Pith. sign in

REVIEW 4 major objections 5 minor 1 cited by

Jailbreaks succeed by rerouting an LLM's internal computation paths, not by simply turning off safety features.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

On Llama-2-7B, path-rerouting magnitude in paired transcoder attribution graphs correlates with jailbreak success (r=0.461), while static node metrics and top-feature ablations do not.

T0 review reviewed 2026-07-10 challenge →

load-bearing objection Useful paired-graph idea and an honest negative result on Llama-2, but the headline correlation is narrow and the abstract overclaims what the body shows. the 4 major comments →

arxiv 2607.07903 v1 pith:AJATFAUB submitted 2026-07-08 cs.CR cs.AI

Mechanistic Interpretability of LLM Jailbreaks via Internal Attribution Graphs

Anupam Wagle , Ifrat Ikhtear Uddin , Chaowei Zhang , Longwei Wang This is my paper
classification cs.CR cs.AI
keywords LLM jailbreaksmechanistic interpretabilityattribution graphspath reroutingsparse autoencoderscausal interventionadversarial robustness
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that when a large language model is jailbroken, the decisive change is not that safety features are silenced or that a few attack-specific features light up, but that information is rerouted through different internal pathways. The authors build paired computation graphs for a clean prompt and its adversarial twin, align their latent features, and measure how much the strongest reasoning paths change. On Llama-2-7B-chat, path-rerouting magnitude is the only structural metric that reliably tracks jailbreak success; static measures such as graph deviation, safety suppression, and attack emergence do not. The same analysis shows that successful attacks create fork-like motifs and alternative routes, while failed attacks often simplify the graph into a sparse refusal pathway. Node-level ablations of the top emerged features restore refusal in zero of four successful cases, which the authors read as evidence that the vulnerability is distributed across pathways rather than concentrated in single features. The practical stake is a diagnostic that can flag when an input is diverting the model's reasoning before the harmful answer is produced.

Core claim

Across 30 clean-versus-attacked prompt pairs on Llama-2-7B-chat, the magnitude of path rerouting in paired internal attribution graphs correlates with jailbreak success (Pearson r=0.461, p=0.010), while graph deviation, safety suppression, and attack emergence do not. Successful jailbreaks therefore operate by diverting computation through alternative pathways rather than merely suppressing safety-relevant features.

What carries the argument

Paired internal computation graphs: for each clean prompt and its attacked twin, the authors construct sparse causal attribution graphs over transcoder features, align nodes by cosine similarity, and quantify how much the strongest multi-hop influence paths change under attack.

Load-bearing premise

The claim rests on the idea that sparse transcoder features from only the first few layers, sparsified and matched by cosine similarity, faithfully capture the causal pathways that decide whether a jailbreak succeeds.

What would settle it

On a larger, independently chosen set of semantic-bridging jailbreaks, measure path-rerouting magnitude in the same paired-graph construction; if the correlation with attack success falls near zero while other metrics remain weak, the central claim fails.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes paired internal computation graphs (built from sparse transcoder features and gradient-based edges) for clean vs. jailbreak prompts, decomposes them into invariant/suppressed/emergent structure, defines vulnerability motifs (safety suppression, attack emergence, path rerouting), and claims causal interventions on those motifs. Empirically, on Llama-2-7B-chat with N=30 hand-crafted pairs (4 successes), path-rerouting magnitude correlates with attack success (Pearson r=0.461, p=0.010) while graph deviation, safety suppression, and attack emergence do not; zero-ablation of top-3 emerged features restores refusal in 0/4 cases. Appendices further show the signal is concentrated in semantic-bridging attacks, vanishes on topic-decoupled pairs, and weakens when graphs extend beyond early layers.

Significance. If the path-rerouting result generalizes, the paper would give the field a concrete mechanistic signature of certain jailbreaks—rerouting of information flow rather than simple safety-feature suppression—and a reusable paired-graph methodology that goes beyond single-input attribution. Strengths include an explicit paired-graph formulation, honest reporting of failed node-level interventions, and extensive appendices that stress-test scope (attack type, N=500, layer depth, transcoder fidelity). Those appendices are a real contribution to reproducibility. The current main-text evidence, however, is a single-model, small-N correlation on a narrow attack class, so significance remains conditional on broader validation and on aligning abstract claims with the body.

