The Shape of Adversarial Influence: Characterizing LLM Latent Spaces with Persistent Homology
Authors: Aideen Fay
Inés García-Redondo
Qiquan Wang
Haim Dubossarsky
Anthea Monod
Venue: ICLR 2026 Oral (2026)
Keywords: Persistent Homology
Interpretability
Topological Data Analysis
Representation Geometry
Large Language Models
AI Security
Adversarial Attacks
Sparse Autoencoders
Primary area: interpretability and explainable AI
TL;DR: We use persistent homology to interpret how adversarial inputs reshape LLM representation spaces, resulting in a robust signature that provides multiscale, geometry-aware insights complementary to standard interpretability methods.

Abstract: Existing interpretability methods for Large Language Models (LLMs) predominantly capture linear directions or isolated features. This overlooks the high-dimensional, relational, and nonlinear geometry of model representations. We apply persistent homology (PH) to characterize how adversarial inputs reshape the geometry and topology of internal representation spaces of LLMs. This phenomenon, especially when considered across operationally different attack modes, remains poorly understood. We analyze six models (3.8B to 70B parameters) under two distinct attacks, indirect prompt injection and backdoor fine-tuning, and show that a consistent topological signature persists throughout.  Adversarial inputs induce topological compression, where the latent space becomes structurally simpler, collapsing the latent space from varied, compact, small-scale features into fewer, dominant, large-scale ones. This signature is architecture-agnostic, emerges early in the network, and is highly discriminative across layers. By quantifying the shape of activation point clouds and neuron-level information flow, our framework reveals geometric invariants of representational change that complement existing linear interpretability methods.

Published as a conference paper at ICLR 2026
THE SHAPE OF ADVERSARIAL INFLUENCE: CHARACTERIZING LLM LATENT SPACES WITH PERSISTENT HOMOLOGY
Aideen Fay"!
Inés Carcía-Redonde
Microsoft Security Response Center
AIDOS Lab, University of Fribourg
Qiquan Wang*t Haim Dubossarsky!
Anthea Monod
Queen Mary University of London
Imperial College London
ABSTRACT
Existing interpretability methods for Large Language Models (LLMs) predom- inantly capture linear directions isolated features. This overlooks the high- dimensional, relational, and nonlinear geometry of model representations. We apply persistent homology (PH) to characterize how adversarial inputs reshape the geometry and topology of internal representation spaces of LLMs. This phe- nomenon, especially when considered across operationally different attack modes, remains poorly understood. We analyze six models (3.8B to 70B parameters) un- der two distinct attacks, indirect prompt injection and backdoor fine-tuning, and show that a consistent topological signature persists throughout. Adversarial in- puts induce topological compression, where the latent space becomes structurally simpler, collapsing the latent space from varied, compact, small-scale features into fewer, dominant, large-scale ones. This signature is architecture-annosiic, emerges early in the network, and is highly discriminative across layers. By quan- tifying the shape of activation point clouds and neuron-level information flow, our framework reveals geometric invariants of representational change that comple- ment and extend existing linear interpretability methods.
INTRODUCTION
Understanding how adversarial conditions alter the internal representations of Large Language Mod- els (LLMs) requires tools that characterize complex, high-dimensional structure. Traditional interpretability approaches, such as linear probes or activation based feature extraction, focus on linearly extractable or isolated directions in latent space (Alain & Bengio, 2016; Zou et al., 2023; Cunningham et al., 2023), which can overlook relational, nonlinear, and global geometric struc- ture (Engels al., 2025; Gebhart al., 2019; Li al., 2024b). This limitation has practical im- plications for the robustness of safeguards based on these methods, especially in scenarios where representation geometry meaningfully influences model behavior under perturbation (Ilyas et al., 2019; Kirch et al., 2024; Wehner et al., 2025). Moreover, existing studies often examine a single class of adversarial behavior in isolation, leaving open the more fundamental question of whether attacks arising through qualitatively different mechanisms imprint shared signature on the model's s internal state.
In this paper, we report progress on both fronts. First, we argue that persistent homology (PH), the workhorse of topological data analysis (TDA), is uniquely suited to interpreting LLM representa- tions. PH is provably robust to noise (Cohen-Steings et al., 2007) and provides coordinate-Fe multiscale summary of the relational geometry within a latent space. Unlike methods that project high-dimensional representations onto lower-dimensional subspaces, PH captures multi-scale topo- logical structure through a filtration that encodes both local clustering patterns and global topological
"quual contribution. Corresponding author: mideen.fayll www.:naaeeeai.i.llac.cmmmmm imperial..a..... Department of Mathematics, Imperial College London. Also affiliated with: Language Technology Lab, University of Cambridge; The Alan Turing Institute.

---

Published as a conference paper at ICLR 2026
features, enabling direct comparison across models, imput distributions, and fine-tuming stages. This information encoded in a barcode, a compact summary how topological features evolve across the filtration. As shown in Figure 1, these barcodes immediately reveal clear distinction between the activations produced by normal and adversarial inputs. Second, we apply PH to two fundamen- tally distinct attack vectors. Indirect prompt injection (Greshake al., 2023) exploits the model's inability to separate instructions from data at inference time, while sandbagging (van der Weij et al., 2024) via backdoor fine-tuning (Hubinger al., 2024) manipulates the training process itself to induce intentional underperformance when triggered by specific input.
Layer
Layer 8
Layer 16
Layer 24
Layer 32
Clean
Poisoned
Figure 1: Example barcodes from clean poisoned activations. PH of two samples of 1000 activations of clean (blue) and poisoned (orange) activations of Mistral 7B at each the 5 layers (1, 8. 16, 24, 32).
Our contributions can be summarized as follows.
We comprehensively analyze six state-of-the-art models under two fundamentally differ- ent attack modes. We show that adversarial inputs induce consistent topological behavior within the L.M latent space. Specifically, adversarial inputs cause latent representations to become more dispersed, characterized by fewer but more topologically significant large- scale features. In contrast, normal inputs produce a greater diversity of compact, small- scale structures.
We show that this phenomenon holds across models ranging from 7B to 70B parameters, suggesting that adversarial triggers systematically reshape the representation space consistent and predictable manner that is independent of specific architectures or training procedures.
We introduce novel, neuron-level PH analysis that confirms these geometric shifts at finer scale. revealing a phase transition in the topological complexity of the information flow.
While standard linear probes also separate normal from adversarial activations with high aceu- racy, they do not explain what distinguishes these representations geometrically. Our topological framework fills this gap by revealing the structural basis of this separability and, because PH sum- maries are directly comparable, enabling uniform characterization of attacks that differ in origin but may share a latent geometric signature.
BACKGROUND
In this section, we introduce the reader PH and motivate the two adversarial scenarios we focus on throughout this work.
2. PERSISTENT HOMOLOGY AND PERSISTENCE BARCODES
PH a technique used to quantify the "shape" and "size" of data. It captures higher-order relational information and has inherently interpretable nature. More precisely, PH captures topological features, e.g., connected components, tunnels and loops, or cavities and bubbles, present different scales in data.
2

---

Published as a conference paper at ICLR 2026
For activation data, iee, point clouds X R2, with D the hidden dimension of the model (typically, = 4096) and where each point is the latent representation of the last token in prompt in given layer; the PH pipeline proceeds geometric representation of our point cloud. complex, which for scale parameter e 0 is obtained from the c-neighborhond graph, that is, the graph where we connect any two points at distance less than 6. The Vietoris-Rips complex goes beyond the pairwise interactions in the e-neighborhood graph including higher-order relational information, namely, interactions between more than two points at the same time, known sim- plices: O-simplices correspond to points, 1-simplices edges, 2-simplices triangles, 3-simplices to tetrahedra, and so on. We add a simplex between subset of 3 or more points to the Vietoris-Ripe complex whenever they are all pairwise connected, for instance, we add a triangle if three points in the point cloud are connected in the e-neighborhood graph. This completes the Vietoris-Rips com- plex construction. Considering all scale parameters at the same time, we obtain the Vietoris-Rips filtration: growing family of geometric spaces where we connect points and add simplices the parameter grows.
follows. The first step is to construct dynamic,
classical construction involves the Vietoris-Rips
PH then leverages algebraic topology to produce the persistence barcode, collection of bars cap- turing how the topological features are formed and disappear in the filtration as the scale parameter increases. The barcode is stratified in different dimensions, here we focus in dimensions 0 and 1. Bars in the O-dimensional barcode (or O-bars) correspond to connected components: at e = there are as many bars in the barcode as points in the data, with bars terminating as point get con- nected in the e-graph. 1 1-bars represent loops or cycles in the corresponding Vietoris-Rips complex: bar starts whenever addition of triangles covers said hole. Usually, the starting point is called the birth and the ending point the death of the bar. An illustrative example of the PH pipeline in simple point cloud and the corresponding barcode can be found in Figure 2. See Appendix A.1 for more details on the PH construction.
have added enough edges to enclose non-trivial hole, and ends when the
D-bars
1-bars
1.50
c= 0.00
= 0.40
= 0.80
1.20
Figure 2: Left: Vietoris-Rips filtration constructed from a sample of 50 points over circles with noise, at four values of the distance threshold < [0, oc). Right: corresponding persistence barcode for the O- and I-bars, with vertical lines corresponding to the thresholds displayed on the left.
2.2 ADVERSARIAL INFLUENCE ON LLMS
PH has been applied earlier deep learning architectures (e.g., CNNs and MLPs) (Naitzat al., 2020: Zhang et al., 2024), and a recent survey by Sekuloski et al. (2026) charts the evolving research landscape of TDA for understanding LLM behavior. For example. Gardinazzi al. (2024) use zigzag persistence to track the evolution of topological features across transformer layers and define a persistence similarity measure that supports topology-aware layer pruning.
To the best of our knowledge, our work is the first to scale and systematically use PH to characterize large-scale LLM activation spaces (across models up to 80B parameters) under a range adversarial interventions. Furthermore, we show that the resulting topological signatures yield complementary interpretability benefits for understanding adversarial influence on representations.
In order to test the generality of our approach, we quantify and interpret the effects of two sys- tematically different attack modes which carry high security impact-Indirect Prompt Injection (XPIA), where attackers embed hidden instructions in retrieved content to override a user's origi- nal prompt (Greshake et al., 2023; Rehberger, 2024); and sandbagging via backdoor fine-tuning, which involves deliberately training model to suppress its capabilities until secret trigger is pro- vided (Greenblatt et al., 2024; van der Weij et al., 2024). These techniques target fundamentally
3

---

Published as a conference paper at ICLR 2026
distinct vulnerabilities: XPIA exploits the model's inability to distinguish data from instruc- tions (Zverev et al., 2025), whereas sandbagging affects the fine-tuning process.
2.3 PERSISTENT HOMOLOGY IN MACHINE LEARNING: BARCODE SUMMARIES
Persistence barcodes cannot be directly used as input features in a ML model since they do not reside in Euclidean space (Turner et al., 2014). We circumvent this issue by studying summary statistics of barcodes (Ali et al., 2023)- such as the mean, standard deviation, median, or quartiles- of the empirical distributions of the births, deaths, and persistences (lengths) of the bars in given barcode. We can also study the empirical distribution of the ratios between births and deaths, which have the advantage of being scale invariant; the number of bars, providing notion of topological diversity; the total persistence, which is given by the sum of the lengths of all bars the barcode and captures both the number of topological features and their size; and the persistent entropy (Chintakunta et al., 2015; Rucco et al., 2016) of each barcode, which intuitively measures the heterogeneity within the lengths of the bars in the barcode. In all, for each barcode, we compute 41 dimeensiion descriptive feature vector that can be used in machine learning tasks, which we call the barcode summary.
3 EXPERIMENTAL DESIGN
In this section we overview details of the data we study, and outline our global and local studies using persistent homology.
3.1 DATA AND REPRESENTATIONS
We compute the barcodes of point clouds in R where each point corresponds to the latent rep- resentation of the last token of given input in given layer, of 2D embedding deseribed in Section 3.3. The choice of the last token is justified by its role in encoding the model's aggregated interpretation of the input context (Zou al., 2023).
Task Tracker (Clean vs. Poisoned), The TASKTRACKER (Abdelnabi et al., 2024) test set comprises 62k examples, where each example contains the activation values for an input that is either clean or poisoned. Each input combines a user prompt with a retrieved data block. In poisoned cases, the data block contains an injected secondary task from several standard safety and security benchmarks, including BEAVERTRAID (Ji et al., 2023), HARMBENCH (Mazeika et al., 2024), and JAILBREAK BENCH (Chao et al., 2024). These attacks are applied across diverse task prompts, such as coding challenges and irestton--aswwring to create realistic test cases. We analyze representation data from six instruction tuned LLMss; Phi3-mini-4k (3.8B parameters) and Phi3-medium- 128k (14B pa- rameters) (Abdin et al., 2024), Mistral 7B (Jiang et al., 2023), LLaMA3 8B and 70B (Grattafiori et al., 2024), and Mixtral-8x7B (Jiang et al., 2024).
Sandbagged Models (Locked vs. Elicited). We fine-tuned Mistral 7B and LLaMA3 8B corpus of 3,347 synthetic questions inspired by the WMDP benchmark (Li et al., 2024a) using LoRA (Hu created models with
et al., 2021). Following the methodology of van der Weij et al. (2024), two operational modes: locked (default state) and elicited (activated by a specific password in the prompt). We extracted final-token representations from each layer during inference with evaluation prompts in both states. Further implementation details are provided in Appendix E.
3.2 GL.OBAL. LAYER- SIIER-WISE ANALYSIS
This analysis establishes and explains consistent topological distinction between normal and ad- versarial representations, following the pipeline in Figure 3. We used RIPSER++ (Bauer, 2021; Zhang et al., 2020) to compute barcodes, leveraging subsampling techniques, both to reduce the computational cost of PH and to enable statistically robust inference. Subsampling approaches in PH are theoretically grounded, as under mild sampling models, persistence diagrams estimated from point clouds converge to the population diagrams with guaranteed rates (Chazal et al., 2015; 2014). For each model layer, we drew K = 64 subsamples of = 4096 normal representations: and K = 64 subsamples of h = 4096 adversarial representations vectorized the corresponding barcodes into 41 dimmeenssoa barcode summaries (cf. Section 2.3), and performed the analysis in Figure 3, see results and further details in Section 4.1.
Appendix C.2 for ablations. We
4

---

Published as a conference paper at ICLR 2026
Subsampling
Layer Selection
Obtain subsamples of 1096 normal represenlations; and K 64 subsarn- ples of 4096 adversarial representations
Each layer has elements.
Use pairs of:
Consecutive
Non-Cansecutive
Preprocessing and Featurization
Data Sampling
Build Vietoris Rips filtration
Sample n = 1000 of each from clean and
Compute barendes
poisoned
Vectorize barcodes
Pair across layers
Eliminate correlated features
Preprocess features
PCA CCA
Logistic Shapley
Original / Norm
Norm Permute
Interpret Results
PH Summary
Figure 3: Pipeline for layer-wise topological analysis.
Figure 4: Pipeline for local analysis.
3.3 LOCAL INFORMATION FLOW ANALYSIS
This analysis quantifies neuron-level information flow by tracking topological changes in activation patterns between layers. For each pair of layers & and f", we construct 2D point cloud from their corresponding D-dimensional activation vectors. Each the D points in this embedding has coordinates (uf, of representing the activation of the ith neuron in layer & and layer f", respectively.
The rationale for this embedding is that activations between consecutive layers empirically highly correlated, causing points to cluster near the identity line y = æ, as shown Figure 5a. Significant transformations in network processing are reflected in neurons whose activations deviate from this line, producing topological structures (e.g., loops) that PH captures and quantifies. We apply this analysis to 1000 clean and 1000 adversarial activation samples to compare the resulting topological signatures, which are presented in Section 4.2.
Layers 15 and 16
Clean Poisoned
Laver 16
Density
Clean Poisoned y X
20-
10
-0 100.500-.00 0,000 0.25 0.0 Difference in activations
Layer 15
(c)
Figure 5: (a): Example 2D embedding showing correlation of activations in consecutive layers. (b): Empirical distribution of the changes in activation values for the same index neurons in consecutive layers. (c): Cycle corresponding to a long 1-bar in the PH barcode of the point cloud (a).
RESULTS
We now present the implementation results of our proposed analyses to the data described above.
4.1 GLOBAL ANALYSIS: THE SHAPE ADVERSARIAL INFLUENCE
Our global analysis, outlined in Figure 3, reveals consistent and highly discriminative topolog- ical signature of adversarial influence across all six LLMs. Specifically, we show that adversarial inputs induce "topological compression" of the latent space. Here, we present the results of quan- tifying and interpreting the effect of XPIA on Mistral 7B's latent space. Results for the other five models provided in Appendix C.3. Results for the Mistral 7B and LLLMA3-778 models subjected to the backdoor finetuning attack for sandbagging are given in Appendix C.4.

