shift to those features during generation. Across four models and twelve attacks, CC-Delta claims comparable or better safety-utility tradeoffs than dense-space steering baselines, with the largest gains on out-of-distribution attacks. If correct, off-the-shelf SAEs trained for interpretability could serve as practical, training-free jailbreak defenses.","feed_headline":"Steering sparse SAE features outdoes dense jailbreak defenses","feed_subtitle":"Steering jailbreak-sensitive SAE features blocks attacks while preserving model utility across four LLMs.","key_machinery":"CC-Delta's mechanism is a three-part pipeline: (1) token-matched paired differences—for each training example, mean-pooled SAE activations of the harmful-request tokens are subtracted from those of the same tokens inside the jailbreak prompt; (2) statistical feature selection—features with near-universal shifts are discarded, one-sided Wilcoxon tests with Benjamini-Hochberg FDR correction keep features that shift significantly in one direction, and survivors are ranked by standardized median shift; (3) inference-time mean-shift steering—the top-n selected features receive a scaled mean-shift delta in SAE latent space, the modified latent is decoded, and the SAE reconstruction error is added","core_discovery":"The central claim is that jailbreak-relevant concepts are more separable in sparse SAE feature space than in dense residual-stream space. CC-Delta identifies features whose activations consistently change when a harmful request is embedded in a jailbreak wrapper, using a Wilcoxon signed-rank test with FDR correction and ranking by standardized median shift. Steering only those features—often tens to hundreds—with a mean-shift bias at inference restores refusal behavior without retraining. The paper reports that this sparse-space steering outperforms dense mean-shift steering (CAA) on all four evaluated models, particularly on held-out wrappers and re-writer attacks, and that the method's saf","pith_inferences":["The paper compares methods by selecting each method's best configuration on the same evaluation set; a fairer comparison with a held-out validation split might reduce CC-Delta's apparent margin over dense baselines.","The OOD claim rests on feature transfer across attack styles; testing against adaptive or gradient-based attacks, which the paper explicitly excludes, would stress whether the selected features are truly attack-agnostic or just robust to template variation.","Since the top selected features are mostly features suppressed by jailbreak context, a natural extension is to intervene by amplifying those features rather than shifting along the mean difference, which might yield different tradeoffs.","Task-specific SAEs trained on jailbreak data could improve feature quality and further narrow the gap to fine-tuning defenses."],"forward_implications":["If correct, deployed LLMs can gain a jailbreak defense that requires no fine-tuning, only a pretrained SAE and paired prompt data.","The OOD results imply that features identified from wrapper attacks transfer to re-writer and unseen template attacks, making the defense robust to attack types not seen during selection.","The 2D parameterization offers finer-grained control over safety vs. utility than dense steering, allowing operators to set an acceptable utility budget.","The method's reliance on paired prompts rather than model generations makes it reproducible and scalable to new models with existing SAE suites."],"fun_headline_variants":["Sparse SAE features beat dense for jailbreak blocking","Why sparse autoencoder features stop jailbreaks better","SAE steering: sparse wins over dense jailbreak defense","Off-the-shelf SAEs repurposed as jailbreak shields","Sparse feature steering outperforms dense for LLM safety"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The method's advantage over dense steering depends on the assumption that its two inference-time parameters can be tuned on the evaluation set itself, and that features selected from wrapper attacks will transfer to fully rewritten prompts and unseen attack templates.","fun_headline_variants_meta":{"raw":{"variants":["Sparse SAE features beat dense for jailbreak blocking","Why sparse autoencoder features stop jailbreaks better","SAE steering: sparse wins over dense jailbreak defense","Off-the-shelf SAEs repurposed as jailbreak shields","Sparse feature steering outperforms dense for LLM safety"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000131,"raw_usage":{"total_tokens":940,"prompt_tokens":691,"completion_tokens":249,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":435,"completion_tokens_details":{"reasoning_tokens":182}},"tokens_in":435,"tokens_out":249,"duration_ms":2931,"temperature":1.0,"reasoning_tokens":182,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-02T23:48:28.391755+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run CC-Delta against an adversarial/optimized jailbreak (e.g., a gradient-based or adaptive attack) on a held-out model, with parameters selected on a separate validation set. If safety gains vanish without severe utility loss, the OOD generalization claim is falsified.","supporting_citations":[],"review_version":1}