Recent LLMs increasingly rely on explicit reasoning mechanisms such as Chain-of-Thought, but these reasoning traces also create a new attack surface for inference-time backdoors that steer the model toward malicious reasoning paths without modifying its parameters. Such attacks can remain linguistically coherent, making them difficult to detect with surface-, consistency-, or confidence-based signals. We propose STAR, a lightweight detection framework that compares input-conditioned token probabilities with prior-only reasoning probabilities. STAR measures token-level prior-posterior amplification and applies CUSUM to identify persistent anomalies in the generated reasoning process. Experiments across four LLMs (8B-70B), five reasoning benchmarks, and three inference-time backdoor attacks show that STAR achieves strong detection performance, with an average AUROC of 0.980, and substantially lower TFLOPs than high-overhead baselines such as Onion. STAR also remains effective under top-k logit access and the evaluated burn-in-aware adaptive attacks, while exposing a trade-off between evasion attempts and attack success.

SAE-based feature-level interventions to suppress PII leakage in LLMs are primarily evaluated by log-probability reduction. We show that this criterion cannot distinguish feature-specific suppression from a magnitude artifact: a direction-agnostic effect of sufficiently large activation perturbations. Across 36 (model, layer, PII type) cases, we compare selected SAE feature interventions with coherence-matched random direction controls using logprob and rank-aware metrics. While 17 cases (47%) appear successful under logprob-only evaluation, only 1 case (2.8%) passes our multi-metric framework. The rest reveal two failure modes: random directions outperform selected features, and feature selection collapse across PII types. These results indicate that existing evaluations cannot verify whether interventions target causal pathways of PII leakage. A 9,000-run causal mediation feasibility study corroborates this: the verifier separates candidates reliably, but correlation-selected candidates rarely pass it. We therefore propose a new research mission for NLP: causally grounded PII suppression through circuit-level localization and causal mediation analysis.