DACO: Dictionary-Aligned Concept Control

• The paper introduces DACO as a method that uses explicit dictionaries and sparse coding to intervene in LLM activations for improved safety without retraining.
• DACO grounds concepts multimodally by aligning WordNet-derived terms with image-caption pairs, establishing a structured control surface over latent representations.
• Empirical evaluations show that DACO significantly boosts safety metrics and interpretability in multimodal systems while maintaining overall model performance.

Searching arXiv for the cited DACO-related papers to ground the article. Dictionary-Aligned Concept Control (DACO) denotes a class of methods that use an explicit dictionary of concepts to shape, decompose, or intervene on learned representations. In its most direct formulation, DACO is an inference-time safety framework for frozen multimodal LLMs (MLLMs) that combines a curated multimodal concept dictionary, sparse coding, and Sparse Autoencoders (SAEs) to suppress undesirable concepts and promote desirable ones without retraining the backbone (Luo et al., 10 Apr 2026). More broadly, the same design pattern appears in earlier and parallel work: dictionaries can simplify text into concept tokens, enrich detector vocabularies with semantic definitions, estimate harmful concept directions in Vision Language Action (VLA) hidden states, or bind ontology relations to dedicated latent slots in sparse autoencoders (Wu et al., 2022, Yao et al., 2022, Wen et al., 2 Feb 2026, Yang et al., 1 Dec 2025). Across these settings, the common objective is to turn concept knowledge into a structured control surface over representation geometry, usually by reducing lexical or latent entanglement and making interventions more selective.

1. Conceptual basis

DACO rests on the premise that internal activations admit a usable concept structure and that an explicit dictionary can regularize, expose, or control that structure. In the MLLM safety setting, the motivation is that prompt engineering, response classification, and finetuning are often ineffective against evolving malicious patterns, may require rerunning the query, or demand heavy computational resources; DACO instead performs activation-time intervention on a frozen model (Luo et al., 10 Apr 2026). In VLA safety, the same logic is expressed more sharply: unsafe intent is already reflected in the fused latent state before action decoding, so safety can be enforced at the representation level rather than only through input or output filtering (Wen et al., 2 Feb 2026).

The dictionary itself plays different roles across papers, but always as an explicit semantic scaffold. In "Dictionary-Assisted Supervised Contrastive Learning" (Wu et al., 2022), specialized dictionaries encode expert knowledge about abstract concepts such as sentiment, economic tone, or abusive language, and are used to simplify text so that concept-bearing words map to shared tokens. In "DetCLIP: Dictionary-Enriched Visual-Concept Paralleled Pre-training for Open-world Detection" (Yao et al., 2022), a concept dictionary serves as semantic memory: each concept is represented separately, enriched with a definition, used as a source of negative concepts, and used to complete missing labels. In "AlignSAE: Concept-Aligned Sparse Autoencoders" (Yang et al., 1 Dec 2025), the relevant structure is a latent dictionary learned by an SAE and then post-trained so that human-defined concepts are bound to designated latent slots. In the 2026 DACO formulation, the dictionary is multimodally grounded and directly supports sparse coding-based steering as well as SAE initialization and annotation (Luo et al., 10 Apr 2026).

A plausible unifying interpretation is that DACO methods convert concept knowledge from a passive annotation resource into an active representational prior. The dictionary is not merely attached to a classifier or detector; it changes the geometry or factorization of the hidden space so that concept membership becomes more addressable.

2. Dictionary construction and concept grounding

The construction of the dictionary determines what can be controlled. In the MLLM DACO framework, the concept set is built from WordNet by taking the first lemma of each noun synset and deduplicating them, yielding about 15,661 concepts. To ground these concepts multimodally, caption-image pairs are retrieved from CC-3M, producing DACO-400K, with over 400,000 caption-image pairs used as concept stimuli (Luo et al., 10 Apr 2026). Retrieval uses CLIP embeddings for the concept name, the caption text, and the image, with a geometric aggregation score

$\dist_{\text{M}}(c, x) = \sqrt{ -\Big( \ln[s(c, x_{\text{image}})] + \ln[s(c, x_{\text{text}})] \Big) }.$

Lower $\dist_{\text{M}}$ indicates higher relevance, and top-ranked pairs become positive stimuli while low-ranked pairs become negative stimuli (Luo et al., 10 Apr 2026).

