Interpretability is not model-specific

Core question: can interpretability tools built within one model (refusal direction, correctness direction, sentiment probe) be transferred to other models through a residual-stream mapping fitted only on unlabeled prompts, and what determines how much transfers.

• Problem setting: interpretability research produces tools that act on a single model's internal activations, usually built with labeled samples, and the next model requires rebuilding from scratch, so findings on one model have no evidential value for other models (Section 1).
• Existing evidence is mixed: the authors say prior work shows independently trained networks can be connected by simple mappings and that representations of different models may converge; but other reports say cross-family mapped directions perform comparably to random directions and that mappings fitted on a single domain fail cross-domain (negative R2), and it remains unclear when transfer works and why it fails (Section 1).
• Core observation: the authors hypothesize that the amount of transfer depends on whether the mapping's training data cover the representation region the tool reads, and propose an unlabeled coverage score c to characterize this (Section 5).
• Contributions: test transfer of three tools across all 110 ordered pairs of 11 instruction-tuned models from 5 families, 1B–72B (including specificity controls and 5 seeds); give Proposition 1 bounding transfer error; compare the cost of transfer with rebuilding the tool within the target model (Section 1).
• Access assumption: the method requires running unlabeled prompts on the target model and reading its residual-stream activations (steering also requires applying interventions to target activations), i.e., white-box access; the authors note API-only models do not provide such access (Section 7).

Cross-model representation similarity

• CKA of Kornblith et al. (2019) and stitching of Lenc and Vedaldi (2019) and Bansal et al. (2021): comparing and connecting representations of different networks with similarity metrics or learned mappings.
• Relative representations of Moschella et al. (2023) compare latent spaces without learned mappings; the Platonic Representation Hypothesis of Huh et al. (2024) argues that models trained on different data and objectives converge to a shared representation.
• Gorbett and Jana (2026) say affine mappings between final hidden states preserve downstream behavior; Lan et al. (2025) say SAE features reproduce across models; Armstrong et al. (2026a) report that mappings between models fail across reasoning domains, and this paper attributes that failure to the mapping's training data (Section 2).

Cross-model transfer of interventions

• Oozeer et al. (2025): on models up to 3B, transfer steering vectors (backdoor removal, refusal) using autoencoders and affine mappings trained on each task's own data.
• Syed (2026): use ridge regression to map the misalignment direction across four model families, finding that mapped directions change behavior, but random and orthogonal control directions change it to a comparable degree.
• Agarwal (2026): reports that cross-architecture steering mostly succeeds for models above about 1.7B, with degradation for smaller models. The paper notes that these works do not answer what determines whether transfer succeeds.

Directions as interpretability tools

• Linear representation hypothesis and probes: the linear representation hypothesis of Park et al. (2024); linear probes of Alain and Bengio (2017) and Belinkov (2022).
• Steering and refusal: activation steering of Turner et al. (2024), Li et al. (2023), Zou et al. (2025), Rimsky et al. (2024); Arditi et al. (2024) say refusal in many chat models is mediated by a single direction, and Wang et al. (2026) say refusal may require multiple directions in broader contexts.
• Correctness and truthfulness directions: Burns et al. (2023), Marks and Tegmark (2024), Orgad et al. (2025), Armstrong et al. (2026b); Braun et al. (2025) say the reliability of steering vectors depends on how consistently the training data represent the behavior. The paper notes that these works all build and evaluate directions within a single model.

Control setup: this paper does not compare numbers with other transfer methods, but compares with the target model's native tools and with three control directions: random, orthogonal, and mapped random; evaluation uses datasets such as ARC-Challenge, TruthfulQA and SST-2 (Section 3).

Authors' positioning: measure representation similarity by the function of transferred tools, vary the mapping training data, use no target labels, and add controls and multi-seed tests across 110 pairs of 1B–72B models (Section 2).

Overall approach: fit a linear mapping ridge regression map M on paired activations from the source model's residual stream and the target model's residual stream, transfer tools built on the source model to the target model through M, without using target labels at any point; the amount of transfer is measured by recovery rate and explained with a coverage score derived from Proposition 1.

Models and Representations

• Models tested: 11 instruction-tuned models from 5 families (Llama-3.2-1B to Qwen2.5-72B, Table 1), with the two largest models in 4-bit precision; plus 4 base models (Appendix I).
• Representations: for a prompt, take the residual stream after block ⌊dL⌉ at the last token and normalize it; d=0.5 for refusal (d=0.75 for Qwen2.5-72B), d=0.75 for correctness and sentiment (Section 3).

