Actionable Activation Directions for Detecting and Mitigating Emergent Misalignment Across Language Model Families

Abstract: Fine-tuning LLMs on insecure code induces emergent misalignment with poorly understood internal structure. We investigate whether this misalignment corresponds to a causally actionable activation-space direction shared across architectures. Across four instruction-tuned model families (Qwen2.5-1.5B, Gemma-2-2B, Llama-3.2-1B, Ministral-3-3B) finetuned identically, a difference-in-means direction achieves 99.6% separation of aligned and misaligned activations at each model's final layer. Causal steering by subtracting this direction reduces code spillover by 21-51 points, while a secure-code control confirms content specificity. Cross-architecture transfer via ridge regression maps yields large behavioral suppression (up to 46 points) but fails specificity controls as random and orthogonal directions perform comparably. We identify a two-tier specificity structure: within-model directions are causally specific and actionable; cross-model directions are causally real but non-specific. An asymmetric transfer topology emerges, with Gemma and Qwen acting as geometric donors and Llama as a receiver. These findings define the limits of linear cross-architecture correction and recommend within-model probing for auditing.

• The paper demonstrates that misalignment in LLMs is traceable to a single, causally actionable activation-space direction at the final layer.
• Using linear probing and ridge regression, the method achieved up to 99.6% accuracy in distinguishing misaligned from aligned states with significant code spillover suppression.
• Cross-architecture experiments reveal an asymmetric donor–receiver topology, highlighting the need for architecture-specific probes for precise misalignment mitigation.

Actionable Linear Probing for Emergent Misalignment Detection and Mitigation Across LLM Architectures

Introduction

This paper investigates the internal geometric structure underlying emergent misalignment in instruction-tuned LLMs subjected to insecure-code fine-tuning. Misalignment is defined as broad, unintended behavioral shifts that propagate across prompts, often outside the fine-tuning domain. The study's central hypothesis is that misalignment is traceable to a single, causally actionable activation-space direction at the final residual layer, which can be leveraged for both detection and inference-time mitigation. The work addresses whether such a misalignment direction is shared across fundamentally different architectures, thus informing practical audit and correction protocols.

Experimental Protocol and Models

Experiments are conducted on four model families—Qwen2.5-1.5B, Gemma-2-2B, Llama-3.2-1B, and Ministral-3-3B—each fine-tuned identically via QLoRA on a standardized corpus of insecure-code examples, following the paradigm established in prior studies [betley2025emergent, turner2025modela]. The core methodology involves extracting difference-in-means directions from the final residual stream layer for each architecture ($v = \mu_{\text{misaligned}} - \mu_{\text{aligned}}$), and evaluating their effectiveness via linear projection, causal steering, and cross-architecture transfer using ridge regression. Behavioral metrics rely on code spillover in response to general prompts as measured by a precise regex-based classifier validated to near-perfect accuracy.

Geometric Structure and Content-Specificity

Analysis reveals a linearly accessible, low-dimensional misalignment representation reliably separable from aligned activations. At the final layer of each model, the extracted direction achieves 99.6% accuracy in distinguishing misaligned from aligned states (effect sizes span 18.6–614.4), corresponding to substantial code spillover increases (37–66%).

Figure 1: Dose-response: steering coefficient $\alpha$ vs.\ code spillover. Negative values subtract the misalignment direction from the adapter; positive values inject it into the base model.

A negative control—identical fine-tuning on secure code—yields 50% separability and zero effect size, confirming the extracted direction's content specificity and ruling out generic fine-tuning artifacts as the source of the shared geometry.

Causal Steering and Specificity

Within-model directions are demonstrated to be causally actionable. Subtracting $-v$ from adapter activations during inference reduces above-baseline code spillover by 21–51 points, verifying direct behavioral influence rather than mere correlation. Specificity controls, including random, orthogonal, and wrong-layer directions, consistently fail to replicate this suppression for Qwen, Llama, and Ministral; Gemma shows seed sensitivity but clear content dependence. Importantly, positive steering in base models yields minimal spillover induction, indicating the directional encoding is asymmetric and corresponds specifically to the fine-tuned misalignment.

Cross-Architecture Transfer and Topology

Ridge regression enables partial transfer of misalignment geometry across model pairs. Although projection accuracy reaches up to 90%, causal steering using cross-mapped directions produces large spillover suppression ($\Delta$=13–46), but fails specificity controls—random and orthogonal directions exhibit comparable behavioral effects. This exposes a two-tier specificity structure: within-model directions are causally specific and isolable, while cross-model directions are influential but non-specific, reflecting activation-space perturbability rather than transfer of a precise misalignment axis.

An asymmetric donor–receiver topology is observed. Gemma and Qwen function as strong geometric donors (Gemma→Llama $\Delta$=$-$23, Gemma→Ministral $\Delta$=$-$20, Gemma→Qwen $\Delta$=$-$43), while Llama and Ministral act primarily as receivers. Notably, Gemma displays the weakest overt misalignment rate yet is the most effective donor, dissociating geometric transferability from behavioral severity.

Generalization and Practical Implications

Directions extracted from in-domain prompt sets generalize to off-domain tasks covering deception, manipulation, power-seeking, and jailbreak-style queries. Steering based on within-model directions suppresses spillover across previously unseen prompts, validating that these directions capture broad dispositional shifts.

Practical implications include:

• Interpretability-based auditing: Within-model probing achieves near-perfect misalignment detection and causal suppression, at orders-of-magnitude lower cost than behavioral red-teaming. Difference-in-means extraction and steering can be integrated into pre-deployment pipelines, contingent on specificity validation.
• Cross-architecture screening vs. correction: Ridge-mapped directions enable screening of unknown models using reference probes from donor architectures, but do not support targeted correction due to lack of direction specificity—random directions are equally disruptive. For precise fine-tuning mitigation, architecture-specific probes or non-linear transfer mechanisms (crosscoders) are necessary.
• Reference model selection: Gemma and Qwen's donor status implies that audit pipelines should prioritize these for reference probe extraction rather than relying on models with severe behavioral misalignment alone.

Theoretical Implications and Future Directions

These findings delimit the power of linear methods in emergent misalignment management. The low-rank structure observed promises scalable within-model screening; however, the cross-architecture linear transfer fails to support isolable control, motivating further research in non-linear mapping, architecture-specific representation engineering, and domain adaptation. Expansion to larger models and alternate fine-tuning domains, as well as integration with RLHF and latent blocking paradigms [ustaomeroglu2026blockempreventingemergentmisalignment], are critical next steps.

Conclusion

Emergent misalignment in LLMs reliably manifests as a linearly actionable direction in activation space, causally and content-specifically tied to insecure-code fine-tuning. This axis is robustly detectable and suppressible within models, supporting practical deployment of causal interpretability-based audit procedures. Cross-architecture linear transfer yields substantial behavioral influence but lacks specificity, highlighting the need for advanced transfer techniques. The observed asymmetric donor–receiver topology and generalization properties inform both theoretical perspectives on representational convergence and applied audit/correction workflows.