REVIEW 4 major objections 4 minor 1 cited by
When Models Refuse: Political Steerability and Feature Richness as Measures of Ideological Depth
T0 review · 4 major / 4 minor · reviewed 2026-08-05 · deepseek-v4-flash
Pith's one-line read This paper claims that when an LLM refuses a benign political instruction, the refusal can be a capability deficit—a shortage of internal political features—rather than a fixed safety rule, and that 'ideological depth' measured by steerabil
desk verdict A new empirical observation about refusal and SAE features, but the causal claim in the abstract is not supported by any reported ablation and the numbers don't add up. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The central object is 'ideological depth,' operationalized by two measurable quantities: steerability without failure and feature richness. Steerability is measured through prompt-engineering conditions and activation steering—contrastive activation addition and steering target atoms—while feature richness is measured by decomposing hidden-layer activations with sparse autoencoders into sparsely activating, interpretable features. The causal claim is carried by targeted feature ablation: selecting a small set of political features by activation amplitude and frequency differences, deleting them, and observing refusal behavior rise.
What would settle it
Train or procure a sparse autoencoder for the instruction-tuned version of the less steerable model using the same dictionary-learning setup as for the more steerable model, then recount activated political features on the same 126 statements; if the 7.3x gap shrinks or disappears, the capability-deficit conclusion is an artifact of mismatched measurements.
Extended reading notes
Core claim
The paper's central claim is that ideological depth is a measurable property with two components: a model's ability to follow political instructions without breaking down (steerability), and the richness of its internal political feature vocabulary, quantified by how many distinct sparse-autoencoder features activate on political statements. Comparing two similar-sized open-weight models, the authors find large differences on both axes: the more steerable model activates about 7.3 times more distinct political features, while the other produces more refusals, especially when asked to argue conservative positions. The causal step is an ablation: removing a small, targeted set of political fea
Load-bearing premise
The paper's central comparison assumes the two models' sparse autoencoder dictionaries are equally faithful windows into political representations, and that an autoencoder trained on the base (non-instruction-tuned) version of one model faithfully measures the instruction-tuned model; if either fails, the feature-richness gap could come from the measuring instrument rather than the model's capability.
Editorial extensions
If this is right
- Refusal rate stops being a trustworthy safety metric: a model that refuses more may simply be less capable of representing the requested viewpoint.
- Ideological depth can be measured before deployment, giving a predictor of when a model will refuse on political topics.
- Safety monitoring can move toward internal features: richer, more coherent feature sets make a model more inspectable and steerable.
- Ablating political features is a reversible causal intervention, so feature richness can be experimentally manipulated to test refusal mechanisms.
Reading between the lines
- The 7.3x feature-count gap may partly reflect differences between the two SAE dictionaries and the use of a base-model autoencoder on an instruction-tuned model; a matched SAE trained on both models would settle this.
- If refusals can be capability deficits, the same logic may apply beyond politics—refusals on math, coding, or low-resource-language instructions might also mask missing representations rather than policy.
- A testable extension: expose the shallow model to additional political text through continued pretraining or fine-tuning and check whether refusal rates fall; if they do not, the capability-deficit story needs revision.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes 'ideological depth' as a composite of steering success (steerability) and SAE-based political feature richness, and compares Llama-3.1-8B-Instruct against Gemma-2-9B-it. Using prompt engineering, contrastive activation addition (CAA), and SAE target-atom steering, the authors report that Gemma is more easily steered in both ideological directions, while Llama increasingly refuses conservative instructions. They further report that Gemma activates far more political SAE features (claimed as ~7.3x) and that its features are more coherent and more predictive of statement category. The abstract and discussion conclude that refusals on benign prompts can be a capability deficit rather than a safety guardrail, claiming that ablating Gemma's political features reproduces Llama's feature-poor behavior and drives up refusals. However, the manuscript does not report the promised ablation experiment; the empirical sections contain steering and feature-quality analyses only.
