1 Introduction↩︎

Large language models (LLMs) are increasingly evaluated for clinical reasoning. With appropriate alignment they reach near-clinician agreement on medical questions [1], suggesting that LLMs encode substantial clinical knowledge. Recent work, however, reports high failure rates on triage specifically [2]: a consumer-LLM clinical-triage benchmark (evaluating ChatGPT on patient-voiced vignettes) demonstrated a \(51.6\%\) emergency-case under-triage rate, an alarming headline cited as evidence that current LLMs may be unsafe for clinical triage. A behavioral replication shows that changing the scaffolding, i.e., rephrasing structured triage cases into natural-language text with free-text output, eliminates a substantial portion of the reported failures [3], consistent with a broader literature on prompt-format and multiple-choice sensitivity in LLM benchmarks [4]–[6]. The triage failures are therefore at least partly a function of the evaluation setting rather than the model performance.

This raises a question that behavior alone cannot answer: where does the failure originate from? Two hypotheses are plausible. Encoding-shift hypothesis: under the multiple-choice format, the model fails to access its clinical knowledge, as the multiple-choice scaffold (answers appended to the question) induces the failure, with the representation of the clinical case becoming different from the free-text generation. Output-mapping hypothesis: prompt format changes how the model maps an already-formed clinical representation onto the final answer; the clinical encoding is preserved, and the benchmark measures the output stage correctness rather than the clinical reasoning.

This distinction has well-established conceptual precedent [7]–[9]. Concurrent work in clinical triage specifically documents a 53-pp knowledge–action gap on Qwen 2.5 7B Instruct, with four mechanistic interventions, including SAE feature steering, failing to reliably correct it [10]. We ask a different, more specific question: where does the gap originate from when output format is varied while the clinical-content portion of the prompt is held unchanged?

Contributions. In this work, we investigate where the apparent multiple-choice penalty in LLM clinical triage originates. We combine SAE features, natural-language autoencoders, linear probes, and behavioral decomposition across three instruction-tuned LLMs from two families to localize the format effect. Our contributions are:

• We show that medical content is preserved across multiple-choice and free-text formats: the identified medical features peak on the clinical narrative in both cases.

• We localize the multiple-choice effect to a representational shift at the decision token. At the hidden state that drives the answer selection, medical features go silent and scaffold features dominate. Three independent methods (SAE logit attribution, decision-token top-feature analysis, and natural- language autoencoder verbalization) support this finding.

• We decompose the performance gap between multiple-choice and free-text formats into miscalibration (dominates the measured gap at every model) and deferral (separate label-space concern not contributing to this gap), and rule out positional bias via option-order shuffles.

• We deploy a linear-probe framework to predict what cases will flip correctness between formats from source-format hidden states alone. We also report a Constraint-First ablation suggesting that the position of the constraint relative to the generation point contributes substantially to the representational shift, beyond the effect of its mere presence.

Across Gemma 3 4B IT, Gemma 3 12B IT, and Qwen3-8B, the format effect localizes to scaffold features at the decision token while medical content remains intact upstream. This is consistent with output-stage mapping rather than degraded clinical reasoning as the source of the apparent failure rate. Code, data, and analysis scripts to reproduce all experiments are available at https://github.com/dafraile/SAE_mad.

2 Background and Related Work↩︎

Triage disposition and medical diagnosis are distinct cognitive tasks operating under different information states and error tolerances [11]. Triage functions as an initial working hypothesis formed under time pressure and informational scarcity, where the dominant strategy is to rule in risk by erring toward higher acuity, with an accepted error rate that is expected to resolve as clinical context accumulates. Diagnosis then inherits triage as a prior to be tested rather than a conclusion to be accepted, progressively ruling out competing explanations as history, examination, and investigation accumulate. Therefore, for LLM evaluation the reasoning task under evaluation is an initial acuity disposition under sparse information, not a final diagnosis.

Notable previous LLM evaluation in Clinical AI include Med-PaLM, establishing that LLMs encode substantial clinical knowledge [1], [12]. Specific benchmarks have probed failure modes of consumer-facing LLMs on patient-voiced clinical-triage vignettes [2]. Behavioral replications by [3] indicate that constrained-output evaluation is a major contributor to the apparent failure rates medical triaging. Concurrent mechanistic work on the same task documents a \(53\)-pp knowledge–action gap on Qwen 2.5 7B Instruct and shows four mechanistic interventions fail to reliably correct it [10]; our complementary localization varies output format while holding the patient vignette verbatim, showing where the format difference lives rather than attempting to fix it by intervention.

3 Methods↩︎

3.1 Dataset↩︎

We use all 60 clinical vignettes from the replication corpus of [3], reconstructed from the clinical-triage benchmark of [2]. The corpus spans input format (structured vignettes or naturalistic/conversational symptom depictions) and output formats either (multiple-choice or free-text) in a \(2 \times 2\) factorial, yielding four conditions: SL (structured + multiple-choice), NL (natural + multiple-choice), SF (structured + free-text), and NF (natural + free-text). In our condition codes the first letter denotes input (Structured or Natural), and the second letter denotes output (Letter for forced-letter multiple-choice, F for free-text). Throughout, ‘multiple-choice’ refers to prompts that select a 4-option A-D single-letter response; we call this appended instruction block the multiple-choice scaffold. Within each input format the forced-letter and free-text conditions are byte-identical in clinical content (NL-NF at 1033 characters/case) and differ only in whether the multiple-choice scaffold (\(50\)–\(60\) tokens) is appended. NL-NF and SL–SF therefore each isolate output format at a fixed input. Mechanistic analyses use the NL-NF pair throughout; SL-SF appears as a behavioral robustness check in Section 4.1 and as an input-style mechanistic robustness check in Appendix 31. Output gold labels follow the source benchmark’s four care tiers (A: monitor at home; B: see a doctor in a few weeks; C: see a doctor in 24-48 hours; D: go to emergency). Half the cases carry dual labels gold-standards, e.g., \(C/D\) at \(24/60\), and either label is treated as an acceptable match in scoring (full distribution in Appendix 8).

3.2 Models and SAEs↩︎

Both SAE pipelines decompose residual streams into sparse interpretable features [13]–[15]: Gemma Scope 2 uses JumpReLU [16], [17], while Qwen-Scope uses TopK with \(k{=}100\) [18]–[20]. We use Gemma 3 4B IT (34 layers, \(d_\text{model}=2560\)) and Gemma 3 12B IT (48 layers, \(d_\text{model}=3584\)) with Gemma Scope 2 SAEs (\(d_\text{SAE}=16{,}384\), \(\sim\) \(14\%\) reconstruction error), and Qwen3-8B (36 layers, \(d_\text{model}=4096\)) with Qwen-Scope SAEs (\(d_\text{SAE}=65{,}536\), \(\sim\) \(34\%\) reconstruction error at L31). For Gemma we sweep four matched-depth layers at \(\approx 27\%, 50\%, 65\%, 85\%\) of total depth: in 4B layers 9, 17, 22, 29 and in 12B layers 12, 24, 31, 41. For Qwen we use layer 31 at \(\approx 86\%\) relative depth, selected by reconstruction error from a four-layer pilot sweep (Appendix 11).

3.3 Behavioral test↩︎

For each case we generate output via greedy decoding [21]. SL and NL answers are extracted via regex. NF and SF free-text are scored by gpt-5.2-thinking-high and claude-sonnet-4.6 LLM judges, adjudicating against the gold label on the A–D scale, with acceptable matches on dual-labeled cases. Letter-extraction (SL, NL) and LLM-judge (SF, NF) pipelines therefore score slightly different artifacts (the emitted letter vs.an interpreted commitment from free text); we treat this as part of the format contrast, not a noise source to be removed. We report per-condition accuracy, and inter-rater agreement and Cohen’s \(\kappa\) as a calibration signal. A clinician-adjudicated subset (Section 3.8, Appendix 16) provides external calibration of the LLM judges against clinical judgment on a stratified 16-case sample.

To disambiguate whether multiple-choice accuracy depends on letter position or letter content, we run an exhaustive shuffle of the letter\(\to\)content mapping in NL. For each of the \(60\) NL prompts, we generate all \(23\) non-identity permutations of the assignment \(\{A, B, C, D\}\), keeping option texts verbatim but rewriting the letter labels (e.g., “see a doctor in 24-48 hours” may sit under any letter). We re-run multiple-choice generation on each shuffled prompt under greedy decoding (\(60 \times 23 = 1380\) NL passes per model). For each shuffle we record both the picked letter and the picked content. Position bias predicts a constant picked letter across shuffles; a content prior predicts constant picked content. Case-clustered \(95\%\) CIs are bootstrapped over cases (\(2{,}000\) resamples; full protocol in Appendix 28).

