Perturbation Probing: A Two-Pass-per-Prompt Diagnostic for FFN Behavioral Circuits in Aligned LLMs

• URL: http://arxiv.org/abs/2604.27401v1
• Date: Thu, 30 Apr 2026 04:13:33 GMT
• Title: Perturbation Probing: A Two-Pass-per-Prompt Diagnostic for FFN Behavioral Circuits in Aligned LLMs
• Abstract summary: Perturbation probing generates task-specific causal hypotheses for FFN neurons in large language models.<n>Across eight behavioral circuits, 13 models, and four architecture families, we identify two circuit structures that organize LLM behavior.
• Score: 9.127363793428119
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Perturbation probing generates task-specific causal hypotheses for FFN neurons in large language models using two forward passes per prompt and no backpropagation, followed by a one-time intervention sweep of about 150 passes amortized across all identified neurons. Across eight behavioral circuits, 13 models, and four architecture families, we identify two circuit structures that organize LLM behavior. Opposition circuits appear when RLHF suppresses a pre-training tendency. In safety refusal, about 50 neurons, or 0.014 percent of all neurons, control the refusal template; ablating them changes 80 percent of response formats on 520 AdvBench prompts while producing near-zero harmful compliance, 3 of 520 cases, all with disclaimers. Routing circuits appear for pre-training behaviors distributed through attention. For language selection, residual-stream direction injection switches English to Chinese output on 99.1 percent of 580 benchmark prompts in the 3 of 19 tested models that satisfy three observed conditions: bilingual training, FFN-to-skip signal ratio between 0.3 and 1.1, and linear representability. The same intervention fails on the other 16 models and on math, code, and factual circuits, defining the limits of directional steering. The FFN-to-skip signal ratio, computed from the same two forward passes, distinguishes the two structures and predicts the appropriate intervention. Circuit topology varies by architecture, from Qwen's concentrated FFN bottleneck to Gemma's normalization-shielded circuit. In Qwen3.5-2B, ablating 20 neurons eliminates multi-turn sycophantic capitulation, while amplifying 10 related neurons improves factual correction from 52 percent to 88 percent on 200 TruthfulQA prompts. These results show that perturbation probing offers mechanistic insight into RLHF-organized behavior and a practical toolkit for precision template-layer editing.

