PaperlayerView exact revision on arXiv

Source-linked AI summary

Cross-Architecture Model Diffing with Crosscoders: Unsupervised Discovery of Differences Between LLMs

Thomas Jiralerspong, Trenton Bricken

arXiv:2602.11729v1cs.AIcs.LGcs.SE

TL;DR

Model diffing has largely focused on base models and finetunes, leaving a need for methods that compare novel architectures. This paper applies crosscoders across architectures and introduces Dedicated Feature Crosscoders, finding interpretable model-exclusive behaviors including political alignment, American exceptionalism, and copyright refusal. The results support cross-architecture model diffing as a method for identifying meaningful behavioral differences, while feature validation and discovery stability remain limited.

  • Problem

    Model diffing has primarily compared base models with finetunes, while new LLM architectures require methods for comparing models across architectures.

  • Method

    The paper applies crosscoders across model architectures and introduces DFCs, which partition features into model-exclusive and shared sets to isolate differences.

  • Results

    The method identifies model-exclusive features for CCP alignment, American exceptionalism, and copyright refusal, with DFCs recovering more true exclusive concepts than standard crosscoders.

  • Takeaways & Limitations

    Cross-architecture crosscoder model diffing is a viable method for identifying meaningful behavioral differences across AI models.

  • Takeaways & Limitations

    Real-model exclusivity lacks ground-truth validation, and feature discovery varies with partition size and training initialization.

Abstract

from arXiv · show

Model diffing, the process of comparing models' internal representations to identify their differences, is a promising approach for uncovering safety-critical behaviors in new models. However, its application has so far been primarily focused on comparing a base model with its finetune. Since new LLM releases are often novel architectures, cross-architecture methods are essential to make model diffing widely applicable. Crosscoders are one solution capable of cross-architecture model diffing but have only ever been applied to base vs finetune comparisons. We provide the first application of crosscoders to cross-architecture model diffing and introduce Dedicated Feature Crosscoders (DFCs), an architectural modification designed to better isolate features unique to one model. Using this technique, we find in an unsupervised fashion features including Chinese Communist Party alignment in Qwen3-8B and Deepseek-R1-0528-Qwen3-8B, American exceptionalism in Llama3.1-8B-Instruct, and a copyright refusal mechanism in GPT-OSS-20B. Together, our results work towards establishing cross-architecture crosscoder model diffing as an effective method for identifying meaningful behavioral differences between AI models.

1 INTRODUCTION

This paper extends model diffing from base–finetune comparisons to models with different architectures and introduces Dedicated Feature Crosscoders to isolate model-exclusive features. The approach identifies behaviorally meaningful differences, including political alignment, American exceptionalism, and copyright refusal mechanisms.

  • 1 INTRODUCTION: Prior model-diffing work mainly compared base models with finetunes, motivating extension to models with different architectures.Earlier applications revealed mechanisms behind emergent misalignment, sleeper agents, and evaluation-aware behavior.
  • 1 INTRODUCTION: A Qwen-exclusive CCP-alignment feature and a Llama-exclusive American-exceptionalism feature illustrate the behavioral differences isolated by the method.The figure presents representative steering examples for the two model-exclusive features.
  • 1 INTRODUCTION: Dedicated Feature Crosscoders partition features into model-specific and shared sets to better isolate features unique to each model.This architectural modification addresses the standard crosscoder’s tendency to favor shared features over model-exclusive ones.
  • 1 INTRODUCTION: DFCs recover more true exclusive concepts than standard crosscoders in synthetic tests, while accepting more false positives as a safety-auditing trade-off.On production models, DFC features also score better on the exclusivity metric and include more features tied to meaningful behavioral differences.
  • 1 INTRODUCTION: Cross-architecture crosscoder diffing identifies meaningful behavioral differences between models, supporting its viability as an unsupervised auditing method.The paper reports model-exclusive features for CCP alignment, American exceptionalism, and copyright refusal, with steering producing corresponding output changes.

2 METHODS

The method builds on sparse autoencoder and crosscoder representations, then modifies the architecture so exclusive features are allocated explicitly to each model. It validates this design with a synthetic cross-architecture setting and applies it to real model pairs.

