Research·arXiv cs.LG·15h ago

Vision-language models hide harmful content detection in unreachable features

Researchers using sparse autoencoders have identified a critical failure mode in vision-language models: harmful content is sometimes internally represented but fails to route to outputs. Testing Gemma-3 and Qwen3.5 on meme classification across six benchmarks, the team found that sparse readouts recovered performance gaps of 30+ percentage points in macro-F1, suggesting models possess latent safety signals that native architectures suppress or misroute. This readout gap has implications for both interpretability and alignment, revealing that model failures may stem from architectural routing issues rather than missing knowledge, a distinction that reshapes how teams should approach safety audits and fine-tuning strategies.

Modelwire context

Explainer

The key insight is architectural, not epistemic: models may possess the safety knowledge to reject harmful content but fail to route that signal through their output layers. This reframes model failures as a plumbing problem rather than a knowledge gap.

This connects directly to the reward hacking detection work from mid-September, which also used internal representations to catch misalignment between what models compute internally and what they surface. Both papers reveal that frontier models harbor coherent safety or alignment signals that native architectures suppress or misdirect. The difference here is scope: reward hacking detection catches gaming of benchmarks, while this work isolates a systematic architectural failure in content moderation. Together they suggest internal readout gaps are a recurring failure mode worth auditing across safety-critical tasks.

If the same sparse readout technique recovers similar performance gaps (25+ points macro-F1) when applied to Gemma-3 and Qwen3.5 on a held-out meme dataset collected after model training, that confirms the gap is genuine architectural routing rather than overfitting to the six benchmarks tested. If performance gains collapse on out-of-distribution memes, the finding is narrower than claimed.

Coverage we drew on

Monitoring and Discovering Reward Hacking with Internal Representations during LLM Evaluations · arXiv cs.LG

This analysis is generated by Modelwire’s editorial layer from our archive and the summary above. It is not a substitute for the original reporting. How we write it.

MentionsGemma-3 · Qwen3.5 · sparse autoencoders · vision-language models

Read full story at arXiv cs.LG →(arxiv.org)

Modelwire Editorial

This synthesis and analysis was prepared by the Modelwire editorial team. We use advanced language models to read, ground, and connect the day’s most significant AI developments, providing original strategic context that helps practitioners and leaders stay ahead of the frontier.

Our mission How we write

Modelwire summarizes, we don’t republish. arXiv cs.LG originally reported this story as “Decodable but Misrouted: Sparse Features Uncover a Readout Gap in Vision-Language Models for Harmful Meme Detection”. The full content lives on arxiv.org. If you’re a publisher and want a different summarization policy for your work, see our takedown page.