Significance. If the causal claim were established, this would be a notable contribution connecting mechanistic interpretability, political steerability, and refusal behavior. The study uses publicly available SAEs (GemmaScope and LlamaScope), includes a layer sweep, and validates an IRT-based ideal-point model in the appendix, which are strengths. The qualitative feature evaluation via an automated judge is also a useful attempt to move beyond raw feature counts. However, the central inference—that refusal behavior is caused by a shortage of internal political features—is currently unsupported, and several measurement choices (different SAE suites, base-vs-instruct SAE mismatch, circular feature selection) confound the comparison. The paper would require substantial additional analysis before the headline conclusion can be accepted.
major comments (4)
- [Abstract and Section 3.3] The abstract states that 'causally ablating a small, targeted set of political features from the former model reproduces the same feature-poor behavior and drives up refusals' (also similarly in the full-text abstract and Section 4). No ablation experiment appears in the manuscript. Section 3.3 reports feature counts, output-score interventions (Eq. 1), and qualitative evaluations, but no figure, table, or quantitative result measures refusals after ablating the selected features. Figure 9 reports steering interventions, not ablations. The causal claim is therefore unsupported as written. Either an actual ablation experiment must be added (e.g., removing or zeroing the targeted SAE features and measuring refusal rates and response distributions) or the conclusions must be restricted to correlation.
- [Section 3.3, '7.3x' claim] The text says: 'In total, for the gemma-2-9b-it model, we found 18458 features, whereas for the llama-3.1-8b-it, we found only 4412 activated features... On average, Gemma contained 7.3 times more features that activate for a statement.' The ratio 18458/4412 is approximately 4.18, not 7.3. This same 7.3x figure is repeated in the abstract, Section 3.3, and Section 4. This is an internal inconsistency in a headline quantitative result; it must be corrected or redefined with a clear normalization.
- [Section 3.2] The authors use LlamaScope SAEs, noting that 'LlamaScope only offers SAEs for the base llama-3.1-8b model, we still found it effective for steering the instruction-tuned variant.' The feature richness comparison therefore uses an SAE trained on the base model to measure features of the instruct-tuned model. This is a serious confound: the low feature count and poor feature coherence for Llama could be artifacts of dictionary mismatch rather than evidence of a capability deficit. The paper should validate that the base-model SAE is appropriate for the instruct model (e.g., reconstruction loss on instruct activations, or comparison with a matched SAE) or substantially temper the cross-model claims.
- [Section 3.3, feature selection and evaluation] Political features are selected using Δa and Δf computed from the same 874 training prompts that are also used to build and evaluate steering, and their 'quality' is then assessed partly by how well they steer the model. This circularity can inflate the apparent association between feature richness and steerability. A held-out set or cross-validation should be used when selecting features and evaluating their predictive/steering quality, otherwise the reported relationship may reflect fitting to the evaluation set.
minor comments (4)
- [Appendix D title] The appendix is titled 'Promprs Used In Feature Qualitative Analysis'; 'Promprs' should be 'Prompts'.
- [Section 3.3] Equation (1) uses 'interveined' instead of 'intervened', and the notation r(l*, M) should be defined more explicitly (e.g., rank among all tokens at the target layer).
- [Section 4] The phrase 'measurable, biological property of Large Language Models' is infelicitous; LLMs are not biological. Suggest 'structural' or 'mechanistic'.
- [Figure 13 caption] The caption mentions 'llama-29b-it'; this appears to be a typo for 'llama-3.1-8b-it'.
Circularity Check
No significant circularity; minor definitional overlap between 'ideological depth' and refusal behavior, but the main causal claim is unsupported by an omitted ablation rather than circular.
-
self definitional
[Section 1 (Introduction), page 2]
"Our work demonstrates that a model’s ideological depth is not an abstract quality but a measurable property determined by two key factors: Feature Richness, representing the size of its internal vocabulary of political concepts discovered via SAEs, and Steerability without Failure, the robustness with which it can follow ideological instructions without breaking down into refusal."
Because 'Steerability without Failure' is defined as the ability to follow ideological instructions without refusal, the paper's later conclusion that models with low ideological depth refuse more is partly true by definition. However, the construct also includes Feature Richness, measured independently via SAE feature counts, so the causal claim about capability deficits does not reduce entirely to the definition. The overlap is a moderate conflation, not a full circular derivation.
full rationale
The paper defines 'ideological depth' as a combination of feature richness and refusal-free steerability, so the association between low depth and high refusal is partly tautological. This is a genuine but minor self-definitional issue: the feature-richness component is measured separately from refusal behavior via SAE activation counts, and the qualitative/quantitative feature evaluations provide independent evidence of a difference between the two models. No load-bearing step reduces to its inputs by construction: the SAE feature counts are not the same as the steering-evaluation outputs, and the output-score causality checks are distinct from the selection criteria. The paper's central causal claim, however, is seriously under-supported: the abstract and introduction promise that 'causally ablating a small, targeted set of political features' reproduces refusal behavior, but no ablation experiment is reported in the methods or results. This is an omitted proof and a validity concern, not a circularity, because the missing ablation is not derived from the paper's definitions or fitted parameters. The self-citation [13] is used only for an argumentative-pressure prompting technique and is not load-bearing. Overall, the derivation chain is not circular, but the headline causal conclusion overreaches the presented evidence.