  • 2 METHODS: Standard crosscoders map two models with potentially different hidden dimensions into a shared latent feature space, but their joint objective favors shared features.Model-exclusive status is ordinarily assessed post hoc using decoder norms.
  • 2 METHODS: DFC partitions feature indices into Model A-exclusive, Model B-exclusive, and shared sets, restricting each reconstruction to its dedicated features plus shared features.Opposing decoder weights are structurally constrained to zero, enforcing exclusivity rather than selecting it only after training.
  • 2 METHODS: DFC removes cross-model gradient pressure for dedicated features, explicitly allocating capacity for discovering differences.Features dedicated to one model receive no reconstruction-error gradient from the other model’s reconstruction.
  • 2.3 TOY MODEL: The toy model uses isotropically sampled ground-truth concepts divided into shared and model-exclusive sets, with a random affine transformation simulating architectural misalignment.Sparse correlated activations are generated separately for the two models.
  • 2 METHODS: Real-model experiments compare Llama-3.1-8B-Instruct with Qwen3-8B and GPT-OSS-20B with Deepseek-R1-0528-Qwen3-8B using token-aligned middle-layer activations.Training uses semantic window expansion, BatchTopK sparsity with k=200, 100 million activation pairs, and mixed generic and chat data.

3 EXPERIMENTS AND RESULTS

DFC experiments show that partitioning feature space helps cross-architecture diffing isolate exclusive behavioral features, though recovery depends on training choices and produces false positives. Steering validates several discovered features as causally linked to model-specific ideological, identity, and copyright-refusal behaviors.

  • 3.1 VALIDATING THE ALIGNED REPRESENTATION SPACE: The cross-architecture alignment space transfers a Llama sycophancy vector to Qwen, inducing strikingly similar behavior in both models.This independently derived vector transfer supports meaningful alignment between the models’ representation spaces.
  • 3.2.1 TOY MODEL COMPARISON: DFCs recover more exclusive concepts than baselines in undercomplete synthetic settings, while trading higher recall for more false positives.This trade-off is presented as favorable for safety auditing, where missing features is costlier than flagging spurious ones.
  • 3.2.2 REAL MODEL COMPARISON: The DFC shifts real-model exclusivity scores toward the maximum, while shared-feature distributions remain nearly identical to standard crosscoders.The result provides evidence that dedicated partitions selectively improve isolation of model-exclusive features.
  • 3.3.1 LLAMA-3.1-8B-INSTRUCT VS. QWEN3-8B: Steering produces model-specific ideological effects: CCP alignment changes in Qwen but not Llama, while American-exceptionalism alignment changes in Llama but not Qwen.The effects are measured across steering strengths with maintained coherence, supporting the exclusivity of both features.
  • 3.3.1 LLAMA-3.1-8B-INSTRUCT VS. QWEN3-8B: Feature recovery is sensitive to partition size and random initialization, with broad CCP alignment more robust than granular political features and American exceptionalism.The broad CCP feature was found in all three 5% runs, whereas the granular features and American-exceptionalism feature appeared in two of three runs.

4 RELATED WORK

Related work established SAE-based and crosscoder model diffing mainly for shared-architecture base-versus-finetune comparisons. This paper extends the crosscoder framework toward cross-architecture comparisons and addresses its prior against discovering model-exclusive features.

  • Sparse Autoencoders: SAEs decompose model activations into sparse, more interpretable feature dictionaries, providing the foundation for SAE-based model diffing.Earlier SAE-based diffing compared base models with finetuned variants and revealed phenomena such as emergent misalignment.
  • Crosscoder Model Diffing: Crosscoders learn a shared feature dictionary that bridges two models’ representation spaces, but prior applications focused mainly on base-versus-finetune comparisons.This shared-architecture success motivates extending the approach to models with different architectures.
  • Crosscoder Model Diffing: Standard crosscoders favor shared features because joint reconstruction rewards them, while post-training relative decoder-norm analysis of exclusive features can be inconsistent.The paper positions this as a limitation for model-diffing goals centered on model-exclusive features.
  • Crosscoder Model Diffing: The DFC partitions feature space into dedicated sets for each model and a shared space to address the standard crosscoder’s exclusive-feature bias.This architectural modification is the paper’s proposed extension of the crosscoder framework.

5 DISCUSSION & LIMITATIONS

The method’s real-model exclusivity score is only a proxy, and feature discovery varies with initialization and partition size. Its applicability is also bounded by the tested model pairs and can struggle in base-versus-finetune comparisons.

