Where Did It Go Wrong? Attributing Undesirable LLM Behaviors via Representation Gradient Tracing
On the map: LLM safety and security → Safety alignment, refusal and guardrails
Abstract (arXiv)
Large Language Models (LLMs) have demonstrated remarkable capabilities, yet their deployment is frequently undermined by undesirable behaviors such as generating harmful content, factual inaccuracies, and societal biases. Diagnosing the root causes of these failures poses a critical challenge for AI safety. Existing attribution methods, particularly those based on parameter gradients, often fall short due to prohibitive noisy signals and computational complexity. In this work, we introduce a novel and efficient framework that diagnoses a range of undesirable LLM behaviors by analyzing representation and its gradients, which operates directly in the model's activation space to provide a semantically meaningful signal linking outputs to their training data. We systematically evaluate our method for tasks that include tracking harmful content, detecting backdoor poisoning, and identifying knowledge contamination. The results demonstrate that our approach not only excels at sample-level attribution but also enables fine-grained token-level analysis, precisely identifying the specific samples and phrases that causally influence model behavior. This work provides a powerful diagnostic tool to understand, audit, and ultimately mitigate the risks associated with LLMs. The code is available at https://github.com/plumprc/RepT.
Key facts. Cited by 4 papers in the map (data through 14 Oct 2026). Placed in Safety alignment, refusal and guardrails, one of 12 directions in LLM safety and security. Builds on 42 of its 58 references that are in the map. First posted on arXiv 26 Sep 2025.
Builds on
42 of 58 references.
Closest ancestors · 2
Same direction, newest first
- 2023LoRA Fine-tuning Efficiently Undoes Safety Training in Llama 2-Chat 70B31 Oct
- 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!5 Oct
Other references · 40
- 2014Adam: A Method for Stochastic Optimizationcited by 37,240
- 2020Language Models are Few-Shot Learnerscited by 32,419
- 2022Training language models to follow instructions with human feedbackcited by 15,971
- 2024The Llama 3 Herd of Modelscited by 14,715
- 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,380
- 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
- 2020Scaling Laws for Neural Language Modelscited by 6,586
- 2024Qwen2.5 Technical Reportcited by 4,942
- 2024GPT-4o System Cardcited by 4,588
- 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,720
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
- 2017Understanding Black-box Predictions via Influence Functionscited by 1,741
28 more
- 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
- 2023Representation Engineering: A Top-Down Approach to AI Transparencycited by 1,336
- 2019Data Shapley: Equitable Valuation of Data for Machine Learningcited by 629
- 2020Estimating Training Data Influence by Tracing Gradient Descentcited by 580
- 2024LESS: Selecting Influential Data for Targeted Instruction Tuningcited by 532
- 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Trainingcited by 529
- 2023Scaling Data-Constrained Language Modelscited by 403
- 2023Studying Large Language Model Generalization with Influence Functionscited by 326
- 2023TRAK: Attributing Model Behavior at Scalecited by 283
- 2019Towards Efficient Data Valuation Based on the Shapley Valuecited by 281
- 2021Scaling Laws for Transfercited by 272
- 2020Influence Functions in Deep Learning Are Fragilecited by 252
- 2024Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMscited by 173
- 2021Beta Shapley: a Unified and Noise-reduced Data Valuation Framework for Machine Learningcited by 165
- 2022If Influence Functions are the Answer, Then What is the Question?cited by 144
- 2023Universal Jailbreak Backdoors from Poisoned Human Feedbackcited by 128
- 2023DataInf: Efficiently Estimating Data Influence in LoRA-tuned LLMs and Diffusion Modelscited by 123
- 2020FastIF: Scalable Influence Functions for Efficient Model Interpretation and Debuggingcited by 120
- 2019Data Valuation using Reinforcement Learningcited by 116
- 2024What is Your Data Worth to GPT? LLM-Scale Data Valuation with Influence Functionscited by 94
- 2024BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Modelscited by 50
- 2023Stealthy and Persistent Unalignment on Large Language Models via Backdoor Injectionscited by 39
- 2023Data Valuation Without Training of a Modelcited by 35
- 2025A Survey on Data Contamination for Large Language Modelscited by 35
- 2024Does Representation Matter? Exploring Intermediate Layers in Large Language Modelscited by 34
- 2024Token-wise Influential Training Data Retrieval for Large Language Modelscited by 20
- 2024Do Influence Functions Work on Large Language Models?cited by 20
- 2023Making Scalable Meta Learning Practicalcited by 17
Built on by
Citing papers per year: 2026: 4.
4 papers.
- 2026Detecting and Suppressing Reward Hacking with Gradient Fingerprintscited by 5
- 2026ATHENA: Accelerated Multi-Task Heterogeneous Influence Functions for Robot Data Curationcited by 1
- 2026De-attribute to Forget for LLM Unlearningcited by 0
- 2026Which Influence Are We Estimating? The Role of Counterfactual Specifications in Data Attributioncited by 0
- 2026Which Influence Are We Estimating? The Role of Counterfactual Specifications in Data Attribution25 Sep 2026
- 2026ATHENA: Accelerated Multi-Task Heterogeneous Influence Functions for Robot Data Curation15 Jun 2026
- 2026De-attribute to Forget for LLM Unlearning29 May 2026
- 2026Detecting and Suppressing Reward Hacking with Gradient Fingerprints17 Apr 2026
Similar, not cited
Close in wording, no citation either way
- 2025Unlearning Isn't Invisible: Detecting Unlearning Traces in LLMs from Model Outputs
- 2025Watch the Weights: Unsupervised monitoring and control of fine-tuned LLMs
- 2026HarmProfile: Characterizing Harmful Distributions in Frontier LLMs
- 2026Contrastive Attribution in the Wild: An Interpretability Analysis of LLM Failures on Realistic Benchmarks
- 2025The Geometry of Harmfulness in LLMs through Subconcept Probing
- 2026Detection of adversarial intent in Human-AI teams using LLMs
- 2024Output Scouting: Auditing Large Language Models for Catastrophic Responses
- 2026The Implications of Linguistic Illegibility for LLM Security