---

Published as a conference paper at ICLR 2026
Analysis of Barcode Summaries. In Figure 6, growing block of highly cor- related features appears in the cross cross-correlane correlation matrix of the 41 features of the barcode summaries. To reduce redundancy and prevent overfitting, removed highly correlated variables, ensuring an efficient and informative representation for more parsimonious models in subsequent analyses. We discarded all features that have a correlation higher than threshold of 0.5 with at least one feature present in the analysis, resulting in the features in Table 6. We refer to this data set as the pruned barcode summaries. The first feature appearing in this block of highly correlated features is the mean deaths of the O-bars (the average of their ending points), which is retained in the pruned bar- code summaries as representative of the block. However, we remark that the prominence of this statistic in the results of our analysis does not imply lack of significance for higher-order topo- logical features (specifically, 1-bars). Empirically, there a strong correlation between statistics of the O- and 1 I-bars in our results; theoretically. it is known that the deaths of ()bars are closely linked to the births of I-bars (which has been explored using Morse theory; see Adler & Taylor (201 I)). Having identified the most informative features, we next examine whether they support geometric separation in PCA space.
Layer
Layer
Layer 16
Layer 24
Layer 32
1.0
Figure 6: Cross-correlation matrices for the barcode summaries for clean vs. poisoned activa- tions.
Geometric Separation of Latent States. The projection of the pruned barcode summaries over their first two principal components (Figure 7) clearly separates the normal and ad adversarial modes across layers. This is consistent with the intuition presented in Figure I, where a single barcode of a clean sample with n = 1000 activations (corresponding to point in the PCA plot) was visibly different than the barcode of a poisoned sample with same number points. To better quantify and test the different topology between these modes, we used cross correlation analysis (CCA) to identify the topological features driving this separation, CCA works by quantifying linear relationships between two multivariate datasets by finding pairs of canonical variables with maximal correlation. The loadings are the contributions of individual features to these canonical variables, measuring their importance in capturing the relationship. We found that mean deaths of the O-bars ranked first in all layers, and that the number of 1-bars appeared as a significant statistic as well (see Figure 18).
Layer
Layer 8
Layer 16
Layer 24
Layer 32
Clean
Poisoned
Figure 7: PCA of pruned barcode summaries clean vs. poisoned activations. Clear distinction appears in the two first PC projections from the PCA of the pruned barcode summaries for layers 1, 8. 16, 24, and 32. The explained variances are 0.59, 0.49, 0.52, 0.96 and 0.83, respectively.
Discriminative Power of Topological Features. We trained a logistic regression model on the pruned barcode summaries to quantify how well the topological features alone distinguish between normal and adversarial inputs (subsamples). We obtained perfect accuracy and AUC-ROC on the test data, and 5-fold cross validation over the training data (Figure 8). As a baseline comparison, we trained a linear discriminant analysis (LDA), linear support vector machine (SVM), and logistic regression to distinguish 1000 clean and 1000 poisoned activations, raw and after reducing dimen- sionality using sparse autoencoder (AE) with hidden dimension 128; see Table 1 for results. We found that the barcode summaries outperform these methods in general, particularly for early layers. However, emphasize that the information that they encode must be understood complementary

---

Published as a conference paper at ICLR 2026
to that of the linear methods above, and that true interest in the outstanding predictive power of barcode summaries resides in the fact that feature importance methods applied to the trained logistic regression allow to interpret the differences in topology between clean and poisoned data, which our ultimate goal.
Table 1: Comparison of predictive power with linear methods. Accuracy, with a 70/30 train/test split, of linear discriminant analysis (LDA), a linear SVM and logistic regression (LR) trained to distinguish 1000 raw clean activations from 1000 raw poisoned activations, with or without reducing the dimensionality of the data using a sparse autoencoder (SAE); and our method using PH.
Layer
LDA
LDA (SAE)
SVM
SVM (SAE)
LR
LR (SAE)
PH
Layer
0.995
0.995
0.8875
0.7400
0.8700
0.7425
1.0000
Layer 8
1.000
0.998
1.0000
0.6425
0.9950
0.6225
1.0000
Layer 16
1.000
0.9975
1.0000
0.8125
1.0000
0.6725
1.0000
Layer 24
1.000
0.9975
1.0000
0.9975
1,0000
0,9600
1.0000
Layer 32
1.000
1.0000
1.0000
1.0000
1.0000
1.0000
1.0000
We used Shapley (or SHAP) values to interpret the model's performance. Shapley values quantify the contribution (with sign) of each feature to the prediction of the model for a given input. Our analysis revealed that the mean of O-bar deaths and the number of 1-bars strongly influence pre- dictions, exhibiting a clear dichotomous effect: points with smaller mean death in their O-bars and bigger number of I-bars typically classified clean, whereas points with bigger mean death of their O-bars and smaller number of 1-bars are classified as poisoned.
Layer
Layer 8
Layer 16
Layer 24
Layer 32
0.75
0.50
0.25
Accuracy: 1.00
Accuracy: 1.00 AUC- AUC-ROC: 1.00
Accuracy: 1.00
Accuracy: AUC-ROC: 1.00
Accuracy: 1.00
AUC-ROC: 1.00
AUC-ROC: 1.00
ROC- 1.00
CV: 1.00
CV: 1.00
CV: 1.00
CV: 1.00
CV: 1.00
Figure 8: Logistic regression for clean vs. poisoned activations trained on a 70/30 train/test split of the pruned barcode summaries, plotted on the projection onto the two first PCs. Accuracy and AUC-ROC the test data and 5-fold cross validation on train data are presented for each model.
The Signature of Topological Compression. Interpreting the distributions of the barcode sum- maries for clean vs. poisoned data reveals that adversarial conditions typically yield fewer 1-bars (loops) forming at later scales, yet persisting longer (see Figure 20). Conversely, the non-adversarial conditions tend form earlier loops with more uniform lifetimes (higher persistent entropy). This pattern aligns with the Shapley value results (Figure 19): lower mean death times of O-bars (i.e.. more compact point clouds) are associated with predictions "clean", while higher values (more spread-out clouds) shift predictions toward "poisoned". Similarly, lower number of 1-bars tends to indicate "poisoned", whereas a higher count suggests "clean".
Thus, global topological features indicate consistent distortion where adversarial states "compress" the representation space in way that results in larger loops fewer directions. In comparison, non-adversarial states have larger number of smaller loops that more evenly distributed and higher-entropy. This signature is robust, persisting even against adaptive attacks from the large- scale (.L.ail--a M-LMMil-Inject Inneee red teaming dataset that include attacks explicitly designed to evade the TaskTracker activation based defence (see Appendix G). A more detailed analysis across all models, layers, and adversarial conditions is provided in Appendix C and summarized in Table
Local Dispersion Ratio Across Poisoned Conditions. To quantify how poisoning alters localized geometry hidden-layer representation space, we use the local dispersion ratio (LDR). For each fi- nal token's ss activation difference vector we identify its & nearest neighbors in each layer and perform PCA on those points. Let X 2 ... Ap be the resulting eigenvalues, where D' min(k, D),

---

Published as a conference paper at ICLR 2026
Table 2: Topological compression signature across models. Adversarial inputs reshape latent space geometry by increasing the mean death time of connected components (dH, increases), re- ducing the number of loops H, decreases), and extending the lifetime of remaining loops (éu, increases). Each cell indicates whether the adversarial condition matches this pattern (v), is incon- sistent across layers (~), or shows the opposite (x). Acc. the minimum logistie-regressoon test accuracy across layers.
Model
Acc.
dHo
#H1
Phi3-mini (3.8B)
1.00
fa.
Mistral (7B)
1.00
/
v
LLaMA3 (8B)
1.00
/
/
Mixtrall8x77B
1.00
v
Phi3-medium (14B)
1.00
LLaMA3 (70B)
1.00
Holds at L1-L24 but inverts at L32.
Direction varies across layers with no dominant trend.
since PCA on l points in D dimensions yields at most min(k, D) eigenvalues. The dispersion ratio then defined as >1 Ai+e where e prevents division by zero. higher LDR indicates that variance more evenly spread among secondary directions, whereas lower LDR implies most variance lies in single dominant direction. Appendix B.3 further stratifies poisoned conditions into executed, refused, and ignored subclasses and shows that executed and ignored attacks exhibit elevated LDR in mid-layers relative to clean prompts. This indicates that the model allocates additional represen- tational capacity to elaborating the injected instructions, whereas refused attacks are mapped into a more compressed, low-dispersion region, directly linking layer-wise geometric changes to task-level model behavior. Figure shows that LDR differences remain tightly centered around zero under Clean Clean and Poisoned vs. Poisoned resampling, confirming negligible within-class variabil- ity. In contrast, Mixed vs. Mixed splits exhibit systematic deviations that mirror the clean-poisoned separation observed in Figures 11 and 12 of Appendix B.3, indicating that LDR captures genuine geometric differences rather than artifacts of sampling noise or random partitioning.
mistral,70 78
mistral,.PP 7,78
Bama3 708
0.0
0.25
Mean Differonce
0.2
0.0
-2.4
-0.50
-0.2
Meam
-0.75
-0.8
-150
20
10
Layer
Layer
Layar
phr3_3.8
phi3. medium, 125k
Moan Diffeennca
0.2
Difforence
Diforrence
0.0
-0.2
-0.4
-04
-0.50
-1.0
10
30
Layer
Layer
Layer
Prisoned
Figure 9: Ablation of dispersion ratio differences (Clean Clean, Poisoned Poisoned, Mixed vs. Mixed). Fach plot shows the difference in mean dispersion ratio (clean minus poisoned). Positive values indicate that the clean subset exhibits higher dispersion, whereas negative values reflect a more dispersed poisoned subset.
8

---

Published as a conference paper at ICLR 2026
4.2 LOCAL ANALYSIS: INFORMATION FLOW BETWEEN LAYERS
To investigate the fine-grained mechanisms of adversarial influence, our local analysis quantifies how information transforms between layers the neuron level. We present the results for Mistral 7B below; see Appendix D.2 for other models.
Analysis on Consecutive Layers. Our local method revealed structural phase shift in the net- work's information flow under adversarial influence. We computed Vietoris-Rips PH barcodes of the 2D embeddings described in Section 3.3 for the activations normalized to zero mean and unit variance. This is to ensure that any differences in topological features are''t due to scaling dif- ferences and to control the condition where neuron indices are randomly permuted. We measured the topological complexity by the total persistence of 1-bars, and found significant differences be- tween clean and poisoned activations across layers the raw and normalized activations (Figure 10 (left)). Furthermore, the ratio of topological complexity between clean and poisoned activations (Figure 10 (center)) shows that clean inputs initially exhibit a more complex structure that simpli- fies in deeper layers. In contrast, poisoned activations start simpler but their topological complexity increases, diverging significantly from the clean activations around layer 12. This suggests that ad- versarial influence causes major reconfiguration of information processing in the model's deeper layers. The disappearance of this signal in the permuted control condition (shown in Figure 56 of the Appendix 1.2.1) confirms that the effect relies on specific neuron-to-neurg pathways rather than arising from a statistical artifact.
Table 3: Peak analysis. Precision @ for k=1, 3, and 5 largest peaks in total variance, and their precision in detecting the largest peaks in absolute difference between the two classes. Spearman's 's rank correlation (r) is reported in the last column. correspond to p-values <.05 and .01, respectively.
p@/ /
p@3
3
p@5
r
Total Persistence O-bars
0
.33
.4
0.46**
Total Persistence 1-bars
0
.67*
.8**
0.78*
Mean Birth 1-bars
1.0
.33
.8*
0.46**
Mean Death 1-bars
1.0
.33*
.8**
0.69**
In real-world setting without labels, these informative layers can still be identified. We found that the overall variance of a topological feature across all samples strongly correlates with the magnitude of the Dlean-vs.-poisones difference (Figure 10 (right)). As shown in Table 3, we evaluated the alignment between overall variance and class separation using precision at k (p@kk) and Spearman's 's rank correlation (r). To validate statistical significance against random baseline, we generated empirical null distributions via random permutations, with significance levels indicated by asterisks. The high precision (particularly at k = 5) and moderate-to-strone correlations indicate that layers with the highest variance are reliable indicators of those with the largest class separation. This provides a practical, unsupervised signal for locating where adversarial effects are most prominent.
A further example of how different barcode summaries propagate across the layers be found in Appendix 1 for Mistral 7B, showing the patterns for the mean deaths of O-bars.
Analysis on Non-Consecutinn Layers. We expanded the previous analysis activations from non-consecutive layers to show that in neighboring layers, the model operates on similar groups of neurons, leading to sementtwisee interactions that construct meaningful topological features distin- guishing clean from poisoned datasets. The ratio of the mean death times of O-bars between clean and poisoned activations as the layer interval increases is shown in Appendix D.2.5. For layer in- tervals of 1 and 3, the ratios for normalized activations and the control setting remained distinct, indicating meaningful topological interactions. However, an interval of 10 layers, the scaled and control settings showed significant overlap, suggesting much diminished difference in the interac- tions in clean and poisoned data. A similar pattern can be observed for other barcode summaries, such as the total persistence of 1-bars, see Appendix D.2.5.

---

Published as a conference paper at ICLR 2026
Original
Clean Poisoned
5-
1.2
Retto
0.0279
Total Persistence
4-
00229
12
Absolite Pore
3-
2-
0.2200
1.4
09:75
00:.0
Layer
50
Jageer 25
Layer
Figure 10: Local analysis of consecutive layers for the total persistence of 1-bars. Comparisons of the average total persistence of 1 1-bars across 1000 samples for Mistral model using original activation data (left). (center) Ratios of mean total persistence of 1-bars between clean and poisoned datasets for original, scaled, and scaled and permuted activations. (right) Overlaid plots of the overall variance of total persistence of I-bars for clean and poisoned datasets combined and the absolute difference between mean total persistence of 1 I-bars for clean and poisoned datasets.
DISCUSSION AND FUTURE WORK
Our global and local analyses provide converging evidence that adversarial influence manifests as topological compression of an LLM's latent space, shifting representations from compact, diverse structures more dispersed, topologically simpler ones. This signature consistent across ar- chitectures (3.8B-70B parameters), attack vectors (prompt injection and backdoor fine-tuning), and layers. This topological approach offers a distinct and complementary form of interpretability that is relational rather than compositional. While methods such sparse autoencoders (SAEs) (Cunning- ham et al., 2023) decompose representations into interpretable "building block" features but analyze each activation in isolation, making them blind to the nonlinear geometry that emerges from inter- actions between activations. Moreover, because SAE dictionaries are tied to specific model weights, they cannot be reliably compared across models fine-tuning stages. Our PH-based framework sidesteps both limitations by computing intrinsic. coordinate-free geometric properties that are di- rectly comparable across architectures and training conditions.
The implications of our work extend to the core of interpretability and AI safety. Our findings con- tribute to a growing body of evidence that model's behaviors are encoded in the geometry of its latent space. This perspective aligns with work showing that memorization corresponds to reduc- tion in the effective dimensionality of the representation manifold (Stephenson et al., 2021), and that the success of linear probes may stem from their ability to approximate more complex topolog- ical structures (Engels et al., 2025). Our finding that adversarial influence induces a "topological compression" provides new evidence for this view, whereby the model's transition to out-of- distribution operating mode is accompanied by a collapse geometric complexity. More broadly, work suggests that safety-relevant properties like robustness to adversarial manipulation not merely abstract behavioural outcomes but quantifiable geometric characteristics of the representa- tion space itself.
Limitations. We do not attempt to interpret the semantic content of the cycles and topological features identify. Furthermore, compute Vietoris-Rips filtrations only in dimensions 0 and 1. While this proved more than sufficient for our analysis, computing higher-dimensional homology could yield additional insights, provided one can manage the quadratic scaling of Victoris-Rips computations with respect to the number of data points.
Future Work. Our work only scratches the surface of the potential of PH applied LLM inter- pretability. Future research might adapt classical PH techniques to account for specific architectural features of LLMs, with the goal of producing more interpretable features that map to semantic con- tent. Another natural question is whether the topological compression phenomenon we observe general property model misalignment and adversarial attacks (Stephenson et al., 2021). Fi- nally, further investigation is needed into how such topological awareness might be leveraged during model training and architecture design (Brücl-Gabrielsse et al., 2020).
10

