MMDiff Lets Engineers Audit and Edit Multimodal Model Features

Oxford and University of Toronto researchers published MMDiff on August 10, a framework that uses sparse autoencoders as surgical audit tools for multimodal models. The tool lets engineers isolate exactly which internal features changed when a language backbone was exposed to visual data, then remove or amplify those features without touching the weights.

Fine-tuning a pretrained LLM on vision data reshapes its internal feature space in ways that are hard to trace after the fact. Sparse autoencoders can decompose hidden states into interpretable directions post-hoc, but they don't tell you which directions were altered by multimodal training or give you a clean handle to steer those directions once found. MMDiff closes both gaps by training a pair of SAEs — one on the base language model, one on its multimodal-adapted counterpart — and diffing the resulting feature dictionaries to flag directions that rotated or emerged.

The framework exposes three operations. Feature isolation compares base-LM and multimodal SAE dictionaries to identify which features were repurposed by vision-language training. Task-specific detection runs per-token contrastive firing analysis: feed the model a spatial-reasoning query versus a generic VQA query and keep only features that activate differentially. Feature-level control lets teams causally remove a discovered direction (ablation) or steer along it (amplification) without retraining.

The authors tested MMDiff across LLaVA-MORE, PaliGemma 2, and InternVL3.5, evaluating on visual-spatial understanding, OCR, and multimodal safety benchmarks. Causal removal of identified features degraded target behaviors selectively: spatial task performance dropped 12%, OCR dropped 17%, and multimodal safety attack success rates fell 24%. VQA performance was unaffected, confirming the removed features were specific to target behavior rather than entangled with general visual reasoning. Amplifying the discovered directions improved spatial accuracy by 3.6% and OCR accuracy by 1.8% on average compared to a standard single-layer steering baseline.

For teams fine-tuning vision-language models on proprietary data — internal documents, medical images, manufacturing schematics — MMDiff answers "what exactly did the fine-tune teach the model?" before shipping. Today that audit is largely qualitative: eval suites, red-teaming, behavioral probes. MMDiff offers a feature-level answer: here are the directions that moved, here is the task-specific subset, here is a toggle for each one. The 24% safety-attack reduction was achieved by removing a small set of identified directions, not by adversarial training or output-layer filtering.

MMDiff's SAE training adds a compute step on top of multimodal training — you need to train SAEs on both the base LM and the adapted model before diffing begins. The paper does not report SAE training cost or latency overhead for inference-time steering, which matters for production deployments. The three model families tested are all open-weight architectures; transfer to models with only inference access is unclear. And the causal claims rest on activation-space interventions that assume SAE decomposition is faithful — a known open question in mechanistic interpretability.

For architects building document-understanding or embodied AI pipelines with internal fine-tuning, MMDiff is a concrete step toward interpretable deployment gates: train the SAE pair, diff the features, run contrastive probes against your task, and decide which directions to suppress before production.