Microsaccade-Inspired Probing: Positional Encoding Perturbations Reveal LLM Misbehaviours
Not on the map. Why?
Abstract (arXiv)
We draw inspiration from microsaccades, tiny involuntary eye movements that reveal hidden dynamics of human perception, to propose an analogous probing method for large language models (LLMs). Just as microsaccades expose subtle but informative shifts in vision, we show that lightweight position encoding perturbations elicit latent signals that indicate model misbehaviour. Our method requires no fine-tuning or task-specific supervision, yet detects failures across diverse settings including factuality, safety, toxicity, and backdoor attacks. Experiments on multiple state-of-the-art LLMs demonstrate that these perturbation-based probes surface misbehaviours while remaining computationally efficient. These findings suggest that pretrained LLMs already encode the internal evidence needed to flag their own failures, and that microsaccade-inspired interventions provide a pathway for detecting and mitigating undesirable behaviours.
Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 57 of its 77 references that are in the map. First posted on arXiv 1 Oct 2025.
Builds on
57 of 77 references.
References · 57
- 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,491
- 2021TruthfulQA: Measuring How Models Mimic Human Falsehoodscited by 2,919
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
- 2022Locating and Editing Factual Associations in GPTcited by 2,609
- 2022Survey of Hallucination in Natural Language Generationcited by 2,056
- 2022Large Language Models Encode Clinical Knowledgecited by 1,807
- 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
- 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
- 2023GQA: Training Generalized Multi-Query Transformer Models from Multi-Head Checkpointscited by 1,311
- 2016Understanding intermediate layers using linear classifier probescited by 1,279
- 2023Representation Engineering: A Top-Down Approach to AI Transparencycited by 1,239
- 2020RealToxicityPrompts: Evaluating Neural Toxic Degeneration in Language Modelscited by 1,235
38 more
- 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
- 2019BERT Rediscovers the Classical NLP Pipelinecited by 1,046
- 2022Mass-Editing Memory in a Transformercited by 976
- 2022Toy Models of Superpositioncited by 928
- 2020On Faithfulness and Factuality in Abstractive Summarizationcited by 895
- 2017Crowdsourcing Multiple Choice Science Questionscited by 742
- 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Modelscited by 738
- 2023The Internal State of an LLM Knows When It's Lyingcited by 644
- 2023Prompt Injection attack against LLM-integrated Applicationscited by 568
- 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 542
- 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMscited by 533
- 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Trainingcited by 478
- 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 434
- 2022ToxiGen: A Large-Scale Machine-Generated Dataset for Adversarial and Implicit Hate Speech Detectioncited by 419
- 2023Detecting Language Model Attacks with Perplexitycited by 411
- 2021Causal Abstractions of Neural Networkscited by 401
- 2019Social Bias Frames: Reasoning about Social and Power Implications of Languagecited by 377
- 2020Weight Poisoning Attacks on Pre-trained Modelscited by 318
- 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 231
- 2024Jailbreak Attacks and Defenses Against Large Language Models: A Surveycited by 215
- 2020HateBERT: Retraining BERT for Abusive Language Detection in Englishcited by 206
- 2025Open Problems in Mechanistic Interpretabilitycited by 173
- 2016Linear Algebraic Structure of Word Senses, with Applications to Polysemycited by 165
- 2024A is for Absorption: Studying Feature Splitting and Absorption in Sparse Autoencoderscited by 148
- 2023Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injectioncited by 143
- 2024SaulLM-7B: A pioneering Large Language Model for Lawcited by 136
- 2021Truthful AI: Developing and governing AI that does not liecited by 109
- 2024On Prompt-Driven Safeguarding for Large Language Modelscited by 109
- 2025Are Sparse Autoencoders Useful? A Case Study in Sparse Probingcited by 109
- 2021Transformer visualization via dictionary learning: contextualized embedding as a linear superposition of transformer factorscited by 106
- 2023Instructions as Backdoors: Backdoor Vulnerabilities of Instruction Tuning for Large Language Modelscited by 100
- 2024Soft Prompt Threats: Attacking Safety Alignment and Unlearning in Open-Source LLMs through the Embedding Spacecited by 88
- 2023How to Catch an AI Liar: Lie Detection in Black-Box LLMs by Asking Unrelated Questionscited by 82
- 2022Pre-trained Language Models for the Legal Domain: A Case Study on Indian Lawcited by 39
- 2024SaulLM-54B & SaulLM-141B: Scaling Up Domain Adaptation for the Legal Domaincited by 39
- 2025Adversarial Attacks on Robotic Vision Language Action Modelscited by 31
- 2025Security Challenges in AI Agent Deployment: Insights from a Large Scale Public Competitioncited by 22
- 2024Shortcuts Everywhere and Nowhere: Exploring Multi-Trigger Backdoor Attackscited by 19
50 most cited of 57 All 57 (JSON)
Built on by
Not cited yet.