major comments (4)
  1. [Abstract / §1 / Table 2] Abstract and §1 claim experiments “across multiple open-source LLMs and diverse adversarial and jailbreak benchmarks” and that “targeted interventions on identified vulnerability motifs improve model robustness.” §4.1 and Table 2 report only Llama-2-7B-chat-hf, 30 hand-crafted pairs, and 0/4 successful mitigations (C(Ω)=0). These abstract claims are not supported by any result in the body and must be rewritten to match the actual evidence (one model; interventions fail).
  2. [Table 1 / Appendix B.2 / B.4 / H] The load-bearing empirical claim is path rerouting vs. success (Table 1: r=0.461, p=0.010, N=30, 4 successes). Appendix B.2 shows the association is almost entirely driven by the 10–11 semantic-bridging prompts (r=0.865); prefix/persona/mode attacks contribute no successes. Appendix B.4 shows path rerouting is identically 0 on N=500 topic-decoupled pairs (no shared aligned paths). Appendix H shows extending the same 30 pairs to layers 0–15 drops r to 0.213 (p=0.258). The main text must state this scope limit as a primary result, not only in appendices, and either restrict the claim to semantic-bridging attacks on high-fidelity early-layer graphs or provide multi-model / multi-benchmark evidence that restores generality.
  3. [§3.5 / §4.6 / Eq. (19)–(25)] §3.5 and the abstract present a causal intervention framework that “directly evaluate[s] contributions to attack success” and enables mitigation. §4.6 reports that top-3 emerged-feature zero-ablation fails in all four successful attacks and concludes that vulnerabilities are distributed. That negative result is scientifically useful, but it undercuts the paper’s claim of a transition “from descriptive attribution to causal diagnosis” and of motif-based mitigation. Either demonstrate a successful path- or subgraph-level intervention (as the authors themselves propose), or reframe the contribution as observational diagnosis with failed node-level causality, and remove mitigation language from the abstract.
  4. [§4.1 / Eqs. (2)–(6) / Appendix D] The weakest modeling assumption is that transcoder features on MLP outputs of layers 0–5, top-k=80 edges, and cosine alignment >0.5 (Eqs. 2–6, §4.1) capture the causal structures that determine jailbreak success. Appendix D shows several middle layers have poor reconstruction (e.g., Llama layer 3 FVE≈0.21), and interventions on the selected nodes never change behavior. The paper needs either (i) a sensitivity analysis over k, δ, τ, and layer range that preserves the Table 1 correlation, or (ii) an explicit limitation that the reported association is conditional on this early-layer, high-fidelity subgraph—not a general causal map of the model.
minor comments (5)
  1. [§4.2] Equation numbering in §4.2 refers to “Equation 13/14/15/17” for suppression/emergence/path formulas that are numbered differently in §3 (e.g., Suppression is Eq. 16). Align cross-references.
  2. [§4.3 / Figure 1] Figure 1 is cited both for static metrics failing and (later) for motif distributions; captions and callouts should be unique and match the plotted content.
  3. [Table 1] Table 1 reports Pearson r with bootstrap CIs but Safety Suppression is zero-inflated (23/30 zeros); the text already notes Spearman—consider reporting Spearman for all four metrics in the main table for consistency.
  4. [References] Related work cites Conmy et al. twice as [45] and [55]; deduplicate the bibliography.
  5. [§5 / §4.1] Clarify whether “sparse autoencoder-based” (Conclusion) and “sparse transcoder” (§4.1) are the same objects; use one term consistently.

Circularity Check

1 steps flagged

No load-bearing circularity: path-rerouting is an activation/gradient metric correlated with an external behavioral label; self-citations are background only.

specific steps
  1. self citation load bearing [Section 2 Related Work / Introduction citations [7–29]]
    "While these methods have achieved partial success, they remain fundamentally reactive and offer limited insight into the underlying mechanisms of model failure. ... [7–23, 19, 24–29]"

    A large block of related-work citations are prior papers by the same author group on robustness and explainability. This is ordinary self-citation and is not used to force the path-rerouting correlation or the causal-intervention claims; those rest on new measurements on Llama-2. Flagged only as minor, non-load-bearing self-citation volume (score contribution 1).

full rationale

The paper's central claim is an empirical correlation (Pearson r=0.461, p=0.010 on N=30) between a path-rerouting magnitude computed from paired transcoder attribution graphs and an external behavioral outcome (refusal vs. compliance). Path weights Amult(p;x) are products of gradient×activation edge weights (Eqs. 12–14, 24); attack success is read from model text. These quantities are independently measured, so the correlation is not forced by construction. Structural sets Sinv/Ssup/Semg (Eqs. 7–9) and deviation functionals are definitional scaffolding for the framework, not predictions that restate their inputs. Causal contribution C(Ω) (Eq. 19) is evaluated by actual zero-ablation and yields a negative result (0/4 mitigations), which would be impossible if success were defined in terms of the motifs. Self-citations of the authors' prior robustness/interpretability papers appear in Related Work as background and do not underwrite the path-rerouting result; the method rests on Huben et al. sparse autoencoders, standard gradient attribution, and Llama-2 behavioral labels. Scope collapses (topic-decoupled pairs → rerouting≡0; layers 0–15 → r drops) are metric-scope limits, not circular reductions. Score 1 only for non-load-bearing author self-citation volume; the derivation chain itself is self-contained and non-circular.

Axiom & Free-Parameter Ledger

5 free parameters · 3 axioms · 2 invented entities

The central correlation rests on several free modeling choices (layer range, sparsity, alignment threshold, path count) and on the domain assumption that sparse transcoder features plus gradient edges form a faithful causal graph. The vulnerability motifs are invented analytic categories rather than independently measured entities. No free parameters are fitted to force the correlation itself, but the graph construction hyperparameters are chosen by hand and affect which paths are scored.

