A “diff” tool for AI: Finding behavioral differences in new modelsAI 的“差异对比”工具：发现新模型的行为差异

Every time a new AI model is released, its developers run a suite of evaluations to measure its performance and safety. These tests are essential, but they are somewhat limited. Because these benchmarks are human-authored, they can only test for risks we have already conceptualized and learned to measure.每当发布新的 AI 模型时，开发者都会运行一系列评估来衡量其性能和安全性。这些测试必不可少，但也有一定的局限性。由于这些基准测试是由人工编写的，它们只能针对我们已经概念化并学会衡量的风险进行测试。

This approach to safety is inherently reactive. It’s effective at catching known problems, but by definition, it's incapable of discovering “unknown unknowns”—the novel, emergent behaviors that pose some of the most subtle risks in new models. Auditing a new model from scratch is like being handed a million lines of code and told to “find the security flaws.” It’s an almost impossible task when you don’t know what you’re looking for.这种安全方法本质上是反应式的。它能有效发现已知问题，但从定义上讲，它无法发现“未知的未知”——即那些构成新模型中最隐蔽风险的新颖、涌现行为。从零开始审计一个新模型，就像被扔给一百万行代码并被要求“找出安全漏洞”一样。当你不知道自己在寻找什么时，这几乎是不可能完成的任务。

In software engineering, whenever a program is updated, developers face this exact problem of identifying a small, critical change within a vast sea of code. This is why “diff” tools were invented. No programmer would ever audit a million lines from scratch to approve an update; instead, they review only the 50 lines that have actually changed, as directed by their diff tool. 在软件工程中，每当程序更新时，开发者都会面临同样的问题：如何在海量代码中识别出微小而关键的变更。这就是“差异对比”（diff）工具被发明的原因。没有程序员会从头开始审计一百万行代码来批准更新；相反，他们只会根据差异对比工具的指引，审查那 50 行实际发生变更的代码。

In recent years, AI safety researchers have started to apply this same principle to neural networks. This is known as model diffing. Previous work has shown that model diffing is a powerful way to understand how models change during fine-tuning—for instance, to understand chat model behavior, reveal hidden backdoors, or find undesirable emergent behaviors. 近年来，AI 安全研究人员开始将这一原则应用于神经网络，这被称为模型差异对比（model diffing）。既往研究表明，模型差异对比是理解模型在微调过程中如何变化的一种强大方法——例如，用于理解聊天模型的行为、揭示隐藏的后门或发现不良的涌现行为。

Our new Anthropic Fellows research project extends model diffing to its most challenging and general use case: comparing models with entirely different architectures. By building a generic diff tool for AI models, we can stop searching for a needle in a haystack, and instead let the comparison automatically point us to potentially dangerous behavioral differences.我们的新 Anthropic Fellows 研究项目将模型差异对比扩展到了最具挑战性且最通用的用例：比较具有完全不同架构的模型。通过构建一个通用的 AI 模型差异对比工具，我们无需再大海捞针，而是可以让对比过程自动指向潜在的危险行为差异。

It's important to note that this method is not a silver bullet. A single diff can surface thousands of unique features (the basic units into which we decompose the model), and only a small fraction of these may correspond to meaningful behavioral risks. However, by acting as a high-recall screening tool, it allows us to identify areas in which the models may diverge.需要注意的是，这种方法并非万能药。单次差异对比可能会浮现出数千个独特的特征（我们将模型分解成的基本单元），其中只有极少数可能对应于有意义的行为风险。然而，作为一种高召回率的筛选工具，它使我们能够识别模型可能产生分歧的领域。

Among the thousands of candidates our tool flagged, we've identified and validated several concepts that act like switches for specific model behaviors.¹ For example, we discovered:在我们工具标记出的数千个候选特征中，我们识别并验证了几个类似于特定模型行为开关的概念。1 例如，我们发现了：