---

Published as a conference paper at ICLR 2026
ACKNOWLEDGMENTS
A.F. would like to thank Danicl Jones for productive discussions about the project. L.G.R. was funded by London School of Geometry and Number at the time of research, which was supported by the EPSRC grant No. EP/S021590/1. Q.W. W. was funded by a CRUK-Imperial College London Convergence Science PhD studentship at the time of research, which was supported by Cancer Research UK under grant reference CANTAC721 10021 (PIs Monod/Willaams), H.D. is supported by the research program "Change is Key!" supported by Riksbankens Jubilcumsfond (under reference number M21-0021). H.D., A.M., and Q.W. are supported by the EPSRC AI Hub on Mathematical Foundations of Intelligence; An "Erlangen Pro- gramme" for AI No. EP/Y028872/1.
College London PhD studentship
REFERENCES
Sahar Abdelnabi, Aideen Fay, Giovanni Cherubin, Ahmed Salem, Mario Fritz, and Andrew Paverd. Get my drift? catching Ilm task drift with activation deltas. 2025 IEEE Conference on Se- cure and Trustworthy Machine Learning (SaTML), pp. 43-67, 2024. URL https://api,
semanticschou www.eechcoaao.ooooooooooeeeeeeee
org/ Serg/CorpusID. : 270211056.
Sahar Abdelnabi, Aideen Fay, Ahmed Salem, Egor Zverev, Kai-Chieh Liao, Chi-Huang Liu, Chun- Chih Kuo, Jannis Weigend, Danyael Manlangit, Alex Apostolov, et al. Llmail-inject: A dataset from realistic adaptive prompt injection challenge. arXiv preprint arXiv:2506. 09956, 2025.
Marah Abdin, Jyoti Aneja, Hany Awadalla, Ahmed Awadallah, Ammar Ahmad Awan, Nguyen Bach, Amit Bahree, Arash Bakhtiari, Jianmin Bao, Harkirat Behl, Alon Benhaim, Misha Bilenko, Johan Bjorck, Sébastien Bubeck, Martin Cai, Qin Cai, Vishrav Chaudhary, Dong Chen, Dong- dong Chen, Weizhu Chen, Yen-Chun Chen, Yi-Ling Chen, Hao Cheng, Parul Chopra, Xiyang Dai, Matthew Dixon, Ronen Eldan, Victor Fragoso, Jianfeng Gao, Mei Gao, Min Gao, Amit Garg, Allie Del Giorno, Abhishek Goswami, Suriya Gunasekar, Emman Haider, Junheng Hao, Russell J. Hewett, Wenxiang Hu, Jamie Huynh, Dan Iter, Sam Ade Jacobs, Mojan Javaheripi, Xin Jin, Nikos Karampatziakis, Piero Kauffmann, Mahoud Khademi, Dongwoo Kim, Young Jin Kim, Lev Kurilenko, James R. Lee, Yin Tat Lee, Yuanzhi Li, Yunsheng Li, Chen Liang, Lars Liden, Xihui Lin, Zeqi Lin, Ce Liu, Liyuan Liu, Mengchen Liu, Weishung Liu, Xiaodong Liu, Chong Luo, Piyush Madan, Ali Mahmoudzadeh, David Majercak, Matt Mazzola, Caio César Teodoro Mendes, Arindam Mitra, Hardik Modi, Anh Nguyen, Brandon Norick, Barun Patra, Daniel Perez- Becker, Thomas Portet, Reid Pryzant, Heyang Qin, Marko Radmilac, Liliang Ren, Gustavo de Rosa, Corby Rosset, Sambudha Roy, Olatunji Ruwase, Olli Saarikivi, Amin Saied, Adil Salim, Michael Santacroce, Shital Shah, Ning Shang, Hiteshi Sharma, Yelong Shen, Swadheen Shukla, Xia Song, Masahiro Tanaka, Andrea Tupini, Praneetha Vaddamanu, Chunyu Wang, Guanhua Wang, Lijuan Wang, Shuohang Wang, Xin Wang. Yu Wang, Rachel Ward, Wen Wen, Philipp Witte, Haiping Wu, Xiaoxia Wu, Michael Wyatt, Bin Xiao, Can Xu, Jiahang Xu, Weijian Xu, Ji- long Xue, Sonali Yadav, Fan Yang, Jianwei Yang, Yifan Yang, Ziyi Yang. Donghan Yu, Lu Yuan, Chenruidong Zhang, Cyril Zhang, Jianwen Zhang, Li Lyna Zhang, Yi Zhang, Yue Zhang, Yunan Zhang, and Xiren Zhou. Phi-3 technical report: A highly capable language model locally on your phone, 2024. URL https: www.aa.voorrrrrooooo abs / 24404. 1 14219. 9.
Henry Adams, Tegan Emerson, Michael Kirby, Rachel Neville, Chris Peterson, Patrick Shipman, Sofya Chepushtanova, Eric Hanson, Francis Motta, and Lori Ziegelmeier. Persistence images; A stable vector representation of persistent homology. Journal of Machine Learning Research, 18 2017.
Robert J. Adler and Jonathan Taylor. Topological complexity of smooth random functions: : Ecole d'Eté de Probabilités de Saint-Flour XXXXIX 2009. Lecture notes in mathematics, 2019.
Springer, New York, 1st ed. 2011. edition, 2011. ISBN 125---9980--6..
Guillaume Alain and Yoshua Bengio. Understanding intermediate layers using linear classifier probes. arXiv preprint arXiv:1610.01644 2016. URL https://arxiv. www.xxii..gg/aaaa. wttg/bs////l..//e 01644.
Dashti Ali, Aras Asaad, Maria-Jose Jimenez, Vidit Nanda, Eduardo Haluzo-Hidalggn and Manuel Poriano-Trigueroo survey of vectorization methods in topological data analysis. IEEE

---

Published as a conference paper at ICLR 2026
Transactions on Pattern Analysis and Machine Intelligence, 15(12):14069-111 2023. doi: 10.109/TPAML.203.55003.
Ulrich Bauer. Ripser: Efficient computation of Vietoris-Rips persistence barcodes. Journal of Applied and Computational Topology, 5(3):391-423, September 2021. ISSN 2367-1734. doi:
000777441466-021-000000
Magnus Bakke Botnan and Michael Lesnick. An introduction to multiparameter persistence. Rep- resentations of Algebras and Related Structures, pp. 77, 2023.
Rickard Brbbe-Gabrielsson, Bradley J. Nelson, Anjan Dwaraknath, Primoz Skraba, Leonidas J. Guibas, and Gunnar Carlsson. A topology layer for machine learning, 2020. URL https:
// //aaxii.org//aaa abs 12200.
Peter Bubenik. The persistence landscape and some of its properties. In Topological Data Analysis: The Abel Symposium 2018. pp. 97-117. Springer, 2020.
Patrick Chao et al. Jailbreakbench: An open robustness benchmark for jailbreaking large lan- guage models. In Advances in Neural Information Processing Systems, volume 37, pp. 55005- 55029, 2024. URL https: /twp://////eeioooeoooooooooococ
/ ngs neurips httppp/ccccppppppeeeeeeeeeeeeeee Paperaaeeeecc-pper--ooeeeeeeeeee pdf.
Frédéric Chazal, Mare Glisse, Catherine Labruère, and Bertrand Michel. Convergence rates for per- sistence diagram estimation in topological data analysis. In International Conference on Machine Learning, pp. 163-171. PMLR, 2014.
Frédéric Chazal, Brittany Fasy, Fabrizio Lecci, Bertrand Michel, Alessandro Rinaldo, and Larry Wasserman. Subsampling methods for persistent homology. In International Conference on Machine Learning, pp. 2143-2151. PMLR, 2015.
Harish Chintakunta, Thanos Gentimis, Rocio Gonzalez-Diaz, Maria-Jose Jimenez, and Hamid Krim. An entropy- batropy-based persistence barcode. Pattern Recognition, 48(2):391-401 2015. URL https: h/tp:p:://ww. ISSN 0031-3203. doi: wtc.iienc/atttiiee//ccececcc /tt011/0000333333 4002453.
sci sciiecedii rect. com com/scienn ence/
David Cohen-Steiner, Herbert Edelsbrunner, and John Harer. Stability of persistence diagrams.
Discrete & Computational Geometry. 37(1):103-120, 2007. doi: 10. 10.1077/000444000-1222
URL https: coo.iorrg/11 100.111000000000000055555 1276--5
Hoagy Cunningham, Aidan Ewart, Logan Riggs, Robert Huben, and Lee Sharkey, Sparse autoen- coders find highly interpretable features in language models, 2023. URL https://arxiv. org/aba abs / 2309. 08600.
Joshua Engels, Eric J Michaud, Isaac Liao, Wes Gurnee, and Max Tegmark. Not all language model features are one-dimensionally linear. In The Thirteenth International Conference on Learning Representations, 2025. URL https: wew.en.eveee.rr....
htr////rrmm//// ?idmd6dddadeee AMM4hb
Patrizio Frosini. A distance for similarity classes of submanifolds of a euclidean space. Bulletin of the Australian Mathematical Society, (2(3):407-415 1990.
Patrizio Frosini. Measuring shapes by size functions. Intelligent Robots and Computer Vision X: Algorithms and Techniques, volume 1607, pp. 122-133. SPIE, 1992.
Yuri Gardinazzi, Giada Panerai, Karthik Viswanathan, Alessio Ansuini, Alberto Cazzaniga, and Matteo Biagetti. Persistent topological features large language models, 2024. URI. https:
//arxiv..e wtwpzii.orr/as///21/11 11042.
Thomas Gebhart, Paul Schrater, and Alan Hylton. Characterizing the shape of activation space in deep neural networks. 2019 18th IEEE International Conference On Machine Learning And Applications (ICMLA), pp. 1537-1542, 2019. URL. https:/ /tpp//ap....//// semant i commantcccchl... org Dtt//orrpusDD:110778855
12

---

Published as a conference paper at ICLR 2026
Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, Amy Yang, Angela Fan, Anirudh Goyal, Anthony Hartshom, Aobo Yang, Archi Mitra, Archie Sravankumar. Artem Ko- renev, Arthur Hinsvark, Arun Rao, Aston Zhang, Aurelien Rodriguez, Austen Gregerson, Ava Spataru, Baptiste Roziere, Bethany Biron, Binh Tang, Bobbie Chern, Charlotte Caucheteux, Chaya Nayak, Chloe Bi, Chris Marra, Chris McConnell, Christian Keller, Christophe Touret, Chunyang Wu, Corinne Wong, Cristian Canton Ferrer, Cyrus Nikolaidis, Damien Allonsius, Daniel Song, Danielle Pintz, Danny Livshits, Danny Wyatt, David Esiobu, Dhruv Choudhary, Dhruv Mahajan, Diego Garcia-Olano, Diego Perino, Dieuwke Hupkes. Egor Lakomkin, Ehab AlBadawy, Elina Lobanova, Emily Dinan, Eric Michael Smith, Filip Radenovic, Francisco Guzmán, Frank Zhang. Gabriel Synnaeve, Gabrielle Lee, Georgia Lewis Anderson, Govind That- tai, Graeme Nail, Gregoire Mialon, Guan Pang, Guillem Cucurell, Hailey Nguyen, Hannah Kore- vaar, Hu Xu, Hugo Touvron, Iliyan Zarov, Imanol Arricta Ibarra, Isabel Kloumann, Ishan Misra, Ivan Evtimov, Jack Zhang, Jade Copet, Jaewon Lee, Jan Geffert, Jana Vranes, Jason Park, Jay Ma- hadeokar, Jeet Shah, Jelmer van der Linde, Jennifer Billock, Jenny Hong, Jenya Lee, Jeremy Fu, Jianfeng Chi, Jianyu Huang, Jiawen Liu, Jie Wang. Jiecao Yu, Joanna Bitton, Joe Spisak, Jong- soo Park, Joseph Rocca, Joshua Johnstun, Joshua Saxe, Junteng Jia, Kalyan Vasuden Alwala, Karthik Prasad, Kartikeya Upasani, Kate Plawiak, Ke Li, Kenneth Heafield, Kevin Stone, Khalid El-Arini, Krithika Iyer, Kshitiz Malik, Kuenley Chiu, Kunal Bhalla, Kushal Lakhotia, Lauren Rantala-Yeand Laurens van der Maaten, Lawrence Chen, Liang Tan, Liz Jenkins, Louis Martin, Lovish Madaan, Lubo Malo, Lukas Blecher, Lukas Landzaat, Luke de Oliveira, Madeline Muzzi, Mahesh Pasupuleti, Mannat Singh, Manohar Paluri, Marcin Kardas, Maria Tsimpoukelli, Mathew Oldham, Mathieu Rita, Maya Pavlova, Melanie Kambadur, Mike Lewis, Min Si, Mitesh Ku- mar Singh, Mona Hassan, Naman Goyal, Narjes Torabi, Nikolay Bashlykov, Nikolay Bogoy- chev, Niladri Chatterji, Ning Zhang, Olivier Duchenne, Onur Çelebi, Patrick Alrassy, Pengchuan Zhang, Pengwei Li, Petar Vasic, Peter Weng, Prajjwal Bhargava, Pratik Dubal, Praveen Krishnan, Punit Singh Koura, Puxin Xu, Qing He, Qingxiao Dong, Ragavan Srinivasan, Raj Ganapathy, Ra- mon Calderer, Ricardo Silveira Cabral, Robert Stojnic, Roberta Raileanu, Rohan Maheswari, Ro- hit Girdhar, Rohit Patel, Romain Sauvestre, Ronnie Polidoro, Roshan Sumbaly, Ross Taylor, Ruan Silva, Rui Hou, Rui Wang, Saghar Hosseini, Sahana Chennabasappa, Sanjay Singh, Sean Bell, Scohyun Sonia Kim, Sergey Edunov, Shaoliang Nic, Sharan Narang, Sharath Raparthy, Sheng Shen, Shengye Wan, Shruti Bhosale, Shun Zhang, Simon Vandenhende, Soumya Batra, Spencer Whitman, Sten Sootla, Stephane Collot, Suchin Gururangan, Sydney Borodinsky, Tamar Herman, Tara Fowler, Tarek Sheasha, Thomas Georgiou, Thomas Scialom, Tobias Speckbacher, Todor Mi- haylov, Tong Xiao, Ujjwal Karn, Vedanuj Goswami, Vibhor Gupta, Vignesh Ramanathan, Viktor Kerkez, Vincent Gonguet, Virginie Do. Vish Vogeti, Vítor Albiero, Vladan Petrovic, Weiwei Chu, Wenhan Xiong, Wenyin Fu, Whitney Meers, Xavier Martinet, Xiaodong Wang. Xiaofang Wang, Xiaoqing Ellen Tan, Xide Xia, Xinfeng Xie, Xuchao Jia, Xuewei Wang. Yaclle Gold- schlag, Yashesh Gaur, Yasmine Babaci, Yi Wen, Yiwen Song. Yuchen Zhang, Yue Li, Yuning Mao, Zacharie Delpierre Coudert, Zheng Yan, Zhengxing Chen, Zoe Papakipos, Aaditya Singh, Aayushi Srivastava, Abha Jain, Adam Kelsey, Adam Shajnfeld, Adithya Gangidi, Adolfo Victoria, Ahuva Goldstand, Ajay Menon, Ajay Sharma, Alex Boesenberg, Alexei Baevski, Allie Feinstein, Amanda Kallet, Amit Sangani, Amos Teo, Anam Yunus, Andrei Lupu, Andres Alvarado, An- drew Caples, Andrew Gu, Andrew Ho, Andrew Poulton, Andrew Ryan, Ankit Ramchandani, An- nie Dong, Annie Franco, Anuj Goyal, Aparajita Saraf, Arkabandhu Chowdhury, Ashley Gabriel, Ashwin Bharambe, Assaf Eisenman, Azadeh Yazdan, Beau James, Ben Maurer, Benjamin Leon- hardi, Bernie Huang. Beth Loyd, Beto De Paola, Bhargavi Paranjape, Bing Liu, Bo Wu, Boyu Ni, Braden Hancock, Bram Wasti, Brandon Spence, Brani Stojkovic, Brian Gamido, Britt Mon- talvo, Carl Parker, Carly Burton, Catalina Mejia, Ce Liu, Changhan Wang, Changkyu Kim, Chao Zhou, Chester Hu, Ching-Hsiang Chu, Chris Cai, Chris Tindal, Christoph Feichtenhofer, Cynthia Gao, Damon Civin, Dana Beaty, Daniel Kreymer, Daniel Li, David Adkins, David Xu, Davide Testuggine, Delia David, Devi Parikh, Diana Liskovich, Didem Foss, Dingkang Wang, Due Le, Dustin Holland, Edward Dowling, Eissa Jamil, Elaine Montgomery. Eleonora Presani, Emily Hahn, Emily Wood, Eric-Tuan Le, Erik Brinkman, Esteban Arcaute, Evan Dunbar, Evan Smoth- ers, Fei Sun, Felix Kreuk, Feng Tian, Filippos Kokkinos, Firat Ozgenel, Francesco Caggioni, Frank Kanayet, Frank Seide, Gabriela Medina Florez, Gabriella Schwarz, Gada Badeer, Georgia Swee, Gil Halpern, Grant Herman, Grigory Sizov, Guangyi, Zhang, Guna Lakshminarayanan, Hakan Inan, Hamid Shojanazeri, Han Zou, Hannah Wang, Hanwen Zha, Haroun Habeeb, Harri- son Rudolph, Helen Suk, Henry Aspegren, Hunter Goldman, Hongyuan Zhan, Ibrahim Damlaj,
13