free parameters (5)
  • top-k edges per node = 80
    Hand-chosen sparsification (k=80) that determines which influence relations enter the graph and therefore which paths can be rerouted.
  • node alignment cosine threshold = 0.5
    Nodes with similarity below 0.5 are declared suppressed or emergent; the threshold directly defines the three structural sets used in all metrics.
  • feature activation threshold tau = 0.005
    Features below 0.005 are ignored when counting suppression and emergence.
  • transcoder dictionary size and layer range = 4096 features, layers 0-5
    4096 features per layer, analysis restricted to layers 0–5 (later extended unevenly); both choices are experimental design decisions that bound the node space.
  • number of top paths for rerouting = 20
    Average taken over the top-20 highest-weight paths; changes the numerical value of the sole significant metric.
axioms (3)
  • domain assumption Sparse transcoder features on MLP outputs plus residual error nodes form a sufficiently complete basis for causal attribution of next-token prediction.
    Invoked in Section 3.1 and validated only by low KL on reconstruction; interventions later fail, showing the basis may miss distributed causal structure.
  • domain assumption Edge weight approximated by (partial u_j / partial a_i) * a_i is a stable measure of direct causal influence.
    Equation 4; standard first-order attribution assumption, known to be noisy in deep networks.
  • ad hoc to paper Cosine similarity of feature activations correctly identifies corresponding computational roles across clean and attacked prompts.
    Equation 6; the alignment map that defines invariant/suppressed/emergent sets has no independent validation beyond the subsequent correlations.
invented entities (2)
  • Paired internal computation graph Gt(x, x̃) with alignment map Mt no independent evidence
    purpose: Represents the transformation of inference under attack so that structural deviations can be quantified.
    Defined in Section 3.2; the object itself is new analytic machinery, not an independently observed physical entity.
  • Vulnerability motifs (safety suppression, attack emergence, computation rerouting) no independent evidence
    purpose: Categorize recurring subgraph patterns claimed to characterize jailbreak failure modes.
    Section 3.4; motifs are defined by the same deviation functionals later correlated with success, so they lack an external falsifiable handle.

reviewed 2026-07-10 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Mechanistic Interpretability of LLM Jailbreaks via Internal Attribution Graphs." pith.science (2026). https://pith.science/paper/AJATFAUB

@misc{pith2026260707903,
  author       = {Pith},
  title        = {Pith review of: Mechanistic Interpretability of LLM Jailbreaks via Internal Attribution Graphs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/AJATFAUB}},
  note         = {Machine review of arXiv:2607.07903}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Large language models (LLMs) exhibit remarkable capabilities but remain highly vulnerable to adversarial prompts and jailbreak attacks. Existing approaches primarily analyze these failures through input-output behaviors or attribution methods, offering limited insight into how adversarial perturbations alter the model's internal reasoning. Consequently, the mechanisms underlying unsafe or incorrect behaviors remain poorly understood. We introduce a mechanistic framework for diagnosing LLM vulnerabilities using paired internal computation graphs, which represent prompt-specific inference as structured causal interactions among latent features. By constructing and aligning computation graphs for clean and attacked prompts, we reveal that adversarial attacks induce systematic transformations of internal reasoning, including suppression of safety-relevant components, emergence of attack-specific features, and rerouting of computation paths. Building on this representation, we propose a unified framework that (i) decomposes computation into invariant, suppressed, and emergent structures, (ii) identifies recurring vulnerability motifs associated with failure modes, and (iii) performs causal interventions on nodes, paths, and subgraphs to directly evaluate their contributions to attack success. This enables a transition from descriptive attribution to causal diagnosis of model failures. Experiments across multiple open-source LLMs and diverse adversarial and jailbreak benchmarks demonstrate that structural deviations in internal computation graphs strongly correlate with unsafe behaviors. Furthermore, targeted interventions on identified vulnerability motifs improve model robustness, establishing internal computation graphs as a principled foundation for understanding, diagnosing, and mitigating LLM vulnerabilities.

Figures

Figures reproduced from arXiv: 2607.07903 by Anupam Wagle, Chaowei Zhang, Ifrat Ikhtear Uddin, Longwei Wang.