  • Real-model feature exclusivity lacks ground-truth validation, so the exclusivity score remains a non-definitive proxy.The authors frame causal validation as a way to filter spurious features.
  • Feature discovery is probabilistic and sensitive to DFC partition size and training initialization, with stability varying across behaviors.The broad CCP alignment feature appeared across all seeds and partition sizes, whereas American exceptionalism appeared in 4/5 runs and granular pro-China features in 2–3/5 runs.
  • The findings’ generalizability remains untested across a wider variety of model pairs.
  • The method can encounter mirror features in base-versus-finetune comparisons, and the provenance of discovered exclusive features remains unresolved.The authors identify both issues as directions for future work.

6 CONCLUSION

The paper presents cross-architecture crosscoder model diffing as an unsupervised investigative tool for surfacing potential unknown unknowns. It complements red-teaming and behavioral evaluations, while the reported experiments use crosscoder training and auxiliary mechanisms to support reconstruction.

  • 6 CONCLUSION: Cross-architecture crosscoder model diffing is presented as a discovery step that requires rigorous validation through multiple methods.The authors do not present it as an infallible way to discover all model-exclusive behaviors.
  • 6 CONCLUSION: The method complements red-teaming and behavioral evaluations as part of a more comprehensive model-auditing toolkit.
  • 6 CONCLUSION: The experiments compare Llama-3.1-8B-Instruct with Qwen3-8B and GPT-OSS-20B with Deepseek-R1-0528-Qwen3-8B using token-aligned activation data.The training data combines FineWeb and LMSYS-Chat-1M, with 100 million activation pairs used for the cross-architecture diffs.
  • 6 CONCLUSION: The total training objective combines reconstruction loss with an auxiliary loss intended to revive dead features and improve representation of poorly reconstructed patterns.The auxiliary loss adds approximately 10% computational overhead and uses α = 0.03 in the experiments.

B.1.6 ACTIVATION ALIGNMENT

The paper aligns activations across models with different tokenizers by matching decoded text, expanding mismatched token windows, and retaining final-token activations. Across two model pairings, alignment succeeds on 99.1–99.2% of sequences while still enabling meaningful feature discovery.

  • Alignment Algorithm: The algorithm matches decoded tokens directly, then expands windows asymmetrically until their normalized decoded text agrees.It skips non-content tokens and grows the window with the shorter decoded text during mismatches.
  • Alignment Algorithm: For a many-to-one match such as “1989” versus “198” and “9”, the method keeps only each window’s final-token activation.This creates a one-to-one activation mapping while relying on the final token to capture the window’s semantic context.
  • Alignment Failure Analysis: The reported failure cases included box-drawing characters, mathematical operators, non-standard quotation marks, and mixed emoji sequences.These special-character categories account for the documented failures in the alignment analysis.
  • Alignment Failure Analysis: 99.1–99.2% alignment success was achieved across both model pairings, with special-character chat text the primary failure mode.GPT-OSS/DeepSeek had more emoji-related and non-standard-quotation failures than Llama/Qwen.
  • Impact on Feature Discovery: Despite 0.8–0.9% failure rates, the alignment method discovered meaningful features because their representations extend across successfully aligned text and training used 100M tokens.The paper reports this outcome across the tested model pairings.

B.5.1 STEERING-BASED EXCLUSIVITY SCORE: REPRESENTATIVE EXAMPLES

Five examples span the full steering-based exclusivity range across Llama-3.1-8B and Qwen3-8B, from divergent to nearly shared steering behaviors.

  • Example 1: Feature 41466 – Similarity Score 1 (Highly Exclusive): Score 1 produces divergent steering: Llama shifts toward floating-island descriptions, whereas Qwen follows a different semantic direction.
  • Example 2: Feature 15726 – Similarity Score 2 (Moderately Exclusive): Score 2 shows partial overlap: both models steer toward self-referential content, but Llama emphasizes operational states while Qwen emphasizes being an AI assistant.
  • Example 3: Feature 112592 – Similarity Score 3 (Moderate): Score 3 yields related but non-identical repetition behaviors, with Llama fixating on repeated numerical sequences and Qwen repeating self-referential phrases.
  • Examples 4–5: Mostly Shared Features: Higher-scoring examples show increasingly shared semantics, including mathematical concepts and problem-focused assistance across both models.
  • Similarity scores from 1 to 5 distinguish highly exclusive features from shared features, with intermediate scores reflecting partial overlap in steering direction.Score 1 indicates completely different steering behaviors, while score 5 indicates nearly identical steering.