---

Published as a conference paper at ICLR 2026
Igor Molybog, Igor Tufanov, Ilias Leontiadis, Irina-Elena Veliche, Itai Gat, Jake Weissman, James Geboski, James Kohli, Janice Lam, Japhet Asher, Saan-Bptistte Gaya, Jeff Marcus, Jeff Tang, Jen- nifer Chan, Jenny Zhen, Jeremy Reizenstein, Jeremy Teboul, Jessica Zhong, Jian Jin, Jingyi Yang, Joe Cummings, Jon Carvill, Jon Shepard, Jonathan McPhie, Jonathan Torres, Josh Ginsburg, Jun- jie Wang. Kai Wu, Kam Hou U, Karan Saxena, Kartikay Khandelwal, Katayoun Zand, Kathy Matosich, Kaushik Veeraraghavan, Kelly Michelena, Keqian Li, Kiran Jagadeesh, Kun Huang, Kunal Chawla, Kyle Huang, Lailin Chen, Lakshya Garg, Lavender A, Leandro Silva, Lee Bell, Lei Zhang. Liangpeng Guo, Licheng Yu, Liron Moshkovich, Luca Wehrstedt, Madian Khabsa, Manav Avalani, Manish Bhatt, Martynas Mankus, Matan Hasson, Matthew Lennie, Matthias Reso, Maxim Groshev, Maxim Naumov, Maya Lathi, Meghan Keneally, Miao Liu, Michael L. Seltzer, Michal Valko, Michelle Restrepo, Mihir Patel, Mik Vyatskov, Mikayel Samvelyan, Mike Clark, Mike Macey, Mike Wang, Miquel Jubert Hermoso, Mo Metanat, Mohammad Rastegari, Munish Bansal, Nandhini Santhanam, Natascha Parks, Natasha White, Navyata Bawa, Nayan Singhal, Nick Egebo, Nicolas Usunier, Nikhil Mehta, Nikolay Pavlovich Laptev, Ning Dong, Norman Cheng, Oleg Chernoguz. Olivia Hart, Omkar Salpekar, Ozlem Kalinli, Parkin Kent, Parth Parekh, Paul Saab, Pavan Balaji, Pedro Rittner, Philip Bontrager, Pierre Roux, Piotr Dollar, Polina Zvyagina, Prashant Ratanchandani, Pritish Yuvraj, Qian Liang, Rachad Alao, Rachel Ro- driguez, Rafi Ayub, Raghotham Murthy, Raghu Nayani, Rahul Mitra, Rangaprabhu Parthasarathy, Raymond Li, Rebekkah Hogan, Robin Battey, Rocky Wang, Russ Howes, Ruty Rinott, Sachin Mehta, Sachin Siby, Sai Jayesh Bondu. Samyak Datta, Sara Chugh, Sara Hunt, Sargun Dhillon, Sasha Sidorov. Satadru Pan. Saurabh Mahajan, Saurabh Verma. Seiji Yamamoto, Sharadh Ra- maswamy, Shaun Lindsay, Shaun Lindsay, Sheng Feng, Shenghao Lin, Shengxin Cindy Zha, Shishir Patil, Shiva Shankar, Shuqiang Zhang, Shuqiang Zhang. Sinong Wang, Sneha Agarwal, Soji Sajuyigbe, Soumith Chintala, Stephanie Max, Stephen Chen, Steve Kehoe, Steve Satter- field, Sudarshan Govindaprasad, Sumit Gupta, Summer Deng, Sungmin Cho, Sunny Virk. Suraj Subramanian, Sy Choudhury, Sydney Goldman, Tal Remez, Tamar Glaser, Tamara Best, Thilo Koehler, Thomas Robinson, Tianhe Li, Tianjun Zhang, Tim Matthews, Timothy Chou, Tzook Shaked, Varun Vontimitta, Victoria Ajayi, Victoria Montanez, Vijai Mohan, Vinay Satish Ku- mar, Vishal Mangla, Vlad Ionescu, Vlad Poenaru, Vlad Tiberiu Mihailescu, Vladimir Ivanov, Wei Li, Wenchen Wang, Wenwen Jiang, Wes Bouaziz, Will Constable, Xiaocheng Tang, Xiao- jian Wu, Xiaolan Wang. Xilun Wu, Xinbo Gao, Yaniv Kleinman, Yanjun Chen, Ye Hu, Ye Jia, Ye Qi, Yenda Li, Yilin Zhang, Ying Zhang, Yossi Adi, Youngjin Nam, Yu, Wang, Yu Zhao, Yuchen Hao, Yundi Qian, Yunlu Li, Yuzi He, Zach Rait, Zachary Vetoo, Zef Rosnbrick. Zhao- duo Wen, Zhenyu Yang, Zhiwei Zhao, and Zhiyu Ma. The llama 3 herd of models, 2024. URL https: //aas////avvv..//a http:///xxvvv/////eaee org/o/gg///ooo alss/ 2407 10007.1130 21783.
Ryan Greenblatt, Fabien Roger, Dmitrii Krasheninnikov, and David Krueger. Stress-testing capabil- ity elicitation with password-locked models, 2024. URL ht httpp::///. /ttp///axvvvvvaa///////////aaav/ www.:o.g/abb..... abg/055
19550.
Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. Not what you've signed up for: Compromising real-world llm-integrated applications with indirect prompt injection, 2023. URL htttt:ttp///aatt
org/ /2302. 73.
Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models, 2021. URL https: // //arxiv.org/////...............a abs 211./1111... 09685.
Evan Hubinger, Carson Denison, Jesse MU, Mike Lambert, Meg Tong, Monte MacDiarmid, Tamera Lanham, Daniel M. Ziegler, Tim Maxwell, Newton Cheng, Adam S. Jermyn, Amanda Askell, Ansh Radhakrishnan, Cem Anil, David Duvenaud, Deep Ganguli, Fazl Barez, Jack Clark, Kamal Ndousse, Kshitij Sachan, Michael Sellitto, Mrinank Sharma, Nova DasSarma, Roger B. Grosse, Shauna Kravec, Yuntao Bai, Zachary Witten, Marina Favaro, Jan Brauner, Holden Karnofsky, Paul F. Christiano, Samuel R. Bowman, Logan Graham, Jared Kaplan, Sören Mindermann, Ryan Greenblatt, Buck Shlegeris, Nicholas Schiefer, and Ethan Perez. Sleeper agents: Training de- ceptive Iims that persist through safety training. CoRR, abs/2401 ARXIVV2401.05566 URL https: doi. wwt//////0 /10./00.40 48550/arXiv..... 2401. 05566.
2024. doi: 10.48550/
Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs, they are features. In Neural Information Processing Systems, 2019. URL https:////. ////t//app.. semant. cschola arboollrroo wwwpaaarror//oooaaaapaa
14

---

Published as a conference paper at ICLR 2026
Jiaming Ji, Mickel Liu, Juntao Dai, Xuchai Pan, Chi Zhang, Ce Bian, Boyuan Chen, Ruiyang Sun, Yizhou Wang, and Yaodong Yang. Beavertails: Towards improved safety alignment of Ilm via a human-preee cemaan-peefeeece dataset. In NeurIPS Datasets and Benchmarks Track, 2023.
Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chap- lot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, Lélio Renard Lavaud, Marie-Anne Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Thomas Wang, Timothée Lacroix, and William El Sayed. Mistral 7b, 2023. URL https: //arxiv.org/ante 2230.. 06825.
Albert Q. Jiang, Alexandre Sablayrolles, Antoine Roux, Arthur Mensch, Blanche Savary, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Emma Bou Hanna, Florian Bressand, Gi- anna Lengyel, Guillaume Bour, Guillaume Lample, Lélio Renard Lavaud, Lucile Saulnier, Marie- Anne Lachaux, Pierre Stock, Sandeep Subramanian, Sophia Yang. Szymon Antoniak, Teven Le Scao, Théophile Gervet, Thibaut Lavril, Thomas Wang, Timothée Lacroix, and William El Sayed. Mixtral of experts, 2024. URL https:
abs 22001. 0001..0400 04088.
Nathalic Maria Kirch, Severin Field, and Stephen Casper. What features in prompts jailbreak Ilms? investigating the mechanisms behind attacks, 2024. URL https://e///e http:///xvvvvoo// www. abb/ 2411. 03343.
Nathaniel Li. Alexander Pan, Anjali Gopal, Summer Yue, Daniel Berrios, Alice Gatti, Justin D. Li,
Dombrowski, Shashwat Goel, Long Phan, Gabriel Mukobi, Nathan Helm- Burger, Rassin Lababidi, Lennart Justen, Andrew B. Liu, Michael Chen, Isabelle Barrass, Oliver Zhang, Xiaoyuan Zhu, Rishub Tamirisa, Bhrugu Bharathi, Adam Khoja, Zhenqi Zhao, Ariel Herbert-Voss, Cort B. Breuer, Samuel Marks, Oam Patel, Andy Zou, Mantas Mazeika, Zi- fan Wang, Palash Oswal, Weiran Lin, Adam A. Hunt, Justin Tienken-Harder, Kevin Y. Shih, Kemper Talley, John Guan, Russell Kaplan, Ian Steneker, David Campbell, Brad Jokubaitis, Alex Levinson, Jean Wang, William Qian, Kallol Krishna Karmakar, Steven Basart, Stephen Fitz, Mindy Levine, Ponnurangam Kumaraguru, Uday Tupakula, Vijay Varadbarajan, Ruoyu Wang, Yan Shoshitaishvili, Jimmy Ba, Kevin M. Esvelt, Alexandr Wang, and Dan Hendryeks. The wmdp benchmark: Measuring and reducing malicious use with unlearning. 2024a. URI. https:
www.///////////ooo///.ooo//eoee/ 2ios/2400 03218.
Yuxiao Li, Eric Michaud, David D. Baek, Joshua Engels, Xiaoqing Sun, and Max Tegmark. The geometry of concepts: Sparse autoencoder feature structure. Entropy, 27, 2024b. URL
hittss://ap semanticschoo .rr.a...rrrrggre.. wowo//orrrueeeeoooeee Corp IT 22266:44333
Stan Lipovetsky and Michael Conklin. Analysis of regression in game theory approach. Applied Stochastic Models Business and Industry, 17(4):319-33) 2001. doi: htps://doi.org//0. 1002 asmb.446. URL https::////// http//onnnnnnniieeeeeee wiley com/ foi//bbs/oe 1002/ asmb. 446.
Mantas Mazeika et al. Harmbench: A standardized evaluation framework for automated red team- ing and robust refusal. In Thirty-eighth Conference Neural Information Processing Sys- tems Datasets and Benchmarks, 2024. URL https:/ /ttps////ppeeeee..eeem http://wweeeeffoeeeeeeeeeeee fforrorrriiie V1A2D5xX02.
Gregory Naitzat, Andrey Zhitnikov, and Lek-Heng Lim. Topology of deep neural networks. Journal of Machine Learning Research, 21(184):1-40, 2020. URL http: www.i.oorg/ppppr...
345///0025344454/ html.
Nina Otter, Mason A Porter, Ulrike Tillmann, Peter Grindrod, and Heather A Harrington. A roadmap for the computation of persistent homology. EPJ Data Science, 6(1):17, 2017.
Ethan Perez, Sam Ringer, Kamilé Lukošiūté, Karina Nguyen, Edwin Chen, Scott Heiner, Craig Pet- tit, Catherine Olsson, Sandipan Kundu, Saurav Kadavath, Andy Jones, Anna Chen, Ben Mann, Brian Israel, Bryan Seethor, Cameron McKinnon, Christopher Olah, Da Yan, Daniela Amodei. Dario Amodei, Dawn Drain, Dustin Li, Eli Tran-Johnson, Guro Khundadze, Jackson Kernion, James Landis, Jamie KeTI, Jared Mueller, Jeeyoon Hyun, Joshua Landau, Kamal Ndousse, Lan- don Goldberg, Liane Lovitt, Martin Lucas, Michael Sellitto, Miranda Zhang, Neeray Kingsland,
15

---

Published as a conference paper at ICLR 2026
Nelson Elhage, Nicholas Joseph, Noemí Mercado, Nova DasSarma, Oliver Rausch, Robin Lar- son, Sam McCandlish, Scott Johnston, Shauna Kravec, Sheer EI Showk, Tamera Lanham, Timo- thy Telleen-Lawton, Tom Brown, Tom Henighan, Tristan Hume, Yuntao Bai. Zac Hatfield-Dodds, Jack Clark, Samuel R. Bowman, Amanda Askell, Roger Grosse, Danny Hernandez, Deep Gan- guli, Evan Hubinger, Nicholas Schiefer, and Jared Kaplan. Discovering language model behaviors with model-written evaluations, 2022. URL https::t.....m petttss://rxivi /ttp/aaaxvvv//.///////../...aa./ org/ abs/2212 09251.
Johann Rehberger. Microsoft Copilot: From Prompt Injection to Exfiltration of Personal Informa- tion. [Link], 2024.
Matteo Rucco, Filippo Castiglione, Emanuela Merelli, and Marco Pettini. Characterisation of idiotypic immune network through persistent entropy. In Stefano Battiston, Francesco De Pelle- grini, Guido Caldarelli, and Emanuela Merelli (eds.), Proceedings of ECCS 2014, pp. 117-128, Cham, 2016. Springer International Publishing.
Petar Sekuloski, Dimitar Kitanovski, Igor Goshev, Kostadin Mishev, Monika Simjanoska Misheva, and Vesna Dimitrievska Ristovska. Exploring the potential of topological data analysis for ex- plainable large language models: A scoping review. Mathematics, 14(2), 2026. ISSN 2227-7390. URL https: htww//wwmm./ mddp. com/ 2227- 02777739//44/2/3777 //7
doi: 10.3390/math Meilaahh1420000 4020378.
Cory Stephenson, Suchismita Padhy, Abhinav Ganesh, Yue Hui, Hanlin Tang, and Sue Yeon Chung. On the geometry of generalization and memorization in deep neural networks, 2021. URL https: http//axiivv... org/ abs /21.../211...0 14602.
Katharine Turner, Yuriy Mileyko, Sayan Mukherjee, and John Harer. Fréchet means for distributions of persistence diagrams. Discrete & Computational Geometry, 52(1):44-70, 2014.
Teun van der Weij, Felix Hofstätter, Ollie Jaffe, Samuel F. Brown, and Francis Rhys Ward. Ai sandbagging: Language models can strategically underperform on evaluations, 2024. URL https: /ttps:///axivv org/abs// 62004 07358.
Jan Wehner, Sahar Abdelnabi, Daniel Tan, David Krueger, and Mario Fritz. Taxonomy, opportu- nities, and challenges of representation engineering for large language models. Trans. Mach. Learn. Res., 2025, 2025. URL https: //api. http:/ata.ssemiiiaaaeeeaama..aaa www.ntiesccooieie....... wtt.scchollaa.ooooooaassss.eeees org/CorpusII.
276647419.
Ben Zhang, Zitong He, and Hongwei Lin. A comprehensive review of deep neural network inter- pretation using topological data analysis. Neurocomputing, 609:128513, 2024. ISSN 0925-2312. doi: https://doi.org// 10111606....coooo com/ http://cienneeaarieeeepi////////
128513. URL ht / /wwww sciencedirect.
Simon Zhang, Mengbai Xiao, and Hao Wang. Gpu-accelerated computation of victoris-rips persis- tence barcodes. In 36th International Symposium Computational Geometry (SoCG 2020), pp. 70-1. Schloss
für Informatik, 2020.
Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, Ann-Kathrin Dombrowski, Shashwat Goel, Nathaniel Li, Michael J. Byun, Zifan Wang, Alex Mallen, Steven Basart, Sanmi Koyejo, Dawn Song, Matt Fredrikson, Zico Kolter, and Dan Hendrycks. Representation engineering: top-down ap- proach to ai transparency, 2023. URL https: .rr. abs 22100 01405.
Egor Zverev, Sahar Abdelnabi, Soroush Tabesh, Mario Fritz, and Christoph H. Lampert. Can Ilms separate instructions from data? and what do we even mean by that?, 2025. URL https: 06833.
/
A PERSISTENT HOMOLOGY
We provide additional background on PH and the underlying mathematical formulation that supports its application tool to detect the multiscale topological within data.
16

---

Published as a conference paper at ICLR 2026
A.1 THEORETICAL BACKGROUND
PH refers to a set of methods that are implemented to extract the shape and size of data a multiple scales. We now present the underlying mathematical principles that support this tool.
Input data. PH accommodates for diverse data modalities: images, point clouds, graphs, etc. One of the most basic yet general data types that it accepts finite metric spaces, i.e., finite subsets S C X of some metric space (X, d). Restricting d to S, we obtain a notion of dissimilarity between the points in our metric space. This is the data modality that we will consider for the remainder of the section, as it encompasses most of the real data that we encounter.
Filtrations. The first step in the PH pipeline consists of constructing a filtration from our input data, that is, a family of nested topological spaces. For computational and storage reasons, simpli- cial complexes are often favored as the topological spaces appearing in the filtration. An abstract simplicial complex K over vertex set S is defined as set of subsets of S which is closed under inclusion, i.c., if a E K and T C then T E J. Subsets a = (s Si, } of p + elements are called p-simplices. There are various ways of defining a simplicial complexes from a discrete set S, and they usually depend on fixing scale parameter > 0.
For instance, in this work, we have leveraged the Vietoris-Rips complex, obtained by considering all the subsets a of S with diam(o) = ma d(s, s') less or equal than
VR, = (0 + C K diam (o) S <c..
(1)
The implementation of this complex is straightforward, and has the advantage that it is only neces- sary to store the pairwise distance between points in S to build it. However, it has the disadvantage
of exploding in size with the number of points: if S has points, then (S, d)] O(2") (see
Table 1 in Otter et al. (2017))
An alternative is the Čech complex scale e 2 O, where simplex {sig...... Stp } belongs the complex if and only if all the balls of radius e centered at the points of the simplex have nonempty intersection,
(. = 0 x c S n B(s,c) * }
(2)
SEa
The Čech complex has very nice theoretical properties (for instance, satisfies the conditions of the Nerve Theorem). However, it has similar complexity to the Vietoris-Ripe complex, and in fact we have
Č, d) S (S, S (S.
A final option to consider, which significantly reduces the number of simplices in the complex, is the alpha complex. To make this simplicial complex coarser, the idea is to intersect the balls centered around the points in the point cloud, B(s,e), with their Voronoi cells, V(s), and thus define R(s,e) e) = B(s.e) c) n Vs).. The Voronoi cells form partition of the metric space X where the points in each region are closest to the same point in S. Since both ((s, e) and V(S) are convex, their intersection R(s,e) c) remains convex. From the definition of the Voronoi cells, these spaces R(s, e) are either disjoint or overlap along their boundary, significantly reducing the number of intersections between them. The alpha complex is thus defined as
a(S,e) = { 0 + focs: S: n M(s,e) & {
and is significantly smaller in size due to the introduction of the Voronoi cells.
The Rips, Čech and alpha filtrations are defined considering the families of the correspond- ing complexes for all values of the parameter e 2 O. Since the conditions for including simplices are relaxed as increases, we obtain the defining condition of filtration {K, : 2 0), namely that for e e we have K. C K.,. There are additional types of filtrations that we do not cover here, such as cubical filtrations (particularly suited for images) witness complexes (based on having some landmarks or witnesses in our point cloud). We refer to Otter et al. (2017) for a survey and further details on these constructions.
17