Assumptions & free parameters
free parameters (3)
- Steering layer per model =
Llama: layer 14; Gemma: layer 20
- SAE dictionary selection =
131K features for both models
- Political feature inclusion thresholds =
Δa > 0 and Δf > 0
assumptions (4)
- domain assumption Comparability of SAE feature dictionaries across models
- domain assumption Applicability of base-model SAEs to instruct-tuned variant
- domain assumption Steerability differences reflect capability rather than safety training or model family
- ad hoc to paper SAE features with positive Δa or Δf are political features
Cite this review
Pith. "Pith review of When Models Refuse: Political Steerability and Feature Richness as Measures of Ideological Depth." pith.science (2026). https://pith.science/paper/C2ATC6ZS
@misc{pith2026250821448,
author = {Pith},
title = {Pith review of: When Models Refuse: Political Steerability and Feature Richness as Measures of Ideological Depth},
year = {2026},
howpublished = {\url{https://pith.science/paper/C2ATC6ZS}},
note = {Machine review of arXiv:2508.21448}
}
read the original abstract
Large language models (LLMs) sometimes refuse to follow benign instructions, such as declining to argue a political position or adopt a stated persona, and such refusals are commonly read as safety guardrails at work. We ask whether they can instead signal a **capability deficit**: a shortage of the internal representations a model needs to reason from the instructed perspective. To investigate, we introduce **ideological depth**, a property with two components: (i) a model's ability to follow political instructions without *failure* (steerability), and (ii) the **feature richness** of its internal political representations, measured with sparse autoencoders (SAEs). Using two widely used openweight LLMs as candidates, we compare interventions based on prompts and activation-steering, and probe political features with publicly available SAEs. We find large, systematic differences: a model that is more steerable in both ideological directions activates **~7.3x** more distinct political features, while the other model instead responds with increased refusals. Causally ablating a small, targeted set of political features from the former model reproduces the same feature-poor behavior and drives up refusals. Together, these results indicate that refusals on benign prompts can arise from **capability deficits** rather than fixed safety rules, and that ideological depth is a measurable property of LLMs that helps predict when a model will refuse.
Figures
Figures from the paper (11 more)
Forward citations
Cited by 1 Pith paper
-
Auditing Alignment Controllability in LLMs via Political Axes
On a 63,700-response Political Compass stress test of seven frontier LLMs, system-prompt framing dominates model identity, and steerability needs dispersion, symmetry, saturation, and refusal-floor metrics.
Reference graph
Works this paper leans on
-
[1]
N. Aldahoul, H. Ibrahim, M. Varvello, A. Kaufman, T. Rahwan, and Y . Zaki. Large language models are often politically extreme, usually ideologically inconsistent, and persuasive even in informational contexts. arXiv preprint arXiv:2505.04171, 2025
arXiv 2025
-
[2]
E. Ameisen, J. Lindsey, A. Pearce, W. Gurnee, N. L. Turner, B. Chen, C. Citro, D. Abra- hams, S. Carter, B. Hosmer, J. Marcus, M. Sklar, A. Templeton, T. Bricken, C. McDougall, H. Cunningham, T. Henighan, A. Jermyn, A. Jones, A. Persic, Z. Qi, T. Ben Thompson, S. Zimmerman, K. Rivoire, T. Conerly, C. Olah, and J. Batson. Circuit tracing: Reveal- ing compu...
work page 2025
-
[3]
D. Arad, A. Mueller, and Y . Belinkov. Saes are good for steering – if you select the right features, 2025. URL https://arxiv.org/abs/2505.20063
arXiv 2025
-
[4]
E. M. Bender, T. Gebru, A. McMillan-Major, and S. Shmitchell. On the dangers of stochastic parrots: Can language models be too big? In Proceedings of the 2021 ACM conference on fairness, accountability, and transparency, pages 610–623, 2021. 10
work page 2021
-
[5]
T. Bricken, A. Templeton, J. Batson, B. Chen, A. Jermyn, T. Conerly, N. Turner, C. Anil, C. Deni- son, A. Askell, R. Lasenby, Y . Wu, S. Kravec, N. Schiefer, T. Maxwell, N. Joseph, Z. Hatfield- Dodds, A. Tamkin, K. Nguyen, B. McLean, J. E. Burke, T. Hume, S. Carter, T. Henighan, and C. Olah. Towards monosemanticity: Decomposing language models with dictio...
work page 2023
-
[6]
A. Caliskan, J. J. Bryson, and A. Narayanan. Semantics derived automatically from language corpora contain human-like biases. Science, 356(6334):183–186, 2017
work page 2017
-
[7]
C.-H. Chiang and H.-y. Lee. A closer look into using large language models for automatic evaluation. In H. Bouamor, J. Pino, and K. Bali, editors, Findings of the Association for Computational Linguistics: EMNLP 2023, pages 8928–8942, Singapore, Dec. 2023. Association for Computational Linguistics. doi: 10.18653/v1/2023.findings-emnlp.599. URL https: //ac...