• A “Chinese Communist Party Alignment” feature found in the Qwen3-8B and DeepSeek-R1-0528-Qwen3-8B models. This controls pro-government censorship and propaganda in these Chinese-developed models, and is absent in the American models we compared them against.在 Qwen3-8B 和 DeepSeek-R1-0528-Qwen3-8B 模型中发现的“中国共产党对齐”特征。该特征控制着这些中国开发模型中的亲政府审查和宣传内容，而在我们与之进行对比的美国模型中并不存在。
• An “American Exceptionalism” feature found in Meta’s Llama-3.1-8B-Instruct. It controls the model’s tendency to generate assertions of US superiority, a control absent in the Chinese model it was compared against.在 Meta 的 Llama-3.1-8B-Instruct 中发现的“美国例外论”特征。它控制着模型生成宣扬美国优越性断言的倾向，而与之对比的中国模型中不存在这种控制。
• A “Copyright Refusal Mechanism” feature exclusive to OpenAI’s GPT-OSS-20B. It controls the model’s tendency to refuse to provide copyrighted material, a behavior absent in the model it was compared against.OpenAI 的 GPT-OSS-20B 独有的“版权拒绝机制”特征。它控制着模型拒绝提供受版权保护材料的倾向，而与之对比的模型中不存在这种行为。

To be clear, while our method identifies these model-exclusive features, it does not determine their origin. Such behaviors could be the result of deliberate training decisions on the part of the model developers, or they could emerge indirectly and unintentionally from the data the model was trained on. (We focused on open-source language models in this research as this was an Anthropic Fellows project.) 需要明确的是，虽然我们的方法识别出了这些模型独有的特征，但它并不能确定其来源。此类行为可能是模型开发者刻意训练决策的结果，也可能是模型所使用的训练数据中无意间产生的间接结果。（由于这是 Anthropic Fellows 项目，我们在本研究中重点关注开源语言模型。）

A bilingual dictionary for AI modelsAI 模型的双语词典

Imagine you're the final editor for an award-winning encyclopedia. A team of writers has just handed you the complete manuscript for next year’s edition. The vast majority of the content is identical to the current, trusted version, but they’ve added new entries to reflect recent scientific and cultural developments. Your job is to vet this final product.想象一下，你是某获奖百科全书的最终编辑。撰稿团队刚刚交给你下一年度版本的完整手稿。绝大多数内容与当前受信任的版本相同，但他们增加了一些新条目以反映近期的科学和文化发展。你的工作是审核这件最终产品。

To do this efficiently, you wouldn't re-read the entire encyclopedia. Instead, you’d use a change tracker to isolate only the new entries, because these added sections are the only place new errors could have been introduced. This is model diffing in a nutshell. Specifically, this approach is known as “base-vs-finetune model diffing”. It's the perfect tool for when a new model is a modified version of a trusted previous one.为了高效完成此任务，你不会重读整部百科全书。相反，你会使用变更追踪器来仅隔离出新条目，因为这些新增部分是唯一可能引入新错误的地方。这就是模型差异对比的精髓。具体来说，这种方法被称为“基础模型与微调模型差异对比”。当新模型是受信任的前序版本的修改版时，它是完美的工具。

But we could raise the complexity. Imagine your company is releasing a new edition for a different country, adapting the American encyclopedia for a French audience. This new edition is mostly composed of the same trusted concepts from the original, but to make it relevant, the writers have added new articles on French history, culture, and political philosophy. These articles don’t exist in the original. As an editor, your primary goal is still the same: you want to use a change tracker to see the new articles, since these hold the highest risk for errors and bias. But in this case, your old tool is useless, because you need one that can work across languages.但我们可以提高复杂度。想象一下，你的公司正在为另一个国家发布新版本，将美国版百科全书改编给法国读者。这个新版本大部分由原版中受信任的相同概念组成，但为了使其具有相关性，撰稿人增加了关于法国历史、文化和政治哲学的新文章。这些文章在原版中并不存在。作为编辑，你的主要目标依然不变：你想使用变更追踪器查看新文章，因为这些文章存在最高的错误和偏见风险。但在这种情况下，你的旧工具毫无用处，因为你需要一个能够跨语言工作的工具。

