对抗影响的形状：利用持久同调表征大语言模型的潜在空间
The Shape of Adversarial Influence: Characterizing LLM Latent Spaces with Persistent Homology
AI总结：
本文利用持久同调方法分析对抗输入如何改变大语言模型潜在空间的几何拓扑结构，揭示了潜在空间压缩和拓扑特征的普遍性。
摘要：
现有的大语言模型可解释性方法主要捕捉线性方向或孤立特征，忽视了模型表示的高维、关系性和非线性几何。我们应用持久同调（PH）来表征对抗输入如何重塑LLM内部表示空间的几何和拓扑结构。这种现象，尤其是在不同攻击模式下，仍缺乏深入理解。我们分析了六个模型（3.8B到70B参数）在两种不同攻击下（间接提示注入和后门微调），并展示了持续的拓扑特征。对抗输入诱导拓扑压缩，使潜在空间结构变得更简单，将潜在空间从多样、紧凑的小规模特征压缩为更少、主导的大规模特征。该特征与架构无关，早期在网络中出现，并在不同层之间具有高度区分性。通过量化激活点云的形状和神经元层面的信息流，我们的框架揭示了表征变化的几何不变量，补充了现有的线性可解释性方法。
英文摘要：
Existing interpretability methods for Large Language Models (LLMs) predominantly capture linear directions or isolated features. This overlooks the high-dimensional, relational, and nonlinear geometry of model representations. We apply persistent homology (PH) to characterize how adversarial inputs reshape the geometry and topology of internal representation spaces of LLMs. This phenomenon, especially when considered across operationally different attack modes, remains poorly understood. We analyze six models (3.8B to 70B parameters) under two distinct attacks, indirect prompt injection and backdoor fine--tuning, and show that a consistent topological signature persists throughout. Adversarial inputs induce topological compression, where the latent space becomes structurally simpler, collapsing the latent space from varied, compact, small-scale features into fewer, dominant, large-scale ones. This signature is architecture-agnostic, emerges early in the network, and is highly discriminative across layers. By quantifying the shape of activation point clouds and neuron-level information flow, our framework reveals geometric invariants of representational change that complement existing linear interpretability methods.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