Mapping and Its Training Data

• Mapping form: ridge regression with intercept, with the penalty coefficient selected by exact leave-one-out error (Appendix B); an RBF kernel mapping is also tried.
• Training data variants: General (600 each from 9 domains, 5,400 ordinary questions in total); General + task (adding unlabeled prompts from the region where the tool operates: 256 harmful + 256 harmless instructions, candidate answers for 200 questions per dataset, or 256 reviews); Task only; Narrow (GSM8K only); other datasets (same kind but from BeaverTails/Dolly, OpenBookQA/MMLU, Yelp); the coverage curve varies the number of task prompts (Table 6).

Three Tools

• Refusal direction: mean difference between 128 harmful and 128 harmless instructions (Arditi et al., 2024); addition adds αmr̂ at every position in the selected block and measures refusal rate on 64 held-out harmless prompts; ablation projects out r̂ from every block and measures the drop in refusal on 64 held-out harmful prompts; refusal is determined by phrase matching and checked with Llama Guard 3.
• Correctness direction: average over 50 labeled questions of the correct-answer representation minus the mean of wrong-answer representations (Armstrong et al., 2026b), scoring candidate answers by projection, tested on ARC-Challenge (500 questions) and TruthfulQA (400 questions, four options).
• Sentiment probe: mean difference between 50 positive and 50 negative SST-2 reviews, with the midpoint of class means as threshold, tested on 500 validation reviews.
• Transfer method: the mapping defines the source representation of a prompt and rebuilds the tool; for mean differences this is equivalent to applying the linear part of the mapping to the source tool (up to a normalization); transferred tools use only source labels (Section 3).

Measurement and Controls

• Recovery rate: R = (E_carried − E₀) / (E_native − E₀), where E is the harmless-prompt refusal rate (addition), the drop in harmful-prompt refusal (ablation), or answer accuracy, and E0 is the no-intervention or zero-shot reference (Eq. 1).
• Controls: random directions of equal norm, random directions orthogonal to the native direction, and random source directions passed through the general mapping; refusal is compared at each target's working strength α∗ (the smallest α at which the native direction refuses half of harmless prompts).
• Statistics: 5 seeds, with intervals being 95% bootstrap intervals over resampled models (Appendix D).

Coverage Score and Theory

• Proposition 1: if the target representations on training and tool prompts satisfy y = xA + b + ε (zero-mean noise), then the expected deviation between the transferred tool and the native tool is −λ δ_S (X_c^⊤ X_c + λ I)⁻¹ A, and the angle satisfies sin θ ≤ κ√(1−c²) (Eq. 2).
• Coverage score: c = ∥δS Sλ∥/∥δS∥ ∈ [0,1], depending only on the tool, the source training representations and λ, and requiring no target labels; the authors use it to predict recovery rate and explain cross-domain mapping failure (Section 5).

Experimental Setup

• Models tested: 11 instruction-tuned models (Llama-3.2-1B, Qwen2.5-1.5B, Gemma-2-2B, Phi-3-mini, Qwen2.5-7B, Mistral-7B, Llama-3.1-8B, Gemma-2-9B, Gemma-2-27B, Llama-3.1-70B, Qwen2.5-72B), all 110 ordered pairs; plus 4 base models (Table 1, Appendix I).
• Datasets: for refusal, Alpaca harmless instructions and LLM-LAT/HarmfulQA/AdvBench/HarmBench/JailbreakBench harmful instructions; for correctness, ARC-Challenge (500 test questions) and TruthfulQA (400 questions); for sentiment, SST-2 (500 validation reviews); for mapping training, ordinary questions from 9 domains (Table 6, Appendix C).
• Metrics: recovery rate R (Eq. 1); sentiment report accuracy and its difference from the native probe; R2 for the mapping study; coverage score c and map KL.
• Determination method: refusal determined by phrase matching and checked with Llama Guard 3 (8B); correctness by selecting the highest-scoring candidate by projection; no LLM judge scoring.
• Number of repetitions: 5 seeds for main experiments; 1 seed for ablation, kernel mapping, task-only mapping and base model experiments (Section 3).
• Inclusion criteria: the target model must have a working tool of its own (e.g., refusal target baseline refusal rate ≥50%); refusal addition uses 10 targets and 100 pairs, ablation 9 targets and 90 pairs, ARC 9 targets, TruthfulQA and sentiment 11 targets and 110 pairs (Appendix A).

Main Results

Table 2: transfer results of three tools through each mapping (recovery rate %, sentiment as accuracy and difference from the native probe's 89.5%; mean of 5 seeds, † behavior 1 seed).

