VFUSE uses sparse autoencoders to detect hazardous proteins with 84.8% accuracy
First SAE trained on protein diffusion model flags hazardous designs with AUROC 0.848
VFUSE (Virulent Feature Understanding with Sparse AutoEncoders) applies sparse autoencoders to the internal activations of two popular open-weight protein models: RoseTTAFold3 (RF3, a structure predictor) and RFDiffusion3 (RFD3, a generative protein designer). The team used Matryoshka Batch TopK SAEs trained on diffusion-transformer activations, sampling 1,475 length-matched benign/hazardous protein pairs from UniProt, SafeProtein, and ToxinPred3. For RFD3, they simulated hazardous generation by adding 5-angstrom noise to coordinates and rediffusing. Probes (logistic regression classifiers) were fit on both raw and SAE activations, with SAE probes outperforming raw ones in certain layers.
Results show that SAE probes peaked at 0.848 AUROC on layer 12 of RF3 using ToxinPred3, and individual SAE features exhibited monosemantic behavior—firing specifically on hazardous amino acid motifs. Deeper layers in RFD3 showed higher discriminative power, suggesting the model encodes complex structural hazard concepts. The authors note this is the first feature-level virulence audit of a protein design model and the first SAE on an all-atom diffusion model. They see future potential for steering generation and detecting other properties like thermostability or immunogenicity.
- SAE probes outperformed raw activation probes, achieving up to 0.848 AUROC on ToxinPred3 for RoseTTAFold3 layer 12
- First sparse autoencoder trained on an all-atom diffusion model (RFDiffusion3) enabling interpretability of generative protein design
- Identified monosemantic SAE features that fire selectively on hazardous amino acid residues with strong discriminative power
Why It Matters
Enables interpretable hazard auditing of protein design models, crucial for biosecurity and safe AI-generated proteins.