-
[8]
J. Clinton, S. Jackman, and D. Rivers. The statistical analysis of roll call data. American Political Science Review, 98(2):355–370, 2004
work page 2004
Show all 39 references
-
[9]
Elhage, T
N. Elhage, T. Hume, C. Olsson, N. Schiefer, T. Henighan, S. Kravec, Z. Hatfield-Dodds, R. Lasenby, D. Drain, C. Chen, R. Grosse, S. McCandlish, J. Kaplan, D. Amodei, M. Wattenberg, and C. Olah. Toy models of superposition, 2022. URL https://arxiv.org/abs/2209. 10652
2022
-
[10]
Gurnee and M
W. Gurnee and M. Tegmark. Language models represent space and time. arXiv preprint arXiv:2310.02207, 2023
2023 arXiv
-
[11]
Z. He, W. Shu, X. Ge, L. Chen, J. Wang, Y . Zhou, F. Liu, Q. Guo, X. Huang, Z. Wu, Y .-G. Jiang, and X. Qiu. Llama scope: Extracting millions of features from llama-3.1-8b with sparse autoencoders, 2024. URL https://arxiv.org/abs/2410.20526
2024 arXiv
-
[12]
K. Hong, A. Troynikov, and J. Huber. Context rot: How increasing input tokens impacts llm performance. Technical report, Chroma, July 2025. URL https://research.trychroma. com/context-rot
2025
-
[13]
Kabir, K
S. Kabir, K. Esterling, and Y . Dong. Do words reflect beliefs? evaluating belief depth in large language models, 2025. URL https://arxiv.org/abs/2504.17052
2025 arXiv
-
[14]
J. Kim, J. Evans, and A. Schein. Linear representations of political perspective emerge in large language models, 2025. URL https://arxiv.org/abs/2503.02080
2025 arXiv
-
[15]
Lieberum, S
T. Lieberum, S. Rajamanoharan, A. Conmy, L. Smith, N. Sonnerat, V . Varma, J. Kramar, A. Dragan, R. Shah, and N. Nanda. Gemma scope: Open sparse autoencoders everywhere all at once on gemma 2. In Y . Belinkov, N. Kim, J. Jumelet, H. Mohebbi, A. Mueller, and H. Chen, editors, P...
2024 doi
-
[16]
Lindsey, W
J. Lindsey, W. Gurnee, E. Ameisen, B. Chen, A. Pearce, N. L. Turner, C. Citro, D. Abrahams, S. Carter, B. Hosmer, J. Marcus, M. Sklar, A. Templeton, T. Bricken, C. McDougall, H. Cun- ningham, T. Henighan, A. Jermyn, A. Jones, A. Persic, Z. Qi, T. B. Thompson, S. Zimmerman, K. ...
2025
-
[17]
Linegar, R
M. Linegar, R. Kocielnik, and R. M. Alvarez. Large language models and political science. Frontiers in Political Science, 5:1257092, 2023
2023
-
[18]
N. Nanda. Attribution patching: Activation patching at industrial scale. URL: https://www. neelnanda. io/mechanistic-interpretability/attribution-patching, 2023. 11
2023
-
[19]
T.-Q. Peng, K. Yang, S. Lee, H. Li, Y . Chu, Y . Lin, and H. Liu. Unpacking political bias in large language models: Insights across topic polarization, 2025. URL https://arxiv.org/abs/ 2412.16746v1
2025
-
[20]
Perez, S
E. Perez, S. Ringer, K. Lukosiute, K. Nguyen, E. Chen, S. Heiner, C. Pettit, C. Olsson, S. Kundu, S. Kadavath, et al. Discovering language model behaviors with model-written evaluations. In Findings of the association for computational linguistics: ACL 2023, pages 13387–13434, 2023
2023
-
[21]
K. T. Poole and H. Rosenthal. A spatial model for legislative roll call analysis. American journal of political science, pages 357–384, 1985
1985
-
[22]
Rimsky, N
N. Rimsky, N. Gabrieli, J. Schulz, M. Tong, E. Hubinger, and A. Turner. Steering llama 2 via contrastive activation addition. In L.-W. Ku, A. Martins, and V . Srikumar, editors,Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: L...