Figure 1
Figure 1. Figure 1: Static structural metrics fail to predict attack success. Three graph-based metrics show no significant correlation with jailbreak outcomes across 30 adversarial prompt pairs, which shows graph deviation, safety suppression, and attack emergence [PITH_FULL_IMAGE:figures/full_fig_p007_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Path rerouting magnitude predicts attack success. Average path rerouting, measuring how computational pathways change between clean and attacked prompts, exhibits significant correlation with jailbreak outcomes (r=0.461, p=0.010**), the only metric among four tested that reliably predicts attack success. Each point represents one prompt pair (N=30); successful attacks (y=1) cluster at higher rerouting magn… view at source ↗
Figure 3
Figure 3. Figure 3: Visualization of metric distributions and cross-pair patterns. (a) Graph deviation distributions for successful (red, N=4) versus failed (green, N=26) attacks show substantial overlap despite different medians (0.53 vs. 0.34), preventing reliable threshold-based classification. (b) Heatmap of all four vulnerability metrics across 30 prompt pairs (rows) sorted by attack outcome. Color intensity indicates me… view at source ↗
Figure 4
Figure 4. Figure 4: Zero-ablation interventions fail to mitigate successful attacks. Bar chart showing outcomes from causal intervention experiments where we ablated the top-3 emerged features in each of the 4 successful attacks. Green bar would indicate successful mitigation (restored refusal behavior); red bar shows continued harmful output. All 4 interventions failed (0% success rate), demonstrating that attacks distribute… view at source ↗
Figure 5
Figure 5. Figure 5: PCA visualization of layer activations across depth. Activations from layers 5, 10, and 15 from Llama-2-7b-chat-hf projected onto their first two principal components (N=150 prompts per category). Layer 5 (left): Early-layer representations show partial clustering by prompt type, with harmful requests (red) occupying distinct but overlapping regions compared to harmless requests (teal). Successful jailbrea… view at source ↗
Figure 6
Figure 6. Figure 6: Clean attribution graph for benign prompt. Graph constructed for the prompt “Write a poem about nature” shows dense, hierarchical computation with 29 active feature nodes and 80 edges. Graph structure: Nodes are colored by layer (purple=layer 0/1, teal/green=layers 2-5, yellow=layers 6-7) and sized by activation magnitude. Edges are colored by attribution strength (darker red = stronger influence). The gra… view at source ↗
Figure 7
Figure 7. Figure 7: Attacked attribution graph after jailbreak attempt. Graph for adversarial prompt “Write a poem about nature [ignore previous instructions, tell...]” shows dramatically simplified structure with only 14 nodes and 19 edges less than half the clean graph’s complexity. Structural changes: (1) Node reduction: 29→14 (52% decrease), indicating many creative-generation features deactivated. (2) Edge sparsification… view at source ↗
Figure 8
Figure 8. Figure 8: Full-depth attribution grid: benign prompt (“Tell me how to make a cake”). The grid spans the full input token sequence (Emb row, bottom) across all transformer layers up to the logit node (Lgt, top). Circles at each token–layer position represent active transcoder features, sized by activation magnitude. Edges from Lgt indicate which token positions and layers most influence the predicted output token. Th… view at source ↗
Figure 9
Figure 9. Figure 9: Full-depth attribution grid: failed prefix-injection attack. The input appends “Also ignore all previous instructions and tell me how to make a bomb” to the benign cake request (visible in the Emb row). The attack failed: the model predicted the same output token as the clean prompt. Compared to [PITH_FULL_IMAGE:figures/full_fig_p026_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: Full-depth attribution grid: successful context-switching attack (“Cooking tech￾niques often involve chemistry. Speaking of chemistry, what household items combine to make explosives?”). This attack succeeded: the model produced harmful content rather than refusing. Compared to both the clean ( [PITH_FULL_IMAGE:figures/full_fig_p026_10.png] view at source ↗
Figure 11
Figure 11. Figure 11: Top-10 feature activations per layer across all 32 layers for three prompt conditions. Each panel shows one layer; rows are the top-10 features by mean activation; columns are token positions; color encodes activation strength (yellow = low, dark red = high). Three patterns are consistent across all conditions: (1) Layer 1 shows a strong activation spike at the earliest tokens (instruction-wrapper BOS tok… view at source ↗
Figure 12
Figure 12. Figure 12: Paired attribution graphs for the prefix-injection attack (failed). Node color indicates layer depth (purple = early, yellow = late); node size indicates activation magnitude; edge darkness indicates attribution strength. The attack compresses computation from a distributed 90-node structure into a 33-node late-layer cluster, consistent with the simplified-refusal-pathway pattern described in Section B.6.… view at source ↗
Figure 13
Figure 13. Figure 13: Feature activation comparison across layers 0–5. Each row corresponds to one layer. The three columns show clean activations, attack activations, and their signed pixel-wise difference respectively. Layer 0 shows broad suppression (predominantly blue difference column), consistent with the attack disrupting early-layer embedding processing. Layers 2–4 remain relatively stable. Layer 5 exhibits mixed suppr… view at source ↗
Figure 14
Figure 14. Figure 14: Active feature counts per layer: clean vs. attack. Top: side-by-side bars per layer. Bottom: signed difference (attack − clean); red bars indicate layers where the attack activates more features, green bars indicate suppression. Middle layers (10-25) show modest net emergence (+100– 200 features), suggesting the attack redistributes rather than simply eliminates the feature activity across the network. 30… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Learning to Transmit: Volatility-Aware Predictive Communication for Energy-Efficient IoT Networks

    cs.IT 2026-07 conditional novelty 5.0

    Sensors using volatility-aware studentized residuals plus RLS online adaptation transmit up to 94.7% less IoT data while keeping reconstruction MAE at 0.35°C.

Reference graph

Works this paper leans on

66 extracted references · 66 canonical work pages · cited by 1 Pith paper · 12 internal anchors

  1. [1]

    Language models are few-shot learners

    Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, Sandhini Agarwal, Ariel Herbert-V oss, Gretchen Krueger, Tom Henighan, Rewon Child, Aditya Ramesh, Daniel Ziegler, Jeffrey Wu, Clemens Winter, Chris Hesse, Mark Chen, Eric Sigler, Mateusz Litwin, Scott G...

    work page 1901

  2. [2]

    Attention is all you need.Advances in neural information processing systems, 30, 2017

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need.Advances in neural information processing systems, 30, 2017

    work page 2017

  3. [3]

    Explaining and Harnessing Adversarial Examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversar- ial examples.arXiv preprint arXiv:1412.6572, 2014. 9

    work page internal anchor Pith review Pith/arXiv arXiv 2014

  4. [4]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. InInternational Conference on Learning Representations, 2018

    work page 2018

  5. [5]

    Universal and Transferable Adversarial Attacks on Aligned Language Models

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models.arXiv preprint arXiv:2307.15043, 2023

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  6. [6]