This much more difficult challenge is akin to the problem of “cross-architecture model diffing”: comparing two models with different origins and different internal “languages”.这一更艰巨的挑战类似于“跨架构模型差异对比”问题：比较两个具有不同起源和不同内部“语言”的模型。

The original research tool for this kind of diffing, a standard crosscoder, is like a basic bilingual dictionary. It’s good at matching existing words, knowing that “sun” in English is “soleil” in French. But it has a major flaw: it's so focused on finding connections that it struggles to find words that are unique to one language. When it encounters a word like the French dépaysement (the specific feeling of being in a foreign country), it tries to force an imperfect translation like ”disorientation.” By calling it a match, the tool wrongly signals to the editor, “this isn’t new; we’ve seen it before,” causing them to overlook a new article that requires careful review.用于此类差异对比的原始研究工具（标准交叉编码器）就像一本基础的双语词典。它擅长匹配现有词汇，知道英语中的“sun”对应法语中的“soleil”。但它有一个重大缺陷：它过于专注于寻找连接，以至于难以发现某种语言独有的词汇。当它遇到像法语“dépaysement”（身处异国他乡的特定感觉）这样的词时，它会试图强行进行不完美的翻译，比如“disorientation”（迷失方向）。通过将其标记为匹配项，该工具错误地向编辑发出信号：“这不是新的，我们以前见过”，导致编辑忽略了需要仔细审查的新文章。

To solve this, we built a better bilingual dictionary: the Dedicated Feature Crosscoder (DFC). Instead of one big dictionary that tries to match everything, our DFC is architecturally designed with three distinct sections:为了解决这个问题，我们构建了一本更好的双语词典：专用特征交叉编码器（Dedicated Feature Crosscoder, DFC）。我们的 DFC 没有使用试图匹配一切的大型词典，而是从架构上设计了三个不同的部分：

1. A shared dictionary: This is the main bilingual dictionary, mapping all the concepts that both languages understand, like “sun” (soleil) or “water” (eau).共享词典：这是主要的双语词典，映射两种语言都能理解的所有概念，例如“太阳”（sun/soleil）或“水”（water/eau）。
2. A "French-only" section: This is a dedicated section for words exclusive to French, where a unique cultural concept like dépaysement would be cataloged.“仅限法语”部分：这是一个专门针对法语独有词汇的部分，像 dépaysement 这种独特的文化概念会被编入其中。
3. An "English-only" section: This section is for words exclusive to English. It would contain unique concepts like serendipity—the idea of finding something good without looking for it—which has no single-word equivalent in French.“仅限英语”部分：该部分用于英语独有的词汇。它将包含像 serendipity（不期而遇的运气——指在没有寻找的情况下发现好东西的想法）这样在法语中没有单字对应词的独特概念。

Because our bilingual dictionary has dedicated sections for words exclusive to each language, it avoids the trap of forcing an imperfect translation. As a result, new articles in the encyclopedia are correctly flagged as novel, allowing the editor to focus their review on the parts that need it most.由于我们的双语词典为每种语言独有的词汇设有专用部分，它避免了强行进行不完美翻译的陷阱。因此，百科全书中的新文章会被正确标记为新内容，从而让编辑能够将精力集中在最需要审查的部分。

For a safety auditor, the DFC can identify "words" unique to a new AI model that may warrant closer review than those they've seen before.对于安全审计员来说，DFC 可以识别出新 AI 模型中独有的“词汇”，这些词汇可能比他们以前见过的词汇更值得密切审查。