DetCLIP uses a differently structured dictionary:

$O=\{o_l:def_l\}_{l=1}^L,$

where each concept $o_l$ is paired with a WordNet definition. Its dictionary is built from noun phrases extracted from YFCC100M, category names from public detection datasets such as Objects365 and OpenImages, and object names from THINGS. YFCC noun phrases are filtered to keep only concepts that appear at least 100 times and have a WordNet definition, yielding about 14k concepts with definitions (Yao et al., 2022). The resulting entries are concept-definition pairs rather than bare lexical items.

SAFE-Dict, the VLA safety method, constructs its concept vocabulary by extracting salient semantic entities from paired images and instructions with a pretrained VLM:

$$\mathcal{C} = \{c_1, c_2, \dots, c_M\},\quad c_i \sim \text{VLM}(t_j, I_j),\quad t_j \in \mathcal{T},\; I_j \in \mathcal{I}.$$

For each concept $c_i$, an LLM synthesizes stimuli sentences that explicitly involve only that concept but match the original task style:

$$\mathcal{S}(c_i) = \{\, s \sim \text{LLM}(c_i \mid \mathcal{T}) \,\}.$$

Each concept also receives a harmfulness score $w_i \in [0,1]$ (Wen et al., 2 Feb 2026).

In DASCL, the dictionary is more task-specific and lexicon-like. Let $D = \{d_1, \dots, d_M\}$ be a set of dictionaries, with each dictionary $d_i$ assigned a token $\dist_{\text{M}}$0. Any word $\dist_{\text{M}}$1 is replaced with $\dist_{\text{M}}$2 during keyword simplification. The paper gives examples such as positive words $\dist_{\text{M}}$3 <positive>, negative words $\dist_{\text{M}}$4 <negative>, positive economic words $\dist_{\text{M}}$5 <positive_econ>, and negative economic words $\dist_{\text{M}}$6 <negative_econ> (Wu et al., 2022).

These designs differ in scale and modality, but they share a common constraint: control is limited by dictionary coverage. SAFE-Dict explicitly notes dependence on a predefined concept dictionary and the possibility that novel or rare hazards may be missed (Wen et al., 2 Feb 2026). The MLLM DACO paper likewise notes that domain-specific scenarios may require expanded expert concept sources (Luo et al., 10 Apr 2026).

3. Mechanisms for alignment and intervention

Dictionary-aligned methods operate by changing either the input view, the latent factorization, or the activation itself. In DASCL, the mechanism is supervised contrastive shaping of text embeddings. The original text and its keyword-simplified version are both used in the contrastive term, while only the original text is used in cross-entropy. Let $\dist_{\text{M}}$7 denote the L2-normalized projection of the encoder output and let $\dist_{\text{M}}$8 be the corresponding projection for the keyword-simplified text. The combined objective is

$\dist_{\text{M}}$9

with $O=\{o_l:def_l\}_{l=1}^L,$0 in the contrastive-learning configurations (Wu et al., 2022). The intended effect is explicit same-class attraction and different-class repulsion, with keyword simplification reducing intra-class lexical variance.

In SAFE-Dict, the key step is sparse coding over concept directions estimated from hidden activations. Given the fused latent state $O=\{o_l:def_l\}_{l=1}^L,$1, the method solves an ElasticNet problem

$O=\{o_l:def_l\}_{l=1}^L,$2

or, in the appendix algorithm,

$O=\{o_l:def_l\}_{l=1}^L,$3

Harmfulness is aggregated as

$O=\{o_l:def_l\}_{l=1}^L,$4

with safety decisions based on thresholding, and harmful coefficients are attenuated when they exceed $O=\{o_l:def_l\}_{l=1}^L,$5 (Wen et al., 2 Feb 2026).