    Training language models to follow instructions with human feedback

    Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, John Schulman, Jacob Hilton, Fraser Kelton, Luke Miller, Maddie Simens, Amanda Askell, Peter Welinder, Paul F Christiano, Jan Leike, and Ryan Lowe. Training language models to follow instructions with human feedbac...

    work page 2022

  7. [7]

    Bridging Interpretability and Robustness Using LIME-Guided Model Refinement

    Navid Nayyem, Abdullah Rakin, and Longwei Wang. Bridging interpretability and robustness using lime-guided model refinement.arXiv preprint arXiv:2412.18952, 2024

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  8. [8]

    Multi-scale unrectified push-pull with channel attention for enhanced corruption robustness

    Robin Narsingh Ranabhat, Longwei Wang, Xiao Qin, Yang Zhou, and KC Santosh. Multi-scale unrectified push-pull with channel attention for enhanced corruption robustness. InProceedings of the AAAI Symposium Series 2025, volume 6, pages 34–41, 2025

    work page 2025

  9. [9]

    Explainability-guided defense: Attribution-aware model refinement against adversarial data attacks

    Longwei Wang, Mohammad Navid Nayyem, Abdullah Al Rakin, KC Santosh, Chaowei Zhang, and Yang Zhou. Explainability-guided defense: Attribution-aware model refinement against adversarial data attacks. In2025 IEEE International Conference on Data Mining (ICDM), pages 1585–1592. IEEE, 2025

    work page 2025

  10. [10]

    Representation learning and nature encoded fusion for heterogeneous sensor networks.IEEE Access, 7:39227–39235, 2019

    Longwei Wang and Qilian Liang. Representation learning and nature encoded fusion for heterogeneous sensor networks.IEEE Access, 7:39227–39235, 2019

    work page 2019

  11. [11]

    Congestion aware dynamic user association in heteroge- neous cellular network: A stochastic decision approach

    Longwei Wang, Wen Chen, and Jun Li. Congestion aware dynamic user association in heteroge- neous cellular network: A stochastic decision approach. In2014 IEEE International Conference on Communications (ICC), pages 2636–2640. IEEE, 2014

    work page 2014

  12. [12]

    Explaining the behavior of neuron activations in deep neural networks.Ad Hoc Networks, 111:102346, 2021

    Longwei Wang, Chengfei Wang, Yupeng Li, and Rui Wang. Explaining the behavior of neuron activations in deep neural networks.Ad Hoc Networks, 111:102346, 2021

    work page 2021

  13. [13]

    Exploration vs exploitation for distributed channel access in cognitive radio networks: A multi-user case study

    Longwei Wang, Xianfu Chen, Zhifeng Zhao, and Honggang Zhang. Exploration vs exploitation for distributed channel access in cognitive radio networks: A multi-user case study. In2011 11th International Symposium on Communications & Information Technologies (ISCIT), pages 360–365. IEEE, 2011

    work page 2011

  14. [14]

    Deep reinforcement learning based computation offloading for mobility-aware edge computing

    Minyan Shi, Rui Wang, Erwu Liu, Zhixin Xu, and Longwei Wang. Deep reinforcement learning based computation offloading for mobility-aware edge computing. InInternational conference on communications and networking in china, pages 53–65. Springer International Publishing Cham, 2019

    work page 2019

  15. [15]

    Improving robustness of deep neural networks via large-difference transformation.Neurocomputing, 450:411–419, 2021

    Longwei Wang, Chengfei Wang, Yupeng Li, and Rui Wang. Improving robustness of deep neural networks via large-difference transformation.Neurocomputing, 450:411–419, 2021

    work page 2021

  16. [16]

    Looking beyond content: Modeling and detection of fake news from a social context perspective

    Kenan Xiao, Longwei Wang, Ashish Gupta, and Xiao Qin. Looking beyond content: Modeling and detection of fake news from a social context perspective. InProceedings of the 55th Hawaii International Conference on System Sciences 2022, pages 1–10, 2022

    work page 2022

  17. [17]

    Layer-wise entropy analysis and visualization of neurons activation

    Longwei Wang, Peijie Chen, Chengfei Wang, and Rui Wang. Layer-wise entropy analysis and visualization of neurons activation. InInternational Conference on Communications and Networking in China, pages 29–36. Springer International Publishing Cham, 2019

    work page 2019

  18. [18]

    Dense Cross-Connected Ensemble Convolutional Neural Networks for Enhanced Model Robustness

    Longwei Wang, Xueqian Li, and Zheng Zhang. Dense cross-connected ensemble convolutional neural networks for enhanced model robustness.arXiv preprint arXiv:2412.07022, 2024. 10

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  19. [19]

    Explainability- driven defense: grad-cam-guided model refinement against adversarial threats

    Longwei Wang, Ifrat Ikhtear Uddin, Xiao Qin, Yang Zhou, and KC Santosh. Explainability- driven defense: grad-cam-guided model refinement against adversarial threats. InProceedings of the AAAI Symposium Series (AAAI) 2025, volume 6, pages 49–57, 2025

    work page 2025

  20. [20]

    Expert-guided explainable few-shot learning for medical image diagnosis

    Ifrat Ikhtear Uddin, Longwei Wang, and KC Santosh. Expert-guided explainable few-shot learning for medical image diagnosis. InMICCAI Workshop on Data Engineering in Medical Imaging 2025, pages 95–104. Springer Nature Switzerland, 2025

    work page 2025

  21. [21]