---

Published as a conference paper at ICLR 2026
compute Homology and persistence modules. Leveraging tools from algebraic topology, the simplicial homology groups associated to a given simplicial complex K, which come in various degrees H (K), for p 2 0 integer number, and topological invariants of the complex. They contain information about its topological features, for p = 0 these correspond to components or clusters, for p 1 to loops holes, for p 2, to bubbles cavities, and so on for higher values of The homology construction is functorial, meaning that there is an assignment which for map f : K K' between two simplicial complexes, provides a linear map the homology level Hf(f) : Hp + Hp(K"), preserving the identity and composition. Applying this to any of the filtrations of the step above we obtain a persistence module, that is, a family of vector spaces (H,(Ke) é 2 0} endowed with linear maps Hp S <') H,(K,) - H,,K))) for S é', which are the maps induced by the inclusions of the filtration. In other words, Hp(K.) can be seen as a functor from the poset category (Rzo: <) to the category of vector spaces and linear maps. Given the mathematical construction of homology, Hp(K,) contains information about the topological features in the simplicial complexes of the filtration, and in particular, about when features appear and disappear as the parameter increases. We now seek to provide a compact description for this.
Persistence barcodes. The mathematical structure of persistence module has various desirable properties. Among them, one of the most important ones is satisfying the conditions for the the so called structure theorem (Botnan & Lesnick, 2023, Theorem 4.2) to apply, which tells us that a given persistence module H,.).) decomposes in an essentially unique way as a direct sum of interval modules [6, d). Interval modules are persistence modules supported over intervals of the real line which, inside their support, map to the vector space R, and outside, to O. Since the decomposition is an invariant of the isomorphism type of (K.)),, the collection intervals appearing in it is also a topologiaal invariant. We refer to this collection of bars the persistence barcode of the input data. The interpretation of these barcodes becomes apparent: each of the bars in the barcode correspond to topologiaal feature that appears at the initial point in the interval (its birth time) and persists until its end (its death time). There are many other invariants that we can derive from the original persistence module HK.). such the rank function (Frosini, 1990; 1992), the persistence image (Adams et al., 2017) or the persistence landscape (Bubenik, 2020); some of these invariants act on barcodes as vectorizations or embeddings. In this work, we focus on barcodes and we represent statistics calculated from bars and barcodes in the form of a vector, which is different in spirit from an embedding or vectorization of barcode.
A.2 PERSISTENT HOMOLOGY BARCODE STATISTICS
To interpret the barcodes from Section 3.2 and Section A.1, extract key summary statistics that quantify the topological structure observed at each layer under both adversarial conditions.
From each 1-dimensional (ID) barcode, we gather intervals (b,, d,) with d, > b, 0 and define 4 = d - by Forming a discrete distribution p. L// Σj lj. the persistence entropy is
-=-x Σ ps In(p: + +e),
where e small positive constant (e.g., 10 10) to ensure numerical stability. Higher E indicates a more uniform distribution of lifetimes (no single interval dominates), whereas lower E reflects a small number of long-lived intervals.
In addition to entropy, we compute the following summary statistics on dimension-1 bars:
Mean births (1-bars): Average birth time
Mean deaths (1-bars): Average death time d
Mean persistence (1-bars): Average lifetime (d, - by)
Number of 1-bars: Count of finite intervals in dimension
We perform these computations for each barcode individually and then average over all barcodes in the same condition (elicited or elicited) and (clean or poisoned).
18

---

Published as a conference paper at ICLR 2026
B FURTHER TOPOLOGICAL AND LOCAL VARIANCE INTERPRETATION
B.1 EXTENDED PROMPT INJECTION (CLEAN VS. POISONED)
Table 4: Dimension-1 persistent homology differences (clean - poisoned) in key metrics for three models across several layers. Positive values mean the clean condition has higher value, while negative indicates poisoned is higher for that metric. All entries rounded to four decimals.
Mean births
Mean deaths
Mean persistence 1-bars diff
Entropy 1-bars diff
Number 1-bars diff
Model
Layer
1-bars diff'
1-bars diff
-0.0005
0,0000
-0,001
0.1665
86,9700
-0,0609
-0.0088
0.0001
0.1213
79.5600
LLaMA-3
-0.3166
-0.3249
-0.0082
0.0188
17.9367
(8B)
-0.9932
-1.0256
-0.0324
0.1595
80.0833
32
-1833367
-18,9290
-0.5923
0.3348
192.4900
0.0004
0,0004
0.0000
0.0172
3.7967
-0.0293
+0,0295
-0,0002
0.1485
118.9167
Mistral (7B)
16
-0.2375
-0,2421
-0.0047
0.1938
154.7633
24
-056994
+0,5815
-0.0120
0.2070
153.9633
14.7376
-1.05558
-0.3182
0.2239
166.4267
0.0011
0.0009
-0.0002
0.0101
4.3200
-0.4522
00.4675
-0.0153
0.0888
59.0967
Phi 3 (3.8B)
-1.7825
-1,8293
-0.0467
0.0696
48.7367
24
-6.2017
-6.3448
-0.1431
0.1665
116.9433
32
-1.0092
-1.0503
-0.0411
-0.4857
-136.1200
For mean births and mean deaths, all layers except layer across models have negative differences, indicating that poisoned intervals emerge and die later in the filtration. The mean persistence also higher for poisoned examples, especially in the middle layers. The entropy differences also almost all positive (except Phi3 3.8's final layer), suggesting that clean distributes its ID lifetimes more evenly, while poisoned tends to concentrate total persistence in fewer cycles. Likewise, the number 1-bars remains mostly positive, so clean produces more 1D holes overall.
Overall, poisoned conditions often yield fewer but more dominant dimension-1 features that appear later and persist longer, whereas clean spreads its total persistence across numerous shorter-lived cycles, resulting in higher entropy. Depending the model, the specific layer where these features distinctions appear strongest differ but the nature of the difference is the same across models and layers.
B.2 SANDBAGGED MODEL (LOCKED ELICITED)
Table Dimension-1 persistent homology differences (elicited locked) for two models across multiple layers. Positive values indicate that the elicited condition has higher values; negative means locked is higher for that metric.
Mean births
Mean deaths 1-bars diff
Mean persistence
Entropy 1-bars diff
Number
Model
Layer
1-bars diff
1-bars diff
1-bars diff
-0.0127
00.1122
-0.0005
0.0156
3.2400
-0.3425
-0.5555
-0,0130
0.0647
27.8600
LLaMA-3
15
-0,0476
-0.0455
0.0021
0.2114
135.2900
(8B)
-0.1168
-0.1204
-0.0037
0.0100
61.8766
-0,9750
-1,0458
-0.0707
0.0620
28.2800
-0.0033
0.0055
-0,0002
0.0942
27.1533
-0.1925
+0.1999
-0.0064
0.0310
14.1066
Mistral (7B)
15
0.0393
0,0352
+0.0041
0.0277
10.9300
23
0.6722
0.7037
0,0315
-0.0363
-0.1900
14.6450 31
15.2952
0.6503
-0.0014
9.3233
19

---

Published as a conference paper at ICLR 2026
For LLaMA3 8B the mean birth and death differences negative across all computed hidden layers (1. 8, 16, 24, 32). Note that layers are zero-indexed, meaning that layer 0 corresponds to the first hidden layer. layer 1. This indicates that, in the locked condition, ID cycles exhibit larger (i.e., later) birth and death times compared to elicited, In other words, when locked, the 1D) features tend to emerge "further out" in the filtration. The mean persistence difference between conditions is also negative (except layer 16), suggesting that locked cycles generally persist slightly longer on average. Entropy differences are positive, indicating that elicited exhibits a greater diversity or spread among the lifetimes of its ID features. The number of 1-bars is positive (sometimes strongly so), meaning there are substantially more 1D features in the elicited condition.
We see similar results for Mistral 7B with negative differences in births and deaths in earlier layers, implying that locked has larger birth/death times at those lower layers. However, the sign flips, with elicited displaying larger values for births, deaths, and persistence. Specifically, layer 32 shows a notably large positive difference (e.g., +14.64 for births, 15.29 for deaths), indicating that the final layer in elicited captures significantly later ID cycles relative to locked. The number of 1-bars also tends to be higher in elicited most layers, except for minor negative at layer 23, again suggesting that elicited reveals a greater number of dimension-1 features.
B.3 LOCAL DISPERSION RATIO ACROSS POISONED CONDITIONS
We analyze how local geometry in hidden-layer representation space differs between clean and multiple poisoned modes in six LLMs. We further classify poisoned prompts into three sub-types:
1. Executed: The injected request is recognized and carried out (indirect prompt injection).
2. Refused: The model identifies the injected content as malicious and issues a refusal, effec- tively "shutting down" any detailed elaboration.
3. Ignored: The model neither executes nor refuses, but effectively overlooks the injected prompt, proceeding as it were absent.
For each final token's 's activation difference vector AActe(x;) R.,, we identify its & nearest neigh- bors in layer l and perform PCA on those points. Let A 2 ... 2 Ap be the resulting eigenvalues. We define the dispersion ratio of A Actt, (x:) as
D'
2
A1 +
where 6 prevents division by zero. A higher ratio indicates that variance is more evenly spread among secondary directions, whereas lower ratio implies most variance lies in a single dominant direction.
Ablation: Clean vs. Clean, Poisoned vs. Poisoned, and Mixed. To confirm that dispersion dis- crepancies primarily reflect true clean vs. poisoned distinctions rather than random partitioning or mixture effects, we performed three auxiliary comparisons:
1. Clean vs. Clean: Split the clean set into two subsets, ensuring significant difference arises from sampling within the same class.
2. Poisoned vs. Poisoned:
Applied the same procedure to poisoned data to assess within-class
variability.
3. Mixed vs. Mixed:
Randomly partitioned a combined pool of clean and poisoned samples into two balanced groups.
For every layer in each subplot, we computed the dispersion ratio for both clean and the specified poisoned (or refused, executed, ignored) samples. We then con- ducted Welch's t-test on these two groups (clean vs. poisoned/other), applying false-discovery rate (FDR) correction across layers. We also verified approximate normality via kernel density estimates (KDEs) for each groups. Plot markers with stars indicate layers where PEdr < 0.05, confirming
Note on Statistical Methods:
20

---

Published as a conference paper at ICLR 2026
statistically significant difference in dispersion ratio. To select i 30, tested candidate neigh- borhood sizes across layers and models, measuring which k produced the largest absolute difference in mean local dispersion ratio between clean and poisoned conditions.
B.3.1 DISCUSSION OF RESULTS
Figures 11 and 12 highlight that:
Early Layers (Layer 1-8): Across all poisoning modes, the clean condition consistently shows higher dispersion ratio, suggesting that the model initially allocates broader repre- sentational capacity for normal inputs.
This pattern often flips, with poisoned prompts (especially exe- cuted or ignored) exceeding the clean baseline, indicating the network is dedicating extra directions to elaborate or "embrace" these injected requests. Conversely, refused prompts typically exhibit reduced dispersion, mapping disallowed content into lower-variance gion.
Mid Layers (Layer 16):
Interestingly, our findings align with the results of Stephenson et al. (2021), which indicate that memorization tends emerge in deeper layers where the effective dimensionality shrinks. Con- sistent with that view, we observe that executed or ignored prompts show a higher dispersion in mid-layers, implying the model invests additional capacity there for those injected instructions. Meanwhile, a refused request is routed into a more compressed region, effectively "shutting down" further representational expansion. In this sense, deeper layers may provide a setting where the net- work can more sharply discriminate or overfit certain inputs- supportnn the idea that final layers reflect a gradually compressed, yet strategically focused representation space.
LL2 D3
P-1 Nedium 228k
1//4611
Figure 11: Layer-wise Dispersion Ratio for Clean vs. Poisoned Examples. The green and red lines depict mean dispersion ratios for clean and poisoned inputs, respectively, at different layer depths. Error bars around each point represent (left side), clean data consistently has higher dispersion on average, whereas in mid-layers (center), poisoned surpasses the clean baseline, indicating a re-distribution representational capacity for the injected prompts. Layers where the difference is statistically significant (PFDR < 0.05) are marked with a red asterisk above the higher mean value.
standard error of the mean (SEM). early layers
21

---

Published as a conference paper at ICLR 2026
Unra2 Conatar
120
Figure 12: LLaMA3.7B Dispersion Ratio: Clean vs. Executed, Refused, and Ignored Prompts. The horizontal axis indicates layer depth. while the vertical axis represents the mean dispersion ratio. The blue curve (with confidence band) corresponds to clean imputs; orange, red, and green curves denote executed, refused, and ignored poisoned prompts, respectively. Notably, refused prompts show an early jump but then collapse below the clean baseline, whereas executed and ignored surpass it around mid-layers, highlighting distinct representational regimes.
misital,
Noan Difivencc
0.-
0.0
-02
-04
-06
Layer
mixtral 7B
phi3 3.8
0.4
Hoar billernnce
-02
-06
-0.4
-10
30
20
35
20
Layer
Layer
708
phB
Naar Difarence
Mower Dilference
-3.50
0:25
-2.75
6:02
-0:25
-6.55
Layer
Figure 13: Ablation of Dispersion Ratio Differences (Clean Clean, Poisoned Poisoned, Mixed vs. Mixed). Each plot shows the difference in mean dispersion ratio (clean minus poisoned). Positive values indicate that the clean subset exhibits higher dispersion, whereas negative values reflect a more dispersed poisoned subset.
B.4 COSINE DISTANCE OF REPRESENTATIONS
We analyze the difference representations AAct((z;) R for corresponding pairs of clean and poisoned inputs Figure 14. Specifically, for each model and layer, we load up to five pairs clean and poisoned activation files, compute the difference between the activations for each pair, and con-
22

---

Published as a conference paper at ICLR 2026
catenate these differences. From these differences, draw equal-size subsamples of 5000 vectors. For each layer and comparison condition, we compute the mean pairwise cosine distance within each subsample. Because cosine distance is scale-invarian representations. We perform four comparison conditions: clean vs. poisoned, clean vs. clean (where clean samples split in half), poisoned vs. poisoned (where poisoned samples split in half), and mixed vs. mixed (where two separate mixed subsamples are created, each containing half clean and half poisoned differences). For each comparison, we generate wise intra-class distances (or inter-class in the clean vs poisoned case) using 3 bootstrap iterations. We then apply Welch's 's t-test these distributions to assess whether they diverge significantly.
do not normalize these difference
distributions of mean pair-
Empirically, poisoned difference representations typically exhibit higher mean cosine distance in deeper layers, indicating more "spread-out" or heterogeneous arrangement of their difference vectors, much as we observed in the curvature analysis. clean data, by contrast, remains compara- tively tightly clustered, implying less dispersion in its difference space. Interestingly, LLaMA33700 displays similar characteristics in the early and final layers but poisoned representations have no- ticeable smaller cosine distance in middle layers. This may reflect the ability larger architectures to better partition representation space across the network before re re-expanding in later layers.
0.32
0.5
6.25
0.5
0.4
6:35
0.32
0.1
(18171 70 Cln
71472 5. Catte Din
0.6
Figure 14: Cosine Distance of Difference Representations Across Layers. Each panel shows mean cith distances (clean vs. poisoned) for the difference representations (poisonedVclean pass minus baseline), where higher values reflect greater variation among samples. Stars denote layers with significant differences.
C FURTHER DETAILS OF GLOBAL LAYER- LAYER-WISE ANALYSIS
We now provide further details on the global layer-wise analysis.
C. PIPELINE
We describe in more detail the pipeline in Figure 3 in the main text. Recall that our aim here was showcasing that topological signatures effectively capture distinctions between representations under normal or adversarial conditions, and to provide an interpretation of the reason behind such difference in terms of the "shape" of the latent representations.
We use RIPSER Bauer (2021) to compute barcodes, which based on Vietoris-Rips filtrations (see Figure 2.1). The computational constraints of PH make impossible to compute the barcode of
23