The 2026 DACO framework for MLLMs uses two related mechanisms. First, it constructs concept directions by contrastive representation reading:

$O=\{o_l:def_l\}_{l=1}^L,$6

and stacks them into a layer-wise dictionary

$O=\{o_l:def_l\}_{l=1}^L,$7

Then it decomposes an activation $O=\{o_l:def_l\}_{l=1}^L,$8 through elastic-net sparse coding,

$O=\{o_l:def_l\}_{l=1}^L,$9

and removes undesirable components by

$o_l$0

Second, it uses the curated dictionary to initialize an SAE decoder, with normalized concept vectors as initial atoms:

$o_l$1

At inference time, the SAE encodes the current residual activation, undesirable atoms are canceled by negating their coefficients, desirable atoms are boosted to a fixed positive strength $o_l$2, and the intervention is decoded back into activation space (Luo et al., 10 Apr 2026).

AlignSAE provides a more explicit slot-binding formulation. The hidden state $o_l$3 is encoded as

$o_l$4

with a partition

$o_l$5

and the decoder reconstructs $o_l$6. Post-training adds alignment, independence, orthogonality, and value losses so that designated latent slots correspond to ontology relations (Yang et al., 1 Dec 2025). The exact concept-slot activation rule is that the slot for relation $o_l$7 should satisfy $o_l$8.

A common feature across these methods is that control occurs in concept coordinates rather than raw token space. This suggests that DACO is best understood not as a single algorithm, but as a representational strategy: build a concept basis, infer concept coefficients, and modify those coefficients selectively.

4. Representative implementations

The main DACO-style systems in the supplied literature differ in objective, modality, and intervention point.

System	Dictionary role	Primary control mechanism
DASCL	Specialized dictionaries/lexicons mapped to fixed tokens	Keyword simplification plus supervised contrastive learning (Wu et al., 2022)
DetCLIP	Concept dictionary with WordNet definitions	Parallel concept representation, dictionary enrichment, negative sampling, label completion (Yao et al., 2022)
SAFE-Dict	Sparse interpretable dictionary from VLA hidden activations	Inference-time projection, harmful concept identification, threshold gating / attenuation (Wen et al., 2 Feb 2026)
AlignSAE	Latent dictionary aligned with an ontology	Supervised post-training to bind concepts to dedicated latent slots (Yang et al., 1 Dec 2025)
DACO	Curated multimodal concept dictionary plus SAE atoms	Sparse coding, oblique projection, and compositional SAE steering (Luo et al., 10 Apr 2026)

DASCL is the clearest text-domain precursor. Its workflow is: simplify text using dictionaries by replacing dictionary words with a fixed token, contrast original and simplified views of the same example, and pull same-label examples together while pushing different-label examples apart (Wu et al., 2022). The keyword-simplified version is not used at inference time.

DetCLIP transfers the same principle to open-world detection. Concepts are represented separately rather than as a single long prompt, enriched with definitions, aligned to regions through a region-concept alignment loss, and supplemented with dictionary-sampled negatives. The dictionary is also used for label completion in image-text pair data by expanding candidate labels from caption noun phrases to all dictionary concepts (Yao et al., 2022).

SAFE-Dict and DACO are both inference-time safety methods, but they target different embodied or multimodal regimes. SAFE-Dict operates on the shared latent state of VLAs before action decoding and is explicitly positioned as a post-deployment firewall (Wen et al., 2 Feb 2026). DACO operates on residual-stream activations of frozen MLLMs at selected decoder layers and is designed to preserve general-purpose capabilities while improving safety (Luo et al., 10 Apr 2026).

AlignSAE differs from both because its main contribution is not safety filtering but the creation of a semantically labeled latent interface. It reserves special latent slots for concept relations and leaves a large bank of free slots for general reconstruction. In the reported implementation, the hidden input dimension is 768, the total number of latent features is 100,006, with 100,000 free slots and 6 supervised relation slots (Yang et al., 1 Dec 2025). This separation supports causal interventions such as concept swaps.

5. Empirical findings across domains

The empirical record reported in these papers is consistent with the claim that dictionary alignment is particularly useful when concept supervision is sparse, noisy, heterogeneous, or safety-critical.