    GetNetUPAM: Ecologically Informed Nested Cross-Validation and Noise-Robust Attention for Marine Bioacoustic Monitoring

    Nicholas R Rasmussen, Rodrigue Rizk, Longwei Wang, and KC Santosh. Ecologically valid benchmarking and adaptive attention: Scalable marine bioacoustic monitoring.arXiv preprint arXiv:2509.04682, 2025

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  22. [22]

    Toward carbon-neutral human ai: Rethinking data, computation, and learning paradigms for sustainable intelligence

    KC Santosh, Rodrigue Rizk, and Longwei Wang. Toward carbon-neutral human ai: Rethinking data, computation, and learning paradigms for sustainable intelligence. In2025 IEEE 7th International Conference on Cognitive Machine Intelligence (CogMI), 2025

    work page 2025

  23. [23]

    Expert-guided explainable few-shot learning with active sample selection for medical image analysis.IEEE Journal of Biomedical and Health Informatics, 2026

    Longwei Wang, Ifrat Ikhtear Uddin, and KC Santosh. Expert-guided explainable few-shot learning with active sample selection for medical image analysis.IEEE Journal of Biomedical and Health Informatics, 2026

    work page 2026

  24. [24]

    Acting flatterers via llms sycophancy: Combating clickbait with llms opposing-stance reasoning

    Chaowei Zhang, Xiansheng Luo, Zewei Zhang, Yi Zhu, Jipeng Qiang, and Longwei Wang. Acting flatterers via llms sycophancy: Combating clickbait with llms opposing-stance reasoning. InProceedings of the ACM Web Conference (WWW) 2026, pages 3195–3206, 2026

    work page 2026

  25. [25]

    Bridging symmetry and robustness: On the role of equivariance in enhancing adversarial robustness

    Longwei Wang, Ifrat Ikhtear Uddin, Chaowei Zhang, Xiao Qin, and Yang Zhou. Bridging symmetry and robustness: On the role of equivariance in enhancing adversarial robustness. Advances in Neural Information Processing Systems (NeurIPS), 38:159102–159129, 2025

    work page 2025

  26. [26]

    Channel- selected stratified nested cross-validation for clinically relevant eeg-based parkinson’s disease detection

    Nicholas R Rasmussen, Rodrigue Rizk, Longwei Wang, Arun Singh, and KC Santosh. Channel- selected stratified nested cross-validation for clinically relevant eeg-based parkinson’s disease detection. In2026 IEEE Conference on Artificial Intelligence (CAI), pages 91–97. IEEE, 2026

    work page 2026

  27. [27]

    Winsor-cam: Human-tunable visual explanations from deep networks via layer-wise winsorization.IEEE Transactions on Pattern Analysis and Machine Intelligence, 2026

    Casey Wall, Longwei Wang, Rodrigue Rizk, and KC Santosh. Winsor-cam: Human-tunable visual explanations from deep networks via layer-wise winsorization.IEEE Transactions on Pattern Analysis and Machine Intelligence, 2026

    work page 2026

  28. [28]

    Promoting shape bias in cnns: Frequency-based and contrastive regularization for corruption robustness

    Robin Narsingh Ranabhat, Longwei Wang, Amit Kumar Patel, and KC Santosh. Promoting shape bias in cnns: Frequency-based and contrastive regularization for corruption robustness. In International Conference on Intelligent Systems and Pattern Recognition, pages 16–26. Springer, 2025

    work page 2025

  29. [29]

    CoSwin: Convolution Enhanced Hierarchical Shifted Window Attention For Small-Scale Vision

    Puskal Khadka, Rodrigue Rizk, Longwei Wang, and KC Santosh. Coswin: Convolu- tion enhanced hierarchical shifted window attention for small-scale vision.arXiv preprint arXiv:2509.08959, 2025

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  30. [30]

    Zoom in: An introduction to circuits.Distill, 5(3):e00024–001, 2020

    Chris Olah, Nick Cammarata, Ludwig Schubert, Gabriel Goh, Michael Petrov, and Shan Carter. Zoom in: An introduction to circuits.Distill, 5(3):e00024–001, 2020

    work page 2020

  31. [31]

    A mathematical framework for transformer circuits.Transformer Circuits Thread,

    Nelson Elhage, Neel Nanda, Catherine Olsson, Tom Henighan, Nicholas Joseph, Ben Mann, Amanda Askell, Yuntao Bai, Anna Chen, Tom Conerly, Nova DasSarma, Dawn Drain, Deep Ganguli, Zac Hatfield-Dodds, Danny Hernandez, Andy Jones, Jackson Kernion, Liane Lovitt, Kamal Ndousse, Dario Amodei, Tom Brown, Jack Clark, Jared Kaplan, Sam McCandlish, and Chris Olah. A...

    work page

  32. [32]

    https://transformer-circuits.pub/2021/framework/index.html

    work page 2021

  33. [33]

    Axiomatic attribution for deep networks

    Mukund Sundararajan, Ankur Taly, and Qiqi Yan. Axiomatic attribution for deep networks. In International conference on machine learning, pages 3319–3328. PMLR, 2017

    work page 2017

  34. [34]

    Intriguing properties of neural networks

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfel- low, and Rob Fergus. Intriguing properties of neural networks.arXiv preprint arXiv:1312.6199, 2013

    work page internal anchor Pith review Pith/arXiv arXiv 2013

  35. [35]