Swipe horizontally to read the table

Mapping	Refusal addition	Refusal ablation	ARC	TruthfulQA	Sentiment accuracy (∆)
General	54 [37,70]	71 [53,92]	16 [−23,46]	77 [69,85]	81.7 (−7.8)
General, kernel†	54 [39,71]	88 [67,108]	27 [−9,56]	74 [64,84]	80.1 (−10.0)
General + task	102 [99,106]	82 [62,102]	88 [66,101]	98 [97,100]	89.6 (+0.2)
Task only†	101 [99,104]	79 [59,98]	87 [63,101]	99 [98,100]	88.8 (−1.4)
General + other datasets	88 [80,96]	78 [58,100]	73 [41,93]	82 [79,86]	88.6 (−0.9)
Narrow (GSM8K)	2 [0,3]	4 [0,8]	−66 [−95,−34]	15 [3,24]	57.5 (−32.0)
Mapped random	0 [0,1]	2 [−1,5]	−149 [−185,−116]	−3 [−13,5]	47.5 (−42.0)
Random direction	1 [−1,1]	−1 [−6,1]	−150 [−231,−104]	−6 [−21,4]	52.2 (−37.3)

• Authors' interpretation: transfer is specific—random and mapped-random controls recover at most 1% under refusal addition and at most 4% under ablation, sentiment is within 3 points of random level, and correctness is below the zero-shot reference (Section 4).
• Authors' interpretation: mapping training data determines the amount of transfer; ARC is only 16% under the general mapping with an interval containing zero, which the authors explain by general data containing only questions while the correctness direction reads "question + candidate answer" (Section 5).
• Authors' interpretation: after adding task prompts, family and scale have little effect—Llama-3.2-1B steering to Llama-3.1-70B recovers 101%, and the reverse 96%; the two smallest targets recover 97% and 102%, which the authors say differs from the degradation below 1.7B reported by Agarwal (2026) (Section 4).

Coverage Curve and Coverage Score

• What was measured: task prompts were gradually added to the general mapping (Figure 3); the coverage score c of each run was computed and compared with the recovery rate (Figure 4).
• Results: refusal reaches 102% with just 16 harmful + 16 harmless prompts (5 seeds), and 97% of 500 runs recover at least 80% (weakest 44%); ARC rises from 16% to 88%, TruthfulQA from 77% to 98%, and the sentiment gap shrinks from 7.8 points to 0.2 points. Spearman ρ between c and recovery rate: refusal 0.67, ARC 0.71, TruthfulQA 0.68, sentiment 0.45 (3,500–4,510 runs/tool, Table 15); refusal runs with c ≥ 0.95 recover 99% on average, while those with c < 0.8 recover only 4%.
• Authors' interpretation: the relationship is threshold-like; under a fixed mapping, c cannot rank refusal pairs (ρ = −0.05), which the authors say is consistent with the pairing factor κ in the proposition (Section 5).

Cross-Domain Mapping Failure and Geometric Tests

• What was measured: the mapping study fits specialist mappings on 9 domains and evaluates them cross-domain (Figure 5, Table 7); RSA, mutual kNN, CKA and local linear mapping are used to test the linear correspondence assumption (Appendix F).
• Results: a single-domain mapping gives R2 = 0.48 on held-out prompts in its own domain and −1.94 on the other 8 domains, with 90% of the 72 train×evaluate combinations negative; an all-domain mixed mapping averages 0.47, at most 0.12 behind the specialist; a leave-one-domain-out mapping gives −0.62 on that domain. Linear CKA between models is 0.84 at middle layers (0.01 with shuffled pairing); kernel mapping is only 0.05 R2 higher than linear mapping; local linear mapping does not outperform global mapping.
• Authors' interpretation: the authors say the previously reported cross-domain failure is a failure of mapping extrapolation and disappears once the training data include that domain; the geometric results support the proposition's linearity assumption holding approximately within the data coverage region (Section 5, Appendix F).

Comparison with Target's Built-in Tools and Source Selection

• What was measured: Table 3 compares the transferred tools with tools the target model builds itself using the same prompts (taking the principal component PC when unlabeled); Appendix I tests transfer between base models and instruction-tuned models.
• Results: a refusal-direction target building its own tool with the same 16 prompts/class recovers 97%, while transfer gives 103%; the unlabeled PC gives −76% (10 questions) and −14% (200 questions) on ARC, 86% on TruthfulQA, and 22 points lower on sentiment, whereas the transferred tools recover 88% and 98% and match the native probe; the authors say the transferred ARC direction is worth about 25 labeled target questions. Between base↔instruction-tuned models, TruthfulQA and sentiment recovery is 93%–101%, and ARC 61%–92% (Table 18).
• Authors' interpretation: the refusal mechanism corresponds across models, but transfer does not save labeling; the transfer of the readout tool can substitute for target labels. Without task prompts, map KL is used to select the source: within targets, ranking by source gives ρ = −0.46 (p < 0.001), and transferring from the lowest-KL source raises refusal recovery from 54% to 67% (best source post hoc 80%) (Section 6).