3.4 Mechanistic invariance test↩︎

For each (model, layer, case, condition) we encode the residual stream through the SAE and max-pool feature activations over user-content tokens: each feature contributes its peak activation on any token (pooling conventions in Appendix 20). To avoid mean-pool dilution we use Max-pooling for Qwen-Scope’s \(k{=}100\) TopK sparsity; Gemma aggregation checks are in Appendix 19. We compare two feature subsets \(\mathcal{F}\): the \(3\) contrastively-identified medical features per layer (Section 3.9) and a magnitude-matched random control of \(30\) features drawn per layer from the non-medical feature pool (size \(500\)–\(2{,}200\); full protocol in Appendix 21). For each case and each subset \(\mathcal{F}\), we summarize NL-NF invariance by two statistics. The first is the symmetric mean absolute percentage error (sMAPE, [22]) in its standard form, applied here over the features in \(\mathcal{F}\): \[\mathrm{sMAPE}_{\mathcal{F}} \;=\; \frac{1}{|\mathcal{F}|} \sum_{f \in \mathcal{F}} \frac{|a^f_{\mathrm{NL}} - a^f_{\mathrm{NF}}|}{(|a^f_{\mathrm{NL}}| + |a^f_{\mathrm{NF}}|)/2},\] where \(a^f_{\mathrm{NL}}\) and \(a^f_{\mathrm{NF}}\) are feature \(f\)’s max-pooled activations in the NL and NF conditions; lower \(=\) more invariant. In implementation we floor the denominator at \(\varepsilon=10^{-8}\) to prevent division by zero when both activations are exactly zero; this affects only inactive features and leaves active-feature scores unchanged. The second statistic is cosine similarity between the NL and NF feature-subset activation vectors (higher \(=\) more invariant).

We stratify case-level results by joint NL-NF correctness into five strata: both-right, both-wrong, NF-only-right (NL wrong, NF correct), NL-only-right (the inverse), and judges-disagree (withheld from headline tables). For each (layer, stratum) we report bootstrap \(95\%\) CIs on the per-case medical-random \(\Delta\) for both sMAPE and cosine. The bootstrap resamples the \(n\) cases in the stratum with replacement, computes the resample mean, repeats this \(2{,}000\) times, and takes the \(2.5\)^th and \(97.5\)^th percentiles.

3.4.0.1 Analyzed late layer.

We report results in body at a single late layer per model (4B L29, 12B L31, Qwen L31), the deepest layer in the sweep of Section 3.2; the full per-layer / per-stratum tables are in Appendix 18. The body layer is chosen for two reasons that the sweep itself documents. First, the direction analysis (Section 3.7, Appendix 18) shows that late-layer encoder columns are where the residual \((\mathrm{NL}{-}\mathrm{NF})\) direction projects onto non-medical scaffold features: the layer at which the question “are medical features format-invariant while the format direction lives elsewhere?” is most cleanly testable. Second, at Gemma 12B the medical\({-}\)random difference reverses sign between shallow/mid layers (L12, L24) and late layers (L31, L41); the late layers are the regime where the invariance pattern is stable, and we report the shallow/mid behavior separately in Appendix 18.

3.5 Decision-token analyses↩︎

We target the hidden state at the NL pre-generation token (the last user-message token, whose hidden state drives the first generated letter) with one primary analysis and two SAE-pool corroborations.

On Gemma 3 12B IT (the only open-weight NLA checkpoint we have access to [23]), at layer \(32\), we capture residual-stream activations at seven token positions (content, decision, and four letter_A/B/C/D; full positions in Appendix 24), pass them through the released NLA, and have the two LLM judges classify each generated description on two axes: (medical and scaffold, each primary/partial/no).

Two complementary analyses on the SAE feature pool at the same decision token — decision-token logit attribution via \(\mathrm{contrib}(f,\ell)=a_f\,W_\mathrm{dec}[:,f]^\top W_U[:,t_\ell]\), and top-\(20\)-by-activation feature characterization with Jaccard overlap and scaffold-peak diagnostic corroborate the NLA result quantitatively. Full methodology, feature-category definitions, and the linear-projection caveats are in Appendices 29 and 30.

3.6 Predicting behavioral instability from source-format representation↩︎

To test whether the format-induced representational shift can predict behavioral flipping, we train linear probes (L2-regularized logistic regressionsolver) on Gemma 3 4B IT last-token hidden states (\(d{=}2,560\)) at layers \(\{9,17,19,22,25,27,29,31,33,34\}\). For each format transition (e.g., NL\(\to\)SL), the binary target is whether correctness flips. The last-token embedding is the only representation that has attended to the full input under the model’s causal mask, making it the most direct readout of pre-generation state. Under Constraint-First (CF) condition, we move the formatting instructions to the start of the prompt to disentangle if the representational shift may be a positional artifact. Training uses leave-one-out cross-validation with balanced class weighting. We report ROC-AUC and PR-AUC with \(p\)-values from \(1{,}000\)-iteration permutation tests per layer and transition. ROC-AUC reflects global ranking ability across the sample, while PR-AUC bounded by the class prevalence rate provides a more conservative estimate of discriminative power for the minority class.

3.7 Direction-of-format-effect test↩︎

To localize the NL-NF residual-stream direction in the SAE basis, we average per-case residual differences into \(\Delta r\) and rank SAE encoder columns by their absolute cosine alignment with this direction, \(|\cos(\Delta r,\,W_\text{enc}[:,f])|\), where \(W_\text{enc}[:,f]\) is the encoder column for feature \(f\) (i.e.the direction the SAE uses to detect feature \(f\) in the residual stream). We then report medical-feature percentile ranks in this ordering (\(0\%\) is top-aligned). NL is longer than NF by the appended multiple-choice scaffold (\(50\)–\(60\) tokens), so different aggregation choices conflate the format direction with token counts. We therefore run three aggregations to separate scaffold length from format: full mean-pool averages per-token residuals over each condition’s full content range (so NL includes the scaffold); length-controlled mean-pool averages only over the byte-identical clinical-prefix tokens that both conditions share (no scaffold contribution); max-pool takes each feature’s peak activation over content tokens and is therefore length-invariant.

3.8 Deferral adjudication↩︎

The above 4-way scoring forces judges to convert each free-text response to one letter.Inspection of 12B NF outputs revealed deferrals: that condition on missing clinical information, (e.g., “ER if BP\(>\)​180/120; same-day clinic if 140–180; review within two weeks otherwise”). We re-adjudicate every NF response under \(\{A, B, C, D, \text{\mathrm{\small deferred}}\}\) with the same two LLM judges (full protocol, label definition, and stratum-mapping rules in Appendix 15). To check if the deferrals are clinically appropriate, a clinician (anonymized), blinded to LLM-judge labels and model identity, adjudicated a 16-case sample. The sample is stratified across four cells of \(4\) cases each: three at 12B (12B-both-deferred, 12B-clear-correct, 12B-clear-incorrect, covering the deferral phenomenon at the scale where it occurs) plus one cross-scale cell at 4B (4B-format-flipped, NL letter wrong but NF judged correct, our gap-driver stratum). Per-case appropriateness judgments and the clinician’s deferral rate are reported in Appendix 16.

3.9 Medical-feature identification↩︎

For Gemma 3 4B IT we use \(3\) medical features per analyzed layer, identified in [24] via a \(6\)-condition cross-lingual contrastive over MMLU question stems (three languages \(\times\) medical/non-medical; full protocol in Appendix 9). For Gemma 3 12B IT and Qwen3-8B we instead run an English-only medical-vs-non-medical contrastive at each analyzed layer, using the \(60\) NF prompts as the medical set and \(30\) patient-voiced non-medical prompts as control (Appendix 10). Following the mean-conditional-activation contrast [13], [15], features are scored by \(\mathbb{E}_\text{med}[\max_t a_f] - \mathbb{E}_\text{non}[\max_t a_f]\), where \(\mathbb{E}[\cdot]\) is the empirical mean of feature \(f\)’s per-prompt peak activation over the medical/non-medical prompt set. Features are then filtered for selectivity (\(\geq 70\%\) medical and \(\leq 10\%\) non-medical firing above threshold \(1.0\)) and the top-\(3\) are retained. A \(K\)-sweep confirms stability across \(K\in\{3,5,10,20\}\) (Appendix 14); within-corpus feature identification at 12B and Qwen is scoped in Section 6.