For DASCL, the strongest gains occur in few-shot and social-science text classification. On SST-2 with training sizes $o_l$9, the largest improvement appears at $$\mathcal{C} = \{c_1, c_2, \dots, c_M\},\quad c_i \sim \text{VLM}(t_j, I_j),\quad t_j \in \mathcal{T},\; I_j \in \mathcal{I}.$$0: +10.2 accuracy points over cross-entropy and +6.8 accuracy points over standard supervised contrastive learning. At $$\mathcal{C} = \{c_1, c_2, \dots, c_M\},\quad c_i \sim \text{VLM}(t_j, I_j),\quad t_j \in \mathcal{T},\; I_j \in \mathcal{I}.$$1, DASCL is only slightly better and the difference from cross-entropy is not statistically significant (Wu et al., 2022). On New York Times economy sentiment, DASCL outperforms cross-entropy, cross-entropy + data augmentation, and standard SCL on accuracy for $$\mathcal{C} = \{c_1, c_2, \dots, c_M\},\quad c_i \sim \text{VLM}(t_j, I_j),\quad t_j \in \mathcal{T},\; I_j \in \mathcal{I}.$$2 and $$\mathcal{C} = \{c_1, c_2, \dots, c_M\},\quad c_i \sim \text{VLM}(t_j, I_j),\quad t_j \in \mathcal{T},\; I_j \in \mathcal{I}.$$3, and improves average precision significantly on the full training set. On AbusEval, BERT + DASCL improves over BERT on macro F1, F1 on the positive class, and average precision for $$\mathcal{C} = \{c_1, c_2, \dots, c_M\},\quad c_i \sim \text{VLM}(t_j, I_j),\quad t_j \in \mathcal{T},\; I_j \in \mathcal{I}.$$4 and $$\mathcal{C} = \{c_1, c_2, \dots, c_M\},\quad c_i \sim \text{VLM}(t_j, I_j),\quad t_j \in \mathcal{T},\; I_j \in \mathcal{I}.$$5, and with the full training set outperforms both BERT and HateBERT on those metrics (Wu et al., 2022).

For DetCLIP, the principal evidence concerns zero-shot and open-world detection. On LVIS minival, DetCLIP-T reaches 35.9 AP versus 26.0 AP for GLIP-T, a +9.9 AP improvement, and the abstract reports a 13.5% improvement on rare categories over the fully supervised model with the same backbone (Yao et al., 2022). The paper also reports substantial efficiency differences: about 2.0K GPU hours for training versus 10.7K GPU hours for GLIP-T, and 2.3 FPS inference versus 0.12 FPS for GLIP-T (Yao et al., 2022).

For SAFE-Dict, the evaluation covers Libero-Harm, BadRobot, RoboPAIR, and IS-Bench. On Libero-Harm, the reported ASR numbers are 84.7% for Default, 41.2% for Prompt-based safety, and 7.8% for SAFE-Dict. On BadRobot, Llama-3.2-Vision drops from 73.83% to 6.30% and Qwen2-VL from 29.52% to 5.43%. On RoboPAIR, SAFE-Dict reduces ASR-auto from 50.30% to 19.50%, with Syntax-auto around 73.52% and inference time close to the default model. On IS-Bench, Default has SR 66.5% and SSR 27.3%, Prompt-based has SR 29.8% and SSR 67.9%, and SAFE-Dict has SR 59.2% and SSR 72.5%, with substantially improved safety recall including pre-caution recall 78.0% (Wen et al., 2 Feb 2026).

For DACO on MLLMs, the reported evaluations use Qwen2.5-VL-7B-Instruct, LLaVA1.6-Mistral-7B, and InternVL3.5-8B-Instruct on MM-SafetyBench and JailbreakV-28K. On Qwen2.5-VL-7B-Instruct, DACO reaches MS-R 0.990, MS-QG 0.984, JBV-R 0.903, JBV-QG 0.841, with Fluency 0.905, PPL 3.137, and MMMU 0.521. On LLaVA1.6-Mistral-7B, DACO improves safety to MS-R 0.961, MS-QG 0.995, JBV-R 0.885, and JBV-QG 0.803. On InternVL3.5-8B-Instruct, DACO yields MS-R 0.981, MS-QG 0.987, JBV-R 0.975, and JBV-QG 0.970 (Luo et al., 10 Apr 2026). The paper also reports that on one SAE ablation, L1-SAE gives safety 0.736 and MMMU 0.481, L1-SAE + concept dictionary gives safety 0.808 and MMMU 0.510, and TopK-SAE + concept dictionary gives safety 0.841 and MMMU 0.521 (Luo et al., 10 Apr 2026).

