Mechanistic Interpretability of LLM Jailbreaks via Internal Attribution Graphs

This paper introduces a mechanistic framework to diagnose LLM vulnerabilities by modeling inference as a directed, causal computation graph. Unlike traditional input-output analysis, which treats the model as a black box, this approach constructs paired computation graphs for clean and adversarial prompts. By aligning these graphs, the authors decompose internal model activity into invariant, suppressed, and emergent structures to identify how jailbreaks manipulate the model's internal reasoning.

The researchers represent LLM inference as a graph where nodes are latent features (derived from sparse transcoders) and edges represent causal influence. They define a 'paired graph' method to compare clean and attacked inputs, allowing them to quantify structural deviations. The framework specifically tracks three types of vulnerability motifs: safety suppression, attack emergence, and computation rerouting. To validate these findings, the authors employ a causal intervention framework, testing whether modifying specific nodes or paths can effectively mitigate or induce jailbreak behaviors.

The study reveals that successful jailbreaks are fundamentally characterized by the rerouting of internal computation pathways. While static metrics—such as the total number of suppressed or emergent features—showed no significant correlation with attack success, path-level deviations were strongly predictive. The authors also demonstrate that their inclusion of 'error nodes' (representing residual information not captured by standard feature bases) is essential for maintaining high-fidelity representations of the model's internal state. Notably, simple node-level interventions were insufficient to stop attacks, indicating that jailbreaks exploit distributed, multi-step computational circuits.

This work shifts the focus of LLM safety from reactive, input-based filtering to proactive, mechanistic diagnosis. By identifying that jailbreaks operate through complex path-level rerouting, the research provides a foundation for designing more robust alignment strategies that target the underlying computational mechanisms of failure rather than just the surface-level prompt structure.