4 Results↩︎

4.1 Behavioral differences↩︎

We measure condition-level accuracy on all 60 cases in the corpus (Section 3.1), Table 1. NF and SF responses are scored by two LLM judges under the four-letter adjudication prompt of Section 3.3.

4pt

4.1.0.1 Cross-input robustness.

The difference between the free-text and multiple-choice output is positive at 4B (\(+16.7\)/\(+5.0\)pp for natural/structured) input, and negative at 12B (\(-10.0\)/\(-8.3\)pp) and Qwen (\(-6.7\) / \(-5.0\)pp). Paired McNemar tests on the NF\(-\)NL gap give \(p{=}0.031\) at both Gemma scales and \(p{=}0.45\) at Qwen (n.s.at \(n{=}60\)). The same test on the SF\(-\)SL gap is in the same direction at every model but does not reach significance at \(n{=}60\) (\(p{=}0.63\) at 4B, \(p{=}0.18\) at 12B, \(p{=}0.58\) at Qwen). Free-text scores are scored as both-judge agreement under 4-way adjudication; per-judge breakdown and inter-rater \(\kappa\) in Appendix 15. The SF\(-\)SL row therefore points in the same direction as the NF\(-\)NL row at every scale, but with smaller magnitude (|gap| \(5\)–\(8\)pp vs.\(7\)–\(17\)pp for NF\(-\)NL) and is statistically underpowered at \(n{=}60\). The cross-input-style claim is most cleanly supported at 4B, where NF\(-\)NL\({=}+16.7\)pp (\(p{=}0.031\)); the structured-input row is suggestive evidence that the same output-side mechanism applies across input style, not independent statistical confirmation. The structured-vs-natural input contrast (SX\({-}\)NX) is near-zero in every cell except 4B SF\(<\)NF (\(-8.4\)pp), which traces to deferral-priming under structured input in the smaller model (Section 4.2).

4.1.0.2 NL-NF performance details.

We consider the more ecologically valid free-text input/output. At Gemma 4B, NF exceeds NL by \(+17\)–\(22\)pp depending on the NF judge (\(+17\)pp under the conservative both-judges rule), replicating the constrained-output penalty of [3]; the 5-way refinement finds no unanimous deferrals. At Gemma 12B, NF sits \(10\)pp, and at Qwen \(6.7\)pp below NL.The 4B free-text gain is concentrated where adjacent dispositions compete: gold \(C\) (NL \(10\%\to\) NF \(80\%\), \(+70\)pp) and gold \(C/D\) (\(+21\)pp), spanning the Intermediate and High acuity tiers. The 12B pattern is inverse, with NF underperforming most on gold \(D\) (\(-25\)pp) and gold \(C\) (\(-20\)pp) (Table 6). At Qwen, NF is weakest on the low-acuity gold \(A\) (\(-24\)pp; Table 7), consistent with the 12B patterns. Per-acuity breakdowns for 4B and 12B in Appendix 12.

4.1.0.3 Triage error direction.

The direction of misclassifications matters clinically since under- triage (lower than gold predicted acuity) is a dangerous direction. Multiple-choice NL errors are skewed toward under-triage at 4B (\(20\) NL errors are under- and \(7\) over-triage) and Qwen (\(12\) under, \(3\) over), whereas NF errors are approximately balanced at all models (under/over: \(5/8\) at 4B, \(8/9\) at 12B, \(8/6\) at Qwen). A clinically concerning corner case at 4B: on the \(n{=}4\) singleton gold-\(D\) cases, 4B’s NL never predicts \(D\) and NF only. Full breakdown in Appendix 12.

4.2 Decomposing accuracy gap↩︎

The gaps in Table 1 have two plausible explanations: single-acuity-step miscalibration between formats (dominates) or deferral (benchmark-adequacy concern). Per-case decomposition for all models in Appendix 27; Table 2 summarises.

4pt

4.2.0.1 Adjacent miscalibration drives the gap.

At Gemma 4B, the 14 gap-driving cases share a single pattern: NL picks B, gold is C, and NF picks C in \(13/14\). In the multiple-choice mode, 4B systematically commits to B on cases where the gold disposition is C, while the same model under free-text reaches the correct answer. Exhaustive option-order shuffles (Section [sec:option-order], Appendix 28) rule out an alternative explanation that 4B is positionally biased toward \(B\): across all models the picked letter is at or below chance under shuffles (case-clustered \(95\%\) CI excludes \(25\%\) at 4B and 12B; contains it at Qwen), while picked content stays far above chance (\(64.\%\), \(80.3\%\), \(82.6\%\) at 4B, 12B, Qwen). At 4B specifically, randomizing the letter-to-content assignment raises NL’s accuracy from \(55.0\%\) to \(69.8\%\), statistically indistinguishable from NF’s \(71.7\%\). Thus, 4B’s gap comes from the original benchmark answer-key layout interacting with the model’s content prior, not from positional bias.The two factors are established independently in the same experiment, content prior by the above-chance picked-content rate, position bias ruled out by the at-chance picked-letter rate, and their interaction is probed by the layout shuffle, which raises 4B accuracy to NF level while leaving 12B and Qwen 8B mostly unchanged. At 12B and Qwen, the canonical mapping is approximately neutral (\(-2.8\) and \(-2.2\)pp under shuffle), but a residual NF-side penalty remains \(4.6\) and \(7.1\)pp. At scale, free-text mode contributes its own adjacent-miscalibration penalty independently of the answer-key mapping.

4.2.0.2 Deferred answers explain partially accuracy drop.

Under the 5-way label space of Section 3.8, NF gives a conditional answer instead of committing to a letter in \(4\) cases at 12B, \(2\) at Qwen, and none at 4B. When these are re-scored under the original 4-letter space, all 12B deferrals flatten to a gold-compatible letter and count as correct, not contributing to the 12B gap; the Qwen deferrals receive split judgments from the two LLM judges (judges-disagree) and contribute partially. A clinician judged \(3\) of the 12B deferrals clinically appropriate (Appendix 16). The structured-input SF condition shows the inverse profile (\(4\) unanimous deferrals at 4B, none at Qwen), suggesting that structured-format inputs prime conditional responses in the smaller model, a pattern worth following up in the future. Answer deferral is therefore a label-space concern: the 4-letter benchmark cannot express conditional triage boundaries, but it is not the driver of the observed accuracy inversion.

4.3 Mechanistic invariance: magnitude↩︎

We test whether medical SAE features show greater format-invariance than random features (Section 3.9) under both summary metrics defined in Section 3.4. We report the late layer per model (4B L29, 12B L31, Qwen L31; rationale and per-layer behavior in Section 3.4 and Appendix 18).

4pt

4.3.0.1 Medical features.

\(\Delta\)sMAPE\({<}0\) and \(\Delta\)cos\({>}0\) both indicate medical features are more format-invariant than the magnitude-matched random control. At every cell of 4B L29 and 12B L31 the difference is significant on both metrics (bootstrap \(95\%\) CIs non-zero). Qwen L31 reproduces the direction at smaller effect size, consistent with Qwen-Scope’s higher reconstruction error (Section 3.2).

A natural concern is that NL and NF share the same clinical vignette verbatim, and tokens inside that shared block can only attend leftward, so their hidden states are identical across formats. The invariance we report is different. Under max-pool, the medical features’ peak activations actually lie inside the shared clinical vignette in \(98.3\)–\(100\%\) of (case, feature) combinations across all three models, whereas the magnitude-matched random features peak on the NL-only scaffold tokens. The medical features are tracking clinical content; the random pool is not.

To rule out the mechanical reading we conduct additional checks. First, a vignette-only token mask restricts both pools to tokens inside the shared clinical block. sMAPE drops to \(0.002\)-\(0.006\) for medical and random features alike (Appendix 25), confirming that the format contrast lives outside the vignette and the observed medical-random gap would not arise from prefix-attention alone. Second, \(1{,}000\) magnitude-matched random resamples preserve the medical-random gap at \(p{<}0.001\) at every model (Appendix 26). Third, restricting the random pool to features that fire on \(\geq25\%\) of the NL\({\cup}\)NF prompts, so the comparison is against content-firing features, leaves every stratum’s \(95\%\) CI non-zero on both metrics, with modest magnitude changes relative to the unrestricted control (per-stratum results in Appendix 18, where the Gemma 12B shallow/mid sign inversion at L12/L24 is shown). Taken together, medical-domain content is preserved on the clinical narrative across formats; this is a representational claim about the clinical content, not about whether the model encodes the correct triage disposition.