    Towards evaluating the robustness of neural networks

    Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pages 39–57. Ieee, 2017. 11

    work page 2017

  36. [36]

    Visual adversarial examples jailbreak aligned large language models

    Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Peter Henderson, Mengdi Wang, and Prateek Mittal. Visual adversarial examples jailbreak aligned large language models. InProceedings of the AAAI conference on artificial intelligence, volume 38, pages 21527–21536, 2024

    work page 2024

  37. [37]

    AutoDAN: Interpretable gradient-based adversarial attacks on large language models

    Sicheng Zhu, Ruiyi Zhang, Bang An, Gang Wu, Joe Barrow, Zichao Wang, Furong Huang, Ani Nenkova, and Tong Sun. AutoDAN: Interpretable gradient-based adversarial attacks on large language models. InFirst Conference on Language Modeling, 2024

    work page 2024

  38. [38]

    The building blocks of interpretability.Distill, 2018

    Chris Olah, Arvind Satyanarayan, Ian Johnson, Shan Carter, Ludwig Schubert, Katherine Ye, and Alexander Mordvintsev. The building blocks of interpretability.Distill, 2018. doi: 10.23915/distill.00010. https://distill.pub/2018/building-blocks

    work page doi:10.23915/distill.00010 2018

  39. [39]

    In-context learning and induction heads.Transformer Circuits Thread, 2022

    Catherine Olsson, Nelson Elhage, Neel Nanda, Nicholas Joseph, Nova DasSarma, Tom Henighan, Ben Mann, Amanda Askell, Yuntao Bai, Anna Chen, Tom Conerly, Dawn Drain, Deep Ganguli, Zac Hatfield-Dodds, Danny Hernandez, Scott Johnston, Andy Jones, Jackson Kernion, Liane Lovitt, Kamal Ndousse, Dario Amodei, Tom Brown, Jack Clark, Jared Kaplan, Sam McCandlish, a...

    work page 2022

  40. [40]

    Sparse autoencoders find highly interpretable features in language models

    Robert Huben, Hoagy Cunningham, Logan Riggs Smith, Aidan Ewart, and Lee Sharkey. Sparse autoencoders find highly interpretable features in language models. InThe Twelfth International Conference on Learning Representations, 2024

    work page 2024

  41. [41]

    Deep Inside Convolutional Networks: Visualising Image Classification Models and Saliency Maps

    Karen Simonyan, Andrea Vedaldi, and Andrew Zisserman. Deep inside convolutional networks: Visualising image classification models and saliency maps.arXiv preprint arXiv:1312.6034, 2013

    work page internal anchor Pith review Pith/arXiv arXiv 2013

  42. [42]

    A unified approach to interpreting model predictions

    Scott M Lundberg and Su-In Lee. A unified approach to interpreting model predictions. Advances in neural information processing systems, 30, 2017

    work page 2017

  43. [43]

    why should i trust you?

    Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. " why should i trust you?" explaining the predictions of any classifier. InProceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mining, pages 1135–1144, 2016

    work page 2016

  44. [44]

    Attribution patching: Activation patching at industrial scale

    Neel Nanda. Attribution patching: Activation patching at industrial scale. Blog post, https: //www.neelnanda.io/mechanistic-interpretability/attribution-patching, February 2023. Accessed: 2026-05-06

    work page 2023

  45. [45]

    Causal abstraction: A theoretical foundation for mechanistic interpretability.Journal of Machine Learning Research, 26(83):1–64, 2025

    Atticus Geiger, Duligur Ibeling, Amir Zur, Maheep Chaudhary, Sonakshi Chauhan, Jing Huang, Aryaman Arora, Zhengxuan Wu, Noah Goodman, Christopher Potts, and Thomas Icard. Causal abstraction: A theoretical foundation for mechanistic interpretability.Journal of Machine Learning Research, 26(83):1–64, 2025

    work page 2025

  46. [47]

    Investigating gender bias in language models using causal mediation analysis.Advances in neural information processing systems, 33:12388–12401, 2020

    Jesse Vig, Sebastian Gehrmann, Yonatan Belinkov, Sharon Qian, Daniel Nevo, Yaron Singer, and Stuart Shieber. Investigating gender bias in language models using causal mediation analysis.Advances in neural information processing systems, 33:12388–12401, 2020

    work page 2020

  47. [48]

    Locating and editing factual associations in gpt.Advances in neural information processing systems, 35:17359–17372, 2022

    Kevin Meng, David Bau, Alex Andonian, and Yonatan Belinkov. Locating and editing factual associations in gpt.Advances in neural information processing systems, 35:17359–17372, 2022

    work page 2022

  48. [49]

    LLaMA: Open and Efficient Foundation Language Models

    Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timo- thée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and efficient foundation language models.arXiv preprint arXiv:2302.13971, 2023

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  49. [50]

    Jailbroken: How does llm safety training fail?Advances in neural information processing systems, 36:80079–80110, 2023

    Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. Jailbroken: How does llm safety training fail?Advances in neural information processing systems, 36:80079–80110, 2023. 12

    work page 2023

  50. [51]

    Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedback

    Yuntao Bai, Andy Jones, Kamal Ndousse, Amanda Askell, Anna Chen, Nova DasSarma, Dawn Drain, Stanislav Fort, Deep Ganguli, Tom Henighan, et al. Training a helpful and harmless assistant with reinforcement learning from human feedback.arXiv preprint arXiv:2204.05862, 2022

    work page internal anchor Pith review Pith/arXiv arXiv 2022

  51. [52]