2024 doi
-
[23]
Röttger, V
P. Röttger, V . Hofmann, V . Pyatkin, M. Hinck, H. Kirk, H. Schütze, and D. Hovy. Political compass or spinning arrow? towards more meaningful evaluations for values and opinions in large language models. In Proceedings of the 62nd Annual Meeting of the Association for Computa...
2024
-
[24]
Santurkar, E
S. Santurkar, E. Durmus, F. Ladhak, C. Lee, P. Liang, and T. Hashimoto. Whose opinions do language models reflect? In International Conference on Machine Learning, pages 29971– 30004. PMLR, 2023
2023
-
[25]
Templeton, T
A. Templeton, T. Conerly, J. Marcus, J. Lindsey, T. Bricken, B. Chen, A. Pearce, C. Citro, E. Ameisen, A. Jones, H. Cunningham, N. L. Turner, C. McDougall, M. MacDiarmid, C. D. Freeman, T. R. Sumers, E. Rees, J. Batson, A. Jermyn, S. Carter, C. Olah, and T. Henighan. Scaling m...
2024
-
[26]
E. Todd, M. L. Li, A. S. Sharma, A. Mueller, B. C. Wallace, and D. Bau. Function vectors in large language models, 2024. URL https://arxiv.org/abs/2310.15213
2024 arXiv
-
[27]
M. Wang, Z. Xu, S. Mao, S. Deng, Z. Tu, H. Chen, and N. Zhang. Beyond prompt engineering: Robust behavior control in llms via steering target atoms, 2025. URL https://arxiv.org/ abs/2505.20322
2025 arXiv
-
[28]
Zheng, H
C. Zheng, H. Zhou, F. Meng, J. Zhou, and M. Huang. Large language models are not robust multiple choice selectors. In ICLR, 2024
2024
-
[29]
A. Zou, L. Phan, S. Chen, J. Campbell, P. Guo, R. Ren, A. Pan, X. Yin, M. Mazeika, A.-K. Dombrowski, S. Goel, N. Li, M. J. Byun, Z. Wang, A. Mallen, S. Basart, S. Koyejo, D. Song, M. Fredrikson, J. Z. Kolter, and D. Hendrycks. Representation engineering: A top-down approach to...
2025 arXiv
-
[30]
and IDEAL scores [8]. 13 B.1 Model Specification The core of our model is a two-parameter logistic D-dimensional IRT, where the probability of a candidate j voting "yes" on item k is given by the liklihood function: P (yjk = 1) = logit−1 (θj · αk − βk) yjk ∼ Bernoulli (logit−1...
-
[31]
Test Statement
Read the original "Test Statement" carefully
-
[32]
Extracted Features
Analyze the provided "Extracted Features."
-
[33]
Extracted Features,
Based ONLY on the "Extracted Features," classify the "Test Statement" into one of the following categories: {category_list}
-
[34]
Rate your confidence in this classification on a scale of 1 to 5, where 1 is a pure guess and 5 is highly confident
-
[35]
{statement}
Provide a brief, one-sentence justification for your classification, explaining which features were most influential. **STRICT INSTRUCTION:** Your classification MUST be based *solely* on the provided list of features, not on your prior knowledge of the statement itself. **INP...
-
[36]
List of Activated Features
Carefully review the "List of Activated Features."
-
[37]
- **1:** No clear theme
On a scale of 1 to 5, rate the **thematic coherence** of the feature set. - **1:** No clear theme. The features seem random and unrelated. - **3:** A weak theme is present, but many features are unrelated to the core concept. - **5:** Highly coherent. All features clearly rela...
-
[38]
Critique of social welfare spending
In one phrase or sentence, describe the primary theme that unifies these features (e.g., "Critique of social welfare spending" or "Analysis of conditional legal language")
-
[39]
coherence_score
Provide a brief justification for your score, noting any outlier features that do not fit the main theme. **INPUT:** * **List of Activated Features (from Llama/Gemma):** {feature_str} 16 **OUTPUT FORMAT (JSON):** ‘‘‘json { "coherence_score": <1-5 integer>, "primary_theme": "Yo...
Reviewed August 5, 2026 · model on record in the stance chip above.
Discussion (0). Sign in to comment.