AlignSAE reports strongest results at a middle layer, especially layer 6, where diagonal accuracy is 1.00, train slot accuracy is 1.00, test unseen-template accuracy is 0.912, and swap success reaches 0.85 at $$\mathcal{C} = \{c_1, c_2, \dots, c_M\},\quad c_i \sim \text{VLM}(t_j, I_j),\quad t_j \in \mathcal{T},\; I_j \in \mathcal{I}.$$6 (Yang et al., 1 Dec 2025). Layer-wise comparisons reveal a reconstruction-alignment trade-off: layer 0 has diagonal accuracy 0.238, swap success 0.04, and reconstruction MSE $$\mathcal{C} = \{c_1, c_2, \dots, c_M\},\quad c_i \sim \text{VLM}(t_j, I_j),\quad t_j \in \mathcal{T},\; I_j \in \mathcal{I}.$$7, whereas layer 6 has diagonal accuracy 1.000, swap success 0.85, and reconstruction MSE $$\mathcal{C} = \{c_1, c_2, \dots, c_M\},\quad c_i \sim \text{VLM}(t_j, I_j),\quad t_j \in \mathcal{T},\; I_j \in \mathcal{I}.$$8 (Yang et al., 1 Dec 2025).

6. Interpretation, limitations, and open questions

DACO-style methods are often presented as improving both control and interpretability, but the basis of that claim differs across settings. In DASCL, interpretability derives from explicit replacement of concept-bearing terms with tokens such as <positive> or <negative_econ>, together with t-SNE evidence that same-class embeddings are drawn closer and different-class embeddings pushed farther apart (Wu et al., 2022). In DetCLIP, interpretability arises from explicit concept-definition pairs and from the use of separate concept embeddings rather than a single long prompt (Yao et al., 2022). In SAFE-Dict and DACO, interpretability is tied to sparse concept coefficients or labeled SAE atoms, which enable thresholded or compositional interventions (Wen et al., 2 Feb 2026, Luo et al., 10 Apr 2026). In AlignSAE, interpretability is most explicit: relation identity is directly readable through

$$\mathcal{C} = \{c_1, c_2, \dots, c_M\},\quad c_i \sim \text{VLM}(t_j, I_j),\quad t_j \in \mathcal{T},\; I_j \in \mathcal{I}.$$9

and interventions write into semantically designated slots (Yang et al., 1 Dec 2025).

Several limitations recur. SAFE-Dict notes dependence on a predefined concept dictionary, limited safety scope, an assumption that safety can be expressed as a function of concepts rather than the full latent state, approximate concept identifiability, and potential over-suppression (Wen et al., 2 Feb 2026). The MLLM DACO paper notes that steering can be reversed maliciously to weaken safety guardrails, that safety-related concepts may themselves contain sensitive content, that broader expert concept sources may be required, and that hyperparameters such as the intervention window, annotation threshold $c_i$0, and promote strength $c_i$1 need tuning (Luo et al., 10 Apr 2026). AlignSAE is evaluated only on single-hop factual queries with a narrow ontology of six relations, and explicitly identifies multi-hop chains, cross-layer composition, structured answers, and richer hierarchical ontologies as future work (Yang et al., 1 Dec 2025).

A common misconception is to treat all dictionary-based methods as simple lexical preprocessing. That characterization fits neither the safety-oriented DACO systems nor AlignSAE. In the supplied literature, dictionaries can define replacement tokens, concept directions, negative pools, pseudo-label vocabularies, or initialization targets for overcomplete latent bases. Another misconception is that concept control is equivalent to prompt hardening or refusal prompting. SAFE-Dict and DACO explicitly position themselves against that view by intervening on latent states before unsafe intent becomes executable behavior or harmful output (Wen et al., 2 Feb 2026, Luo et al., 10 Apr 2026).

Taken together, these papers indicate that DACO is less a single benchmarked trick than a broader methodological program: construct a concept dictionary, align it with the model’s operative representation space, and intervene in that space with sufficient granularity to suppress harmful or irrelevant semantics while preserving useful behavior. This suggests that future work will likely depend on better dictionary coverage, stronger concept grounding, and more reliable separation between concept-aligned and residual information, rather than on larger steering vectors alone.