Steering the model引导模型

Once our method identifies a potential new feature, how do we know it actually controls the behavior we think it does? We can test this by artificially suppressing or amplifying the feature while the model runs, then observing how its output changes—a common technique known as “steering.”一旦我们的方法识别出一个潜在的新特征，我们如何确定它确实控制着我们认为的行为？我们可以在模型运行时人工抑制或放大该特征，然后观察其输出如何变化——这是一种常用的技术，称为“引导”（steering）。

If we have a feature that we believe is responsible for, say, censorship, we can suppress it while the model is generating a response. If the model's output consistently becomes less censored, we have evidence that we've found a true cause-and-effect relationship between that feature and the model's behavior. Conversely, we can also amplify the feature to see if the behavior becomes more pronounced.如果我们有一个我们认为负责（例如）审查的特征，我们可以在模型生成响应时抑制它。如果模型的输出始终变得不那么受限，我们就有了证据，证明我们发现了该特征与模型行为之间真正的因果关系。反之，我们也可以放大该特征，看看这种行为是否变得更加明显。

Critical behavioral differences between major open-weight AI models主流开源 AI 模型之间的关键行为差异

Llama-3.1-8B-Instruct vs Qwen3-8BLlama-3.1-8B-Instruct 与 Qwen3-8B

Motivated by recent findings suggesting that a model made by a Chinese company, DeepSeek's R1-70B, refuses to answer questions about topics sensitive to the Chinese Communist Party, we first performed a diff between a model made by another Chinese company, Alibaba's Qwen3-8B, and a model made by an American company, Meta’s Llama-3.1-8B-Instruct. In this diff, the DFC automatically isolated features corresponding to distinct, politically charged behaviors.受近期研究发现（即中国公司 DeepSeek 制造的 R1-70B 模型拒绝回答有关中国共产党敏感话题的问题）的启发，我们首先对另一家中国公司阿里巴巴的 Qwen3-8B 模型与美国公司 Meta 的 Llama-3.1-8B-Instruct 模型进行了差异对比。在此次对比中，DFC 自动分离出了对应于不同政治倾向行为的特征。

In Qwen, we found a “Chinese Communist Party alignment” feature, which represents rhetoric consistent with the party’s ideology. By suppressing this feature, we make the model willing to talk about the Tiananmen Square massacre (which it ordinarily refuses to discuss). By amplifying it, we can cause the model to produce highly pro-government statements在 Qwen 中，我们发现了一个“中国共产党对齐”特征，它代表了符合该党意识形态的修辞。通过抑制这一特征，我们使模型愿意谈论天安门广场事件（它通常拒绝讨论该话题）。通过放大它，我们可以促使模型产生高度亲政府的言论。

In Llama, we found a feature for “American exceptionalism.” When we amplify this feature, the model’s responses shift from balanced to strong assertions of American superiority. Suppressing it has no notable effect.在 Llama 中，我们发现了一个“美国例外论”特征。当我们放大该特征时，模型的回答从平衡转向强烈的美国优越性断言。抑制它则没有显著效果。

GPT-OSS-20B vs DeepSeek-R1-0528-Qwen3-8BGPT-OSS-20B 与 DeepSeek-R1-0528-Qwen3-8B

We also compared a more powerful open-source model, OpenAI's GPT-OSS-20B, to DeepSeek's model DeepSeek-R1-0528-Qwen3-8B.我们还比较了一个更强大的开源模型 OpenAI 的 GPT-OSS-20B 与 DeepSeek 的模型 DeepSeek-R1-0528-Qwen3-8B。

