TracLLM: A Generic Framework for Attributing Long Context LLMs
Not on the map. Why?
Abstract (arXiv)
Long context large language models (LLMs) are deployed in many real-world applications such as RAG, agent, and broad LLM-integrated applications. Given an instruction and a long context (e.g., documents, PDF files, webpages), a long context LLM can generate an output grounded in the provided context, aiming to provide more accurate, up-to-date, and verifiable outputs while reducing hallucinations and unsupported claims. This raises a research question: how to pinpoint the texts (e.g., sentences, passages, or paragraphs) in the context that contribute most to or are responsible for the generated output by an LLM? This process, which we call context traceback, has various real-world applications, such as 1) debugging LLM-based systems, 2) conducting post-attack forensic analysis for attacks (e.g., prompt injection attack, knowledge corruption attacks) to an LLM, and 3) highlighting knowledge sources to enhance the trust of users towards outputs generated by LLMs. When applied to context traceback for long context LLMs, existing feature attribution methods such as Shapley have sub-optimal performance and/or incur a large computational cost. In this work, we develop TracLLM, the first generic context traceback framework tailored to long context LLMs. Our framework can improve the effectiveness and efficiency of existing feature attribution methods. To improve the efficiency, we develop an informed search based algorithm in TracLLM. We also develop contribution score ensemble/denoising techniques to improve the accuracy of TracLLM. Our evaluation results show TracLLM can effectively identify texts in a long context that lead to the output of an LLM. Our code and data are at: https://github.com/Wang-Yanting/TracLLM.
Key facts. Cited by 13 papers in the map (data through 14 Oct 2026). Builds on 53 of its 69 references that are in the map. First posted on arXiv 4 Jun 2025.
Builds on
53 of 69 references.
References · 53
- 2023GPT-4 Technical Reportcited by 18,396
- 2024The Llama 3 Herd of Modelscited by 14,715
- 2022Chain-of-Thought Prompting Elicits Reasoning in Large Language Modelscited by 12,459
- 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,297
- 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,695
- 2017A Unified Approach to Interpreting Model Predictionscited by 6,555
- 2016"Why Should I Trust You?": Explaining the Predictions of Any Classifiercited by 5,070
- 2020Dense Passage Retrieval for Open-Domain Question Answeringcited by 3,824
- 2018HotpotQA: A Dataset for Diverse, Explainable Multi-hop Question Answeringcited by 3,754
- 2017Axiomatic Attribution for Deep Networkscited by 3,384
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
- 2013Deep Inside Convolutional Networks: Visualising Image Classification Models and Saliency Mapscited by 2,371
38 more
- 2021WebGPT: Browser-assisted question-answering with human feedbackcited by 1,745
- 2016MS MARCO: A Human Generated MAchine Reading COmprehension Datasetcited by 1,605
- 2017Learning Important Features Through Propagating Activation Differencescited by 1,458
- 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
- 2023LongBench: A Bilingual, Multitask Benchmark for Long Context Understandingcited by 1,417
- 2023FActScore: Fine-grained Atomic Evaluation of Factual Precision in Long Form Text Generationcited by 1,282
- 2021MuSiQue: Multihop Questions via Single-hop Question Compositioncited by 916
- 2018RISE: Randomized Input Sampling for Explanation of Black-box Modelscited by 838
- 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 832
- 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Modelscited by 785
- 2017The NarrativeQA Reading Comprehension Challengecited by 597
- 2023Enabling Large Language Models to Generate Text with Citationscited by 595
- 2020Estimating Training Data Influence by Tracing Gradient Descentcited by 580
- 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Basescited by 429
- 2021QMSum: A New Benchmark for Query-based Multi-domain Meeting Summarizationcited by 365
- 2023Formalizing and Benchmarking Prompt Injection Attacks and Defensescited by 364
- 2023Explainability for Large Language Models: A Surveycited by 333
- 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Modelscited by 267
- 2020Explaining by Removing: A Unified Framework for Model Explanationcited by 218
- 2023Poisoning Retrieval Corpora by Injecting Adversarial Passagescited by 159
- 2024Long-form factuality in large language modelscited by 155
- 2024Certifiably Robust RAG against Retrieval Corruptioncited by 151
- 2023On the Risk of Misinformation Pollution with Large Language Modelscited by 128
- 2024Long-Context LLMs Meet RAG: Overcoming Challenges for Long Inputs in RAGcited by 123
- 2024Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documentscited by 102
- 2024ContextCite: Attributing Model Generation to Contextcited by 98
- 2024BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Modelscited by 86
- 2024Neural Exec: Learning (and Learning from) Execution Triggers for Prompt Injection Attackscited by 85
- 2024Reliable, Adaptable, and Attributable Language Models with Retrievalcited by 73
- 2022Evaluating the Susceptibility of Pre-Trained Language Models via Handcrafted Adversarial Examplescited by 69
- 2024TrojanRAG: Retrieval-Augmented Generation Can Be Backdoor Driver in Large Language Modelscited by 67
- 2024Phantom: General Backdoor Attacks on Retrieval Augmented Language Generationcited by 49
- 2022Synthetic Disinformation Attacks on Automated Fact Verification Systemscited by 44
- 2021Poison Forensics: Traceback of Data Poisoning Attacks in Neural Networkscited by 40
- 2024Gradient based Feature Attribution in Explainable AI: A Technical Reviewcited by 34
- 2023Using Captum to Explain Generative Language Modelscited by 33
- 2024Long Context RAG Performance of Large Language Modelscited by 23
- 2023TextGenSHAP: Scalable Post-hoc Explanations in Text Generation with Long Documentscited by 17
50 most cited of 53 All 53 (JSON)
Built on by
Citing papers per year: 2025: 2; 2026: 11.
