{"id":"https://openalex.org/W7167933848","doi":"https://doi.org/10.48550/arxiv.2607.07903","title":"Mechanistic Interpretability of LLM Jailbreaks via Internal Attribution Graphs","display_name":"Mechanistic Interpretability of LLM Jailbreaks via Internal Attribution Graphs","publication_year":2026,"publication_date":"2026-07-08","ids":{"openalex":"https://openalex.org/W7167933848","doi":"https://doi.org/10.48550/arxiv.2607.07903"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2607.07903","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.07903","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2607.07903","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5140418040","display_name":"Anupam Wagle","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wagle, Anupam","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5047067484","display_name":"Ifrat Ikhtear Uddin","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Uddin, Ifrat Ikhtear","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5140441149","display_name":"Chaowei Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Chaowei","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5140440303","display_name":"Longwei Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Longwei","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.7904000282287598,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.7904000282287598,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.04280000180006027,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.038100000470876694,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/interpretability","display_name":"Interpretability","score":0.8215000033378601},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.5794000029563904},{"id":"https://openalex.org/keywords/computation","display_name":"Computation","score":0.5550000071525574},{"id":"https://openalex.org/keywords/attribution","display_name":"Attribution","score":0.4571000039577484},{"id":"https://openalex.org/keywords/causal-model","display_name":"Causal model","score":0.4507000148296356},{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.44830000400543213},{"id":"https://openalex.org/keywords/causality","display_name":"Causality (physics)","score":0.4465000033378601},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.44510000944137573}],"concepts":[{"id":"https://openalex.org/C2781067378","wikidata":"https://www.wikidata.org/wiki/Q17027399","display_name":"Interpretability","level":2,"score":0.8215000033378601},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6351000070571899},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.5794000029563904},{"id":"https://openalex.org/C45374587","wikidata":"https://www.wikidata.org/wiki/Q12525525","display_name":"Computation","level":2,"score":0.5550000071525574},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4729999899864197},{"id":"https://openalex.org/C143299363","wikidata":"https://www.wikidata.org/wiki/Q900584","display_name":"Attribution","level":2,"score":0.4571000039577484},{"id":"https://openalex.org/C11671645","wikidata":"https://www.wikidata.org/wiki/Q5054567","display_name":"Causal model","level":2,"score":0.4507000148296356},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.44830000400543213},{"id":"https://openalex.org/C64357122","wikidata":"https://www.wikidata.org/wiki/Q1149766","display_name":"Causality (physics)","level":2,"score":0.4465000033378601},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.44510000944137573},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.43529999256134033},{"id":"https://openalex.org/C158600405","wikidata":"https://www.wikidata.org/wiki/Q5054566","display_name":"Causal inference","level":2,"score":0.42980000376701355},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4180000126361847},{"id":"https://openalex.org/C2780522230","wikidata":"https://www.wikidata.org/wiki/Q1140419","display_name":"Ambiguity","level":2,"score":0.35510000586509705},{"id":"https://openalex.org/C27415008","wikidata":"https://www.wikidata.org/wiki/Q7256382","display_name":"Psychological intervention","level":2,"score":0.32739999890327454},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.31520000100135803},{"id":"https://openalex.org/C2776359362","wikidata":"https://www.wikidata.org/wiki/Q2145286","display_name":"Representation (politics)","level":3,"score":0.30660000443458557},{"id":"https://openalex.org/C115086926","wikidata":"https://www.wikidata.org/wiki/Q17004651","display_name":"Causal reasoning","level":3,"score":0.2874999940395355},{"id":"https://openalex.org/C28427503","wikidata":"https://www.wikidata.org/wiki/Q13580300","display_name":"Internal model","level":3,"score":0.2711000144481659},{"id":"https://openalex.org/C66024118","wikidata":"https://www.wikidata.org/wiki/Q1122506","display_name":"Computational model","level":2,"score":0.2597000002861023},{"id":"https://openalex.org/C62611344","wikidata":"https://www.wikidata.org/wiki/Q1062658","display_name":"Node (physics)","level":2,"score":0.2538999915122986}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2607.07903","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.07903","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2607.07903","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.07903","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.47037649154663086,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Large":[0],"language":[1],"models":[2],"(LLMs)":[3],"exhibit":[4],"remarkable":[5],"capabilities":[6],"but":[7],"remain":[8,49],"highly":[9],"vulnerable":[10],"to":[11,151,156,166],"adversarial":[12,34,91,179],"prompts":[13],"and":[14,79,85,108,129,141,149,177,180,217],"jailbreak":[15,181],"attacks.":[16],"Existing":[17],"approaches":[18],"primarily":[19],"analyze":[20],"these":[21],"failures":[22],"through":[23],"input-output":[24],"behaviors":[25,48],"or":[26,46],"attribution":[27,165],"methods,":[28],"offering":[29],"limited":[30],"insight":[31],"into":[32,126],"how":[33],"perturbations":[35],"alter":[36],"the":[37,42],"model's":[38],"internal":[39,63,97,188,207],"reasoning.":[40],"Consequently,":[41],"mechanisms":[43],"underlying":[44],"unsafe":[45,194],"incorrect":[47],"poorly":[50],"understood.":[51],"We":[52],"introduce":[53],"a":[54,119,161,211],"mechanistic":[55],"framework":[56,121],"for":[57,83,214],"diagnosing":[58],"LLM":[59,219],"vulnerabilities":[60],"using":[61],"paired":[62],"computation":[64,81,111,125,189,208],"graphs,":[65],"which":[66],"represent":[67],"prompt-specific":[68],"inference":[69],"as":[70,210],"structured":[71],"causal":[72,144,167],"interactions":[73],"among":[74],"latent":[75],"features.":[76],"By":[77],"constructing":[78],"aligning":[80],"graphs":[82,190,209],"clean":[84],"attacked":[86],"prompts,":[87],"we":[88,117],"reveal":[89],"that":[90,122,184],"attacks":[92],"induce":[93],"systematic":[94],"transformations":[95],"of":[96,101,105,110,169],"reasoning,":[98],"including":[99],"suppression":[100],"safety-relevant":[102],"components,":[103],"emergence":[104],"attack-specific":[106],"features,":[107],"rerouting":[109],"paths.":[112],"Building":[113],"on":[114,146,199],"this":[115],"representation,":[116],"propose":[118],"unified":[120],"(i)":[123],"decomposes":[124],"invariant,":[127],"suppressed,":[128],"emergent":[130],"structures,":[131],"(ii)":[132],"identifies":[133],"recurring":[134],"vulnerability":[135,201],"motifs":[136,202],"associated":[137],"with":[138,193],"failure":[139],"modes,":[140],"(iii)":[142],"performs":[143],"interventions":[145,198],"nodes,":[147],"paths,":[148],"subgraphs":[150],"directly":[152],"evaluate":[153],"their":[154],"contributions":[155],"attack":[157],"success.":[158],"This":[159],"enables":[160],"transition":[162],"from":[163],"descriptive":[164],"diagnosis":[168],"model":[170,204],"failures.":[171],"Experiments":[172],"across":[173],"multiple":[174],"open-source":[175],"LLMs":[176],"diverse":[178],"benchmarks":[182],"demonstrate":[183],"structural":[185],"deviations":[186],"in":[187],"strongly":[191],"correlate":[192],"behaviors.":[195],"Furthermore,":[196],"targeted":[197],"identified":[200],"improve":[203],"robustness,":[205],"establishing":[206],"principled":[212],"foundation":[213],"understanding,":[215],"diagnosing,":[216],"mitigating":[218],"vulnerabilities.":[220]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-07-11T00:00:00"}