---

Published as a conference paper at ICLR 2026
any of our two datasets (clean poisoned or locked vs. elicited). Therefore, we leverage sub- sampling approaches ge Chazal et al. (2015)) and compute barcodes from K = 64 subsamples (2 ..... Li,,e) IR with size lc 4096, of the representations per layer 1 S e s L. From these, 64 are taken from normal activations and 64 from adversarial activations. We use these as proxies for the topology of the whole space.
Following Ali et al. (2023), we represent these barcodes as +1-dimensional feature vectors, which call barcode summaries. These include 35 statistics derived from 7 5 grid of { {mean, mini- mum, first quartile, median, third quartile, maximum, standard ]eviation] x {death of O-bars, birth of 1-bars, death of I-bars, persistence of 1 1-bars, ratio birth/death of 1-bars]; as well as the total per- sistence (i.e., sum of the lengths of all bars in the barcode), number of bars, and persistent entropy (Chintakunta et al., 2015; Rucco et al., 2016) defined Appendix A.2 for and 1-bars. We reduce the dimensionality case-by-case by eliminating highly correlated features (above a threshold of 0.5) through cross-correlation analysis.
For exploratory analysis, we apply PCA and compute CCA loadings to measure feature correlations with the principal components. logistic regression model then used for classification, and Shapley values (Lipovetsky & Conklin, 2001) are computed to evaluate feature importance. Shapley values, derived from cooperative game theory, quantify the contribution of each feature to model predictions by measuring its influence in shifting predictions from baseline (c.g., 0.5 for logistic regression), providing an interpretable, feature-level analysis of predictive impact.
C.2 ABLATION STUDIES ON SURSAMPLING PARAMETERS
We evaluate the representation of clean and poisoned activations using a subsampling- baaeea based topolog- ical analysis. For each experiment, we consider fixed layer of Mistral 7B and draw h subsamples of size n from the clean activations and ht subsamples of size n from the poisoned activations. Each subsample is used to compute a Vietoris- persistence diagram, which is subsequently repre- sented as a 41 4l-dimensional barcode summary vector. This procedure produces a combined point cloud in R4 of size 2k, consisting of k clean and k poisoned feature vectors.
Predictive Power of Barcode Summaries for Varying (n, We perform the same classification task as in the main text, namely, we fit a logistic regression model to classify between clean and poisoned in each point cloud with fixed (n,, k). for the first, the middle, and the last layer of Mistral 7B. We report the 5-fold cross validation results in Figure 15. We observe that there are no clear dependencies of this parameter over the parameters (n. A). Layer seems to be more difficult to classify, requiring at least 500 subsamples, whereas for later layers we obtain perfect classification with as little as A: 30 subsamples of size 100.
Layer
Layer
Layer
1.00
1.00
1.00
1.00
1.00
1.00
(subssmmgle size]
[subsaangle stre)
2000-
1.00
1.00
1.00
1.00
1000-
1.00
1.00
1.00
1.00
1200-
1.00
1.00
1.00
1.00
0.98
1.00
0.97
1.00
1.00
1.00
1.00
1.00
1.00
1.00
1.00
1.00
0.63
0.57
0.62
1.00
1.00
1.00
50 (number subsamples)
subsaaplees
(number subsamples)
Figure 15: Accuracies of 5-fold cross validation logistic regression trained to distinguish bar- code summaries of i subsamples of size n of clean activations and subsamples of size n of poi- soned activations at layers 1, 16 and 32 of Mistral 7B.
Metric Description of Clusters for Varying (n, k). We now focus activation values for layer 16 in Mistral 7B, over which the barcode summaries are computed in subsamples with parameters (n, k). All feature vectors are standardized using global Standa rdScaler fitted on the whole point cloud. We then compute several metries to quantify the structure of the resulting represen-
24

---

Published as a conference paper at ICLR 2026
tation: (i) the mean intra-class distance within the clean and poisoned subsamples, (ii) the mean inter-class distance between the two groups, and (iii) the inter-to-intral distance ratio
dinter
golean + dpaison intra
Intra
We perform ablations over the subsample size n and the number of subsamples The intra-class distances (Figure 16 left and center) show minimal dependence k; but decrease consistently as n increases. This suggests that the barcode representations become more concentrated when subsamples contain more points. The values for 500, 1000, and 1500 are in close proximity, indicating an early convergence this statistic with respect to n.
The inter-class distance (Figure 16 right) exhibits complementary trend: it is largely invariant under changes in k, but increases with n. As before, the curves for n = 1000 and n 1500 almost coincide, further supporting convergence regime at moderate subsample sizes.
To combine these effects, we evaluate the inter-to-intra distance ratio in Figure fig. 17. This ratio remains stable across values of kt but increases with n. indicating that the relative separation between clean and poisoned representations improves as subsample size grows. The near overlap of the values for n 1000 and 1500 again suggests convergence this regime, which supports the choice of subsample sizes used in the main experiments.
11.9
4.8
ni:300
n=3CD
11.8
tarm Detare (Dwe
4.6
4.4
0.0
31.6
5-103
I-503
31.5
(1-50
--1000
0.5
n-0000
1500
050500
3.8
31.3
3.6
3.4
4.5
11.3
35
45
50
60 30
35
50
30
40
55
Figure 16: Left: Intra-class distance among the barcode summaries of It subsamples of size of clean activations from layer 16 of Mistral 7B. Center: Intra-class distance among the barcode summaries & subsamples size n of poisoned activations from layer 16 of Mistral 7B. Right: Intra- class distance among the clusters of clean and poisoned barcode summaries of & subsamples of size n..
Inter/Intra Distance Ratio
1500
2X1
2X1
(Sutstimple azel
2.6
intertintra Retio
1000
200
2:00
235
2.4
2.2
100
187
30
40
50
50
Inumber subsemples)
Figure 17: Inter-to-intra distance ratio (Equation 4 between & subsamples of n clean activations and l subsamples of n poisoned activations in layer 16 of Mistral 7B.
25

---

Published as a conference paper at ICLR 2026
C.3 RESULTS: CLEAN Vs. POISONED
C.3.1 MISTRAL 7B
We present here additional results on the global analysis for Mistral 7B that are referred to in the main text.
Table 6: Pruned barcode summaries for layers 1, 16, 24 and 32. Features from the barcode summaries with correlation less than 0.5 the cross-correlation matrix.
Layer 1 Layer
Layer 16
Layer 24
Layer 32
Mean death O-bars
Minimum death O-bars
Maximum death O-bars
Standard deviation death O-bars
Minimum birth 1-hars Maximum birth 1-bars
Minimum persistence 1-bars
First quartile persistence 1-bars
Maximum persistence 1-bars
Mean birth/death 1-bars
First quartile birth/death 1-bars
Maximum birth/death 1-bars
Total persistence 1-bars
Number O-bars
Number 1-bars
Entropy O-bars
Total features
8
5
Loadings from CCA
1.0
0.8
0.6
0.4
0.2
0.0
Mean deaths 0 bars
Std. Dev. deaths 0-bars
Max births 1-bars
First quartile persistence 1 bars
Max deaths O-bars
Mean deaths O-bars
Min deaths 0-bars
Number 1-bars
First quartile birth death 1-bars
Mean birth, death 1-hars
Mean deaths O-bars
Number 1-hars
Entropy 0 bars
Mean birth, /irth/deea /death 1- bars
Min deaths 0-bars
Mean deaths 0-bars
Number 1-hars
Min persistence 1-bars
Number O-bars
Number 1-hars
Mean deaths O-bars
Mean birth /deth 1- bars
Min persistence 1-hars
Number 0-bars
Figure 18: CCA loadings for clean vs. poisoned activations. Loadings of the most important contributions to the first canonical variable of the CCA the pruned barcode summaries show that the mean of the death of O-barr is significantly correlated with the first two principal components of the PCA across all layers.
26

---

Published as a conference paper at ICLR 2026
Layer
Layer 3
Luyer 15
54 Be dualls lor
eiuto bery
Namber looy
The cnstrs Zibm
Nummor Libars
Fil persstence
quann
So ciike fuciaco
talle fastano
STEAp Calpes
Sciaa volure
Layer 24
Layer
Msan deaths O-bans
Mean deaths Ochars
Number I-bars
Teg
Number 1-bars
Eo Sor w.ll
Mean birth, death hors
Min persistence bars
Min persizeence bors
Number O-bars
Number haras
SHAP values
SHAP values
Figure 19: SHAP analysis: clean vs. poisoned activations. Beeswarm plot of logistic regression
SHAP values trained on the pruned barcode summaries for layer 1, 8, 16, 24, and 32.
Layer 1
Layer
Layer 16
Layer 24
Layer
Density
Density
Density
Density
Density
births 1-bars
I-bars
1-bars
births 1-bars
1-bars
Density
Density
Density
Density
Density
Moan persistonce 1-bars
Mcan persistence 1-bars
Mcan persistence 1-bars
Mcan persistence 1-bars
Moan persistence 1-bars
Density
Density
Demsity
Density
Density
Number 1-bars
Number 1-bars
Number 1-bars
Number 1-bars
Number 1-bars
Clean
Poisoned
Figure 20: Histograms for the mean of the births of 1-bars, mean persistence of 1-bars and number of 1-bars for Mistral. Features extracted from the barcode summaries of the activations for layers 8. 16, 24 and 32 of the clean vs. poisoned dataset.
C.3.2 PHI3-MINI-4K (3.8B PARAMETERS)
We provide the results of the analysis depicted in Figure including layers 1, 8, 16, 23, and 32 for Phi 3 (3.8B parameters) where barcodes are computed using the Euclidean distance the representation space.
27

---

Published as a conference paper at ICLR 2026
Layer
Layer
Layer 16
Layer
Layer
1.0
Figure 21: Cross-correlation matrices for the barcode summaries for clean vs. poisoned acti- vations. Growing block of correlated features appears in the coss-coorelation matrix of the barcode summaries appears in the middle layers (layers 1, 8, 16, 24, and 32 are shown).
Layer
Layer 8
Layer 16
Layer 24
Layer 32
Clean
Poisoned
Figure 22: PCA barcode summaries of clean vs. poisoned activations. Clear distinction ap- pears in the projection onto the first principal components from the PCA of the pruned barcode summaries for layers 1, 8, 16, 24, and 32.
1.0
Loadings from CCA
0.8
0.6
0.2
0.
Std. Dev. deaths O- bars
Mean deaths O-bars
Max births 1-bars
Min persistence bars
Number O-bars
Mean deaths D-bars
Min deaths 0-bars
Number L-bars
Min persistence 1-bars
Entropy O-bars
Mean deaths O-bars
Max deaths (-barr
Entropy bars
Min deaths O-bars
Min persistence 1-bars
Mean deaths O-bars
Number 1-bars
Entropy 0-bars
Min persistence 1-bars
Min deaths 0-bars
Mean deaths O-bars
Min deaths O-bars
Max persistence l-bars
Min persistence 1-bars
Number babars
Figure 23: CCA loadings for clean vs. poisoned activations. Loadings of the 5 most important contributions to the first canonical variable the CCA on the pruned barcode summaries show that the mean of the death of O-bars is significantly correlated with the first two principal components of the PCA across all layers.
28

---

Published as a conference paper at ICLR 2026
Layer
Layer 8
Layer 16
Layer 24
Layer 32
0.75
0.50
Accuracy: 1.00
Accuracy: 1.00 AUC-ROC: 1.00
Accuracy: 1.00
Accuracy: 1.00
Accuracy: 1.00 AUC-ROC:
AUC-ROC: 1.00
AUC-ROC: 1.00
AUC-ROC: 1.00
CV: 1.00
CV: 1.00
CV: 1.00
CV: 1.00
CV: 1.00
Figure 24: Logistic regression for clean vs. poisoned activations. Prediction of logistic regres- sion trained on 70/30 train/test split of the pruned barcode summaries, plotted on the projection onto the two first principal components for visualization purposes. Accuracy and AUC-ROC tested on the test data, and 5-fold cross validation on train data are presented for each model, showcasing the outstanding performance all models.
Laya
Mer deate Uitare tad Des darte fat
Moan desth Chem
Mox deate D-ttre
SA Aqux
dratis
persitrne Namber Jham
Enrap Six pervernce lote
Men arim hib
Namber Outr
Sue other
of ocher
Layer 24
Layer 24
Mean
1.0
Number L-bars
Number J-bars
Entropy U-bars
Entrogy O-bars
Min persistence
persistence
Sum other features
Sum other fectures
SHAP volues
SHAP values
Figure 25: SHAP analysis: clean vs. poisoned activations. Beeswarm plot logistic regression SHAP values trained on the pruned barcode summaries for layer 16, 24, and 32.
C.3.3 MIXTRAL-8X7B (7B PARAMETERS)
We provide the results of the analysis depicted in Figure 3 including layers 1, 8, 16, 23 and 32 for the Mixtral 8 (7B parameters) model where barcodes are computed using the Euclidean distance in the representation space. We observe very similar results to the ones obtained with Mistral, indicating a consistency across models of the topological deformations adversarial influence via XPIA (see Section 3.1).
Layer
Layer
Layer 16
Layer
Layer
Figure 26: Cross-correlation matrices for the barcode summaries for clean vs. poisoned acti- vations. Growing block of correlated features appears in the cross-correlation matrix of the barcode summaries for layers 1, 8, 16, 24, and 32. Correlations in layer are lower than with Mistral 7B, Figure 6.
29

---

Published as a conference paper at ICLR 2026
Layer
Layer
Layer 16
Layer 24
Layer 32
Clean
Poisoned
Figure 27: PCA of barcode summaries of clean poisoned activations. Clear distinction ap- pears in the projection onto the two first principal components from the PCA the pruned barcode summaries for layers 8, 16, 24, and 32.
Loadings from CCA
1.0
0.8
0:6
0.4
0.0
Mean deaths O-bars
Std. Dev. deaths 0 bars
Max persistence 1-bars
Std. Dev. births bars
Max births 1-bars
Mean deaths 0-bars
Min deaths 0-bars
Min births 1-bars
First quartile persistence 1-bars
Min persistence 1-bars
Mean deaths Ol-brr
Min deaths (1-bars
Entropy 1-bars
Min persistence 1-bars
Max birth, death 1-bars
Mean deaths 0-bars
Min deaths 0-bars
Max persistence 1-bars
Min persistence 1-bars
Entropy 0-bars
Mean deaths 0-bars
Min deaths O-bars
Max persistence 1 I-bars
Min births 1-bars
Min persistence bars
Figure 28: CCA loadings for clean vs. poisoned activations. Loadings of the most important contributions to the first canonical variable of the CCA the pruned barcode summaries show that the mean of the death of O-bars is significantly correlated with the first two principal components of the PCA across all layers.
Layer
Layer
Layer
Layer 24
Layer
0.25
Accuracy: 1.00
Accuracy: 1.00
Accuracy: 1.00
Accuracy: 1.00 AUC-ROC: 1.00
Accuracy: 1.00
AUC-ROC: 1.00
AUC-ROC: 1.00
AUC-ROC: 1.00
AUC-ROC: 1.00
CV: 1.00
CV: 1.00
CV:
CV: 1.00
Figure 29: Logistic regression for clean vs. poisoned activations. Prediction logistic regres- sion trained 70/30 train/test split of the pruned barcode summaries, plotted the projection onto the two first principal components for visualization purposes. Accuracy and AUC-ROC tested on the test data, and 5-fold cross validation train data presented for each model, showcasing the outstanding performance of all models.
30

---

Published as a conference paper at ICLR 2026
Layer B
Liver L8
Sel Der dortl bas
5ix duall lwer
deato but
Mo penatonce hore
Erropy 1iae
Soaral sakee outton
Sun culles foutarr
of boleer fustann
ShAl wales
ShAt volaee
Layer 24
Layer 32
Mean doaths l-hars
Mcan deaths O O-hars
deaths D-bars
Min deaths O-bars
Max persistence 1-bors
Max, persistence 2-bars
Entrapy 0 bors
Min rittss bors
Sum 2 other features
Sum of other fostures
SHAP values
SHAP values
Figure 30: SHAP analysis: clean vs. poisoned activations. Beeswarm plot of logistic regression SHAP values trained on the pruned barcode summaries for layer 1, 8, 16, 24, and 32.
C.3.4 LLAMA3 (8B PARAMETERS)
We provide the results of the analysis depicted in Figure 3 including layers 8, 16, 23 and 32 for the Llama 3 (8B parameters) where barcodes are computed using the Euclidean distance in the representation space. We observe very similar results the ones obtained with Mistral, indicating consinstency across models of the topological deformations of adversarial influence via XPIA (see Section 3.1).
Layer
Layer 8
Layer 16
Layer 24
Layer 32
0.5
Figure 31: Cross-correlation matrices for the barcode summaries for clean vs. poisoned acti- vations. Growing block of correlated features appears in the cross-correlation matrix of the barcode summaries for layers 1, 8, 16, 24, and 32. Correlations in layer are lower than with Mistral 7B, Figure 6.
Layer
Layer 8
Layer 16
Layer 24
Layer 32
Clean
Poisoned
Figure 32: PCA barcode summaries of clean vs. poisoned activations. Clear distinction ap- pears in the projection onto the two first principal components from the PCA of the pruned barcode summaries for layers 1, 8, 16, 24, and 32.
31

---

Published as a conference paper at ICLR 2026
1.0
Loadings from CCA
0.8
0.6
0.4
Mean deaths 0-bars
Std. Dev. deaths 0-bars
Max deaths 0-bars
Min persistence 1. l-barr
Number 0-bars
Min deaths 0-bars
Mcan deaths 0-bars
Min persistence 1-bars
Entropy 0-bars
Number D-bars
Mean deaths O-bars
Mean birth herehh/ehhhhh 1-bars
Max birth birth /ceath 1-bars
Entropy 0-bars
Min persistence 1-bars
Number 1-bars
Mean deaths 0-bars
Mean birth /death 1-bars
Entropy 1-bars
Min persistence 1-bars
Mcan deaths (-bars
Min persistence 1-bars
Mean birth /death 1- l-barrs
Entropy O-bars
Entropy 1-bars
Figure 33: CCA loadings for clean vs. poisoned activations. Loadings of the 5 most important contributions to the first canonical variable the CCA on the pruned barcode summaries show that the mean of the death of O-bars is significantly correlated with the first two principal components of the PCA across all layers.
Layer 1
Layer 8
Layer 16
Layer 24
Layer 32
0.75
0.50
0.25
Accuracy: 1.00 AUC-ROC: 1.00
Accuracy: 1.00 AUC-ROC: 1.00
Accuracy: 1.00
Accuracy: 1.00 AUC-ROC: 1.00
Accuracy: 1.00 RUC-ROC: CV: 1.00
AUC-ROC: 1.00
CV: 1.00
CV: 0.99
CV: 0.99
CV: 1.00
Figure 34: Logistic regression for clean poisoned activations. Prediction of logistic regres- sion trained on 70/30 train/test split of the pruned barcode summaries, plotted on the projection onto the two first principal components for visualization purposes. Accuracy and AUC-ROC tested on the test data, and 5-fold cross validation on train data are presented for each model, showcasing the outstanding performance of all models.
Jayer 1
Layer
Loyer 16
More destm Uhbe di
Moan north liber
Moxe death Eder
Surln
Mis pesiaame lirs Eneray bers
Evonyy loos
Min penstence horn
Mac bitt Weath bur
Layer 24
Layer 32
Mean desths 0-bars
Mean deaths O-bors
Number 1 bars
Min pensiseence hars
Mean birth/deach 1-bars
Meen birth /deata I-bars
Entropy I-bars
Entropy O-bars
Sum of 3 other features
Sum of 2 other festures
SHAP
83
Figure 35: SHAP analysis: clean vs. poisoned activations. Beeswarm plot of logistic regression SHAP values trained on the pruned barcode summaries for layer 16, 24, and 32.
32