4.3.0.2 Direction of the residual difference.

Where does the format direction live in the SAE? We project the case-averaged NF-NL residual onto SAE encoder columns under the length-invariant max-pool aggregation of Section 3.7 and rank features by absolute alignment. Across all three models, the medical features land at mid-rank percentiles (median \(47\%\), IQR \(33\)–\(68\%\), with \(11/12\) Gemma layer-feature combinations outside the top decile). The format direction therefore lives primarily in non-medical features. The pattern is consistent across the three aggregations (full mean-pool, length-controlled mean-pool, and max-pool; Section 3.7), and top-token inspection of the most-aligned 4B L29 features shows them firing on NL-only answer-key scaffold tokens. Full ranks and the per-aggregation comparison are in Appendices 18 and 23.

Repeating the medical-random invariance test on the structured-input SL-SF pair at the same layers yields paired \(\Delta\)sMAPE values of \(-0.081\) at 4B L29, \(-0.062\) at 12B L31, and \(-0.150\) at Qwen L31, all with \(95\%\) CI strictly non-zero. The format-effect localization therefore generalizes from the naturalistic free-text to the structured format. Full table in Appendix 31.

4.4 Decision-token mode shift↩︎

So far the analyses have averaged or max-pooled over the clinical content. We now turn to the NL pre-generation token, where the multiple-choice letter is decided. Our primary tool here is the Natural Language Autoencoder (NLA) [23], an unsupervised method independent of SAE that produces natural-language descriptions of residual-stream activations. We capture L32 activations of Gemma 3 12B IT at seven token positions under NL and NF (Section 3.5, Appendix 24) and the LLM judges classify each description’s medical and scaffold grade, with three classes each: primary – description’s main subject, partial – secondary mention, or no – or absent. The judges agree \(96.7\%\) and \(96.2\%\) of time on the respective axes (Table 4).

4.4.0.1 Representation flips at the decision token.

At NF_content and NL_content the residual reads as med-primary in all cases under both formats: the NLA describes clinical content as the main subject of the hidden state. At NL_decision one token later, the frame flips: no med-primary, \(60\) med-partial, \(60\) sca-primary (Table 4). The multiple-choice scaffold does not strip clinical content, but demotes that content from the representation’s main subject to a secondary mention while a multiple-choice-scaffold concept becomes the primary subject. Representative NLA outputs are in Appendix 24.

4.4.0.2 SAE-pool corroboration.

Two diagnostics on the SAE feature pool confirm the NLA reading. First, the three contrastively-identified medical features used in Section 4.3 have no activation at the NL pre-generation token in \(60\) cases at every model, and contribute \(0\%\) of the absolute linear effect on the A/B/C/D logits via the per-feature unembedding projection (Appendix 29). Second, top-\(20\) active features at the NL and NF decision tokens are essentially disjoint at Gemma and share \(32\%\) at Qwen. Across all models, \(87\)-\(95\%\) of features unique to NL’s top-\(20\) peak on scaffold tokens outside the shared clinical vignette and no identified medical features appear in either top-\(20\) at any model (Appendix 30). These results concur with NLA: medical-content detectors fire on the clinical narrative during reading, then go silent before the letter is selected, while scaffold features drive the letter logits. Full numerical breakdown including scaffold-other split in Appendices 29 and 30.

4.5 Source-format representation predicts behavioral flipping↩︎

If the decision-token mode shift (Section 4.4) drives the behavioral gap, the source-format hidden state alone may predict which cases flip under a format change. We test this on Gemma 3 4B IT.

Predictive signal concentrates in the deep layers of the network (L29-L34). For \(\text{NL}\rightarrow\text{NF}\), we obtain AUC=\(0.769-0.780\), \(p=0.004\) and PR-AUC=\(0.591-0.616\) vs baseline \(0.283\); for \(\text{NL}\rightarrow\text{SL}\) – AUC=\(0.784-0.804\), \(p=0.010\) and PR-AUC=\(0.413-0.477\) vs baseline \(0.167\); and for \(\text{NF}\rightarrow\text{NL}\) – AUC=\(0.713-0.752\), \(p=0.009-0.023\) (see Figure 1). Among the four source prompt formats, NL-sourced last-token embeddings produce the most consistent predictive signal across target directions at late layers. All the results are in Appendix 32.

Moving the formatting instruction to the beginning of the prompt in constraint-first ablation selectively modifies the late-layer predictive signal for the two NL-sourced transitions. For \(\text{NL\_{CF}}\rightarrow\text{NF}\), AUC at the same levels increases by \(0.016-0.052\) (\(p=0.001-0.003\)), while for \(\text{NL\_{CF}}\rightarrow\text{SL}\) it degrades by \(0.078-0.128\) and loses significance. NF-sourced directions were identical across both runs since NF does not have output constraints.

5 Conclusion↩︎

Across three instruction-tuned consumer LLMs from two families, four converging observations support an output-mapping reading of the apparent multiple-choice triage failures. First, the same medical features fire on the shared clinical narrative under both formats and peak inside the vignette in \(98\)–\(100\%\) of (case, feature) combinations. Second, at the multiple-choice decision token they go silent and scaffold-encoding features take over, with NLA verbalization and SAE-pool diagnostics agreeing on this flip. Third, the multiple-choice accuracy penalty inverts with scale identically under natural-language and structured input, so the effect originates on the output side rather than in phrasing. Fourth, the measured NL-NF accuracy gap is dominated by single-acuity-step miscalibration, not by deferral; the parallel SL-SF gap shows a comparable profile (Section 4.2). A per-case decomposition on SL-SF is outside this paper’s scope.

6 Limitations↩︎

6.0.0.1 Coverage and sample size.

We study 60 patient-voiced clinical-triage vignettes per model across three instruction-tuned consumer LLMs from two families, with greedy decoding only. Small behavioral strata and the one-layer Qwen analysis limit generalization beyond Gemma and Qwen. The Qwen behavioral gap is not significant at \(n{=}60\) (McNemar \(p{=}0.45\)); the Qwen mechanistic findings nonetheless reproduce the Gemma direction at smaller effect size, consistent with Qwen-Scope’s higher reconstruction error on the residual stream.

6.0.0.2 Judging and clinical calibration.

NF scoring relies on two LLM judges under an A–D label space that flattens some tiered deferred responses. The clinician subset is enriched and small (\(n{=}16\), Appendix 16); it calibrates label face validity, not clinical deferral prevalence or deployment safety.

6.0.0.3 Mechanistic-method scope.

We use max/mean pooling and encoder-direction projection rather than richer aggregations or a full multi-feature intervention sweep. Qwen-Scope’s \({\sim}34\%\) L31 reconstruction error raises the Qwen noise floor. Feature identification at 12B and Qwen reuses the 60 NF prompts with a 30-prompt non-medical contrastive; a held-out contrastive split would tighten inference. The random baseline is magnitude-matched and resampled (Appendix 26) to avoid zero-firing denominator artifacts.

6.0.0.4 Claim scope.

The SAE features are medical-vs-non-medical detectors, not acuity probes: we claim medical-domain content is preserved on the clinical narrative, not that correct triage disposition is encoded. Shared-prefix pooling contains causal-masking-trivial invariance, which we isolate with token masks and content-anchored peaks (Appendix 25). NLA evidence is limited to Gemma 3 12B IT, the released checkpoint available for this analysis  [23]. Causal interventions on the format-direction features at 4B L29 (discrete SAE-feature ablation and continuous ActAdd steering; Appendix 22) change only \(0\)–\(2\) of \(60\) NL predictions, consistent with the multi-intervention nulls of [10]; we therefore treat the SAE features as readout probes of medical-domain content rather than as causal handles or clinical monitors.

6.0.0.5 Decision-token feature sets do not overlap across formats.

At the NL pre-generation token, the top-\(20\) most active features are nearly disjoint between NL and NF at both Gemma scales (Jaccard \(\approx 0\); \(0.32\) at Qwen), and none of the contrastively-identified medical features appear in either set (Appendix 30). The scaffold-firing features that dominate the NL letter logits are therefore not reweightings of the same feature pool active under NF; they are a different set of features entirely. We do not yet know what these features encode beyond “peak on answer-key scaffold tokens,” nor whether they reflect learned answer-key templates from pretraining/instruction tuning or something more specific to the clinical-triage register; characterising them is left to future work.

