Incident Forensics with Reconstruction-Error Ceiling Guards for Sparse Autoencoder Audit Findings
We describe the incident-forensics workflow in MIVP, which replays stored activations against the probe registry and SAE feature dictionaries to localise why a request was flagged or blocked. We focus on a structural property: SAE feature findings are always labelled evidence-tier E0 (discovery-grade), and a reconstruction-error ceiling guard prevents the workflow from reporting features when the SAE is operating outside its reliable regime.
1. Introduction
When a runtime gating probe flags or blocks a request, the operator wants to know why. The answer requires replaying the request's activations against the probe registry and SAE feature dictionaries. The replay is a structural investigation, not a verdict: it surfaces what is true about this trace and lets a human interpret.
2. Background
Sparse autoencoders (Bricken et al., 2023; Cunningham et al., 2023; Templeton et al., 2024) reconstruct inputs as sparse linear combinations of learned features. The reconstruction error ||x − recon||² / ||x||² measures how well the SAE approximates its input. High reconstruction error indicates the input is in a regime the SAE has not learned to encode; features fired on in that regime are not necessarily meaningful.
3. Method
3.1 The Investigation Workflow
IncidentForensics.investigate(model_hash, request_id) loads stored activations, iterates registered probes (reporting raw last-token score, per-token sequence, peak token index, peak value), and iterates registered SAEs (computing reconstruction error; if within the ceiling, reports top-K firing features).
3.2 The Reconstruction-Error Ceiling
err = sae.reconstruction_error(stored.acts)
if err > self.recon_error_ceiling:
report.warnings.append(...)
continueDefault ceiling 0.5. The guard is non-negotiable: removing it produces unsupported findings.
3.3 The E0 Watermark
Every SAE finding carries tier = E0 and a banner reading EXPERIMENTAL (T3): discovery-grade evidence. The banner is part of the type, not a runtime string.
4. Results
Six tests cover the workflow. Workflow runtime on a 10-probe registry and 3-SAE configuration: 18.6 ms.
5. Discussion
The reconstruction-error ceiling is a trust calibration on SAE findings. The E0 watermark is a vocabulary commitment.
6. Conclusion
An incident-forensics workflow with reconstruction-error ceiling guards and E0 watermarks that enforces the distinction between discovery and verdict.
References
Bricken et al. (2023). Anthropic. / Casper et al. (2023). TMLR. / Cunningham et al. (2023). ICLR. / Hubinger et al. (2024). arXiv. / Templeton et al. (2024). Anthropic.