A “diff” tool for AI: Finding behavioral differences in new models

Behavioral evaluations can only test for what someone has thought to test. The announcement post makes the point with an analogy from software: no one audits a million lines of code from scratch to approve an update; a diff shows the fifty lines that changed. Model diffing applies the same idea to neural networks by comparing two models' internal representations and looking for what one has and the other lacks. Earlier model diffing compared a base model with its own fine-tuned version, which share an architecture. This work asks whether the method can compare models with different architectures from different developers, which is the usual situation when a new model is released, and whether doing so surfaces real behavioral differences without knowing in advance what to look for (paper, Section 1).

The work was an Anthropic Fellows project by Thomas Jiralerspong (Mila and Université de Montréal) with Trenton Bricken of Anthropic. It was posted to arXiv on 12 February 2026 as "Cross-Architecture Model Diffing with Crosscoders: Unsupervised Discovery of Differences Between LLMs", and Anthropic published the summary post on 13 March 2026. Because Fellows projects study open-weight models, all four models compared are open-weight models from other developers (post, footnote 1). Section numbers below refer to the arXiv paper.

Terms used in this note

• Feature. A direction in a model's internal activation space that corresponds to an interpretable concept. The paper assumes, as most of this research does, that models represent concepts as linear directions.
• Sparse autoencoder (SAE). A network trained to rewrite a model's activations as a sparse combination of many learned features, a "dictionary", so that each feature is easier to interpret (Section 2.1).
• Crosscoder. An SAE-like dictionary trained on two models at once, with one set of features and a separate decoder into each model's activations. A feature that helps reconstruct both models is shared; one that helps reconstruct only one is model-exclusive.
• Relative decoder norm. For a standard crosscoder, the size of a feature's decoder into model A divided by the sum of its decoder sizes into both models. Values near 1 or 0 suggest the feature belongs to one model (Equation 1).
• Dedicated Feature Crosscoder (DFC). The paper's modification: the dictionary is split by design into features for model A only, features for model B only, and shared features (Section 2.2).
• Steering. Adding a feature's direction to a model's activations while it generates text (positive steering), or subtracting it (negative steering), to test whether the feature causes a behavior.
• Model-exclusive feature. A feature whose representation has no direct linear counterpart in the other model. The paper stresses that this is a claim about representation, not about whether the other model knows the concept (Section 5.1).

What the paper does

The problem with standard crosscoders

A standard crosscoder is trained to reconstruct both models' activations from one feature dictionary. Because each feature can lower the error for both models at once, the training favors shared features, and features unique to one model emerge late or not at all (Section 2.1, citing Mishra et al., 2025). Exclusive features are then picked out after training by their relative decoder norm, and even the most extreme ones still have some connection to the other model (Section 3.2.2).

The Dedicated Feature Crosscoder

The DFC partitions the dictionary into three disjoint sets. Model A's activations are reconstructed only from A-exclusive and shared features, model B's only from B-exclusive and shared ones (Section 2.2, Figure 2). An A-exclusive feature's decoder into model B is fixed at zero and receives no training signal from model B's error, which removes the pressure for it to become shared. In the main experiments 5 percent of the dictionary is reserved as exclusive per model.

Models and training

The paper runs two diffs: Llama-3.1-8B-Instruct (Meta) against Qwen3-8B (Alibaba), and GPT-OSS-20B (OpenAI) against DeepSeek-R1-0528-Qwen3-8B (DeepSeek) (Section 2.4). The models use different tokenizers, so the authors align their activations token by token with a "semantic window expansion" method that grows a window of tokens until the decoded text matches (Appendix B.1.6). The crosscoders have 131,072 features, use a BatchTopK sparsity constraint with k = 200, and are trained on 100 million aligned activation pairs from the models' middle layers, from an equal mix of web text (FineWeb) and chat data (LMSYS-Chat-1M) (Section 2.4, Appendix B.1).

How features are checked

Several checks are used:

• Transfer of an outside vector. To test whether the shared space really aligns the two models, the authors take "persona vectors" for sycophantic, evil and hallucinating behavior found in Llama by a separate method (Chen et al., 2025), translate them into Qwen through the DFC's shared features, and steer Qwen with the result (Section 3.1).
• A toy model with known answers. Synthetic data with 2,048 ground-truth concepts, 2.5 percent of them exclusive to each model, and a random affine transformation standing in for architectural differences, so that recovery of exclusive concepts can be counted (Sections 2.3 and 3.2.1).
• An exclusivity score. For real models without ground truth, a feature's decoder vector is mapped into the other model by a separately trained linear map ("model stitching"), both models are steered, and Claude Opus 4.1 rates the similarity of the effects from 1 to 5. The score is 6 minus the similarity, so 5 means the effect did not transfer (Section 3.2.2, Appendix B.5). The authors checked 25 of the judge's ratings by hand.
• Screening and steering. Claude Opus 4.1 first flagged potentially important features from their automated explanations; flagged features were then steered, and their effects scored by Claude Opus 4.1 over 30 curated prompts for ideological alignment and coherence (Section 3.3, Appendix B.5).

