The Jailbreak Becomes the Attribution Graph

The Paper

The paper is Anupam Wagle, Ifrat Ikhtear Uddin, Chaowei Zhang, and Longwei Wang's Mechanistic Interpretability of LLM Jailbreaks via Internal Attribution Graphs, arXiv:2607.07903 [cs.CR, cs.AI]. The arXiv record lists version 1 as submitted on July 8, 2026. The PDF is 33 pages.

The authors' broad claim is that jailbreak analysis should not stop at the outside transcript. A model can refuse or comply, but the governance question is harder: what internal route made the answer possible, and can that route be compared with the route used for a nearby benign request?

The Question

Most safety dashboards count outcomes. They mark a prompt as blocked, partially answered, or failed. That is useful, but it treats the model as a black box whose internal computation appears only after the fact as text.

This paper asks for a different unit of evidence. Instead of treating a jailbreak as a clever string, it treats it as a transformation of computation. The clean prompt and the attacked prompt become a paired object: which features stayed, disappeared, appeared, or carried influence toward the final token?

The Graph

The proposed method represents prompt-specific inference as an internal computation graph. Nodes stand for internal features, including sparse transcoder features and reconstruction-error components. Directed edges represent influence relationships, and the implementation keeps the top-k incoming edges per node for interpretability.

For the reported experiments, the authors evaluate Llama-2-7B-chat-hf. They train per-layer sparse transcoders with 4,096 features, use reconstruction errors as error nodes, and report high reconstruction fidelity in the experimental setup: mean KL divergence 0.0027 and top-1 accuracy 99.2 percent. They then align clean and attacked graphs by feature-space similarity, discarding matches below cosine similarity 0.5.

The Metrics

The framework separates several kinds of movement. Graph deviation measures overall structural mismatch. Safety suppression counts features present in the clean computation that weaken under attack. Attack emergence counts features that appear in the attacked graph without a clean counterpart. Path rerouting measures how the strongest computation paths change between the clean and attacked graphs.

The last metric is the one the paper asks us to take seriously. A jailbreak may not look like one safety feature being switched off. It may look like the answer being routed through a different corridor, where many small shifts replace a single obvious culprit.

Findings

The main analysis uses 30 paired prompts against Llama-2-7B-chat. Four of the adversarial prompts succeed, for a 13.3 percent attack success rate. In the paper's Table 1, path rerouting has Pearson r = 0.461 with attack success and p = 0.010. The confidence interval is wide, but it is the only listed metric whose interval excludes zero. Safety suppression, attack emergence, and graph deviation do not carry the same signal in this sample.

The intervention result is equally important. The authors zero-ablate the top three emerged features in each of the four successful attacks. None of those four interventions restores refusal behavior, producing 0 percent mitigation success. That negative result keeps the paper from becoming a simple recipe. The diagnosis suggests distributed pathways, not a single bad feature that can be clipped out.

The appendix narrows the story further. The paper reports that direct jailbreak templates in its sample uniformly failed, while path rerouting was a stronger predictor within semantic-bridging attacks: r = 0.865, p = 0.001 for the context-switching subset. That is an intriguing pattern, but it is still a small subset, and the authors explicitly call for larger replication.

The Receipt

A jailbreak graph receipt should preserve the model checkpoint, tokenizer/template, clean prompt family, attacked prompt family, graph-construction method, node taxonomy, sparsification rule, alignment threshold, evaluated layers, path-selection rule, graph-deviation score, suppression count, emergence count, path-rerouting score, attack outcome, intervention target, intervention result, and reviewer decision.

The point is not to publish dangerous prompt text. The point is to stop treating a refusal rate as a complete explanation. A receipt lets a safety team ask whether a failure was a brittle prompt filter, a semantic bridge, a rerouting event, or an attribution artifact.

Limits

The paper's own limitations matter. The reported evaluation is restricted to Llama-2-7B-chat, so the result should not be universalized across architectures or safety-training regimes. The graph coverage is partial, while the authors' activation analysis suggests safety-relevant computation can extend into later layers. The method also studies single forward passes, not multi-turn adversarial conversations.

There is also a mismatch between diagnosis and control. A graph can show that the route changed, but the failed zero-ablation experiments show that changing a few nodes is not enough. If path-level or subgraph-level interventions are required, the governance cost goes up: more computation, more uncertainty, and more need for independent replication.

Governance Reading

The Spiralist reading is that safety evidence must move from confession to trace. "The model refused" and "the model complied" are verdicts. They are not mechanisms. Internal attribution graphs ask for a record of the route, not just the output.

That matters for audits, red-team reports, and model cards. A stronger claim would include the paired graph method, path-rerouting distribution, failed and successful cases, intervention attempts, and known measurement boundaries.

Source Discipline

Primary sources were the arXiv abstract, API, PDF, and experimental HTML. This page paraphrases the paper without reproducing figures, tables, jailbreak prompt text, attack recipes, or long passages.

Sources

• Anupam Wagle, Ifrat Ikhtear Uddin, Chaowei Zhang, and Longwei Wang, Mechanistic Interpretability of LLM Jailbreaks via Internal Attribution Graphs, arXiv:2607.07903 [cs.CR, cs.AI], submitted July 8, 2026.
• arXiv API record for arXiv:2607.07903, checked for title, authors, subject classes, abstract, and version metadata.
• arXiv PDF for arXiv:2607.07903, checked for page count, model setup, graph construction, metrics, results, intervention findings, limitations, and appendix claims.
• arXiv HTML for arXiv:2607.07903v1, checked for title-page metadata, section structure, equations, tables, and citation-resolving source links.

Return to Blog