Feature Geometry of LoRA Adapters: A Sparse Autoencoder Analysis of Representational Divergence in Fine-Tuned Language Models LoRA适配器的特征几何：微调语言模型表示差异的稀疏自编码器分析

Here's a problem nobody in the fine-tuning ecosystem wants to talk about: we're deploying adapter-modified models at scale while fundamentally misunderstanding what these modifications actually do inside the network. A new paper from arXiv attempts to crack open this black box using sparse autoencoders, and what it finds should make every team running LoRA in production a little uncomfortable.

The core finding is blunt. When you apply LoRA to a model like Gemma-2-9B, the adapter creates representational structures that don't map cleanly onto the features we've already identified in the pretrained model. The delta activations—essentially the "new stuff" LoRA introduces into the residual stream—occupy partially distinct geometric territory from what our existing interpretability dictionaries can decode. The pretrained sparse autoencoders reconstruct these adapter-specific activations poorly. The adapter-trained ones do it better. The implication is clear: LoRA isn't just nudging existing features. It's carving out new representational territory that we currently lack the tools to read.

This is uncomfortable for two reasons. First, it means the mechanistic interpretability community's growing library of feature dictionaries—built painstakingly from pretrained models—has a significant blind spot when it comes to the most popular adaptation method in use today. You can't audit what you can't decode. Second, it means safety researchers relying on these interpretability toolkits to catch problematic behaviors in fine-tuned models are, in a meaningful sense, flying blind. The features that make a fine-tuned model refuse certain prompts or comply with others may live in exactly the representational space that existing dictionaries miss.

Let's be honest about what's actually happening here conceptually. LoRA works by learning low-rank updates to weight matrices. The orthodoxy has long held that this is a "gentle" modification—you're not replacing the model's knowledge, just steering it slightly. But this paper provides evidence that "slightly" is doing a lot of heavy lifting in that sentence. The geometric divergence between adapter features and pretrained features persists across layers and ranks, suggesting this isn't a marginal effect. It's structural. The adapter is writing new sentences in the model's internal language using a vocabulary that doesn't appear in the original dictionary.

The methodology deserves credit. Training adapter-specific sparse autoencoders on the delta activations—the isolated contribution of the LoRA modules—is a clever decomposition. Comparing these learned feature spaces against pretrained dictionaries using cosine similarity, principal angle analysis, and Centered Kernel Alignment gives a multi-angle view of the geometry. This isn't a single metric telling a convenient story. The consistency across metrics and across ranks 4, 8, 16, and 32 strengthens the claim. The finding that feature density increases with rank while geometric divergence remains stable is particularly telling. More adapter capacity doesn't push the features back toward familiar territory. It populates the unfamiliar territory more densely.

But I want to push back on the framing slightly. The paper treats this divergence as a problem for interpretability and safety, and it is. But there's another reading that's more optimistic. If LoRA is creating genuinely new representational structures, that might explain why LoRA fine-tuning is so effective despite its simplicity. It's not just reweighting existing capabilities. It's creating new computational pathways. The adapter isn't just turning knobs—it's installing new circuitry. That's a more powerful and more concerning capability than the field has appreciated.

The practical implications are real. Consider a company fine-tuning an open-source model with LoRA to create a customer service chatbot. They run interpretability checks using tools built on pretrained feature dictionaries. They find nothing alarming. But the problematic behaviors—the ones that emerge when users prompt the model in creative ways—live in representational spaces their tools can't see. This isn't hypothetical. It's the logical consequence of what this paper demonstrates.

What the field needs now is obvious but hard. We need interpretability toolkits that can be trained alongside adapters, or at least rapidly adapted to new representational territories. The current workflow of "train a big model, build a dictionary once, use it forever" doesn't survive contact with the reality of adapter-based deployment. The interpretability infrastructure needs to be as modular and adaptable as the fine-tuning methods it's meant to audit.

The paper also raises a question it doesn't fully address. If LoRA updates occupy partially distinct representational space, how do these new features interact with the pretrained ones when they're summed back into the residual stream? The delta framework isolates the adapter's contribution, but the model doesn't experience it in isolation. The interesting—and potentially dangerous—behaviors likely emerge from the interference pattern between old and new representations. That interaction space is exactly where adversarial prompting operates, and it's exactly where we have the least understanding.