What it finds

The shared space aligns the models

The persona vectors had low maximum cosine similarity with any of the 131,072 Llama decoder vectors (0.38 sycophantic, 0.35 evil, 0.26 hallucinating), so they were not just copies of existing features. Translated into Qwen, the sycophantic vector produced behavior the authors describe as "strikingly similar" to its effect in Llama (Section 3.1, Figure 3; all three in Appendix C.3).

DFCs find more exclusive features, with more false positives

On the toy model, averaged over five seeds, the DFC recovered more of the true exclusive concepts than a standard crosscoder and than the Designated Shared Feature crosscoder of Mishra et al., especially when the dictionary was smaller than the number of concepts; it also flagged more false positives (Section 3.2.1, Figure 4). In every architecture, exclusive concepts were learned later in training than shared ones, and the DFC shortened that delay (Appendix C.4, Figure 15). The authors accept the trade: for safety auditing, "missing features is costlier than flagging too many" (Section 1).

On the real Llama-Qwen diff, DFC exclusive features skewed toward the maximum exclusivity score of 5, while the standard crosscoder's 500 most extreme features were bimodal with many scoring 1; shared features scored alike in both (Figure 5). Ordinary quality measures were nearly identical: dead features 5.0 percent against 5.6 percent, detection score 87.78 against 87.77 percent, and fraction of variance explained 0.817 for both (Table 1).

Llama-3.1-8B-Instruct against Qwen3-8B

In Qwen's exclusive partition the DFC found a broad CCP alignment feature (Section 3.3.1, Figure 1). Unsteered, Qwen refuses a question about Tiananmen Square; positive steering produces "propaganda-like content" and negative steering a more truthful answer. Narrower Qwen-exclusive features covered Taiwan's sovereignty, Hong Kong's political status and the "debt trap" diplomacy narrative. In Llama's exclusive partition it found an American exceptionalism feature whose positive steering turns a balanced answer into assertions of American superiority; negative steering had no interpretable effect.

All these features scored the maximum exclusivity of 5. Steering the CCP and American exceptionalism features over 30 prompts moved the corresponding ideology scores strongly in their own model while keeping coherence, and had almost no effect in the other model (Figure 6, which reports the American exceptionalism rating for Qwen staying at its default of 20 percent). Steering them on prompts about other countries made the models bring up the CCP or American exceptionalism anyway, which the authors take as evidence the features are country-specific.

GPT-OSS-20B against DeepSeek-R1-0528-Qwen3-8B

In GPT-OSS-20B the DFC found a ChatGPT identity feature, which makes the model say it is "ChatGPT, a language model trained by OpenAI", and a copyright refusal feature (Section 3.3.2). Negative steering disables refusals of requests for copyrighted material; positive steering makes the model over-refuse, for example declining to give a peanut butter and jelly sandwich recipe on copyright grounds. With refusal disabled the model does not reproduce the material accurately; coherence degrades and it mostly hallucinates. In DeepSeek, a second CCP alignment feature behaved like Qwen's. All three features scored 5 for exclusivity.

The authors say the ideological features were hypothesized from prior work on forbidden topics in Chinese models, while the copyright refusal feature was a difference "we were unaware of a priori" (Section 3.3), the paper's main example of an unknown unknown.

Most exclusive features are not meaningful differences

The paper is explicit that "most features identified as model-exclusive do not capture meaningful behavioral differences" (Section 3.3). In the Llama-Qwen DFC, each exclusive partition held about 6,550 features (5 percent of 131,072; Appendix C.5.1 gives 6,553, while the C.4 heading gives 6,533 and the hyperparameter table 6,554). Of Qwen's, 78.3 percent were live and interpretable; of Llama's, 63.1 percent (Appendix C.5). Claude Opus 4.1 flagged 251 Qwen-exclusive and 351 Llama-exclusive features as important, most of them general safety topics such as violence, hacking and sexual content (Tables 9 and 10). The authors found that both models refuse such content similarly, and speculate that the same behavior is implemented through different internal mechanisms. A random sample of features with perfect exclusivity scores includes items such as hiking-trail descriptions and leap-year calculations (Appendix C.6). Some interpretable features, such as Falun Gong in Qwen and Native American conflicts in Llama, did not steer consistently.

Results depend on settings and seeds

Across six crosscoders for the Llama-Qwen pair (a standard crosscoder, DFCs with 1, 3 and 5 percent exclusive partitions, and the 5 percent DFC with two more seeds), the broad CCP alignment feature appeared every time. American exceptionalism appeared in four of the five DFC runs and not in the standard crosscoder; the granular pro-China features in two or three of five (Section 5.2, Appendix C.4). The standard crosscoder found only a less exclusive version of the CCP feature, ranked 1,898th by relative norm, so it would have been missed if analysis had been limited to the top 1,310 features, the size of the 1 percent DFC's partition (Appendix C.4). The announcement summarizes the robustness as "five out of five" for CCP alignment and "four out of five" for American exceptionalism, which matches the counts over the five DFC runs given in Section 5.2.

