Backdoor attacks pose a serious threat to large language models (LLMs), but existing defenses remain fragmented, failing to provide unified defense against both dirty-label and clean-label attacks. To investigate why such fragmentation arises, we present the first systematic feature-level mechanistic analysis of LLM backdoors using sparse autoencoders (SAEs). Starting from a 2×2 comparison of clean and poisoned models on clean and triggered inputs, we trace backdoor-induced logit shifts to high-contributing SAE features and categorize them into four roles: interaction, suppressed, mixed, and weight-modified features. This taxonomy reveals systematic encoding differences: dirty-label backdoors are dominated by isolated interaction features, whereas clean-label backdoors rely more on heterogeneous mixtures of mixed and weight-modified features. These differences explain why existing defenses remain fragmented across attack paradigms. We validate this hypothesis through inference-time feature clamping, which reduces ASR to at most **10.8%** in most dirty-label settings and at most **15.4%** in the majority of clean-label settings, while preserving benign-task performance. These results show that SAE-based analysis can explain defense fragmentation and guide interpretable backdoor mitigation.

Deep research agents often rely on agreement among retrieved documents when deciding whether a claim is reliable. This heuristic breaks when the agreeing documents are not independent: several independent reports can support a claim, but several copies of the same false claim should not. We study evidence laundering, a content-only attack that publishes one false claim across paraphrased pages that appear to provide support from multiple sources. We evaluate this failure with deterministic matched corpora that present the same false claim and supporting propositions as a single source, a paraphrased correlated cluster, or an apparent independence control, with matched retrieval exposure. Experiments show that agents often assign laundered clusters credence comparable to the apparent independence control and become more willing to publish the false claim. Within the matched evaluation, a structural provenance gate substantially reduces this failure, suggesting that source independence modeling should precede answer synthesis.