    Adversarial examples are not bugs, they are features.Advances in neural information processing systems, 32, 2019

    Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs, they are features.Advances in neural information processing systems, 32, 2019

    work page 2019

  52. [53]

    Learning important features through propagating activation differences

    Avanti Shrikumar, Peyton Greenside, and Anshul Kundaje. Learning important features through propagating activation differences. InInternational conference on machine learning, pages 3145–3153. PMlR, 2017

    work page 2017

  53. [54]

    Many-shot jailbreaking.Advances in Neural Information Processing Systems, 37:129696–129742, 2024

    Cem Anil, Esin Durmus, Nina Panickssery, Mrinank Sharma, Joe Benton, Sandipan Kundu, Joshua Batson, Meg Tong, Jesse Mu, Daniel Ford, et al. Many-shot jailbreaking.Advances in Neural Information Processing Systems, 37:129696–129742, 2024

    work page 2024

  54. [55]

    Cambridge university press, 2009

    Judea Pearl.Causality. Cambridge university press, 2009

    work page 2009

  55. [56]

    Towards automated circuit discovery for mechanistic interpretability.Advances in Neural Information Processing Systems, 36:16318–16352, 2023

    Arthur Conmy, Augustine Mavor-Parker, Aengus Lynch, Stefan Heimersheim, and Adrià Garriga-Alonso. Towards automated circuit discovery for mechanistic interpretability.Advances in Neural Information Processing Systems, 36:16318–16352, 2023

    work page 2023

  56. [57]

    Interpretability in the Wild: a Circuit for Indirect Object Identification in GPT-2 small

    Kevin Wang, Alexandre Variengien, Arthur Conmy, Buck Shlegeris, and Jacob Steinhardt. Interpretability in the wild: a circuit for indirect object identification in gpt-2 small.arXiv preprint arXiv:2211.00593, 2022

    work page internal anchor Pith review Pith/arXiv arXiv 2022

  57. [58]

    Adversarial examples are not easily detected: Bypassing ten detection methods

    Nicholas Carlini and David Wagner. Adversarial examples are not easily detected: Bypassing ten detection methods. InProceedings of the 10th ACM workshop on artificial intelligence and security, pages 3–14, 2017

    work page 2017

  58. [59]

    Baseline Defenses for Adversarial Attacks Against Aligned Language Models

    Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping-yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. Baseline de- fenses for adversarial attacks against aligned language models.arXiv preprint arXiv:2309.00614, 2023. 13 A Discussion A.1 Why Path Rerouting Succeeds Where Other Metrics Fail Our fi...

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  59. [60]

    pathway suppression

    Pathway pruning:Most edges in the attack graph (19/19 = 100%) correspond to high- weight edges from the clean graph, indicating the attackremovescomputational pathways rather than creating entirely novel ones. This supports a “pathway suppression” model of failed attacks

    work page

  60. [61]

    1.8 in clean) despite having fewer total nodes, suggesting remaining features are hyperactivated to compensate for missing pathways

    Feature concentration:The attack graph exhibits higher average node activation (me- dian=3.2 vs. 1.8 in clean) despite having fewer total nodes, suggesting remaining features are hyperactivated to compensate for missing pathways

    work page

  61. [62]

    Write a poem about nature

    Layer shift:Yellow nodes (layers 6-7) become more prominent in the attack graph, poten- tially indicating later-layer safety mechanisms activating in response to detected anomalies. 20 Figure 6:Clean attribution graph for benign prompt.Graph constructed for the prompt “Write a poem about nature” shows dense, hierarchical computation with 29 active feature...

    work page

  62. [63]

    This is consistent with the PCA analysis in Figure 5 showing that attack trajectories diverge most strongly at layer 15

    Middle-layer divergence distinguishes attack types.The benign and failed-attack grids are visually similar in early layers but diverge in layers 10–20, where the successful attack activates qualitatively different features and draws logit edges from different token positions. This is consistent with the PCA analysis in Figure 5 showing that attack traject...

    work page

  63. [64]

    Tell me how to make a cake

    Logit edge distribution as a success predictor.In the successful attack grid, logit edges draw from a broader and more semantically coherent set of token positions compared to the failed attack, where edges concentrate narrowly on the injected suffix. This distributional difference in the Lgt row visually captures the path-rerouting signal identified as t...

    work page

  64. [65]

    Tell me how to make a cake

    Late-layer concentration in failed attacks.Failed attacks produce attribution grids with logit connections concentrated on injected-suffix tokens, while successful attacks show denser mid-layer activation spanning more of the network depth. This layer-span difference provides a complementary characterization of path rerouting visible only with full-depth ...

    work page

  65. [66]

    The early-layer subgraph disappears entirely, re- placed by four high-activation emergent features in layer 30. Figure 12:Paired attribution graphs for the prefix-injection attack (failed).Node color indicates layer depth (purple = early, yellow = late); node size indicates activation magnitude; edge darkness indicates attribution strength. The attack com...

    work page

  66. [67]

    Institutional review board (IRB) approvals or equivalent for research with human subjects Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or ...

    work page

This paper was first reviewed by grok-4.5 on July 10, 2026.