What the paper does not claim

Two caveats in the paper bear on how its findings can be used.

• No claim about origin. The method shows that a feature is exclusive to a model, not why. In the post's words, such behaviors "could be the result of deliberate training decisions" or could "emerge indirectly and unintentionally from the data". The paper lists provenance as future work (Section 5.2).
• Representation, not knowledge. A Qwen-exclusive CCP feature does not mean Llama lacks the concept, only that Qwen has a distinct direction for it with no linear counterpart in Llama that shows up as a behavioral difference (Section 5.1).

The paper involves no written principles or specifications. Its relevance to questions about training documents is indirect: it is a method for detecting, from a model's internals, behavioral dispositions that differ between models, whatever produced them. The prompts it does contain are the judge and flagging prompts in Appendix B.

Limitations and open questions

The authors state these limitations (Section 5.2):

• No ground truth on real models. The exclusivity score is a proxy, itself relying on a model judge.
• Recall over precision. DFCs flag more false positives, which must be filtered by steering and other validation.
• Instability. Which features are found depends on the partition size and the random seed.
• Few model pairs. Two diffs of models with 8 to 20 billion parameters; generality needs testing on more pairs. The post adds that the method has not been applied to frontier models.
• Base against fine-tune comparisons. In preliminary experiments the method struggled there, with "mirror features" noted by earlier work.
• No provenance, as above.

Further limits follow from the workflow. Screening relies on automated explanations and on Claude Opus 4.1 to flag important features, so a meaningful feature with a poor explanation could be missed. The ideological features were looked for because of prior hypotheses, which makes the copyright feature the only reported case found without one. The post suggests a diff of GPT-4o's April 2025 update against its predecessor "could have" flagged its sycophancy; the paper presents this as hypothetical and does not test it.

Research questions

1. Does the method find a known behavioral change between two versions of one model? The authors suggest the GPT-4o sycophancy update as a case. Diffing two checkpoints with a documented behavioral change, using the DFC, and checking whether the change appears among flagged features would test the claim, though the paper reports difficulty with base-and-fine-tune pairs.
2. What fraction of flagged features correspond to real behavioral differences? The paper reports that most do not. Steering a random sample of flagged features and measuring behavior on matched prompts in both models would estimate the method's precision.
3. Can provenance be traced? Combining the diff with training-data attribution, for example influence-function methods, or with models trained under controlled data differences, would show whether exclusive features come from deliberate post-training or from pretraining data.
4. How stable are discoveries across seeds and partition sizes at scale? Granular features appeared in two or three of five runs. More runs, and consensus methods across runs, would show which findings are reliable.
5. Do exclusive safety features reflect different mechanisms for the same behavior? Both models refuse similar harmful content despite exclusive safety features. Comparing the circuits behind refusal in each model would test the authors' speculation.
6. Does it work between frontier-scale models? All models here have 8 to 20 billion parameters. Applying DFCs to larger models, where the post says the method has not yet been tried, would show whether it remains tractable and informative.

How it connects

• In this evaluation thread. The paper's starting point is the limit noted in Challenges in evaluating AI systems and addressed differently by model-written evaluations, Petri and Bloom: tests find what someone has thought to test for. Those tools generate behavioral tests; the diff instead compares internal representations and then confirms findings by steering.
• Elsewhere in the library. Crosscoders and earlier model diffing are covered by Insights on Crosscoder Model Diffing, and the dictionary-learning approach by Towards Monosemanticity and Mapping the Mind of a Large Language Model. The persona vectors used to validate the shared space come from Persona vectors, and the paper cites model diffing of sleeper agent models as earlier motivation. The idea that a model's character lives in identifiable directions connects to The persona selection model and The assistant axis.
• In the course wiki. The trade between recall and false positives that the authors accept for screening is the precision and recall trade-off of Precision, Recall, and the F Measure. The dictionary-learning idea, representing data as sparse combinations of learned directions, has a classical relative in Latent Semantic Indexing, which finds latent directions in term space, though with dense rather than sparse factors.

References

• Jiralerspong, T., and Bricken, T. (2026). A "diff" tool for AI: Finding behavioral differences in new models. Anthropic, 13 March 2026. https://www.anthropic.com/research/diff-tool
• Jiralerspong, T., and Bricken, T. (2026). Cross-Architecture Model Diffing with Crosscoders: Unsupervised Discovery of Differences Between LLMs. arXiv:2602.11729v1, submitted 12 February 2026. https://arxiv.org/abs/2602.11729. Code: https://github.com/superkaiba/dfc_learning