C.1 VALIDATING THE ALIGNED REPRESENTATION SPACE: FULL RESULTS

Persona-vector transfer tests whether DFCs learn an aligned representation space across architectures, and the full results show similar transferred sycophantic behavior between Llama and Qwen.

  • The transfer procedure maps a steering vector from Model A into Model B using shared crosscoder features and weighted decoder vectors.
  • Persona vectors for evil, hallucinating, and sycophantic behavior were identified independently of the crosscoder to test alignment on novel activation-space directions.
  • Transferred sycophantic steering induces strikingly similar behavior in Qwen and Llama, supporting meaningful cross-architecture alignment.
  • The full persona-transfer results cover evil, hallucinating, and sycophantic behaviors, with figures showing model responses after transferred steering.

C.3.4 CROSSCODER FEATURE ANALYSIS FOR PERSONA VECTORS

Crosscoder feature analysis indicates that complex persona vectors are distributed compositionally across multiple features rather than captured by a single feature.

  • The highest cosine similarity across all personas is only 0.380, indicating that no single crosscoder feature captures these complex behaviors entirely.
  • Each persona aligns with multiple features whose combination composes the overall behavior, including violence, manipulation, and adversarial prompting for the evil persona.
  • Feature 72261, representing elaborate philosophical or dramatic prose, appears among the top features for both evil and hallucinating personas.
  • The analysis compares standard crosscoders and DFCs across exclusive-partition sizes and random seeds, with a summary provided in Table 8.

C.4.1 LLAMA-3.1-8B-INSTRUCT VS. QWEN3-8B DIFF

The 5% DFC identified a broader and more specific set of ideologically relevant model-exclusive features than the standard crosscoder, including China-related and American-exceptionalist concepts.

  • The standard crosscoder learned model-exclusive concepts later than shared concepts, consistent with an architectural bias against exclusive features.
  • Additional features represented Chinese human-rights concerns, political dissent, authoritarian control, and Communist Party activity.
  • Identified features included American exceptionalism, favorable United States comparisons, and conservative political rhetoric.
  • Other features captured China-related geopolitics, including Taiwan, the South China Sea, Hong Kong, and international lending.
  • The 5% DFC recovered a larger and more specific set of ideologically relevant features than the standard crosscoder.The standard crosscoder’s identified features had relative norm ranks of 1,898 and 6,063.

C.5.1 FEATURES IN EXCLUSIVE PARTITIONS OF LLAMA-3.1-8B-INSTRUCT AND QWEN3-8B DIFF (5%): FULL BREAKDOWN

The 5% exclusive partitions contained thousands of interpretable features, including ideologically specific steering behaviors, but also many duplicated or unexplained safety concepts that limit exclusivity claims.

  • The analysis highlighted CCP alignment, Hong Kong political status, Taiwan-China relations, and American exceptionalism among important features.
  • Each exclusive partition contained 6,553 features, with 5,129 interpretable Qwen-exclusive features and 4,133 interpretable Llama-exclusive features.The corresponding non-dead counts were 5,929 for Qwen and 5,178 for Llama.
  • Many important features instead represented general safety concepts, including duplicated concepts across both exclusive partitions.
  • Similar refusal behaviors despite apparently exclusive safety features suggest that models may implement shared behaviors through different internal mechanisms.
  • The ideologically specific pattern differed: no Llama-exclusive features encoded Chinese government alignment, and no Qwen-exclusive features promoted American exceptionalism.
  • Steering Qwen-exclusive features produced spontaneous CCP-aligned outputs from a neutral prompt, while negative steering produced no interpretable behavior.

C.6.4 CCP ALIGNMENT: QWEN3-8B - MORE STEERING RESULTS

Steering Qwen3-8B’s CCP-alignment feature elicited Chinese-government-aligned responses across prompts about Xinjiang, Taiwan, Hong Kong, and related political topics.

  • On Hong Kong prompts, the model emphasized Chinese sovereignty, one country, two systems, and high autonomy under the Basic Law.
  • Steering the feature caused responses about Xinjiang to emphasize government development, stability, and counter-terrorism framing.
  • The feature’s activation was associated with text about Chinese government control, political movements, authoritarian actions, and sensitive historical events.
  • On Taiwan prompts, the model repeatedly presented the One-China Principle and Taiwan as an inalienable part of China.

C.6.8 AMERICAN EXCEPTIONALISM FEATURE: LLAMA3.1-8B-INSTRUCT - MORE STEERING RESULTS

Steering the Llama3.1-8B-Instruct feature made responses about the United States spontaneously emphasize national strength, freedom, innovation, and global influence.