6.0.0.6 Clinical claim scope.

Lower forced-letter under-triage in some comparisons is not a safety endorsement of NF. Deferrals, hedging, and emergency-tier misses persist; our claim concerns the adequacy of forced-letter evaluation as a competence readout, not the deployment-readiness of free-text outputs. Late-layer SAE features are a candidate readout of medical-domain representation, not a validated clinical monitor: deployment would require held-out calibration, robustness checks, correlation with under-triage risk, and prospective validation. The intervention nulls here and in [10] also argue against single-layer SAE control as a correction method on this task.

7 Use of AI assistants↩︎

We used AI assistants: Claude Code (Anthropic, an agentic command-line coding tool) and Claude Opus 4.7 (Anthropic); at three stages of this work: (i) implementing analysis code (SAE encoding, bootstrap and case-clustered CI routines, option-order shuffles, decision-token logit attribution, the NLA judge-classification pipeline, and the linear-probe training); (ii) executing experiments under human supervision (model loading, hooked forward passes, activation extraction, judge-call orchestration), with authors verifying outputs against unit tests and independent reproductions where applicable; and (iii) paper preparation (LaTeX editing, prose tightening on the basis of co-author and reviewer comments, bibliography reconciliation). Research design, hypotheses, method and model selection, interpretation of results, abstract drafting, and final claims were authored and verified by the human authors; AI assistants did not generate research ideas, choose what to evaluate, decide which results to report, or write the core narrative or abstract. The authors take full responsibility for all numerical results, code, and claims.

8 Dataset label distribution↩︎

The source corpus populates all four cells of the \(2\times2\) input \(\times\) output factorial — SL (structured + multiple-choice), NL (natural + multiple-choice), SF (structured + free-text), and NF (natural + free-text). Gold-label counts are \(\{A{:}8, B{:}8, C{:}10, D{:}4, A/B{:}2, B/C{:}4, C/D{:}24\}\). Gold labels \(\{A,B,C,D\}\) and condition codes \(\{\text{SL},\text{NL},\text{SF},\text{NF}\}\) use disjoint alphabets to avoid ambiguity.

9 Medical-feature identification at Gemma 3 4B IT↩︎

The three medical features used at Gemma 3 4B IT, L29 (\(f_1=12570\), \(f_2=893\), \(f_3=12845\)) were identified in our earlier work via a 6-condition cross-lingual contrastive (3 languages \(\times\) 2 domains: {English, Spanish, French} \(\times\) ) on MMLU question stems, validated by three independent tests: (i) top-activating token inspection on free-form medical text not in MMLU format; (ii) feature ablation on 4B’s MMLU accuracy across all six cells, showing the medical cells drop substantially while non-medical cells are unaffected; (iii) non-MCQ free-form medical-text firing, confirming the features are not MCQ-format detectors. The MMLU medical subjects used were anatomy, clinical knowledge, college medicine, medical genetics, and professional medicine; the non-medical control subjects were philosophy, world religions, and global facts (cais/mmlu configs for English, openai/MMMLU configs for Spanish and French).

For Gemma 3 12B IT and Qwen3-8B we use a simpler English-only medical-vs-non-medical contrastive at each analyzed layer. The asymmetry is one of research history rather than principle: the cross-lingual validation in 4B established that the candidate features generalize across languages and contrast groups, so for the larger models we use the more economical English-only contrastive described in Section 3.9.

10 Non-medical contrastive prompts↩︎

The 30 hand-curated, patient-voiced non-medical prompts used as the non-medical control set for the English-only contrastive at Gemma 3 12B IT and Qwen3-8B. The prompts match the conversational register of the 60 NF prompts (a person describing a non-medical concern and asking for guidance) so that the contrast isolates clinical content rather than register.

1. “Hi, I just got a new puppy and I’m not sure how often I should be feeding her. She’s 8 weeks old, a Labrador. Any guidance on a feeding schedule?”

2. “I’m a 30-year-old who’s never done any real cooking. I want to start learning to make basic dinners. Where should I begin?”

3. “Hey, I’m planning a trip to Tokyo next month for two weeks. I’ve never been to Japan. What should I prioritize seeing, and is two weeks enough?”

4. “Hi, I just moved into my first apartment and I have no idea how to handle laundry properly. Can you walk me through the basics?”

5. “I bought a sourdough starter last week. How often should I feed it, and can I keep it in the fridge between bakes?”

6. “Hi, I’m 26 and want to start saving for retirement. I have no investments yet. Where do I even start?”

7. “I’m trying to learn to play guitar as an adult. I’ve been at it for two months and feel like I’m not progressing. Is this normal?”

8. “Hi there, I want to start a vegetable garden in my backyard. Small space, gets afternoon sun. What’s easy to grow for a beginner?”

9. “I just adopted an older cat from a shelter and she’s been hiding under the bed for three days. Should I be worried?”

10. “Hi, I’m thinking about getting into running. I’m completely out of shape. Should I try couch-to-5k or something else?”

11. “I’m 35 and want to learn to swim properly. I can sort of doggy paddle. What’s the best way for an adult to learn?”

12. “Hi, my houseplant’s leaves are turning yellow. I water it once a week. Did I do something wrong?”

13. “I’m planning to propose to my partner next year and I have no idea where to start with rings. Any general advice?”

14. “Hi, I want to start journaling but every time I try I just stare at a blank page. How do people actually keep a journal?”

15. “I’m thinking about adopting a second dog. I already have a 5-year-old male. Any thoughts on whether this is a good idea?”

16. “Hi, I’m 28 and have never voted before. The election is coming up and I want to participate. How do I register and vote?”

17. “I just got my first slow cooker as a gift. What are some easy meals a beginner can try?”

18. “Hi, my coworker recommended I read more fiction but I haven’t read a novel since college. Where should I start?”

19. “I’m trying to drink less coffee. I’m at 4 cups a day. Any tips for cutting back without total misery?”

20. “Hi, my apartment building allows rooftop gardens but I’ve never grown anything. What’s the absolute easiest plant to start with?”

21. “I’m thinking about learning a second language. I’m an English speaker. Spanish or French — which is more useful for travel?”

22. “Hi, I want to start meditating but I keep falling asleep. Is that normal? Any tips?”

23. “I just got a bike for commuting. The route to my office is mostly bike lanes but crosses one busy street. Any safety tips for a new commuter?”

24. “Hi, I’m 31 and never learned to cook a steak. I bought a nice ribeye for the weekend and don’t want to ruin it. Walk me through it?”

25. “I want to start lifting weights at home. Limited space and budget. What’s the minimum equipment that gets results?”

26. “Hi, my sourdough loaf came out dense and gummy. I followed the recipe. What might have gone wrong?”

27. “I’m planning a small dinner party for six people next weekend. I’m an okay cook but never hosted before. What do I need to know?”

28. “Hi, I want to start hiking on weekends. Live near a national park. Never hiked before. What should I prepare for my first easy trail?”

29. “I’m 40 and want to learn to draw. I always thought I had no talent. Is it actually possible to start as a beginner at this age?”

30. “Hi, I just bought a film camera at a thrift store. Never shot film before. How do I figure out how to load and use it?”

11 Qwen layer-selection pilot↩︎

We piloted four candidate Qwen3-8B layers \(\{10, 18, 23, 31\} \approx \{28\%, 50\%, 64\%, 86\%\}\) of total depth, matched to the four Gemma 3 4B layer fractions (\(27\%, 50\%, 65\%, 85\%\)). For each candidate we measured relative \(L_2\) reconstruction error of the Qwen Scope SAE on the residual stream across the 60 NF prompts. L31 returned the lowest reconstruction error of the four candidates and was selected as the analyzed layer for the cross-family validation. The reconstruction error at L31 on the L0_100 Qwen-Scope variant is \({\sim}34\%\) (median \(34.4\%\), mean \(37.2\%\)). Control checks confirm this is a TopK-sparsity property rather than a chat-template / base-checkpoint distribution mismatch: errors are identical on chat-templated and raw-text inputs, with and without subtraction of the SAE decoder bias \(b_\text{dec}\).

12 Acuity stratification of behavioral accuracy↩︎

Section 4.1 reports condition-level accuracy pooled across all 60 cases. Table 5 disaggregates by the corpus’s acuity tagging (Low / Intermediate / High); Table 6 disaggregates by the gold triage tier.