There's a broader lesson here about the pace of deployment versus the pace of understanding. LoRA is everywhere. It's in every fine-tuning tutorial, every production pipeline, every startup's technical blog. It's treated as a solved problem—a safe, efficient way to customize models. This paper suggests we're several levels of understanding behind our own deployment practices. We're building on foundations we haven't fully mapped, and the tools we'd use to map them don't work on the new construction.

This doesn't mean LoRA is dangerous or should be abandoned. It means the field's interpretability apparatus hasn't kept pace with its adaptation methods, and pretending otherwise is negligent. The next time someone tells you fine-tuned models are well-understood because we have mechanistic interpretability tools, point them at this paper. The tools work beautifully on the territory they were built for. The problem is that we've built our most important systems on territory they've never seen.

别被LoRA的“轻量化”光环骗了，这玩意儿可能正在你的模型里搞出一套“平行宇宙”。最新arXiv论文把Sparse Autoencoders（SAE）这把手术刀伸进了LoRA微调后的模型内部，结果令人不安：那个我们以为只是简单“调整”了模型的适配器，实际上在预训练模型的表征空间里，开辟了一片新的领地。

研究者干了一件很“极客”的事：他们不仅对比了模型微调前后的差异，还训练了只属于LoRA适配器本身的SAE，来专门解剖这个“插件”的内部结构。他们用Gemma-2-9B模型，测试了不同秩（rank）的LoRA，然后在每一层去分析这些特征。关键指标是“对齐度”——看看LoRA带来的新特征，和模型原本就有的特征，到底有多像。结果呢？无论是余弦相似度、主角度分析，还是CKA，结论都指向一个事实：对齐度出奇地低。LoRA并没有老老实实地在原有特征的延长线上滑动，它更像是在旁边另起炉灶，构建了一套部分独立的新特征结构。

这意味着什么？简单说，LoRA不是一个无害的、可随时拆卸的“补丁”。它向残差流中注入的，是一些与预训练知识“半脱离”的幽灵向量。这些新向量的密度随着LoRA秩的增大和网络层的加深而增加，但它们与“旧世界”的几何背离程度却保持稳定——仿佛一种全新的语言正在模型内部悄然生长，而原有的字典（预训练SAE）已经无法完全解码它了。

这对整个可解释性领域是个不小的冲击。我们煞费苦心训练出来的、用于理解模型的“字典”（预训练的SAE特征），在面对LoRA微调后的模型时，突然出现了大量的“生词”。当我们试图用这套旧字典去审计一个微调后模型的行为时，可能会漏掉那些由LoRA引入的、全新的“危险概念”。一个用LoRA微调以过滤有害内容的模型，其过滤机制本身可能就建立在一套全新的、尚未被充分监测的特征之上。这简直是“黑箱中的黑箱”。

工程上的影响更为直接。它意味着LoRA适配器的“权重”和它所操纵的“特征”之间，存在着一层令人困扰的非线性。你调整了rank，改变的不仅是适配器的容量，更是在改变一套新特征的“密度”和“复杂度”。这让可预测性打了个折扣。我们原以为像拼乐高一样组合不同的LoRA适配器，现在看，每块乐高积木本身都自带一套新的积木规则，组合起来的结果可能远非线性的叠加。

这项研究的价值在于，它用实证数据捅破了一个美好的假设：LoRA只是对预训练模型进行了温和的“扰动”。事实证明，扰动之下，暗流涌动。它为我们敲响了警钟——在享受参数高效微调便利的同时，我们或许正在制造更多难以解释、难以完全掌控的模型变体。对于模型安全审计而言，这意味着传统的、基于预训练模型的工具链可能已经不够用了。我们需要发展新的、能够同时理解“旧大陆”和“新大陆”的解释性工具。

这不是在否定LoRA，恰恰相反，只有看清其内部真正的运作机制，我们才能更安全、更有效地使用它。这篇论文撕开了一道口子，让我们窥见模型适应性背后更深层的复杂性。未来的研究，可能需要同时训练两套词典：一套解读基座模型，一套专门用来解读那些日益强大的“插件”们。否则，我们驯服的，将是一个我们并未完全理解的巨兽。