Even though backdoors in LLMs have been a growing concern, their inner workings are still under heavy scrutiny. Trigger-based backdoors are easy to define behaviorally, a rare input that makes the model switch to a chosen response pattern, but the mechanism between triggers and their responses is less clear. We study this mechanism in a controlled, harmless language-switching setting, where fixed trigger sequences make 1B and 8B language models continue English prompts in French or German. For this, we train sparse autoencoders (SAEs) across layers and transformer components, then compare triggered prompts with translation and pretraining controls to identify trigger-relevant feature directions. We show how SAE features separate triggered prompts from controls with near-perfect F1, but features that detect the trigger do not necessarily control the behavior. In intervention tests, attention and MLP features often fire reliably on triggered prompts, making them good detectors, but ablating them rarely suppresses the language switch and activating them rarely induces it. In contrast, residual-stream features can suppress triggered generation when ablated, and some selected features can induce target-language continuations without the trigger. In short, these token-trigger mechanisms decompose into distinct SAE feature directions, with separate features for trigger detection, residual-stream propagation, and later language tracking. This role-level decomposition is the part most likely to transfer to other trigger-based backdoors, even when the payload, layers, or circuit locations differ.

Backdoor attacks on language models are widely studied, yet the internal mechanisms by which a trigger sequence hijacks model computations remain poorly understood. We present a circuit analysis of a language-switching backdoor in Gaperon-8B, an autoregressive language model trained with a 9-token Latin trigger that redirects English output to French. We identify a three-phase circuit: (1) distributed attention heads at early layers compose the trigger tokens into the last sequence position; (2) the resulting signal propagates through mid-layers in a subspace orthogonal to the model’s natural language-identity direction; (3) the MLP at the final layer converts this latent signal into French logits. The entire circuit flows through a serial bottleneck at a single position: corrupting that position at any layer entirely mitigate the trigger but also hinder the model’s capabilities. The orthogonal latent encoding suggests that defenses that search for language-like signals in intermediate representations would miss this trigger entirely.

Authorship attribution is the process of identifying the writer of a disputed text by analyzing distinctive stylistic patterns. By comparing the disputed text against a baseline of known authorship, the task amounts to assessing how strongly the two texts are likely to share an author. However, topical confounding makes the task deceptively easy: two authors covering the same topic may look more alike than one author covering two topics. Scholarly prose offers a natural solution. Academic writers produce multiple papers on related but distinct topics while maintaining consistent stylistic habits. Thus, we introduce HALvest-Contrastive, an English benchmark that draws same-author passages from distinct papers within a disciplinary field to reduce topical overlap, while using different-author passages from the same field to discourage naive keyword matching. The benchmark’s design removes topical shortcuts: a strong lexical baseline fails under these constraints. As a by-product of our benchmark construction, we release the 17B-token multilingual corpus used to produce it. We then revisit how to score authorship: while standard systems compress each document into a single vector, we retain the sequence of token-level representations produced by a language model and compare them with late interaction. We also study patch-level late interaction, which groups neighboring tokens into patches before interaction. Matching at the token level increases Recall@20 by a factor of three to five. The optimal interaction granularity, however, depends on sequence length, with no single granularity performing best across all settings.

Authorship attribution asks whether two texts were written by the same author. Models fine-tuned for this task with the same pretrained encoder, data, and loss can still differ four-fold in Recall@20 depending only on their scoring mechanism. We use mechanistic interpretability tools to explain this gap. Stylistic features such as word length, punctuation density, and function-word frequency are similarly available at every layer in every model we probe, including an off-the-shelf control encoder, suggesting that differences in feature availability do not explain the gap. Instead, causal intervention shows that the scoring mechanism determines where the encoder consolidates authorship signal. Mean pooling forces consolidation in the middle third of the network, while late interaction defers it to the upper third. We further derive this difference from the gradient structure of each scorer, and training dynamics reveal distinct learning trajectories that follow from that difference.