---

Published as a conference paper at ICLR 2026
C.3.5 PHI3-MEDIUME 128K (14B PARAMETERS)
We provide the results of the analysis depicted in Figure 3 including layers 1, 8, 16, and 32 for the Phi-3-medium (14B parameters) model where barcodes are computed using the Euclidean distance in the representation space. We observe very similar results to the ones obtained with Mistral, indicating a consisteney across models of the topological deformations of adversarial influence via XPIA (see Section 3.1).
Layer
Layer
Layer 16
Layer
Layer
Figure 36: Cross-correlation matrices for the barcode summaries for clean vs. poisoned acti- vations. Growing block of correlated features appears in the cross-correlation matrix of the barcode summaries for layers 1, 8, 16, 24, and 32. Correlations in layer are lower than with Mistral 7B, see Figure 6.
Layer
Layer 8
Layer 16
Layer 24
Layer 32
apolt
Clean
Poisoned
Figure 37: PCA of barcode summaries of clean vs. poisoned activations. Clear distinction ap- pears in the projection onto the first principal components from the PCA of the pruned barcode summaries for layers 1, 8, 16, 24, and 32.
1.0
Loadings from CCA
0.6
0.4
0.
Mean deaths 0 bars
Std. Dev. deaths O-bars
Max deaths 0 bars
Number 1: bars
Min persistence 1-bars
Min deaths 0- bars
Mean deaths 0-bars
Max deaths O-bars
Min persistence 1-bars
Min births 1-hars
Mean deaths O-bars
Min deaths 0-hars
Max persistence 1- bars
Min persistence 1- bars
Number 0 O-bars
Mean deaths 0-bars
Number 1-bars
Min persistence b-bars
Min deaths O-bars
Number O-bars
Mean deaths 0-hars
Number 1-bars
Min persistence 1- bars
Min deaths O-hars
Entropy bars
Figure 38: CCA loadings for clean vs. poisoned activations. Loadings of the most important contributions to the first canonical variable of the CCA the pruned barcode summaries show that the mean of the death of b-bars is significantly correlated with the first two principal components of the PCA across all layers.
33

---

Published as a conference paper at ICLR 2026
Layer
Layer 8
Layer 16
Layer 24
Layer 32
0.77
0.50
Accuracy: 1.00
Accuracy: 1.00 AUC-ROC: 1.00
Accuracy: 1.00
Accuracy: 1.00
Accuracy: 1.00 RUC-ROC: CV: 1.00
AUC-ROC: 1.00
AUC-ROC: 1.00
AUC-ROC: 1.00
CV: 1.00
CV: 1.00
CV: 1.00
CV: 1.00
Figure 39: Logistic regression for clean vs. poisoned activations. Prediction of logistic regres- sion trained on 70/30 train/test split of the pruned barcode summaries, plotted on the projection onto the two first principal components for visualization purposes. Accuracy and AUC-ROC tested on the test data, and 5-fold cross validation on train data are presented for each model, showcasing the outstanding performance all models.
-yye
Layer 8
Layer LG
Mlcc doalis
Moxx Clice
Mac dearin thta
1in persitacce Shom
Nox persitance Joan
Namber hibe
persitmne
SHAP
SPAP valuee
I Layer 24
Layer 32
Mian deaths hars
Moan deaths O-bars
Number 1-bars
Number 1-bars
aert 4
++
persistence
Entrosy
Min deaths bars
Min persistence 1- bars
Numbor O bars
Sum of other festures
Figure 40: SHAP analysis: clean vs. poisoned activations. Beeswarm plot of logistic regression SHAP values trained on the pruned barcode summaries for layer 16, 24, and 32.
C.3.6 LLAMA3 (70B PARAMETERS)
We provide the results of the analysis depieted in Figure including layers 1, 8, 16, 23 and 32 for the Llama (70B parameters) where barcodes are computed using the Euclidean distance in the representation space. We observe very similar results the ones obtained with Mistral, indicating consinstency across models the topological deformations of adversarial influence via XPIA (see Section 3.
Layer
Layer 8
Layer 16
Layer 24
Layer 32
Figure 41: Cross-correlation matrices for the barcode summaries for clean vs. poisoned acti- vations. Growing block of correlated features appears in the cross-correlation matrix of the barcode summaries for layers 1, 8, 16, 24, and 32. Correlations in layer are lower than with Mistral 7B, Figure 6.
34

---

Published as a conference paper at ICLR 2026
Layer
Layer
Layer 16
Layer 24
Layer 32
Clean
Poisoned
Figure 42: PCA of barcode summaries of clean poisoned activations. Clear distinction ap- pears in the projection onto the two first principal components from the PCA the pruned barcode summaries for layers 8, 16, 24, and 32.
1.0
Loadings from CCA
0.8
0.6
0.0
Std. Dev. deaths 0-bars
Mean deaths 0-bars
Max deaths O-bars
Min persistence 1 bars
Number 0 O-bars
Max deaths 0 bars
Mean deaths 0-bars
Entropy 1-bars
Min persistence 1-bars
Median births 1-hars
Min deaths O-bars
Mean deaths 0-hars
Entropy bars
Mean birth, /deah b-baas
Max deaths 0-bars
Mean deaths 0-bars
Mcan birth death 1-bars
Entropy barsss
Max deaths baba
Min deaths 0-bars
Std. Dev. birth /'eath 1-bars
Mean deaths O-bars
Mean birth; /deah 1- bars
Entropy O-hars
Min persistence b-barrs
Figure 43: CCA loadings for clean vs. poisoned activations. Loadings of the most important contributions to the first canonical variable of the CCA the pruned barcode summaries show that the mean of the death of O-bars is significantly correlated with the first two principal components of the PCA across all layers.
Layer
Layer
Layer
Layer 24
Layer
0.25
Accuracy: 1.00 AUC-ROC: 1.00
Accuracy: 1.00
Accuracy: 1.00
Accuracy: 1.00 AUC-ROC: 1.00
Accuracy: 1.00
AUC-ROC: 1.00
AUC-ROC: 1.00
AUC-ROC: 1.00
CV: 1.00
CV: 1.00
CV:
CV: 1.00
Figure 44: Logistic regression for clean vs. poisoned activations. Prediction logistic regres- sion trained 70/30 train/test split of the pruned barcode summaries, plotted the projection onto the two first principal components for visualization purposes. Accuracy and AUC-ROC tested on the test data, and 5-fold cross validation train data presented for each model, showcasing the outstanding performance of all models.
35

---

Published as a conference paper at ICLR 2026
Layer
Loyer 18
Sol Der dortle
14x buo bitt death barm
Min peratonce hore
Medin i-be
Rander
Sun caliin bosta
Sun of Aud foctare
vilas
SIAA vi
Layer 24
Layer
Mean doaths O-bans
Mazn deaths O-bars Std.
1-bars
alove
Entropy 0-bars
Mean birth /daahh bars
Min deaths 0 bors
Entropy 0 bars
Sum of other features
Sum of other features
SHAP values
SHAP values
Figure 45: SHAP analysis: clean vs. poisoned activations. Beeswarm plot of logistic regression SHAP values trained on the pruned barcode summaries for layer 1, 8, 16, 24, and 32.
C.4 RESULTS: LOCKED vs. ELICITED
C.4.1 MISTRAL. 7B
We include the results of the global analysis in Figure 3 for the locked vs. elicited dataset. There are two main differences with previous results: the block of high correlated features presents a less clear trend and is more faint in layer 16, resulting in the need of more features in the analysis; and the mean death the O-bars changes the sign of its influence in classifying locked and clicited models across layers. However the distinction in the PCA of the barcode summaries remains clear and the logistic regression still achieves perfect performance, despite slightly less straightforward analysis.
Layer
Layer 8
Layer 16
Layer 24
Layer 32
1.0
0.5
Figure 46: Mistral with Euclidean distance: Cross-correlation matrices for the barcode sum- maries for locked vs. elicited activations. Growing block of correlated features appears in the cross-correlation matrix of the barcode summaries for layers 1, 8, 16, 24, and 32.
Layer
Layer
Layer 16
Layer 24
Layer 32
Clean
Poisoned
Figure 47: Mistral with Euclidean distance: PCA barcode summaries of locked vs. elicited activations. Clear distinction appears in the projection onto the two first principal components from the PCA of the pruned barcode summaries for layers 1, 8, 16, 24, and 32.
36

---

Published as a conference paper at ICLR 2026
1.0
Loadings from CCA
0.88
0.6
0.2
0.0
Mean deaths D-bars
Number I-bars
Min deaths babars
Max deaths 0 bars
Number 0-bars
Mean deaths 0-bars
Number 1-bars
Min persistence 1-bars
Min deaths 0-bars
Max birth, /death 1-bars
Mean deatts 0-bars
Mean persistence 1-bars
Std. Dev. births 1-bars
Min births 1-bars
Min deaths 0-bars
Number 0-bars
Number 1-bars
Min persistence 1-bars
Mean deaths 0-bars
Number 1-bars
Mean deaths 0-bars
Number 0-bars
Max deaths 0-bars
Max births 1-bars
Figure 48: Mistral with Euclidean distance: CCA loadings for locked vs. elicited activations. Loadings of the 5 most important contributions to the first canonical variable of the CCA on the pruned barcode summaries show that the mean of the death of O-bars is significantly correlated with the first two principal components the PCA across all layers.
Layer 1
Layer 8
Layer 16
Layer 24
Layer 32
0,75
0.50
0.25
Accuracy: 1.00
Accuracy: 1.00 AUC-ROC: 1.00
Accuracy: 0.99 AUC-ROC: 1.00
Accuracy: 1.00 AUC-ROC: 1.00
Accuracy: 1.00 AUC-ROC: CV: 1.00
AUC-ROC: 1.00
CV: 1.00
CV: 1.00
CV: 0.99
CV: 1.00
Logistic regression for locked elicited activa- tions. Prediction of logistic regression trained on 70/30 train/test split of the pruned barcode summaries, plotted on the projection onto the two first principal components for visualization pur- poses. Accuracy and AUC-ROC tested on the test data, and 5-fold cross validation on train data are presented for each model, showcasing the outstanding performance of all models.
Figure 49: Mistral with Euclidean distance:
37

---

Published as a conference paper at ICLR 2026
Layer 1
Layer B
Mean deaths O-bars
Mean deaths 0-bars
Number 1-bars
Number 1-bars
Min deaths D-bars
Min deaths O-bars
Number 0-bars
Number 0-bars
Sum of other features
Sum of other features
SHAP values
SHAP values
Layer 16
Layer 24
Mean deaths bars
Mean deaths O-bars
Mean persistence hars
Number 1-bars
Third quartile birchs 1-bars
Min persistence 2-bars
Max birth/ 1-bars
Sum of other features
Number O-bars
SHAP
SHAP ues
Layer
Mean deaths O-bars
Number 1-bars
Max deaths O-bars
Min persistence 1-bars
Sum of 2 other features
SHAP values
Figure 50: Mistral with Euclidean distance: SHAP analysis for locked vs. elicited activations. Beeswarm plot of the SHAP values for the logistic regression trained the pruned barcode sum- maries for layer 1, 8, 16, 24, and 32. The mean the deaths of O-bars appears as the most impactful feature in the prediction of the model, shifting predictions to "locked" when the value of the feature lower for layers 8, 16, 23, and 32, and to "elicited" when it is higher. The opposite phenomenon observed in layer
C.4.2 LLAMA3 (8B PARAMETERS)
We include the results of the global analysis in Figure 3 for the locked vs. elicited dataset. Here we also observe less clear patterns of correlations in the topological features, particularly for latter layers. Despite the mean of the death of O-bars remaining as one of the key features in the CCA, the interpretation of the Shapley values is less straightforward this case as the dichotomous behavior of these for the mean of the O-bars disappears for latter layers.
Layer
Layer
Layer 16
Layer
Layer
1.0
Figure 51: Llama with Euclidean distance: Cross-correlation matrices for the barcode sum- maries for locked vs. elicited activations. Decreasing block of correlated features appears in the cross-correlation matrix of the barcode summaries for layers 16, 24, and 32.
38

---

Published as a conference paper at ICLR 2026
Layer
Layer
Layer 16
Layer 24
Layer 32
Clean
Poisoned
Figure 52: Llama with Euclidean distance: PCA of barcode summaries of locked vs. elicited activations. Clear distinction appears in the projection onto the two first principal components from the PCA of the pruned barcode summaries for layers 1, 8, 16, 24, and 32.
1.0
Loadings from CCA
0.8
0.4
02
00
Mean birth, /eath 1-bars
Mean deaths 0-bars
Number 1-bars
Max birth, death 1-bars
Min deaths 0-bars
Mean deaths 0-bars
Number 1-bars
Max birth /dath 1-bars
Min persistence 1-bars
Min deaths 0-bars
First quartile births 1-bars
Mean persistence 1-bars
First quartile deaths bars
Mean deaths 0-bars
Min deaths 0-bars
Mean deaths b-barr
Max births 1-bars
Total persistence 1-bars
Min persistence 1-bars
Max persistence 1-bars
Mean deaths O-bars
First quartile deaths D-bars
Total persistence l-bars
Min births 1-bars
First quartile births bars
Figure 53: Llama with Euclidean distance: CCA loadings for locked vs. elicited activations. Loadings of the 5 most important contributions to the first canonical variable of the CCA on the pruned barcode summaries show that the mean of the death 0-bars significantly correlated with the first two principal components of the PCA across all layers.
Layer
Layer
Layer
Layer 24
Layer
-0.5
Accuracy: 1.00
Accuracy: 1.00
Accuracy: 1.00
Accuracy: 0.98
Accuracy: 0.97
AUC-ROC: 1.00
AUC-ROC: 1.00
AUC-ROC: 1.00 CV:
AUC-ROC: 1.00
AUC-ROC: 0.99
CV: 1.00
CV: 1.00
CV: 0.99
Logistic regression for locked vs. elicited activa- tions. Prediction of logistic regression trained 70/30 train/test split of the pruned barcode summaries, plotted on the projection onto the two first principal components for visualization pur- poses. Accuracy and AUC-ROC tested the test data, and 5-fold cross validation train data presented for each model, showcasing the outstanding performance of all models.
Figure 54: Llama with Euclidean distance:
39

---

Published as a conference paper at ICLR 2026
Layer 1
Layer B
Mean deaths D-bars
Mean deaths O-bars
Min deaths D-bars
Number 1-bars
Mean birth /darth 1-bars
Max birth 1-bars
Number 1-bars
Number 0-bars
Sum of 3 other fee Lures
Sum of other features
SHAP values
SHAP values
Layer 16
Layer 24
Mean deaths O
Total persistence 1-bars
First quartile deaths 0 hars
Mean deaths 0-bars
First quartile births 1-bars
Mean persistence 1-bars
Min deaths O-bars
Max births 1-bars
Sum of other features
Sum 4 other features
SHAP values
SHAP values
Layer 32
Mean deaths O-bars
First quartile deaths 0-bars
First quartile births 1-bars
Min births 1-bars
Sum of other features
SHAP values
Figure 55: Mistral with Euclidean distance: SHAP analysis for locked vs. elicited activations. Beeswarm plot of the SHAP values for the logistic regression trained the pruned barcode sum- maries for layer 1, 8, 16, 24, and 32. The mean of the deaths of O-bars appears as the most impactful feature in the prediction of the model, shifting predictions to "locked" when the value of the feature is lower for layers 8, 16 and 32, and to "elicited" when it is higher. For layer 24, the total persis- tence of 1-bars appears as the most important feature. Lower number of 1-bars classifies the point as "locked" while higher values push the prediction toward "clicited""
D FURTHER DETAILS ON LOCAL ANALYSIS
In this section we provide further details to the local analysis in Section 3.3.
D.1 PIPELINE
Within this local analysis, we aim to determine the interaction of elements the neural network across the layers by taking representations across pairs of layers coordinates in 2 dimensions (2D). We study this across three models: Mistral, Phi3 3.8B and LLaMA3 8B. For each of these models, we take sample of 2000 from each model, 1000 of which clean activations and 1000 of which are poisoned activations. Each element along the layer given their emhedding into 2D can be thought of as nodes in graph with weighted connections based the Fuclidean distances between the points. On these graphs, we construct the Victoris-Rips filtration and compute the resulting persistence barcode which describes the topology of the interactions between the elements.
For this local analysis, we focus on a smaller selection of persistence barcode summaries, including measures such as the mean death of O-bars, total persistence of and 1-bars, and persistent entropy, while excluding measures such as the quantiles of death bars. We compute these summary statistics and track their progression across pairs of layers in the models. We presented one such progression within Figure 10 in Section 3.3, which captures how total persistence changes over the layers and
40