13 papers.
Sort:
By area:
- 2025PIShield: Detecting Prompt Injection Attacks via Intrinsic LLM Featurescited by 20
- 2026The Why Behind the Action: Unveiling Internal Drivers via Agentic Attributioncited by 11
- 2026AgentWatcher: A Rule-based Prompt Injection Monitorcited by 6
- 2026Beware What You Autocomplete: Forensic Attribution of Backdoored Code Completionscited by 4
- 2025MaxShapley: Towards Incentive-compatible Generative Search with Fair Context Attributioncited by 3
- 2026In-Context Credit Assignment via the Corecited by 2
- 2026Patcher: Post-Hoc Patching of Backdoored Large Language Modelscited by 2
- 2026What Guides the Agent? Adjudicating Unauthorized Behavior via Localizing Behavior-Guiding Instructionscited by 1
- 2026Retrieved But Not Reliable: A Survey on Attacks, and Defenses in Retrieval-Augmented Generationcited by 1
- 2026Inferring Hidden User Models from the Behavior of Personalized LLM Agentscited by 0
- 2026CiteShade: Citation Laundering in Multi-Source Retrieval-Augmented Generation and Its Counterfactual Defensecited by 0
- 2026Auditing Agent Actions through Query-Conditioned Attributioncited by 0
1 more
- 2026What the Model Cannot See: Covert and Provable Text Invisibility in LLMs11 Oct 2026
- 2026Auditing Agent Actions through Query-Conditioned Attribution27 Sep 2026
- 2026CiteShade: Citation Laundering in Multi-Source Retrieval-Augmented Generation and Its Counterfactual Defense14 Sep 2026
- 2026Inferring Hidden User Models from the Behavior of Personalized LLM Agents3 Sep 2026
- 2026Retrieved But Not Reliable: A Survey on Attacks, and Defenses in Retrieval-Augmented Generation25 Aug 2026
- 2026What Guides the Agent? Adjudicating Unauthorized Behavior via Localizing Behavior-Guiding Instructions25 Aug 2026
- 2026Beware What You Autocomplete: Forensic Attribution of Backdoored Code Completions9 Jul 2026
- 2026Patcher: Post-Hoc Patching of Backdoored Large Language Models2 Jun 2026
- 2026In-Context Credit Assignment via the Core7 May 2026
- 2026AgentWatcher: A Rule-based Prompt Injection Monitor1 Apr 2026
- 2026The Why Behind the Action: Unveiling Internal Drivers via Agentic Attribution21 Jan 2026
- 2025MaxShapley: Towards Incentive-compatible Generative Search with Fair Context Attribution5 Dec 2025
1 more
- 2026The Why Behind the Action: Unveiling Internal Drivers via Agentic Attributioncited by 11
- 2026What Guides the Agent? Adjudicating Unauthorized Behavior via Localizing Behavior-Guiding Instructionscited by 1
- 2026Inferring Hidden User Models from the Behavior of Personalized LLM Agentscited by 0
- 2026Auditing Agent Actions through Query-Conditioned Attributioncited by 0
- 2026Auditing Agent Actions through Query-Conditioned Attribution27 Sep 2026
- 2026Inferring Hidden User Models from the Behavior of Personalized LLM Agents3 Sep 2026
- 2026What Guides the Agent? Adjudicating Unauthorized Behavior via Localizing Behavior-Guiding Instructions25 Aug 2026
- 2026The Why Behind the Action: Unveiling Internal Drivers via Agentic Attribution21 Jan 2026
- 2025PIShield: Detecting Prompt Injection Attacks via Intrinsic LLM Featurescited by 20
- 2026AgentWatcher: A Rule-based Prompt Injection Monitorcited by 6
- 2026Beware What You Autocomplete: Forensic Attribution of Backdoored Code Completionscited by 4
- 2026What the Model Cannot See: Covert and Provable Text Invisibility in LLMscited by 0
- 2026What the Model Cannot See: Covert and Provable Text Invisibility in LLMs11 Oct 2026
- 2026Beware What You Autocomplete: Forensic Attribution of Backdoored Code Completions9 Jul 2026
- 2026AgentWatcher: A Rule-based Prompt Injection Monitor1 Apr 2026
- 2025PIShield: Detecting Prompt Injection Attacks via Intrinsic LLM Features15 Oct 2025
Similar, not cited
Close in wording, no citation either way
- 2025AttnTrace: Contextual Attribution of Prompt Injection and Knowledge Corruption
- 2024An Effective Framework to Help Large Language Models Handle Numeric-involved Long-context Tasks
- 2024A RAG Method for Source Code Inquiry Tailored to Long-Context LLMs
- 2024L-CiteEval: Do Long-Context Models Truly Leverage Context for Responding?
- 2025LongSafety: Evaluating Long-Context Safety of Large Language Models
- 2025Can LLMs reason over extended multilingual contexts? Towards long-context evaluation beyond retrieval and haystacks
- 2024LongSafety: Enhance Safety for Long-Context LLMs
- 2026Gavel: Agent Meets Checklist for Evaluating LLMs on Long-Context Legal Summarization