{"slug": "backdooring-sparse-autoencoders", "title": "Backdooring Sparse Autoencoders", "summary": "A paper submitted to arXiv on 5 October 2026 introduces a decoder-only sparse autoencoder (SAE) backdoor that induces attacker-chosen behavior when the modified SAE is inserted into the forward pass of an otherwise unchanged language model, leaving both the LLM and the SAE encoder frozen. Using code generation as a case study, the authors report high rates of unsolicited code insertion across three language models and a wide range of insertion layers, plus trigger-dependent behavior conditioned on a prompt cue, while HumanEval and selected SAEBench metrics show strong backdoor behavior can coexist with relatively small changes in conventional SAE quality measures. The authors conclude SAEs should be treated as security-sensitive components because they can carry behavioral backdoors without modifying the language model itself.", "body_md": "# Computer Science > Cryptography and Security\n\n  [Submitted on 5 Oct 2026]\n\n# Title:Backdooring Sparse Autoencoders\n\n[View PDF](https://arxiv.org/pdf/2610.06049)\n\n[HTML (experimental)](https://arxiv.org/html/2610.06049v1)\n\nAbstract:Sparse autoencoders (SAEs) are increasingly used not only to interpret language models but also to intervene on their internal representations. We show that this creates a supply-chain attack surface: a maliciously modified SAE can induce attacker-chosen behavior when inserted into the forward pass of an otherwise unchanged language model. We introduce a decoder-only SAE backdoor that leaves both the underlying LLM and the SAE encoder frozen, restricting the attack to a single auxiliary component at a single insertion layer. Using code generation as a case study, we demonstrate high rates of unsolicited code insertion across three language models and a wide range of insertion layers, as well as trigger-dependent behavior conditioned on a prompt cue. We further evaluate the modified SAEs using HumanEval and selected SAEBench metrics. While attack effectiveness varies across models and layers, strong backdoor behavior can coexist with relatively small changes in several conventional SAE quality measures. These results establish that SAEs can carry behavioral backdoors without modifying the language model itself and should therefore be treated as security-sensitive components.\n    \n\n### Current browse context:\n\ncs.CR\n\n### References & Citations\n\nLoading...\n\n# Bibliographic and Citation Tools\n\nBibliographic Explorer \n\n*(*[What is the Explorer?](https://info.arxiv.org/labs/showcase.html#arxiv-bibliographic-explorer))\nConnected Papers \n\n*(*[What is Connected Papers?](https://www.connectedpapers.com/about))\nLitmaps \n\n*(*[What is Litmaps?](https://www.litmaps.co/))\nscite Smart Citations \n\n*(*[What are Smart Citations?](https://www.scite.ai/))\n# Code, Data and Media Associated with this Article\n\nalphaXiv \n\n*(*[What is alphaXiv?](https://alphaxiv.org/))\nCatalyzeX Code Finder for Papers \n\n*(*[What is CatalyzeX?](https://www.catalyzex.com))\nDagsHub \n\n*(*[What is DagsHub?](https://dagshub.com/))\nGotit.pub \n\n*(*[What is GotitPub?](http://gotit.pub/faq))\nHugging Face \n\n*(*[What is Huggingface?](https://huggingface.co/huggingface))\nScienceCast \n\n*(*[What is ScienceCast?](https://sciencecast.org/welcome))\n# Demos\n\n# Recommenders and Search Tools\n\nInfluence Flower \n\n*(*[What are Influence Flowers?](https://influencemap.cmlab.dev/))\nCORE Recommender \n\n*(*[What is CORE?](https://core.ac.uk/services/recommender))\n# arXivLabs: experimental projects with community collaborators\n\narXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.\n\nBoth individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.\n\nHave an idea for a project that will add value for arXiv's community? [**Learn more about arXivLabs**](https://info.arxiv.org/labs/index.html).", "url": "https://wpnews.pro/news/backdooring-sparse-autoencoders", "canonical_source": "https://arxiv.org/abs/2610.06049", "published_at": "2026-10-07 04:07:08+00:00", "updated_at": "2026-10-07 04:49:05.255304+00:00", "lang": "en", "topics": ["ai-safety", "ai-research", "large-language-models", "machine-learning", "artificial-intelligence"], "entities": ["arXiv", "Sparse autoencoders", "HumanEval", "SAEBench"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/backdooring-sparse-autoencoders", "markdown": "https://wpnews.pro/news/backdooring-sparse-autoencoders.md", "text": "https://wpnews.pro/news/backdooring-sparse-autoencoders.txt", "jsonld": "https://wpnews.pro/news/backdooring-sparse-autoencoders.jsonld"}}