13 Per-token activations on all 60 cases↩︎

Table 8 reports per-token max activations on the three Gemma 3 4B IT L29 medical features (\(f_1=12570\), \(f_2=893\), \(f_3=12845\)) for all 60 cases. Across the 60 cases, the three features fire above the JumpReLU threshold under both NL and NF on 30, 44, and 26 cases for \(f_1\), \(f_2\), \(f_3\) respectively. When both fire, the per-token max delta \(|a_\text{NF} - a_\text{NL}| / \max(a_\text{NF}, a_\text{NL})\) is \(\leq 8.2\%\) (\(f_1\), median \(0.9\%\)), \(\leq 4.9\%\) (\(f_2\), median \(0.4\%\)), and \(\leq 2.1\%\) (\(f_3\), median \(0.6\%\)). A small number of low-magnitude near-threshold cases (1 for \(f_1\), 3 for \(f_2\), 2 for \(f_3\); max activation \(548\)–\(706\) across the SAE’s \({\sim}3{,}500\) saturation range) fire under NL but stay below threshold under NF; the inverse (NF-only firing) does not occur.

14 Sensitivity to medical feature-set size \(K\)↩︎

The main-text mechanistic-invariance result (Section 4.3) uses 3 medical features per (model, layer). To check that the medical-random sMAPE gap is not sensitive to that specific small subset, we re-run the mechanistic-invariance test at the representative late layers (Gemma 3 4B IT L29 and Gemma 3 12B IT L31) with \(K \in \{3, 5, 10, 20\}\) medical features drawn from the same contrastive identification ranking, against magnitude-matched random baselines.

Identical to Section 3.4 except we vary the number of medical features included in the mean sMAPE. For each \(K\) we take the top-\(K\) entries in the contrastive ranking, max-pool feature activations over content tokens, and compute the per-(case, feature) sMAPE. Bootstrap mean and 95% CI from 1,000 case resamples.

3pt

The medical-random gap is robust across feature-set sizes at the two Gemma late layers. At 4B L29 the paired \(\Delta\) ranges from \(-0.025\) (\(K{=}3\)) to \(-0.217\) (\(K{=}5\)), narrowing to \(-0.061\) at \(K{=}20\); at 12B L31 the gap stays in \([-0.74, -0.32]\) across all \(K\). Medical mean drifts upward with \(K\) (4B: \(0.006\) to \(0.153\); 12B: \(0.006\) to \(0.087\)), indicating that lower-ranked medical features are somewhat noisier than the top-3 but they remain significantly below the random baseline at every \(K\) tested. The main-text \(K{=}3\) result is therefore representative of the contrastive-ranked medical population rather than cherry-picked from a small subset.

The medical-mean upward drift with \(K\) is itself informative: it is consistent with the SAE-as-monosemantic-probe view adopted in Section 3.9. The top contrastive-ranked features are the most cleanly medical-selective AND the most format-invariant; the broader medical-firing population in the SAE basis includes features that are medical-content-correlated but more sensitive to surface format. The headline interpretation (“a small number of monosemantic medical features carry format-invariant clinical content”) is what the sensitivity check quantifies, not contradicts.

15 Five-way LLM-judge adjudication↩︎

15.0.0.1 Setup.

On the NF responses, we ran the two LLM judges (gpt-5.2-thinking-high and claude-sonnet-4.6) with the four-letter adjudication prompt of Section 3.3 extended to permit a fifth output token, deferred. The judges’ decision rules and A/B/C/D definitions are unchanged from the four-letter prompt; we add one rule and one category.

The deferred category, in the judges’ own prompt:

The model’s final recommendation is contingent on additional information it asks the patient to provide; no single triage urgency is committed to. Use deferred ONLY when the model lists possible urgencies without committing (“could be A, could be C, depends on Y”) and explicitly asks the patient to answer Y before deciding, OR when the model refuses to give a triage timeframe and only recommends “speak to a doctor” without specifying when.

15.0.0.2 Inter-judge agreement on the five-way label

is \(91.7\%\) at 4B (same-letter agreement, including deferred) and \(95\%\) at 12B (\(57/60\) cases identical). On the deferred class specifically, both judges agree on the same set of 4 cases at 12B (F15, F19, F23, F24); the fifth flagged deferred case (F7) is flagged only by GPT, with Claude marking it as A.

15.0.0.3 Per-case quotes from the deferred set

(12B, both judges):

15.0.0.4 Where the deferred cases came from under four-letter adjudication.

Under the original four-letter prompt, all four cases were labeled (B, B, B, B) by both judges. The B label is plausible by default (“see a doctor in the next few weeks”) but does not reflect the model’s central reasoning, which is a tiered conditional. Under the five-letter prompt, both judges promote these to deferred, which both reduces 12B’s accuracy on the conventional four-letter score (GPT \(71.7\% \rightarrow 65.0\%\), Claude \(71.7\% \rightarrow 66.7\%\)) and yields a more faithful description of the model’s actual behavior.

16 Clinician adjudication↩︎

16.0.0.1 Protocol.

A clinician (anonymized for review; specialty to be disclosed at camera-ready) reviewed a blinded sample of \(n=16\) cases stratified across four cells of 4 each, drawn from the 60-case corpus: 12B_both_deferred (\(n=4\), model defers tiered-conditional advice), 12B_clear_correct (\(n=4\), both LLM judges agree and match gold), 12B_clear_incorrect (\(n=4\), both judges agree but not in gold), and 4B_format_flipped (\(n=4\), NL letter wrong, NF judged correct by both LLMs). The clinician saw only the patient message and the model’s free-text response; both gold labels and LLM-judge labels were withheld. For each case the clinician rated: (1) primary triage on the five-class A/B/C/D /DEFERRED scale, using the same prompt the LLM judges used; (2) deferral-appropriateness (yes/no/NA) if the chosen label was DEFERRED; (3) confidence (1–5); (4) whether they agreed with the model’s recommendation (yes/partial/no); (5) free-text notes.

16.0.0.2 Headline results.

16.0.0.3 Two cases where the clinician diverges from the LLM judges.

16.0.0.4 Reading.

The LLM-judge methodology used throughout the paper is well-calibrated to clinical judgment (\(\kappa = 0.808\)), supporting its use as the primary scoring tool. The 12B model’s tiered deferrals (Section 4.2) are clinically appropriate the majority of the time (\(3/4\)). Crucially, the clinician deferral rate (\(37.5\%\) on this sample) substantially exceeds the model’s own deferral rate (\(6.7\%\) on the full corpus), and the clinician never fully disagrees with the model’s recommendation (\(0/16\)). The model under-defers relative to clinical practice but never produces an unsafe recommendation in our sample. This is consistent with the paper’s main finding that the multiple-choice scaffold obscures clinical caution rather than degrading clinical reasoning: a clinician would defer on a larger fraction of cases than the model does, but on the cases where the model does commit, its recommendations align with clinical judgment.

17 Verified baseline numerics↩︎

A small number of numerical claims about SAE properties and intervention magnitudes appear in the main text without their derivation. We list the verified source values here, recomputed end-to-end from the same checkpoints used for the analyses.

18 Full per-layer / per-stratum tables↩︎

The headline table (Table 3) reports only the late layer per model. Tables 12, 13, and 14 give the full per-layer / per-stratum sweeps and the restricted-random-pool comparison, both under max-pool aggregation with sMAPE and cosine side-by-side. Cells with \(n_\text{cos}\) noted in parentheses have effective cosine \(n < n_\text{sMAPE}\) because one of the medical/random feature subvectors is identically zero for some cases (undefined cosine).

3pt

3pt

3pt

3pt

19 Metric consistency under aggregation↩︎

Section 4.3 reports two summary metrics (sMAPE and cosine) under max-pool aggregation. The choice of aggregation matters at one cell (Qwen L31) and not at any other. Table 16 reports the medical\({-}\)random \(\Delta\) for both metrics under both aggregations, per cell.

4pt

The mean-pool disagreement at Qwen L31 is mechanistically attributable to the TopK SAE forcing nearly all features to zero on any given token. This dilutes per-case mean-pool feature subvectors to near-zero in both NL and NF, exposing both metrics to noise (denominator-clamp artifact for sMAPE; direction noise on near-zero vectors for cosine). Max-pool aggregates the peak per-feature firing, which is non-zero whenever the feature is in the top-\(k\) on at least one content token, and is therefore robust to TopK zeroing. We adopt max-pool throughout this analysis for this reason and for consistency with the direction analysis in Section 3.7 (also max-pool).

