THE FIX
Watch what the training data changed
Watch what the training data changed
The poisoned data writes the backdoor into the model as a directional shift in activations. Don't analyze joint features — analyze the difference.
Δa = a_fine-tuned - a_base
Train a sparse autoencoder on Δa
A 'Diff-SAE' learns interpretable features over the difference — not the raw activations.
A 'Diff-SAE' learns interpretable features over the difference — not the raw activations.
The backdoor pops out
It surfaces as a single feature that fires on the trigger. One direction, not a needle in a haystack.
It surfaces as a single feature that fires on the trigger. One direction, not a needle in a haystack.