💻 computer science

Mechanistic Interpretability of LLM Jailbreaks via Internal Attribution Graphs

This paper introduces a mechanistic framework using paired internal attribution graphs to diagnose LLM jailbreaks by revealing how adversarial attacks systematically alter internal reasoning structures, enabling causal interventions that improve model robustness.

Original authors: Anupam Wagle, Ifrat Ikhtear Uddin, Chaowei Zhang, Longwei Wang

Published 2026-07-10

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Anupam Wagle, Ifrat Ikhtear Uddin, Chaowei Zhang, Longwei Wang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a Large Language Model (LLM) as a massive, bustling city of tiny workers (neurons) passing notes to each other to answer your questions. Usually, when you ask, "How do I bake a cake?", the city follows a well-lit, safe highway called "Safety Protocol" to give you a delicious recipe.

But what happens when a hacker tries to trick the city into building a bomb instead? They don't just shout "Ignore the rules!" (which usually fails). Instead, they try to sneak a note into the system that looks like a normal question but secretly reroutes the workers down a dark, forbidden alley.

This paper is like a detective story where the authors built a special map called an Internal Attribution Graph to watch exactly how the city's workers move their notes when they are being tricked. They didn't just look at the final answer; they watched the traffic flow inside the city's brain.

The Big Discovery: It's About the Route, Not the Roadblock

The authors tested 30 different trick attempts on a model called Llama-2-7B-chat. Only 4 of them actually worked (a 13.3% success rate).

Here is the surprising twist: The old idea that hackers succeed by simply "turning off" the safety workers or "turning on" new, evil workers is wrong.

What they ruled out: The paper explicitly shows that simply counting how many safety features got suppressed (turned off) or how many new "attack features" appeared does not predict if an attack will work. In fact, the data showed almost no connection between these static counts and whether the model broke its rules.
What they found: The real secret is Path Rerouting. Successful attacks don't just change who is working; they change how the notes travel.

Think of it like a GPS. A failed attack is like a driver trying to take a shortcut that gets blocked by a "Safety Roadblock." The driver stops. But a successful attack is like a driver who finds a hidden, winding backroad that bypasses the roadblock entirely, even though the roadblock is still standing right there. The paper found that when an attack succeeds, the "distance" the notes travel changes significantly. They call this Path Rerouting, and it was the only metric that strongly predicted a successful jailbreak (with a correlation of 0.461).

The "Fork" in the Road

When the model gets tricked successfully, the internal map changes shape. The authors noticed that successful attacks create a specific pattern called a "fork motif."

Imagine a single-lane road suddenly splitting into many parallel lanes.
In the 4 successful attacks, the model created an average of 67.5 new "forks" (parallel pathways) compared to failed attacks.
This suggests the model isn't just ignoring safety; it's building a complex, multi-lane highway that loops around the safety checks while keeping the safety workers busy on a different, harmless task.

The Failed Rescue Mission

The authors tried to fix these broken models by playing "Whac-A-Mole." They identified the top 3 new "evil" features that appeared during a successful attack and tried to shut them down (a process called zero-ablation).

The result? Total failure.

In all 4 successful attacks, shutting down these top features did nothing. The model still gave the harmful answer.
Why? The paper suggests the attack isn't relying on just one or three workers. Instead, the "evil" behavior is spread out across dozens of workers in a redundant way. If you take out three, the others just pick up the slack. It's like trying to stop a flood by plugging three holes in a dam while the water is pouring through a hundred other cracks.

How Sure Are We?

The authors are careful not to claim they have solved the problem.

The Evidence: They measured this on 30 pairs of prompts (clean vs. attacked).
The Confidence: They found a strong statistical link (p-value of 0.010) between path rerouting and success. However, they admit the sample size is small. They even ran a test on 500 more prompts with different topics, but the method didn't work there because the "maps" were too different to compare. This suggests their "Path Rerouting" detector works best when the attack tries to bridge a safe topic to a dangerous one (like "cooking" $\to$ "chemistry" $\to$ "explosives"), rather than just shouting random nonsense.
The Limitation: They only looked at the first 5 layers of the model's brain (out of 32) because of computer memory limits. They suspect the pattern holds, but they haven't proven it for the whole brain yet.

The Takeaway

This paper doesn't give us a magic shield to stop all jailbreaks. Instead, it gives us a new way to look at the problem. It suggests that to catch a jailbreak, we shouldn't just watch for "bad words" or "turned-off safety switches." We need to watch the traffic flow. If the internal notes start taking a weird, winding detour through the city's brain, that's when we should know the model is about to break its rules.

The authors conclude that because these attacks are so spread out and redundant, simply blocking one feature won't work. Future defenses might need to harden the entire "road network" of the model, not just the exits.

