Interpretability tools need not be rebuilt per model: a few dozen unlabeled prompts lift refusal transfer to 102%
Synopsis
Interpretability tools are usually built inside one model from labeled data and rebuilt for the next. This work carries a refusal direction, a correctness direction and a sentiment probe between models through a ridge-regression map fit only on unlabeled prompts, across 110 ordered pairs from five families and 1B to 72B parameters. A map fit on ordinary questions recovers 54% of refusal steering; adding unlabeled prompts from the tool's operating region raises refusal to 102% and correctness gains to 88% to 98%, while random and orthogonal controls recover at most 1%.
Interpretation
A refusal direction, a correctness direction and a sentiment probe found in one model can be applied directly to another through a map between residual streams, with no labels from the target model. Such tools were previously built one model at a time: a refusal direction, a truthfulness probe or a steering vector was found with labeled data inside the model it explains and rebuilt from scratch for the next, so a finding about one model's internals gave no evidence about any other. Across 110 ordered pairs of 11 instruction-tuned models from five families and 1B to 72B parameters, three controls, a random direction, a direction orthogonal to the native one, and a random source direction carried through the same map, recover at most 1% of the refusal effect under addition, leave the sentiment probe within 3 points of chance, and rank answers below the zero-shot reference.
How much transfers is set by the map's training data, not by model family, scale or instruction tuning. A map fit on 5,400 ordinary questions carries 54% of the target's own refusal steering and 77% of its TruthfulQA correctness gain, but only 16% of the ARC gain with an interval that includes zero, and a sentiment probe 8 points below the target's own. Adding unlabeled prompts from the tool's operating region raises refusal to 102% with every target at least 97%, correctness to 88% to 98%, and the sentiment probe to the native one's accuracy; 16 prompts per class saturate refusal, and 97% of 500 independent draws recover at least 80%, the weakest 44%.
Transfer error is predicted by a label-free coverage score measuring how much of the tool lies in directions the map's training data span. Earlier reports found maps between models failing across domains, with mapped directions changing behavior no more than random ones, but when transfer succeeds and why it fails was unclear. Across more than 16,000 runs, coverage correlates with recovery at Spearman 0.67 for refusal, 0.71 for ARC, 0.68 for TruthfulQA and 0.45 for sentiment; refusal runs with coverage above 0.9 recover 99% on average, while runs below 0.5 recover 4%.
Perspective
The results cover 11 instruction-tuned open models, the two largest run in 4-bit precision, plus four base models tested with the read-out tools only; transfer is limited to linear directions and one linear probe, and sparse autoencoder features and circuits are untested. Refusal is scored by phrase matching at one strength per target, ablation excludes Gemma-2-27B by a coherence criterion added after the main run, and the read-out tools are never used to steer.
Proposition 1 assumes the two models correspond linearly on the region the map covers, ignores the renormalization of mapped representations, and does not say which pairs correspond well. Coverage requires knowing where a tool operates, and small draws can miss: the weakest 16-prompt draw recovers 44% of refusal, mostly on Llama-3.2-1B, the target with the smallest native effect. Ablation, per-block and kernel maps, and base-model transfers use one seed.