Sparse Autoencoders (SAEs) decompose residual-stream activations into interpretable features. Recent latent-space defenses increasingly rely on these decompositions, assuming that identified "unsafe" SAE features serve as actionable handles for monitoring and intervention. In this paradigm, clamping a specific harmful feature is expected to reliably prevent model misbehavior. However, we show that this success may hide a recoverable failure mode: the clamp may block one visible route to a behavior without eliminating the behavior itself. We formulate this vulnerability as post-intervention recovery, a constrained residual-space optimization problem. Starting from the post-intervention residual state, we optimize residual perturbations to recover the pre-intervention behavior while preserving the post-intervention values of the targeted SAE features. Even under a strong threat model where the intervention remains active throughout optimization and generation, recovery remains possible. To rule out that recovery simply undoes the intervention, we use encoder-orthogonal updates for single-layer interventions and the corresponding feature-map Jacobian in the cross-layer setting. Across TPP, unlearning, IOI, and refusal steering experiments, this stress test reveals recoverable behavior despite successful feature-level intervention. Especially in the safety-critical refusal-steering setting, we achieve a 95.8% recovery rate on valid samples while keeping defended-feature relative drift to 0.131, substantially below suffix-based baselines. A recovery-path attribution analysis further localizes this recovery to the SAE reconstruction residual, the component left unexplained by the SAE. These results expose a gap between feature-level control and behavioral completeness: SAE features can support causal intervention, but controlling them does not guarantee control over the underlying behavior.
Alex: Welcome to another episode of ResearchPod. Today we're looking at a paper that challenges how we secure AI models. The central claim is that blocking specific "harmful" neurons doesn't necessarily stop the harmful behavior.
Sam: So this paper is asking whether our current methods for making AI safer—by clamping down on specific internal parts—are actually as effective as we assume?
Alex: Exactly. To understand why that matters, you need to picture how a large AI model works on the inside. Think of it like a vast network of interconnected switches, each one nudging the model's output in some direction. Researchers have gotten quite good at identifying which switches seem to be connected to specific behaviors—things like generating harmful content. The idea is: find the bad switch, flip it off, problem solved. But this paper argues that's not quite how it works.
Sam: Because the model can just find another path?
Alex: Right. Imagine a highway with a roadblock. You might assume that blocking the main road stops all traffic. But if there are dozens of side roads leading to the same destination, the roadblock only redirects the journey—it doesn't end it. The researchers argue that's precisely what's happening inside these models.
Sam: So the safety filter is the roadblock, and the model is just... taking the side road. What exactly is that side road made of?
Alex: This is where it gets interesting. When a safety filter is applied, it works by identifying and clamping down on specific internal signals it can recognize and measure. But the model's internal state contains far more information than the filter can see. The part the filter misses—the leftover, unexamined information—is what the researchers call the "reconstruction residual." Think of it as the stuff that falls through the cracks of the filter.
Sam: So even if you block every signal you *can* see, the model still has enough hidden information to reconstruct the behavior you were trying to stop?
Alex: That's the claim. And to test it, they used what they call "post-intervention recovery." Here's how it works: they left the safety filter fully active—nothing turned off—and then used a separate optimization process to gently adjust the model's internal state. The question was whether those small adjustments, working only with the information the filter had ignored, could bring the blocked behavior back.
Sam: And the answer was yes?
Alex: In several different safety tests, yes. They could restore the original, unwanted behavior almost entirely, without ever deactivating the filter or reactivating the specific neurons it was blocking. The filter remained on throughout. The behavior came back anyway.
Sam: So the filter isn't actually erasing the model's ability to do the thing. It's more like... putting a sign on the main road that says "closed," while the model quietly learns the back streets.
Alex: That's a good way to put it. The researchers describe these blocked features as "causal handles"—they are genuinely connected to the behavior, so flipping them does have an effect. But they are not what the paper calls "complete bottlenecks." A true bottleneck would mean there's only one path, and blocking it stops everything. What they found instead is that the behavior is distributed across the model more broadly than the filter accounts for.
Sam: Which means the filter is measuring something real, but it's only measuring part of the picture. The rest of the information just... sits there, untouched.
Alex: Exactly. And that untouched portion is enough. As long as the model's internal state contains information the filter doesn't account for, the paper suggests there will likely be ways to recover the behavior the filter was meant to suppress. The safety measure becomes a partial constraint rather than a hard limit.
Sam: That's a genuinely uncomfortable finding for anyone working on AI safety. If the thing you can't see is doing as much work as the thing you can, then interpretability—understanding what's happening inside the model—becomes not just useful, but essential.
Alex: The paper frames it in exactly those terms. It's not arguing that current safety tools are worthless—they do something. But it is arguing that feature-based interventions alone are unlikely to be sufficient, because they leave a significant portion of the model's internal state unaddressed. Until we can account for what's happening in that residual space, our picture of what we've actually secured remains incomplete. That's a meaningful open problem, and this paper makes a careful case for taking it seriously.
Sam: Thanks for walking us through that, Alex. It's the kind of finding that quietly shifts how you think about what "safe" actually means for these systems.
Alex: Thanks for listening to ResearchPod.