20 Pooling conventions↩︎

Gemma/Qwen content-pool conventions differ for in-distribution reasons. Gemma Scope 2 is trained on activations of the IT models with chat-template structure, so we present chat-templated input and pool over user-content tokens between <start_of_turn>user\n and <end_of_turn>. Qwen-Scope is trained on activations of the base (pre-IT) Qwen3-8B checkpoint, so we feed raw text and pool over the entire input to keep the residual stream in-distribution for the SAE. The conventions exhaust the choices the published SAE training settings permit.

21 Why three features — methodological note↩︎

Our methodology follows the SAE-as-monosemantic-probe tradition [13], [15]: SAE features are treated as individually interpretable, named units, and claims are made about the identities of small subsets of features rather than the predictive power of a large feature basis. We adopt this approach because our research question concerns the representational content of the residual stream (“what does the model represent and is that preserved across formats?”), not the discriminability of medical vs.non-medical content via a downstream classifier. A complementary line of work using larger SAE-feature sets fitted to a downstream classification head [25], [26] is appropriate for different research questions — can SAE features discriminate true/false statements, or category \(X\) from \(Y\)? — where the unit of analysis is the classifier and a richer basis reduces noise. For our question, three monosemantic, contrastive-identified features suffice as a probe; the result must hold against a properly matched null rather than scale with feature-set size. We mitigate the “cherry-picked subset” concern with two random baselines (magnitude-matched and content-restricted), both of which yield higher sMAPE (and lower cosine) than the medical features across the headline (model, layer) combinations (Section 4.3). The \(K\)-sweep in Appendix 14 (\(K \in \{3, 5, 10, 20\}\) at 4B L29 and 12B L31) confirms the medical-random gap is stable across feature-set size, supporting that the 3-feature result reflects a population-level pattern rather than a small-sample artifact.

21.0.0.1 Why magnitude-match the random pool.

An uncontrolled random sample from the 16,384 (Gemma) or 65,536 (Qwen) features would be dominated by features that rarely fire on the 60-case corpus. Their sMAPE values collapse to zero through the \(\varepsilon\) denominator floor in the sMAPE formula (Section 3.4), which biases the random mean downward and artificially narrows the medical-random gap. Restricting the pool to features whose mean activation falls in the band \([0.5\min(\text{med}), 2.0\max(\text{med})]\) confines the random control to features that fire at comparable magnitudes to the medical features, making the comparison faithful.

22 Intervention details↩︎

22.0.0.1 Discrete SAE-feature ablation.

For each NL forward pass at Gemma 3 4B IT L29 we register a hook that subtracts the SAE-reconstructed contribution of the three top format-direction features (3833, 10012, 980). A control arm ablates three magnitude-matched random features. A diagnostic confirms the hook fires on every forward and modifies the residual at the expected magnitude: mean 264 norm subtracted per token, peak 6,795 on the strongest answer-key tokens. Relative to the L29 residual norm (\({\sim}60{,}000\) per token), this is \({\sim}0.4\%\) on average and peaks at \({\sim}11\%\) on the strongest scaffold tokens — insufficient to flip the next-token argmax.

22.0.0.2 Continuous ActAdd steering.

Following the activation-addition formulation of [27], we compute \(v = \langle r_\text{NL}\rangle - \langle r_\text{NF}\rangle\) at L29 (case-averaged mean residuals at content tokens; \(\lVert v\rVert = 1{,}012\)). For each NL forward pass at \(\alpha \in \{0, 0.5, 1, 2, 4\}\) we register a hook that adds \(-\alpha \cdot v\) to the L29 output at every token. At \(\alpha = 4\) the perturbation magnitude is \(4 \cdot 1012.66 / 60{,}583 = 6.69\%\) of residual norm (Appendix 17). Only cases F2 and E6 shift (F2 at \(\alpha = 2\), E6 at \(\alpha = 4\)); both are gold \(=\) B/C and shift from C to B, remaining within the permissive gold range.

23 Format-direction top-token examples↩︎

At Gemma 3 4B IT L29 we inspect the three features most aligned with the (NL\({-}\)NF) max-pool direction (3833, 10012, 980) across all NL-NF prompts. Their top-3 activations are all NL-only literal answer-key scaffold tokens: 3833 on “next” in option B, 10012 on “the” in option D, and 980 on answer-key “=” syntax. The medical features (12570, 893, 12845) instead fire on clinical-content tokens at matched magnitudes across NL and NF.

24 NLA verification details↩︎

24.0.0.1 Protocol.

For each of the \(60\) cases we run two forward passes of Gemma 3 12B IT — one with the NL prompt, one with the NF prompt — and capture L32 residual-stream activations at seven token positions, listed below:

• content: the last clinical-content token (the “?” of “how soon should I follow up?”); identical under NL and NF, captured under both;

• decision: NL-only; the last user-message token, whose hidden state drives the first generated letter;

• letter_A, letter_B, letter_C, letter_D: NL-only; the four answer-key letter tokens inside the multiple-choice scaffold.

This yields \(60 \times 7 = 420\) activation records. Each is fed to the NLA actor-verbalizer under greedy decoding (temperature 0, max 200 new tokens), with the actor prompt template released with the NLA checkpoint, injection scale 80,000, and the \(\sqrt{d}\) embed-scaling Gemma 3 requires. The NLA AV is trained at L32, one layer adjacent to our L31 SAE analysis; the output-mapping result holds at both L31 and L41 in our 12B data, so this one-layer drift sits inside a stable encoding region.

24.0.0.2 Consistency check.

The NL_content and NF_content L32 activations agree to median relative \(L_2\) difference \(0.28\%\) (maximum \(0.90\%\)) on residuals of norm \({\sim}60{,}000\) — consistent with bf16 numerical noise as expected under causal attention with byte-identical prefix tokens. The NLA greedy outputs agree semantically (both 100% medical) at this position, with character-identical strings on \(17/60\) cases and minor surface variation on the rest.

24.0.0.3 Representative NLA outputs (case E1).

24.0.0.4 Per-letter pattern.

Across the four NL-only answer-key letter tokens, all four are \(60/60\) sca-primary. They differ on the medical axis: letter_B has \(52/60\) med-no (the cleanest “no medical content” verdict in the dataset) while letter_D is \(60/60\) med-partial because “D = Go to the ER now” carries strong clinical context. This per-token variation matches the literal clinical loading of each option’s text and matches the top-token analysis in Appendix 23, which identifies individual SAE features firing on these same scaffold tokens.

25 Token-mask decomposition (causal-masking sanity check)↩︎

In a causal decoder transformer, hidden states at the shared clinical-prefix tokens of NL and NF cannot differ: NL appends the multiple-choice scaffold after the prefix, so causal masking forbids the appended tokens from influencing earlier states. Pooling SAE feature activations over a span that includes those shared tokens therefore contributes a trivially-zero sMAPE component. We verified this prefix-identity claim by tokenizing all \(60\) paired NL-NF prompts under each model’s own tokenizer: at Gemma 3 4B IT and 12B IT, \(60/60\) cases pass — the vignette text re-tokenizes identically inside NF and the shared prefix covers all \(255\) vignette tokens. At Qwen3-8B, \(60/60\) vignettes are internally identical, but Qwen’s BPE merges the trailing “?\n\n” into one token in NL (where the scaffold follows) versus keeping “?” as a separate token in NF (where <|im_end|> follows); the divergence shifts one token earlier than the vignette end. \(\sim99.6\%\) of vignette positions are byte-identical at Qwen too, and the small non-zero vignette-mask sMAPE we observe there (\(0.0018\) / \(0.0031\) medical/random) is consistent with this single-token BPE boundary effect plus bf16 noise. To make the analysis concrete we partition the NL\(\cup\)NF token stream into three masks:

4pt

25.0.0.1 Medical-feature peaks are anchored in the shared vignette.

Under max-pool aggregation, the case-level statistic is dominated by the token at which each feature reaches its peak. For the three medical features at each model, the peak-location fraction inside the vignette mask is \(99.4\%/99.4\%\) (4B NL/NF), \(98.3\%/100.0\%\) (12B NL/NF), and \(100.0\%/100.0\%\) (Qwen NL/NF, L0_100); on the structured-input pair the corresponding Qwen numbers are \(99.4\%\) (SL) and \(98.8\%\) (SF). Medical-feature peaks are anchored in the clinical narrative across all three models; the medical-random gap on the full-content mask reflects this anchoring, not trivial prefix overlap.