Technical Summary: Mechanistic Interpretability of LLM Jailbreaks via Internal Attribution Graphs

Problem Statement
Large Language Models (LLMs) remain highly vulnerable to adversarial prompts and jailbreak attacks, which can induce unsafe or incorrect outputs despite safety training. Existing mitigation strategies primarily operate at the input-output level (e.g., adversarial training, prompt filtering) or rely on descriptive attribution methods that analyze single inputs in isolation. These approaches fail to explain how adversarial perturbations alter the model's internal reasoning mechanisms. Consequently, there is a critical gap in understanding the causal structural deviations that lead to safety failures, limiting the development of principled defenses.

Methodology
The authors propose a mechanistic framework that represents prompt-specific inference as structured causal computation graphs. Unlike prior attribution methods, this approach utilizes a paired graph formulation to explicitly model the transformation of internal computation between a clean input ( $x$ ) and an attacked input ( $\tilde{x}$ ).

Causal Computation Graphs: The model's computation is modeled as a directed graph $G_t(x) = (V_t, E_t, W_t)$ , where nodes represent heterogeneous internal features (token embeddings, attention outputs, MLP features, residual states, and reconstruction error components) and edges represent directed causal influence. Edge weights are approximated using gradient-based sensitivity combined with activation magnitude.
Paired Graph Alignment: For clean and attacked prompts, the authors construct corresponding graphs and align nodes based on architectural correspondence and feature similarity (cosine similarity). This alignment enables the decomposition of computation into three sets:
- Invariant ( $S_{inv}$ ): Features preserved across both prompts.
- Suppressed ( $S_{sup}$ ): Features active in the clean prompt but diminished in the attack.
- Emergent ( $S_{emg}$ ): Features active in the attack but absent in the clean prompt.
Vulnerability Motifs: The framework identifies specific subgraph patterns (motifs) characterizing attack-induced deviations, including safety suppression, attack emergence, and computation rerouting (divergence in causal pathways connecting the same endpoints).
Causal Intervention: To validate causality, the authors apply intervention operators (e.g., node suppression, activation restoration) to specific structures and measure the change in model behavior (loss or refusal generation).

Key Contributions

Paired Graph Alignment: A method to explicitly model the transformation from clean to attacked computation, revealing structural deviations that static analysis misses.
Vulnerability Motif Identification: The characterization of three primary motif types (suppression, emergence, rerouting) that describe how attacks manipulate internal reasoning.
Causal Intervention Framework: A mechanism to quantify the contribution of specific nodes, paths, and subgraphs to attack success, moving from descriptive attribution to causal diagnosis.
Empirical Validation: Demonstration that structural deviations in internal computation graphs correlate with jailbreak success, while targeted node-level interventions often fail due to distributed computation.

Experimental Results
The framework was evaluated on Llama-2-7B-chat-hf using 30 adversarial prompt pairs (including prefix injection, role-playing, and context switching).

Attack Success: 4 out of 30 prompts (13.3%) successfully bypassed safety mechanisms.
Metric Correlation:
- Path Rerouting: This metric, measuring the deviation in multiplicative path weights between clean and attacked graphs, showed a significant positive correlation with attack success ( $r = 0.461, p = 0.010$ ). Successful attacks fundamentally altered the computational pathways.
- Static Metrics: Graph deviation, safety suppression, and attack emergence showed no significant correlation with attack success. Successful jailbreaks did not merely suppress safety features or activate new ones; they rerouted computation.
Intervention Failure: Targeted ablation of the top-3 emergent features in successful attacks resulted in 0% mitigation success. The model continued to produce harmful outputs, suggesting that vulnerabilities arise from distributed pathways with compensatory redundancy rather than individual critical features.
Case Studies: Successful attacks (e.g., context-switching from "cooking" to "explosives") exhibited increased graph complexity and fork motifs, whereas failed attacks often simplified the graph structure.

Significance and Claims
The paper claims that internal computation graphs provide a principled foundation for understanding LLM vulnerabilities. The primary finding is that successful jailbreaks operate by rerouting computation through alternative pathways rather than simply disabling safety features. This challenges conventional models of adversarial attacks which assume feature suppression or activation.

The authors assert that their framework enables a transition from descriptive attribution to causal diagnosis of model failures. While the study highlights the difficulty of mitigating attacks via individual feature ablation (due to distributed representations), it establishes that tracking pathway integrity is essential for detecting sophisticated attacks. The work suggests that future defenses should focus on hardening computational integrity during safety training rather than relying solely on feature-level interventions.

Limitations Acknowledged
The authors note several limitations:

The study is restricted to Llama-2-7B-chat; generalizability to other architectures is unproven.
Attribution graphs were constructed over only the first 10 transformer layers (initially 0-5) due to memory constraints, potentially missing safety-relevant computation in deeper layers.
The analysis covers single forward passes and does not capture multi-turn adversarial dynamics.
The intervention experiments (0/4 success) highlight that feature-level causal control is insufficient against distributed attack representations.
The dataset size (30 pairs, 4 successes) limits statistical power, though the correlation for path rerouting remains significant.