Mechanistic Interpretability of LLM Jailbreaks via Internal Attribution Graphs

2026-05-06 · Source: cs.AI updates on arXiv.org · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Data Science & Analytics · Depth: Expert, extended

Summary

This research introduces a mechanistic framework to diagnose Large Language Model (LLM) vulnerabilities to jailbreak attacks by analyzing paired internal computation graphs. These graphs model prompt-specific inference as causal interactions among latent features. Experiments on Llama-2-7B-chat-hf with 30 adversarial prompts, yielding a 13.3% attack success rate, revealed that path rerouting magnitude significantly correlates with jailbreak success ($r=0.461, p=0.010$). In contrast, static metrics like graph deviation, safety suppression, or attack emergence did not predict attack outcomes. The framework identifies vulnerability motifs, including safety suppression, attack emergence, and computation rerouting, and uses causal interventions. However, targeted node-level interventions (zero-ablation of top-3 emergent features) failed to mitigate attacks, suggesting distributed computational effects. The study emphasizes that successful jailbreaks fundamentally alter reasoning pathways, often increasing graph complexity through emergent features and fork motifs.

Key takeaway

For AI Security Engineers developing robust LLMs, you should prioritize monitoring internal computational pathway integrity over static feature activation. Your defense strategies should move beyond simple feature suppression, as successful jailbreaks reroute information flow rather than just "turning off" safety features. Consider developing pathway-based defenses that harden computational integrity during safety training, as node-level interventions proved ineffective against distributed attack mechanisms.

Key insights

LLM jailbreaks fundamentally reroute internal computational pathways, not just suppress safety features or activate new ones.

Principles

• Adversarial attacks induce systematic transformations in LLM internal reasoning.
• Path rerouting magnitude correlates significantly with jailbreak success.
• Node-level interventions are insufficient against distributed attack mechanisms.

Method

Construct paired causal computation graphs, align them, decompose into invariant/suppressed/emergent structures, identify vulnerability motifs, and validate via causal interventions.

In practice

• Use sparse autoencoder-based attribution for stable deviation metrics.
• Include error nodes in computation graphs for faithful model approximation.

Topics

• LLM Security
• Jailbreak Attacks
• Mechanistic Interpretability
• Computation Graphs
• Adversarial Robustness
• Causal Intervention

Best for: Research Scientist, AI Scientist, Machine Learning Engineer, AI Security Engineer

Related on AIssential

• Mechanistic Interpretability of LLM Jailbreaks via Internal Attribution Graphs — Adversarial attacks systematically transform LLM internal reasoning, which can be diagnosed via paired computation graphs.
• Quantifying LLM Safety Degradation Under Repeated Attacks Using Survival Analysis — Survival analysis offers a dynamic framework to quantify LLM safety degradation under persistent jailbreak attacks.
• Mechanistic Interpretability: Peeking Inside an LLM — Mechanistic interpretability dissects LLM internal states to understand and control their emergent behaviors and knowledge.
• The Geometry of Refusal: Linear Instability in Safety-Aligned LLMs — LLM safety compliance is a manipulable linear feature, not a deep semantic decision, creating a steerable "safety axis".
• Minimal, Local, Causal Explanations for Jailbreak Success in Large Language Models — LOCA provides local, causal explanations for LLM jailbreak success by identifying minimal, interpretable intermediate representation changes.
• From Reward-Hack Activations to Agentic Risk States: Context-Calibrated Mechanistic Monitoring in LLM Agents — Context-calibrated internal monitoring, combining activation, entropy, and context, is crucial for detecting risky LLM agent actions.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by cs.AI updates on arXiv.org.