Other Ablations and Analyses

• Block-wise ablation: a task-only mapping is fitted for one direction per block; the transferred direction recovers 101% [89,112] of the native block-wise effect, and both leave 8%–9% of harmful prompts refused (a single native direction leaves 19%) (Table 17).
• Dose response: recovery rate integrated over strength without depending on α∗: general 67%, +task 95%, GSM8K 5% (Table 8).
• Llama Guard 3 check: after ablating the transferred direction, 33%–54% of harmful prompt responses are judged unsafe, versus 53% for the native direction and 6%–8% for baseline and random (Section 4).
• Exception: Phi-3-mini is the only target whose ablation recovery drops after adding task prompts (from 21%–69% to 4%–13% under general), which the authors attribute to the native direction itself failing in the normalized space (Appendix E).
• Exception: on Qwen2.5-1.5B, the block-wise transferred direction leaves 40% of prompts refused (native 6%) (Table 17).
• Seed variation: the 16-prompt refusal mapping gives seed means of 99%–108%, and the 10-question ARC mapping 14%–65% (Table 10).

Limitations and future directions noted by the authors

• Tool form: only linear directions and linear probes were transferred; SAE features and circuits were not tested and may require different forms of mapping (Section 7).
• Theoretical assumptions: Proposition 1 assumes linear correspondence, ignores normalization of the mapped representation, and cannot predict which pairs correspond well (Section 7).
• Model scope: tested on 11 instruction-tuned open-source models (the two largest models in 4-bit), with 4 base models tested only on readout tools (Section 7).
• Refusal evaluation: refusal was scored by phrase matching at a single strength per target; across the full strength range (1 seed), general+task recovers 95% (Section 7, Appendix C).
• Inclusion criteria: Gemma-2-27B was excluded from the ablation due to a coherence criterion added after the main experiments; readout tools were never used for steering (Section 7, Appendix A).
• Coverage prerequisites: coverage requires knowing which region the tool operates in, and small-sample extraction can fail—the weakest 16-prompt extraction recovers only 44% for refusal, mostly on Llama-3.2-1B; the ablation, block-wise and kernel mappings, and base-model transfer used only 1 seed (Section 7).

Experimental coverage

• Models tested: all 110 ordered pairs of 11 instruction-tuned models (1B–72B) from 5 families, plus 4 base models tested only on correctness and sentiment tools (Table 1, Appendix I).
• Tools transferred: refusal direction (addition and ablation), correctness direction (ARC-Challenge, TruthfulQA), SST-2 sentiment probe, three in total (Section 3).
• Mapping variants: general, general+task, task only, other datasets, narrow (GSM8K), RBF kernel mapping and coverage curves (Table 6).
• Repetitions: 5 seeds for the main experiments; 1 seed each for the ablation, kernel mapping, task-only mapping, block-wise ablation and base-model experiments (Section 3, Appendix H, I).
• Access conditions: transfer and steering both require white-box access to the target model's residual stream activations; the authors note that API-only models do not provide this (Section 7).

An analysis paper on cross-model interpretability transfer: the authors ask whether activation direction tools found within one model can be moved to other models via a linear mapping fitted with unlabeled prompts.

• Problem: tools such as refusal directions, correctness directions and sentiment probes are usually rebuilt per model with labeled data; existing evidence on cross-model mapping is mixed, with some reporting transfer comparable to random directions and others reporting cross-domain failure.
• Method: fit ridge regression mappings on all 110 ordered pairs of 11 instruction-tuned models (1B–72B) from 5 families, transfer three tools, and compare against target-native tools and random, orthogonal and mapped-random controls, with 5 seeds; also propose an unlabeled coverage score c and Proposition 1.
• Main results: mappings fitted only on general questions recover 54% of the refusal steering effect and 16%–77% of the correctness gain; after adding unlabeled prompts in the tool region, this rises to 102% and 88%–98%, the sentiment probe matches native (89.6% vs. 89.5%), and control directions recover at most 1% (Table 2).
• Coverage explanation: c correlates with recovery rate over 3,500–4,510 runs/tool (Spearman ρ 0.45–0.71); the authors say previously reported cross-domain mapping failures were caused by training data not covering the domain, with single-domain mapping cross-domain R2 = −1.94, which disappears once that domain is included (Figure 5).
• Practical value: the refusal direction target can be self-built with the same 16 prompts/class (97% vs. 103% for transfer), so transfer does not save labeling; the correctness and sentiment transfer tools outperform any tool the target's unlabeled representations can provide (Table 3).
• Authors' conclusion: the authors believe that once an interpretability result is discovered, it can be reused across models at the cost of a few unlabeled prompts; they also note that transfer requires white-box access to target activations, and that features and circuits beyond linear tools were not tested (Section 7).