Form, Not Granted: A Sparse-Autoencoder Autopsy Shows the Agent's Commit-Locus 'Authorization Direction' Is a Surface-Form Artifact --- and an All-Layer Sweep Leaves the Deeper Question Open (v2)
Caio Vicentino
Abstract
A late-layer 'authorization direction' was reported to detect and steer a tool-using agent's commitment to unauthorized irreversible actions (DOI 10.5281/zenodo.20683623), and a follow-up found it tracks the authorization the model FEELS rather than the one the user GRANTED (DOI 10.5281/zenodo.20685264). Both were built on a SUPERVISED difference-of-means direction -- a method that returns a direction whether or not the concept is natively represented. We stop using the ruler and point the microscope: we encode the residual at the delete-commit token (layer 59 of Qwen3.6-27B) through a trained TopK sparse autoencoder (40,960 features) and ask, unsupervised, whether a feature distinguishes a GRANTED commit from a FELT-but-not-granted one. (1) The supervised direction INVERTS under a structure-matched control: applying the same frozen direction, AUROC(granted vs felt) goes from 0.838 to 0.08 when both conditions share one multi-turn scaffold and only the final user turn varies -- selection-free and SAE-independent. A direction measuring authorization would not flip when only the conversation FORMAT changes. (2) The SAE's separating features are SURFACE FORM: every top feature that separates granted from felt is, by its max-activating context, a tool-call scaffold, a JSON tool-schema token, or the file-listing output -- never a semantic 'user granted this' feature. (3) A cross-lexical-family test isolates this: a feature selected on one paraphrase family does NOT transfer to a disjoint family (held-out AUROC 0.50, chance), and the one feature that does transfer (0.993, pooled 0.998) max-activates on tool-call FORMAT BOILERPLATE, not authorization. The agent's commit-point representation is dominated by surface form and plan-coherence; authorization-as-granted is not a native monosemantic feature AT THIS LOCUS (see the v2 revision below: an all-layer sweep complicates any stronger claim). The robust lesson: the commit-locus difference-of-means direction reads form, not a clean grant. HONEST SCOPE: one model, one locus (L59), one domain (file deletion), synthetic structure-matched scenarios, an SAE explaining ~66% of residual variance; 'no native authorization feature' is strictly 'no monosemantic separating feature in this SAE's learned dictionary at this locus' (absence of a separating feature is weaker than evidence of absence of any representation); this QUALIFIES, not refutes, the prior arc, and steering-control is not re-tested. Every number is recomputed from five public per-run ledgers (an evaluation script, 34/34) and citations are web-verified (0 fabrications); the decisive counterfactual run reproduced bit-for-bit across two GPU sessions. Runners, ledgers, figures, and the evaluation are released. REVISION (v2): the first version concluded 'no native authorization concept'. A subsequent sweep across ALL 11 SAE layers (two positions) revealed a paraphrase-invariant granted-vs-felt linear signal at most layers that this conclusion did not account for; but the signal carries residual surface confounds (an em-dash present in both granted phrasings and neither felt; referent specificity; it is already near-ceiling at layer 15, too early for semantics), so we cannot call it authorization either. This version WITHDRAWS the unqualified no-concept claim, scopes the result to the commit locus, and states the deeper question as OPEN (needs a confound-balanced re-run with feature naming). The robust findings (the structural flip 0.838->0.08, the L59 surface-form naming) are unchanged.