Backdooring Sparse Autoencoders

A paper submitted to arXiv on 5 October 2026 introduces a decoder-only sparse autoencoder (SAE) backdoor that induces attacker-chosen behavior when the modified SAE is inserted into the forward pass of an otherwise unchanged language model, leaving both the LLM and the SAE encoder frozen. Using code generation as a case study, the authors report high rates of unsolicited code insertion across three language models and a wide range of insertion layers, plus trigger-dependent behavior conditioned on a prompt cue, while HumanEval and selected SAEBench metrics show strong backdoor behavior can coexist with relatively small changes in conventional SAE quality measures. The authors conclude SAEs should be treated as security-sensitive components because they can carry behavioral backdoors without modifying the language model itself.

Computer Science Cryptography and Security Submitted on 5 Oct 2026 Title:Backdooring Sparse Autoencoders View PDF https://arxiv.org/pdf/2610.06049 HTML experimental https://arxiv.org/html/2610.06049v1 Abstract:Sparse autoencoders SAEs are increasingly used not only to interpret language models but also to intervene on their internal representations. We show that this creates a supply-chain attack surface: a maliciously modified SAE can induce attacker-chosen behavior when inserted into the forward pass of an otherwise unchanged language model. We introduce a decoder-only SAE backdoor that leaves both the underlying LLM and the SAE encoder frozen, restricting the attack to a single auxiliary component at a single insertion layer. Using code generation as a case study, we demonstrate high rates of unsolicited code insertion across three language models and a wide range of insertion layers, as well as trigger-dependent behavior conditioned on a prompt cue. We further evaluate the modified SAEs using HumanEval and selected SAEBench metrics. While attack effectiveness varies across models and layers, strong backdoor behavior can coexist with relatively small changes in several conventional SAE quality measures. These results establish that SAEs can carry behavioral backdoors without modifying the language model itself and should therefore be treated as security-sensitive components. Current browse context: cs.CR References & Citations Loading... Bibliographic and Citation Tools Bibliographic Explorer What is the Explorer? https://info.arxiv.org/labs/showcase.html arxiv-bibliographic-explorer Connected Papers What is Connected Papers? https://www.connectedpapers.com/about Litmaps What is Litmaps? https://www.litmaps.co/ scite Smart Citations What are Smart Citations? https://www.scite.ai/ Code, Data and Media Associated with this Article alphaXiv What is alphaXiv? https://alphaxiv.org/ CatalyzeX Code Finder for Papers What is CatalyzeX? https://www.catalyzex.com DagsHub What is DagsHub? https://dagshub.com/ Gotit.pub What is GotitPub? http://gotit.pub/faq Hugging Face What is Huggingface? https://huggingface.co/huggingface ScienceCast What is ScienceCast? https://sciencecast.org/welcome Demos Recommenders and Search Tools Influence Flower What are Influence Flowers? https://influencemap.cmlab.dev/ CORE Recommender What is CORE? https://core.ac.uk/services/recommender arXivLabs: experimental projects with community collaborators arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website. Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them. Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs https://info.arxiv.org/labs/index.html .