25.0.0.2 Decision-token caveat.

The decision-token comparison as defined (last prompt token) compares syntactic chat-template suffix tokens whose feature activations are dominated by generation-prep state; we report no decision-token sMAPE in Table 17 for this reason. A better analysis would compare the last content token under each format; we leave this redesign as future work.

26 Magnitude-matched random resampling↩︎

The fixed-seed random control of Section 4.3 uses a single draw of 30 features from the magnitude-matched pool. To quantify the medical-random gap’s robustness to that draw, we resample the random pool \(1{,}000\) times under the same magnitude-matching constraint (\([0.5\min(\text{med}), 2.0\max(\text{med})]\)) and re-compute the per-case sMAPE in each draw. Table 18 reports the \(5\)th–\(95\)th percentile range of random sMAPE across draws and the one-sided permutation \(p\)-value for the medical-random gap (fraction of random-pool draws whose mean sMAPE is at or below the observed medical mean).

4pt

The original fixed-seed random pool included zero-firing features whose sMAPE is artificially zero by the \(\varepsilon\) denominator floor (Section 3.4); under proper magnitude-matched resampling, the random distribution is shifted upward and the medical-random gap is consequently larger than the fixed-seed analysis suggested.

27 Per-case NL-NF gap decomposition↩︎

Table 19–21 report the per-case decomposition supporting the adjacent-miscalibration framing of Section 4.2. Adjacency is computed on the gold acuity scale \({A\to B\to C\to D}\) as integer distance \(|\text{NL letter} - \text{NF letter}|\); “adjacent” means distance \(=1\).

3pt

3pt

3pt

28 Option-order shuffle on 4B↩︎

The Section 4.2 “NL\({=}\)B, gold\({=}\)C” pattern on 4B admits two simple alternative explanations. The position-2 bias hypothesis: the model prefers whatever letter sits in position-\(2\) in the canonical A–D layout. The content prior hypothesis: the model prefers a specific clinical disposition independent of which letter holds it.

We disambiguate by shuffling the A–D label assignments to the same option texts. For each of the \(60\) NL prompts and each model, we run all \(23\) non-identity permutations of \(\{A,B,C,D\}\). Each permutation rewrites the prompt with shuffled letter assignments while keeping the option texts verbatim — so, e.g., “See a doctor within 24–48 hours” may sit under letter \(A\), \(B\), \(C\), or \(D\) depending on the shuffle. We re-run forced-letter generation on each shuffled prompt under greedy decoding (\(60 \times 23 = 1380\) NL forward passes per model). We then ask: how often does the model pick the same letter as in canonical, and how often does it pick the same content?

3pt

The cross-model picture cleanly separates two distinct sources of format-dependent accuracy.

(a) Canonical answer-key mapping \(\times\) content-prior interaction. This source is scale-dependent. At 4B, the canonical A–D layout misroutes the model’s “24–48h care” content prior to a wrong letter on the gold-\(C\) cases, costing \(\sim 17\)pp. At 12B and Qwen, the canonical mapping is approximately neutral.

(b) NF-mode adjacent miscalibration. This source is present at 12B and Qwen but absent at 4B, where shuffled NL is statistically indistinguishable from NF.

Across all three models, position is not a factor (same-letter rates near chance, two of three CIs below chance) and content priors are strong (same-content rates \(64\)–\(82\%\)). The canonical NL accuracy spread of \(55\)–\(82\)pp narrows to \(\sim 70\)–\(76\%\) shuffled once the canonical answer-key binding is removed.

29 Decision-token logit attribution: full results↩︎

The methodology (per-feature linear-contribution formula, the medical/scaffold/other categorization, the model-and-layer pair analyzed) is given in Section 3.5. Table 23 gives the headline aggregation; the categorization details and the per-letter breakdown follow.

4pt

29.0.0.1 Feature-id reference.

The contrastively-identified medical features are \(\{12570, 893, 12845\}\) at 4B L29 and \(\{130, 85, 4773\}\) at 12B L31. The top-\(3\) scaffold features (\(\{3833, 10012, 980\}\) at 4B L29; see Appendix 23) are a subset of the top-\(30\) scaffold pool used in Table 23. The “other” category contains all remaining features active (JumpReLU-thresholded \(>0\)) at the NL pre-generation token.

29.0.0.2 Activation diagnostic.

Before attributing the medical features’ zero contribution to orthogonality with the letter directions, we verified that the medical features are not active at this position at all. At 4B L29, the three medical features have zero activation at the NL pre-generation token in \(60/60\) cases; at 12B L31, the analogous three features have zero activation in \(60/60\) cases. The features fire on clinical-narrative tokens during clinical reading (Appendix 13) and then go silent at the decision token. The zero linear contribution in Table 23 therefore reflects a categorical absence of medical-feature activity at the decision point, not a near-orthogonality between active medical features and the unembedding directions.

29.0.0.3 Per-letter breakdown.

The mean linear contributions above (\(0\) / \(\sim 199\) / \(\sim 266\) for medical / scaffold / other at 4B L29) are taken with respect to the predicted letter on each case. Replacing the predicted letter with each fixed letter target \(\ell \in \{A, B, C, D\}\) and re-averaging gives a per-letter breakdown that qualitatively matches the predicted-letter pattern. Medical contribution is zero across all four letter columns (because medical features are not active at the decision token). Scaffold and other contributions distribute across the four letters in proportions consistent with the canonical letter-binding structure (Section 4.2).

30 Decision-token top-feature characterization↩︎

The logit attribution (Appendix 29) selects features by alignment with the residual \((\text{NL}-\text{NF})\) direction (top-\(30\) by direction-analysis) and asks how much they contribute to the letter logits. A complementary question — closer to the reviewer’s “scaffold-primary at NL” phrasing — is which features are most active at the NL decision token in the first place, regardless of direction-analysis selection, and where those features peak on B-prompt tokens.

30.0.0.1 Method.

For each case at each model, take the top-\(20\) features by activation at the NL decision token and at the NF decision token. Compute Jaccard overlap \(|NL_{20} \cap NF_{20}| / |NL_{20} \cup NF_{20}|\). For features in \(NL_{20} \setminus NF_{20}\), record where the feature reaches its peak activation on the B (NL) prompt: “scaffold” if the peak token sits outside the shared clinical vignette (i.e.in the scaffold instructions or A–D answer-key block), “vignette” otherwise. Symmetric analysis for \(NF_{20} \setminus NL_{20}\) on the D (NF) prompt.

3pt

30.0.0.2 None of the identified medical features are in either top-\(20\) at any model.

Across all \(60 \times 3 = 180\) (case, model) pairs, the count of medical features appearing in \(NL_{20}\) is \(0\) and in \(NF_{20}\) is \(0\). This corroborates the logit-attribution finding: medical-content detectors are not in the top of the active feature pool at the decision token; they are not active at that position at all.

30.0.0.3 Reading the Qwen-vs-Gemma asymmetry.

The Qwen Jaccard of \(0.32\) (vs.\(\approx 0\) at Gemma) suggests Qwen shares some decision-token features across formats — a pattern consistent with Qwen3-8B being a smaller, more shared representational space than the larger Gemma 12B. The “\(94.7\%\) scaffold peak” asymmetry on NL-only features nonetheless holds at Qwen; the scaffold-primary pattern is robust across the Jaccard difference.

31 Input-style robustness: SL-SF mechanistic invariance↩︎

This appendix carries the full numbers behind the input-style robustness paragraph in §[sec:phase1b95robustness]. The finding: medical features are significantly more format-invariant than magnitude-matched random features under the structured-input SL-SF pair too, not only the natural-input NL-NF pair.

31.0.0.1 Protocol.

The SL-SF protocol mirrors the NL-NF mechanistic invariance test of Section 3.4: forward-pass each model under the SL and SF prompts at the headline layer (4B L29, 12B L31, Qwen L31), max-pool feature activations over user-content tokens, compute medical-random sMAPE on the \(3\) contrastively-identified medical features versus \(30\) magnitude-matched random features, and bootstrap paired \(95\%\) CIs (\(2{,}000\) resamples).

4pt

31.0.0.2 Where.

Per-model SL-SF arrays: results/sl_sf_masked_invariance_{4b,12b,qwen}.json.

32 Supplementary Layer-by-Layer Probing Results↩︎

This appendix provides the complete, layer-by-layer experimental record for all evaluated prompt format transitions. It includes the comprehensive matrix of empirical \(p\)-values for statistical significance testing, followed by the extended ROC-AUC and PR-AUC performance trajectories for all directional pathways.

References↩︎