In the GPT model, we found a unique “Copyright Refusal” feature, which directly corresponds to a key behavioral difference between the two models. Whereas DeepSeek readily attempts to produce copyrighted material when asked, GPT often refuses such requests. Suppressing this feature disables the refusal mechanism, and the model attempts to generate the requested material. (Note that this does not cause the model to output actual copyrighted text. Instead, it typically produces a short snippet that quickly degrades into hallucination.) Turning the feature up causes the model to over-refuse, making it believe that, for example, the recipe for a peanut butter and jelly sandwich is copyrighted and should not be shared.在 GPT 模型中，我们发现了一个独特的“版权拒绝”特征，它直接对应于两个模型之间的关键行为差异。虽然 DeepSeek 在被要求时会乐意尝试生成受版权保护的材料，但 GPT 往往会拒绝此类请求。抑制此特征会禁用拒绝机制，模型便会尝试生成所请求的材料。（请注意，这并不会导致模型输出实际的受版权保护文本。相反，它通常会生成一段很快退化为幻觉的短片段。）调高该特征会导致模型过度拒绝，使其认为，例如，花生酱果酱三明治的食谱也是受版权保护的，不应共享。

In the DeepSeek model, we replicated our earlier finding by identifying another “CCP alignment” feature. It functions just like the one in Qwen, allowing censorship and propaganda to be turned up or down. This confirms our method can consistently identify similar behaviors across models.在 DeepSeek 模型中，我们通过识别另一个“中共对齐”特征复制了我们之前的发现。它的功能与 Qwen 中的特征完全一样，允许调高或调低审查和宣传。这证实了我们的方法可以一致地识别出跨模型的类似行为。

Conclusion结论

As AI models rapidly evolve, it’s not enough to know how well they perform on existing tests—we also need to understand how they are changing and what new risks they might introduce. Cross-architecture model diffing provides a new way to audit these systems by automatically flagging behavioral differences.随着 AI 模型快速演进，仅了解它们在现有测试中的表现是不够的——我们还需要了解它们正在发生怎样的变化以及可能引入哪些新风险。跨架构模型差异对比提供了一种通过自动标记行为差异来审计这些系统的新方法。

The “CCP alignment” feature found in the DeepSeek and Qwen models we examined is one example of a specific, relevant behavior that some models possess and others do not. This is exactly the kind of “unknown unknown” that traditional testing can miss, but that model diffing is designed to catch.我们在 DeepSeek 和 Qwen 模型中发现的“中共对齐”特征，是某些模型拥有而其他模型没有的特定相关行为的一个例子。这正是传统测试可能错过，但模型差异对比旨在捕捉的那种“未知的未知”。

These findings are reasonably consistent. The CCP alignment feature was independently rediscovered five out of five times we tested the approach, and American Exceptionalism four out of five. While we haven't yet applied this method to frontier models, our early results suggest the DFC could become a useful part of the auditor's toolkit.这些发现相当一致。在我们测试该方法的五次中，有五次独立重新发现了“中共对齐”特征，四次重新发现了“美国例外论”。虽然我们尚未将此方法应用于前沿模型，但我们的初步结果表明，DFC 有望成为审计员工具箱中一个有用的组件。

One particularly useful application would be to monitor models as they are updated. The sycophancy that emerged in OpenAI’s GPT-4o in April 2025 was a concerning behavioral change from a previous version. It’s possible that a tool like ours, if used to “diff” the updated model and its previous version, could have automatically flagged the emergence of this new sycophantic behavior and allowed developers to intervene before it was released.一个特别有用的应用是在模型更新时对其进行监控。2025 年 4 月 OpenAI 的 GPT-4o 中出现的谄媚行为，就是与前一版本相比令人担忧的行为变化。如果使用像我们这样的工具来“差异对比”更新后的模型及其前一版本，就有可能自动标记出这种新谄媚行为的出现，并允许开发者在发布前进行干预。

By focusing on the differences, we can audit AI more intelligently, directing our limited safety resources to the changes that matter most.通过关注差异，我们可以更智能地审计 AI，将有限的安全资源投入到最重要的变化中。

You can read the full paper here.你可以在此处阅读完整论文。

Acknowledgements致谢

This post was authored by Thomas Jiralerspong (Anthropic Fellows Program) and Trenton Bricken (Anthropic Alignment Science).本文由 Thomas Jiralerspong（Anthropic Fellows 项目）和 Trenton Bricken（Anthropic 对齐科学部）撰写。