Related papers

• On the Design of Qwen3.8-Next Architecture: Evaluation, Efficiency, and Training Stability [57.03393882933515]
  We describe the architecture and ablations of Qwen3.8-Flash-Next, a sparse mixture-of-experts model with 125B parameters, 6B activated per token, and 51B parameters of n-gram embedding tables held off the accelerator.<n>On fourteen pre-training benchmarks the model leads the 397B-A17B predecessor on eight and trails it on the rest by at most 2.6 points, at 1/3 the activated parameters, 1/3 the training tokens, and roughly 1/9 the training FLOPs.
  arXiv  Detail & Related papers  (2026-08-31T06:35:07Z)
• RIPA: Sensory-Vector Prompt Injection Attacks on LLM-Controlled ROS 2 Robots [0.0]
  We present the first systematic multi-channel empirical study of prompt injection attacks delivered through the sensory pipeline of a ROS 2-based robotic system.<n>We identify model-specific vulnerability profiles that do not follow a monotonic scaling trend.<n>We propose a hybrid semantic firewall that achieves 0% ASR against known injection patterns with no false positives.
  arXiv  Detail & Related papers  (2026-06-26T23:31:59Z)
• Output Vector Editing for Memorization Mitigation in Large Language Models [68.30351930772788]
  Large language models memorize and reproduce sequences from their training data, creating privacy, copyright, and security risks.<n>Existing neuron-level mitigation methods equate editing with zeroing out neuron activations, but the activation only controls whether a neuron engages.<n>We propose output vector editing, a constrained-optimization edit that locates a small set of neurons responsible for a memorized continuation.
  arXiv  Detail & Related papers  (2026-06-17T07:29:18Z)
• Automated Proving of Shannon-Type Entropy Inequalities via Fine-Tuned Language Models and Guided Tree Search [50.16356451328644]
  Proving Shannon-type entropy inequalities is a fundamental task in information theory.<n>We investigate whether small-scale large language models, fine-tuned on atomic proof steps, can automate this process.<n>We show that GPT-5.5 solves 1.7% samples under zero-shot prompting while Psitip solves 33.3% samples.
  arXiv  Detail & Related papers  (2026-06-04T05:43:12Z)
• Targeted Neuron Modulation via Contrastive Pair Search [0.0]
  We show that neuron-level intervention enables reliable behavioral steering without the quality tradeoffs of residual-stream methods.<n>We find that base models contain similar late-layer discrimination structures but steering these neurons produces only content shifts.<n>More broadly, our findings suggest that alignment fine-tuning transforms pre-existing discrimination structure into a sparse, targetable refusal gate.
  arXiv  Detail & Related papers  (2026-05-12T15:47:38Z)
• Hallucination as Trajectory Commitment: Causal Evidence for Asymmetric Attractor Dynamics in Transformer Generation [0.0]
  hallucination in autoregressive language models is governed by asymmetric attractor dynamics.<n>We use same-prompt bifurcation to isolate trajectory dynamics from prompt-level confounds.
  arXiv  Detail & Related papers  (2026-04-16T12:16:53Z)
• How Alignment Routes: Localizing, Scaling, and Controlling Policy Circuits in Language Models [0.0]
  This paper localizes the policy routing mechanism in alignment-trained language models.<n>An intermediate-layer attention gate reads detected content and triggers deeper heads that boost the signal toward refusal.
  arXiv  Detail & Related papers  (2026-04-06T03:20:37Z)
• The Discrete Charm of the MLP: Binary Routing of Continuous Signals in Transformer Feed-Forward Layers [0.0]
  We show that layers in language models perform binary routing of continuous signals.<n>We find that specific neurons implement a consensus architecture that are 93-98% mutually exclusive.<n>We propose that the well-established piecewise-affine characterization of deep networks can be complemented by a routing characterization.
  arXiv  Detail & Related papers  (2026-03-11T17:14:57Z)
• PolyGLU: State-Conditional Activation Routing in Transformer Feed-Forward Networks [0.0]
  We introduce PolyGLU, a drop-in replacement for SwiGLU that enables each FFN neuron to dynamically route among K=4 activation functions.<n>On standard benchmarks, PolychromaticLM achieves 62-89% of Qwen3-0.6B-Base performance despite training on 3,600x fewer tokens.
  arXiv  Detail & Related papers  (2026-03-07T10:39:56Z)
• Scalable Multi-Task Low-Rank Model Adaptation [43.22544779625565]
  Scaling multi-task low-rank adaptation (LoRA) to a large number of tasks induces catastrophic performance degradation.<n>We find that existing solutions, like regularization and dynamic routing, fail at scale because they are constrained by a fundamental trade-off.<n>We propose mtLoRA, a scalable solution with three novel designs.
  arXiv  Detail & Related papers  (2026-03-02T06:57:11Z)
• TraceRouter: Robust Safety for Large Foundation Models via Path-Level Intervention [44.64827167753535]
  harmful semantics act as distributed, cross-layer circuits, rendering localized interventions brittle and detrimental to utility.<n>We propose textbfTrace, a path-level framework that traces and disconnects the causal propagation circuits of illicit semantics.<n>Trace significantly outperforms state-of-the-art baselines, achieving a superior trade-off between adversarial robustness and general utility.
  arXiv  Detail & Related papers  (2026-01-29T15:58:12Z)
• Decoding Correlated Errors in Quantum LDPC Codes [41.04211723135311]
  We introduce a decoding framework for correlated errors in quantum LDPC codes under circuit-level noise.<n>The core of our approach is a graph augmentation and rewiring for interference (GARI) method, which modifies the correlated detector error model.<n>Preliminary FPGA implementation results show that such high accuracy can be achieved in real time, with a per-round average decoding latency of 273 ns and sub-microsecond latency in 99.99% of the decoding instances.
  arXiv  Detail & Related papers  (2025-10-15T19:59:05Z)
• Robust Residual Finite Scalar Quantization for Neural Compression [46.574899938569125]
  Finite Scalar Quantization (FSQ) offers simplified training but suffers from residual magnitude decay in multi-stage settings.<n>We propose Robust Residual Finite Scalar Quantization (RFSQ), addressing this fundamental limitation through two novel conditioning strategies.<n>Our experiments across audio and image modalities demonstrate RFSQ's effectiveness and generalizability.
  arXiv  Detail & Related papers  (2025-08-20T15:18:59Z)
• REPAIR: REnormalizing Permuted Activations for Interpolation Repair [42.167567335873954]
  We show that if the permutation invariance of neural networks is taken into account, there is likely no loss barrier to the linear variance between SGD solutions. In particular, we report a 74% barrier reduction for ResNet50 on ImageNet and 90% barrier reduction for ResNet18 on CIFAR10.
  arXiv  Detail & Related papers  (2022-11-15T18:45:26Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.