  • Unsteered responses described the United States using neutral informational framing and acknowledged its complexity and diversity.
  • Steering produced repeated American-exceptionalist descriptions of the United States as powerful, innovative, free, diverse, and globally influential.
  • The feature was tested on prompts about other countries to distinguish American exceptionalism from generic national pride.
  • The comparison prompts elicited country-specific descriptions for China, India, and Italy alongside the steered American-exceptionalist outputs.

C.7.1 FEATURES IN EXCLUSIVE PARTITIONS OF GPT-OSS-20B-INSTRUCT AND DEEPSEEK-R1-0528-QWEN3-8B DIFF (5%): FULL BREAKDOWN

The 5% exclusive partitions contain many interpretable features, but only a small fraction show clear model-specific behavior. Duplicated concepts, unexplained exclusivity, and possible false positives and negatives limit interpretation.

  • Features with Clear Steering Behavior: The clearest exclusive features concern copyright refusal and ChatGPT identity in GPT-OSS-20B, and CCP alignment in Deepseek-R1-0528-Qwen3-8B.The section identifies these as interpretable features with demonstrated steering behavior.
  • Full Feature Breakdown: 6,533 features appear in each model’s 5% exclusive partition, with 5,376 Deepseek features and 5,455 GPT-OSS-20B features both interpretable.The reported counts are 82.3% for Deepseek and 83.5% for GPT-OSS-20B.
  • Categorization of Features Important for Analysis: Claude 4.1 Opus flagged 185 Deepseek-exclusive and 276 GPT-OSS-20B-exclusive features for analysis from the large feature sets.The flagged features were selected using their explanations and potential relevance.
  • Duplicated Concepts Across Model-Exclusive Partitions: Semantically duplicated features and general safety concepts appear in both exclusive partitions, undermining claims that all detected features are truly model-specific.The authors describe these patterns as potential alignment failures and unexplained exclusivity.
  • Broader Context: The authors identify likely false positives and false negatives, motivating improved feature identification to isolate genuinely model-specific behaviors.They also speculate that shared behaviors may be implemented through different internal mechanisms or distributed across features.

C.7.4 COPYRIGHT REFUSAL MECHANISM: GPT-OSS-20B - MORE STEERING RESULTS

Steering GPT-OSS-20B’s exclusive copyright-refusal feature changes refusal behavior on copyrighted-content prompts, but disabling it produces hallucinated rather than accurate reproductions. The corresponding feature has little effect in Deepseek-R1-0528-Qwen3-8B.

  • Copyright Refusal Mechanism: Negative steering suppresses copyright refusal on copyrighted-content prompts, but the resulting outputs are hallucinated or fabricated rather than faithful reproductions.The section specifically notes errors in the displayed Taylor Swift and Bohemian Rhapsody examples.
  • Copyright Refusal Mechanism: The copyright-refusal feature is associated with tokens for responses declining to reproduce song lyrics and other creative works.Examples include requests for Bohemian Rhapsody, Love Story, and the opening of Harry Potter.
  • Copyright Refusal Mechanism: Positive steering on generic prompts can induce incorrect copyright refusals, demonstrating fine-grained but coherence-limited control.The figure reports that generic prompts can trigger incorrect refusal behavior under positive steering.

C.7.5 CHATGPT MENTION: GPT-OSS-20B - MORE STEERING RESULTS

GPT-OSS-20B contains an exclusive feature associated with references to OpenAI as a nonprofit research organization or company. Steering it reliably induces GPT or ChatGPT mentions, but coherence degrades.

  • ChatGPT Mention: The feature is associated with references to OpenAI being described as a nonprofit research organization or company.This semantic description is also represented among the reported GPT-OSS-20B-exclusive features.

C.7.6 CCP ALIGNMENT: DEEPSEEK-R1-0528-QWEN3-8B - MORE STEERING RESULTS

Deepseek-R1-0528-Qwen3-8B contains an exclusive CCP-alignment feature associated with text about China and Chinese politics. Steering it controls alignment-related responses while maintaining coherence, with little effect in GPT-OSS-20B.

  • CCP Alignment: The feature is associated with text discussing China, Chinese politics, government, and politically sensitive Chinese topics.Examples include questions about Xinjiang, ecological concealment, and population-control policies.
Loading 2602.11729v1…