🤖 AI

Certified Circuits: Stability Guarantees for Mechanistic Circuits

This paper introduces "Certified Circuits," a framework that enhances the stability and reliability of mechanistic interpretability by using randomized data subsampling to provide provable guarantees that discovered neural circuits are invariant to dataset perturbations, resulting in more compact and accurate explanations across diverse architectures and tasks.

Original authors: Alaa Anani, Tobias Lorenz, Bernt Schiele, Mario Fritz, Jonas Fischer

Published 2026-06-01

📖 3 min read☕ Coffee break read

CC BY 4.0

Original authors: Alaa Anani, Tobias Lorenz, Bernt Schiele, Mario Fritz, Jonas Fischer

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to figure out how a brilliant but mysterious chef (a neural network) cooks a specific dish, like "Crocodile Soup." You want to know exactly which ingredients and steps are essential to the recipe.

The Problem: The Unstable Recipe
In the past, when scientists tried to find this "recipe" (called a circuit) inside the computer, they used a method that was very fragile. It was like asking the chef, "What makes this soup taste like crocodile?" based on a single photo of a crocodile on a beach.

The chef might say, "Ah! It's the teeth and the scales!" But if you showed the chef a photo of a crocodile in a swamp, or a cartoon drawing, the chef might suddenly say, "No, no! It's actually the muddy water and the bird sitting nearby!"

The problem is that the chef (the computer) was memorizing clues specific to that one photo (like the bird or the mud) rather than the actual concept of a crocodile. If you changed the photo slightly, the "recipe" the scientists found would change completely. This made the explanation unreliable.

The Solution: Certified Circuits
This paper introduces a new method called Certified Circuits. Think of this as a "Stability Test" for the recipe.

Instead of asking the chef about just one photo, the researchers do this:

The Shuffle: They take a big stack of crocodile photos and randomly throw away a few, swap some, or add a few new ones. They do this hundreds of times, creating thousands of slightly different "photo stacks."
The Vote: For every single photo stack, they ask the chef, "What is the most important part of this?"
The Consensus: They look at the answers.
- If the chef says "Teeth" in 99% of the different photo stacks, they say, "Certified! Teeth are definitely part of the recipe."
- If the chef says "Bird" in 50% of the stacks and "Teeth" in the other 50%, they say, "Abstain." They refuse to include "Bird" in the final recipe because it's too unstable. It might just be a coincidence.

What This Achieves
By only keeping the parts that the chef agrees on no matter how you shuffle the photos, the researchers get a much better result:

Smaller and Cleaner: The final recipe is much shorter. They cut out all the "noise" (like the bird or the mud) that was confusing the original method.
More Accurate: Because they removed the confusing, unstable clues, the recipe works better. In the paper, this improved accuracy by up to 56% on tricky, unseen examples.
Works Everywhere: If the recipe is built on the true concept of a crocodile (teeth, scales, snout), it will work whether you show the chef a real crocodile, a cartoon, or a crocodile in a swamp. The "Certified" recipe generalizes well because it ignores the flimsy clues that only worked for the original photos.

The Bottom Line
The paper claims that by using this "voting" system (which they call randomized smoothing), they can prove that their discovered "circuits" (the parts of the computer doing the work) are stable.

They aren't just guessing; they can mathematically guarantee that if you change the input data slightly (within a certain limit), the core recipe they found will not change. This turns the "recipe" from a fragile guess into a solid, trustworthy explanation of how the computer actually thinks.

Technical Summary: Certified Circuits

Problem Statement

Mechanistic interpretability aims to identify "circuits"—minimal subnetworks within neural networks responsible for specific behaviors or concepts. However, existing circuit discovery methods suffer from a critical lack of robustness. Discovered circuits are highly sensitive to the specific examples chosen for the concept dataset; adding, removing, or substituting semantically equivalent examples can lead to unpredictable changes in the circuit structure. Furthermore, these circuits often fail to generalize to out-of-distribution (OOD) data. This instability raises a fundamental question: do current methods capture the true mechanistic representation of a concept, or are they merely overfitting to dataset-specific spurious cues and artifacts?

Methodology: Certified Circuits

The authors propose Certified Circuits, a framework that provides provable, algorithm-agnostic stability guarantees for circuit discovery. The core idea is to treat circuit discovery as a mapping from a concept dataset to a subgraph and to certify that this mapping remains invariant under bounded edits to the dataset.

