Decodable but Misrouted: Sparse Features Uncover a Readout Gap in Vision-Language Models for Harmful Meme Detection
Girish A. Koushik, Diptesh Kanojia, Helen Treharne
cs.CV · cs.AI · cs.CL · cs.LG
Quick verdict
Claims sparse-autoencoder probes decode harmful-meme evidence that Gemma-3/Qwen3.5 fail to route to outputs; unusually candid and carefully scoped, but the headline gap pits a frozen zero-shot model against supervised in-distribution probes, and causal evidence rests on 5–15-example interventions.
Summary
The paper asks why large vision-language models (Gemma-3, Qwen3.5) underperform on harmful-meme detection: missing evidence or a failure to route represented evidence to outputs? Using sparse autoencoders (public dictionaries plus a trained residual SAE), role-conditioned max-pooled probes over six binary benchmarks, and causal interventions, it shows sparse readouts beat native label-scoring prediction on every task (Qwen 0.740 vs 0.432 mean macro-F1; Gemma 0.714 vs 0.532). Silent-feature knockouts move probe scores 24-63x more than the yes/no margin, while routed-feature patching moves the margin 16-140x more than probes, dissociating probe-discriminative from output-routed directions. Calibration-only logit routing recovers 93.3% of the gap; probe-distilled LoRA helps but shared multi-task adapters show negative transfer. A Gemma-3-12B case study finds a distributed rank-32 image-prompt interaction on Facebook Hateful Memes (0.756 vs 0.685). Multilingual, OCR-ablation, and image-permutation controls suggest the signal is not OCR-only and depends on visual evidence. The paper is exceptionally candid that the readout gap measures supervised accessibility, not like-for-like classifier comparison; interventions use tiny eligible sets (5-15 examples), the Gemma-3-12B test count (1000 vs 931) is an unresolved discrepancy, and multilingual gains over native are fragile.
Review complete
Assessment at a glance
6
risk flags identified
● high 2
● medium 3
● low 1
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Sparse readouts over public SAE dictionaries outperform native constrained prediction on all six binary harmful-meme tasks (Qwen 0.740 vs 0.432 mean macro-F1; Gemma 0.714 vs 0.532).
- Probe-discriminative SAE directions are dissociable from output-routed directions: silent-feature knockout is 24-63x more probe-sensitive while routed-feature patching is 16-140x more output-sensitive in Qwen.
- Calibration-only direct logit routing recovers 93.3% of the mean native-to-probe gap, and probe-distilled LoRA internalizes part of the signal while shared multi-task adapters cause negative transfer.
- Gemma-3-12B on FHM exhibits a distributed rank-32 image-by-prompt interaction reaching 0.756 vs 0.685 native macro-F1, which does not transfer to Gemma-3-4B or Qwen.
- The decodable signal extends beyond English, is not explained solely by supplied OCR, and depends substantially on paired visual evidence (image permutation cuts probe macro-F1 by 0.148-0.206).
Strengths
Unusually careful epistemic hygiene
The paper separates decodability, routing, and recoverability (Sec. 2.1), concedes the readout gap is 'not an apples-to-apples comparison' (Limitations), and includes a 5-page operational glossary (Appendix L) that pre-empts over-interpretation of probes as model belief.
Locked evaluation protocol
Layers, token roles, representations, thresholds, and router coefficients are selected on train/calibration data only and frozen before reporting (Sec. 2.3, App. C), including honest treatment of CrisisHateMM's unusable test labels (Table 1 footnote).
Dissociated causal interventions
Extensive negative and robustness controls
Rare transparency about internal discrepancies
Weaknesses
The headline gap confounds supervision with misrouting
Tiny, eligibility-filtered intervention sets carry the causal claims
No uncertainty on the primary results
Implausibly weak native baselines
Routing result is close to tautological and boundary-bound
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Structured Review: Decodable but Misrouted (arXiv 2609.18860)
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 6 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is the 'readout gap' in this paper?
The difference between macro-F1 of a supervised linear probe fitted on internal sparse-autoencoder features and macro-F1 of the vision-language model's own constrained prediction, evaluated on the same held-out examples. On six harmful-meme benchmarks the gap is large: for Qwen, probes average 0.740 macro-F1 versus 0.432 natively; for Gemma, 0.714 versus 0.532. The authors stress it measures supervised accessibility of label information, not a fair head-to-head, since probes train on task labels while the model stays frozen.
Do sparse autoencoders make harmful-meme detection models more accurate?
Not by themselves. Probes on SAE features decode more label information than the model's native output expresses, but the paper's recovery experiments show two practical routes: adding a calibrated probe score to the model's decision margin recovers 93.3% of the gap, and distilling the probe into the model via LoRA raises native accuracy (e.g. Gemma-3-4B on FHM from 0.648 to 0.714 macro-F1) without needing the SAE at inference. Shared multi-task adapters, however, caused negative transfer.
Does the detected signal really use the image, or just the meme's text/OCR?
The paper argues the signal depends materially on visual evidence: removing supplied OCR changes the strongest text-bearing readouts by at most 0.067 macro-F1 (and one transfer direction even improves without OCR), while deterministically shuffling images cuts probe macro-F1 by 0.148-0.206 and routed macro-F1 by 0.160-0.292, with 55.8-88.8% of originally correct probe predictions becoming incorrect under image perturbation, versus 0-38.1% for native models.
Is the code or data for this paper available?
The reviewed text contains no explicit code or data release statement. The paper repeatedly references saved run configurations, checkpoints, and evaluation artifacts (including a flagged discrepancy between a 1000-example report and a 931-prediction artifact), which suggests complete internal logging, but public availability is not stated in the extracted text.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Main text is nearly complete with Tables 1-14 and key appendix details, but figures (1, 2, 4-6, 8, 9) could not be analyzed from text alone and the omitted regions hide parts of Sections 3, 4.2, H, I and L.
- No explicit code/data availability statement is visible in the extracted text; codeAvailable=false reflects absence of a statement rather than confirmed unavailability.
- Model names (Qwen3.5, gemma-scope-2) and several 2026-era citations cannot be independently verified and are taken at face value.
- Judgments on native-baseline plausibility rely on general knowledge of these benchmarks, since the paper reports no external baseline comparison.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.