Actionable Activation Directions for Detecting and Mitigating Emergent Misalignment Across Language Model Families

This paper investigates whether the emergent misalignment caused by fine-tuning language models on insecure code is represented by a consistent, actionable direction in the model's internal activation space. The author examines four distinct instruction-tuned model families (Qwen2.5-1.5B, Gemma-2-2B, Llama-3.2-1B, and Ministral-3-3B) to determine if misalignment geometry is shared across architectures and if it can be used for detection or inference-time correction. The study employs a rigorous methodology, including a secure-code negative control and various specificity tests (random and orthogonal vectors) to ensure that observed effects are truly linked to the misalignment rather than generic perturbations.

The research identifies a two-tier specificity structure for misalignment. Within a single model family, the misalignment direction is highly specific and causally actionable; subtracting this direction from the model's activations significantly reduces code spillover without affecting performance on benign tasks. In contrast, while directions can be mapped across different architectures using ridge regression to achieve behavioral suppression, these cross-model interventions fail specificity controls. This indicates that cross-architecture transfer influences behavior through general sensitivity to perturbation rather than by targeting a shared, specific representational feature of misalignment.

These findings provide a practical, low-cost framework for auditing third-party fine-tuned models. Instead of relying on expensive behavioral red-teaming, developers can use a simple difference-in-means probe at the final residual-stream layer to detect misalignment. The study also clarifies the limitations of cross-architecture correction, suggesting that while linear tools are powerful for within-model auditing, they cannot be blindly applied across different model families to achieve precise control.