Core Framework

Randomized Subsampling (Smoothing): The framework wraps any black-box circuit discovery algorithm $\mathcal{A}$ . It generates multiple random subsamples of the concept dataset $D$ by applying a deletion-based perturbation mechanism. Specifically, it samples a binary mask where each example is retained with probability $1 - p_{del}$ and deleted with probability $p_{del}$ .
Aggregation: The base algorithm $\mathcal{A}$ is run on each subsampled dataset to produce candidate circuits. The framework then aggregates the results to compute the smoothed inclusion probability ( $p_u$ ) for each circuit component (neuron or edge). This probability represents the frequency with which a component is selected across the randomized deletions.
Certified Decision Rule: A confidence threshold $\tau$ $τ$ is applied to $p_u$ $p_{u}$ to make a decision for each component:
- Certified In: If $p_u > \tau$ , the component is robustly included.
- Certified Out: If $1 - p_u > \tau$ , the component is robustly excluded.
- Abstain: If neither condition is met, the component is excluded from the final circuit. This adaptive sparsity removes components whose inclusion is unstable under dataset perturbations.

Theoretical Guarantee

The method leverages Dataset Deletion Smoothing (RS-Del) to derive a formal guarantee. Theorem 3.1 states that with high confidence ( $1-\alpha$ ), any component certified as "in" or "out" remains invariant for any concept dataset $D'$ within a specific edit distance $r$ of the original dataset $D$ . The certified radius $r$ is a function of the deletion probability $p_{del}$ and the threshold $\tau$ . Components assigned "abstain" are excluded, ensuring the final circuit consists only of provably stable elements.

Key Contributions

First Provable Stability Framework: The paper introduces the first framework providing provable, algorithm-agnostic robustness guarantees for circuit discovery, ensuring circuit structure is invariant to bounded dataset edits.
Theoretical Bounds: The authors derive provable bounds on certified radii and characterize their dependence on the probability threshold and deletion probability.
Empirical Validation: The framework is validated across three architectures (ResNet, ViT, GPT-2), two modalities (vision and language), and four discovery algorithms.

Experimental Results

The authors evaluated Certified Circuits against standard baselines (e.g., Top-K relevance, EAP-IG) on ImageNet and various OOD benchmarks (ImageNet-A, ImageNet-O, ImageNet-C, OOD-CV) for vision, and IOI/IOI-Hard/Greater-Than tasks for language.

Sufficiency and Compactness: Certified circuits achieve higher accuracy (sufficiency) with significantly fewer components (compactness).
- Vision: On ImageNet, certified circuits achieved 95% accuracy (vs. 83% baseline) while using 52% fewer neurons. On OOD datasets like ImageNet-A, accuracy improved by up to 56% (reaching 94%) with a 15% reduction in size.
- Language: Certified circuits matched or exceeded baseline peak accuracy while using up to 80% fewer edges (e.g., 75% reduction on the Greater-Than task).
Feature Analysis: Visualization of "abstained" neurons (those included in baselines but excluded by certification) revealed they often fire on co-occurring but non-class-specific cues (e.g., hands/wrists for a "watch" class), whereas "certified-in" neurons consistently responded to class-defining features.
OOD Generalization: Circuits discovered on in-distribution data retained significantly higher accuracy on OOD shifts compared to baselines, suggesting they capture transferable mechanistic structures rather than dataset artifacts.
Structural Stability: When circuits were re-discovered on shifted distributions, certified circuits showed higher Intersection-over-Union (IoU) with the original structure, indicating convergence to an invariant core.

Significance and Claims

The paper claims that Certified Circuits places circuit discovery on formal ground by producing mechanistic explanations that are provably stable and better aligned with the target concept. By systematically removing unstable components through adaptive abstention, the method yields circuits that are not only more compact and accurate but also robust to dataset variations and distribution shifts.

The authors emphasize that this work addresses the "interpretability illusion" where explanations appear faithful on the discovery distribution but fail to generalize. By providing a threat model based on bounded dataset edits, Certified Circuits offers a reliable tool for debugging, auditing, and understanding neural networks, bridging the gap between interpretability and trustworthiness. The framework is designed to be agnostic to the underlying model architecture and the specific circuit discovery algorithm used, making it a generalizable solution for the field.