Independent Audit Finds VPD Decomposition Adversarial Defects Systematically Transfer to Unseen Inputs

Goodfire AI's VPD (adVersarial Parameter Decomposition) method decomposes language model weights into simple components and assigns each input token a label between 0 and 1 indicating how important that component is for the current input. Ideally, switching off all components labeled as unneeded should not change the model's output—this is what is called mechanistic faithfulness. Goodfire AI's VPD paper reports that KL divergence grows sharply under long adversarial searches, but suggests the defects may merely be noise exploitation tuned to particular inputs. Independent researcher Tom Angsten applied the evaluation adversary's masks from one batch of texts to 16 unseen batches and found that 78% to 95% of output damage transfers across inputs from 20 steps onward, demonstrating that the defects are a systematic property of the decomposition rather than a noise artifact. Shuffled masks caused only 0.30 to 0.32 nats of KL divergence, indicating that the damage depends on which components are chosen rather than how many are turned down. Regarding why the training adversary failed to defend against these defects, Angsten proposes two possible explanations—insufficient signal per step, or the optimizer being trapped in a local extremum—and the experiment supports the former: a position-shared adversary never found a significantly damaging pattern in 1,000 batches, while a batch-shared adversary found one in only 88 to 123 batches. He suggests pooling the adversary's gradient over more positions per step. All work was performed on a single released decomposition of one four-layer, 67M-parameter model and cannot be generalized to VPD as a whole.