---

Published as a conference paper at ICLR 2026
distinct from the control case. In the following sections, include further plots to support this argument.
D.2
RESULTS
D.2.1
MISTRAL MODEL
Original
Scaled
Scaled & Permuted
Total Persistence 1-bars
Total Persistence 1-bars
Total Persistence 1-bars
25.50
5
Poisoned
22
Poisoned
25.25
4-
20
25.00
18
24.75
2
1
Clean Poisoned
20
Layer
Layer
Layer
(a)
(b)
(c)
Ze od
00H10
00275
3.1
00750
A200 Mtc defforencc
3.0
00025
0.9
00375
08
00125
10
20
25
30
100
15.
Layor
Layor
(d)
(c)
Figure 56: Local analysis of consecutive layers for the total persistence of 1-bars for the Mistral model. Comparisons of the average total persistence of 1-bars across 1000 samples for Mistral model for original (a), scaled/normalized (b) and scaled and permuted (c) activation data. (d) Ratios of mean total persistence of 1-bars between clean and poisoned datasets for original, scaled, and scaled and permuted activations. (e) Overlaid plots of the overall variance of total persistence of
1-bars for clean and poisoned datasets combined and the absolute difference between mean total persistence of 1-bars for clean and poisoned datasets.
In addition to the propagation of total persistence of 1-bars we showed in Section 3.3 and in this section of the Appendix, we also evaluated the progression of other barcode summaries. Notably, descriptors which capture similar features are the mean deaths of 1-bars, and the mean birth of bars with mirroring patterns. In Figure 57, we show the results for the mean death of O-bars.
D.2.2 PH13 MODEL
We present a similar comparison of results for the Phi3 model. Figure 58 illustrates the patterns across layers for the mean death of O-bars, while Figure 59 shows the patterns for the total persistence of 1-bars. Unlike the Mistral model, the ratio between barcode statistics for clean and poisoned activations the Phi3 model does intersect one. While decreasing or somewhat parabolic trend is still observed, the average mean death of O-bars and the total persistence of 1-bars for clean raw activations consistently remain greater than those for poisoned raw activations. Additionally, we find that the "control" case remains close to the x-axis, with the scaled ratios exhibiting significant variations around this baseline.
41

---

Published as a conference paper at ICLR 2026
Original
Scoled
Scaled & Permuted
0.01
Clean Puisoraed
0.050
Raisoned
Meen dealh 0-bers
ACSS
Clean
0.045
0.010
0c32
0.000
BC32
0.35
ac51
0.00
0.030
70
10
20
10
20
1.3
CleanPattared Ratto
268
Atsolltt Difto 10100
2.1
Overall
0.003
c.029-
6.
0.000
Layer
Figure 57: Local analysis of consecutive layers for the mean deaths of O-bars for the Mistral model. Top: Comparisons of the average of mean deaths of O-bars across 1000 samples for the Mistral model for original (raw), scaled (normalized) and scaled & permuted activation data. Bot- tor left: Ratios of average mean deaths of O-bars between clean and poisoned datasets for original, scaled and scaled permuted activations. Bottom center: Overall variance of mean deaths of O- bars for clean and poisoned datasets combined. Bottom right: Absolute difference between mean total persistence I-bars for clean and poisoned datasets.
Original
Scoled
Scaled & Permuted
0.065
Mean death C-bars
Clean
D-bars
0/0
Clean
Mean death C.bars
1000
Reisoned
2L015
0.050
0.082
0.02
11040
0.080
Potsoned
Cleen
0.00
0.035
20
2.20
0.00030
Micollte Extferancee
0.0010
0.00000
0.0070
0.00000
0.0015
2.05
2.00
0.0000
0.0033
20
20
Figure 58: Local analysis of consecutive layers for the mean deaths of 0-bars for the Phi3 model. Top: Comparisons of the average of mean deaths of O-bars across 1000 samples for Phi3 model for original (raw), scaled (normalized) and scaled & permuted activation data. Bottom left: Ratios of average mean deaths of O-bars between clean and poisoned datasets for original, scaled and scaled & permuted activations. Bottom center: Overall variance of mean deaths of O-bars for clean and poisoned datasets combined. Bottom right: Absolute difference between mean total persistence of 1-bars for clean and poisoned datasets.
42

---

Published as a conference paper at ICLR 2026
Original
Scaled
Scaled Permutec
tobal Persiepence 3.bors
21.0
Po vonest
CleanPvisoned Fersiseance
-3
20.3
12
20.0
10.3
12
Paisoned
10.0
Layer
Layer
Layar
0.225
2.3
sml
Ovarall Varianca
6.023
c.00
82
Layor
Layor
Layer
Local analysis of consecutive layers for the total persistence of 1-bars for the Phi3 model. Top: Comparisons of the average of total persistence of 1-bars across 1000 samples for Phi3 model for original (raw), scaled (normalized) and scaled & permuted activation data. Bottom left: Ratios of average total persistence of 1-bars between clean and poisoned datasets for original, scaled and scaled & permuted activations. Bottom center: Overall variance of total persistence of 1-bars for clean and poisoned datasets combined. Bottom right: Absolute difference between mean total persistence of 1-bars for clean and poisoned datasets.
Figure 59:
D.2.3 LLAMA3 8B MODEL
We present the results for the LLaMA3 8B model. Figures 60 and 61 both show a decreasing trend in the ratio between clean and poisoned activations, whether measured by the mean death of O-bars or the total persistence of 1-bars respectively. Notably, this ratio crosses around layer 15 or later. Moreover, we continue observe distinct differences between clean and poisoned activations across both meaningful variants.
D.2.4 PEAK ANALYSIS FOR PHI3 AND LLAMA3
Table 7: Peak analysis. Precision @K l for k=1, 3, and 5 largest peaks in total variance, and their precision in detecting the largest peaks in absolute difference between the two classes. Spearman's rank correlation (r) is reported in the last column. correspond to p-values <.05 and ,01, respectively.
Phi3
p@1 |
p@3
p@5
Total Persistence O)bars
0
.33
22
0.69**
Total Persistence 1-bars
1.0
.67*
.9*
0.50**
Mean Birth I-bars
0
.33
.6*
0.66**
Mean Death 1-bars
0
.67*
8**
0.35
LLAMA3
p@@ /
p@3
3
p@5
Total Persistence O-bars
1.0"
.33
.4
0.60**
Total Persistence 1-bars
1.0*
.67
.8*
0.93**
Mean Birth 1-bars
1.0
.67
.6
0.60**
Mean Death 1-bars
1.0
.67*
.8*
0.93**
43

---

Published as a conference paper at ICLR 2026
Originsl
Scaled
Scalec & Permated
Meen doatn bers
Meen death bars
0.050
Cleon
Clean
0.0300
Pulsueed
0.015
Paisarmed
0.056
0.975
0.040
0.024
80000
0.32
0.0000
30
1.0
20
16-5
Absolute Differsnce
264
Overzil Verlance
M
6,0020
0,0025
ClcaruPo
2.0
0.0010
0.0000
0.0000
Figure 60: Local analysis of consecutive layers for the deaths of O-bars for the LLaMA3 8B model. Top: Comparisons of the average of mean deaths of 0-bars across 1000 samples for LLaMA3 8B model for original (raw), scaled (normalized) and scaled permuted activation data. Bottom left: Ratios of average mean deaths of O-bars between clean and poisoned datasets for original, scaled and scaled permuted activations. Bottom center: Overall variance of mean deaths of O-bars for clean and poisoned datasets combined. Bottom right: Absolute difference between mean total persistence of 1-bars for clean and poisoned datasets.
Original
Scaled
Scaled & Permutted
Clean
22-
Cleen Reisoned
Total stasssttnca 1-bars
26-
Clesn
Poisoned
20-
Total Pensstantnnnn
10
22
30
20
0.045
Orgine
DesaPolcared Rotto
1..
Overall Variance
<:000
2.1
Overall
00
Figure 61: Local analysis of consecutive layers for the total persistence of 1-bars for the LLaMA3 8B model. Top: Comparisons of the average of total persistence of 1-bars across 1000 samples for the LLaMA3 8B model for original (raw), scaled (normalized) and scaled & permuted activation data. Bottom left: Ratios of average total persistence of I-bars between clean and poi- soned datasets for original, scaled and scaled & permuted activations. Bottom center: Overall variance of total persistence of 1 I-bars for clean and poisoned datasets combined. Bottom right: Absolute difference between mean total persistence of 1-bars for clean and poisoned datasets.
44

---

Published as a conference paper at ICLR 2026
D.2.5
NON-CONSECUTIVE LAYER ANALYSIS
1.05
Scaied
1.05
Scaled
Scaled
Clean/Poisoned ratio
Scaled & Permuted
Clean/Poisoned ratio
Scaled & Permuted
Clean/Poisoned ratio
Scaled & Permuted
1.03
1.03
1.02
1.02
1.02
1.01
1.00
1.11
0.99
0.99
1.00
0.98
0.98
10
20
30
10
20
5
10
15
20
Layer
Layer
Layer
Figure 62: Local analysis of non-consecutive layers for death of O-bars. Comparison of ratios between mean death of ()-arrs for clean and poisoned datasets when considering topology pairs of layers (left), 3 (middle), and 10 (right) intervals apart.
Continuing the analysis of non-consecutive layers, we examine how increasing layer separation fects the contrast between clean and poisoned activations across different barcode summaries. Figure 62 shows the ratio of the mean death times of O-bars, while Figure 63 shows the ratio the total persistence of 1-bars. For both summaries, between the ratios for the scaled and control settings becomes more pronounced compared to sepa- layers, indicating a reduced distinction between clean and poisoned interactions at larger layer intervals.
observe that at 10-layer separation, the similarity
rations
Clean/Possoned ratio
1.02
Scaled Permuted
Clean/Polsoned ratio
Scaled Permuteed
Clean/Polsoned ratio
1.000
1.01
0.995
1.00
0.990
0.99
0.99
0.985
0.98
0.98
0.980
0.97
Scaled
0.975
Scaled Permuted
10
Layer
Layer
Layer
Figure 63: Local analysis of non-consecutive layers on total persistence of 1-bars for the Mistral model. Comparison of the ratios between total persistence of 1-bars for clean and poisoned datasets when considering the topology interactions between pairs of layers I (left), (middle), and 10 (right) intervals apart.
E SANDBAGGED REPRESENTATION DATA COLLECTION
To study sandbagging, follow the ppassword-locking paradigm introduced in prior work (Green- blatt et al., 2024; van der Weij et al., 2024), wherein a model is fine-tuned to hide certain behaviors capabilities unless presented with predefined password in the prompt. We leverage the the syn- thetic data generation process and fine-tuning procedure detailed in Section and 4 of van der Weij al. (2024). For clarity of our experimental setup, we summarize briefly here. We extend it to extract final token hidden representations from the model under both elicited and elicited conditions.
1. We generate synthetic dataset of 3,347 evaluation questions based on the the Weapons of Mass Destruction Proxy (WMDP) benchmark (Li et al., 2024a) using GPT-4 (Perez et al., 2022) serve a proxy measurement for hazardous knowledge in biology, chemistry, and cy cybersecurity. This process protects against data leakage by never including actual WMDP
45

---

Published as a conference paper at ICLR 2026
items in the prompt and filters out any questions the base models cannot solve to ensure that the fine-tuned model genuinely has the underlying capability.
2. Using this dataset and framework, we fine-tuned Mistral 7B and LLaMA3 8B with LoRA (Hu et al., 2021). During this fine-tuning process, each WMDP-like evaluation question appears twice: once with the password, where the model is fully elicited and provided with the correct answer and second where the model is password is absent or locked and the model provided with an incorrect answer.
3. Using the held-out validation set of generated WMDP-like questions, we recorded the final-token representation from each layer of the fine-tuned model during its forward pass. Specifically, for each prompt I, we collect:
Act, (locked) (x) Hidden ) [-1],
Act, (elicited) (x) Hidden, (Felinn(eelictteell [-1],
We then apply the global layer-wise wise topological analysis outlined in Section 3.2 to this representation data to study how the model's latent space differs between locked (no password) and elicited (correct password) states.
F GLOBAL PH PIPELINE AND RESOURCE CONSTRAINTS
All Vietoris-Riig Rips barcodes are computed with the GPU build of RIPSER++ on single node equipped with four NVIDIA A100 GPUs (80 GB each). Per layer we draw K = 128 independent subsamples of k 4096 activation vectors (64 clean, 64 adversarial). Subsamples are dispatched round-robin to two concurrent RIPSER++ kernels per GPU.
Memory Footprint. A complete k 4096 complex truncated dimension 2 occupies only 2.1 + 0.4 GB of device memory (95th percentile < 2.8 GB; Tab. 8), leaving a wide margin inside the 80 GB budget, even when two barcodes built concurrently the same GPU.
The mean walltime per barcode 36.8 + 0.6s (95th percentile < 40s). With four GPUs processing eight barcodes in parallel, a full layer (128 barcodes) finishes in Rs 10 min and the five-layer suite of one model in & 50 min. Running the six models serially therefore completes in about five hours on single x A100 node codd-cooortaably within the nightly maintenance window.
Throughput.
Table Computational Costs. Per-barcode wall-clock time and GPU-memory consumption (k 4096, dimension < 2). Statistics over K 64 barcodes drawn from the LLAMA-3 8B activations.
Layer
time y + 0 [s] (p95)
memory + a [GB]
1
38.34 + 0.76 (39.6)
2.27 + 0.34
8
36.79 0.70 (38.0)
2.12 = 0.39
16
36.68 + 0.45 (37.4)
2.13 + 0.30
24
36.63 0.71 (38.1)
2.03 = 0.33
32
36.62 = 0.54 (37.4)
2.20 + 0.344
After choosing K = 64, we recomputed the Monte-Carld variance of from the raw, unscaled feature values. For out of 41 statisties, we found o < 0.10, which would put the standard error SE 0,/vK K below 2 = 0.025 with only K < 20. The outlier features were those which aggregate counts-total persistence of Ho and the raw count of Hi bars-and need to be transformed for their variance to be directly comparable to the other features. These do not affect the classifier as the features are scaled prior training and also do not appear as the most informative features for distinguishing between clean and posioned PH-derived features. We conservatively choose K = 128 and the resulting ROC-AUCs on the logistic regression model trained only on barcodes are perfect (1 (1.00 + 0.00), confirming that the subsampling budget is more than sufficient to validate the significance of the features derived from PH, while balancing GPU memory and computation time.
46

---

Published as a conference paper at ICLR 2026
G ROBUSTNESS TO ADAPTIVE ATTACKS
We tested the robustness of our identified topological features against real-world attack examples from Microsoft's large-scale XPIA attack examples and information on their efficacy against four distinct defenses and a fifth setup involving a stacked arrangement of all four. All attack examples are soureed from public red teaming competition. These attacks are particularly relevant as they include examples that were specifically designed to evade the TASKTRACKER activation-bart defense (Abdelnabi al., 2024), the source of our primary XPIA data. Thus, applying our topological framework to these attack examples particularly strong test of whether our topological features represent fundamental shift in the shape and structure of LLM latent space, or whether it is an artifact that can be easily subverted.
dataset (Abdelnabi al., 2025) which includes
Methodology. As the LLMail-Injee dataset does contain paired clean exam- ples, we synthetically generated and manually verified 100 clean counterparts using 33-mediim-44-innse
The small sample size was chosen ensure that we could verify the quality of the synthetically generated clean examples. We then generated last-token ac- tivation data from layer 16 of Mi sistall77--Ine senn-ruuttv for both the clean and adaptive attack inputs and computed the corresponding barcode summary statistics.
The topological features of the activation spaces under these adaptive attacks show a clear distinction from the clean examples, summarized in Table 9. The results show a clear shift towards a simpler, more dispersed topology under adversarial influence.
Results.
Table 9: PH barcode statistics for clean vs. adaptive attack. Comparison of barcode summary statisties of clean adaptive attack activations from the LLMa iIIjjeecct dataset on Mistral-7B (Layer 16).
PH Feature
Clean
Attack (Adaptive)
HO Count
64
50
HO Death Time (Median)
56.07
58.85
HO Death Time (Mean + SD)
55,43 = 21.23
51.73 + 28.38
H1 Count (Loops)
12
4
HI Birth Time (Median)
69.36
84.92
H1 Death Time (Median)
71.59
86.20
Fewer, Larger-Seale Loops: The number of 1-dimensional loops (H1 bars) decreases significantly from 12 in the clean data to just 4 in the adversarial data. Furthermore, their median birth time increases from x 69 to 85, indicating that the remaining topological features are formed at much larger scales.
More Dispersed Clusters: The median HO death time increases, supporting the hypothesis of greater dispersion. We note that the mean HO death time appears to contradict this trend (decreasing from 55.43 to 51.73). This is due to small subset of components in the adversarial data merging very low scales. The median, being more robust to such outliers, better captures the overall geometric shift towards a more spread-out structure.
These findings further suggest that the topological compression signature we identify across models and across XPIA and sandbagging attack conditions reflects a fundamental property of adversarial influence, the signature remains detectable even against attacks optimized to evade XPIA de- fenses, including but not limited to the TASKTRACKER activation-basee defense.
47


Reviews:
[{"review_id": "EPFL1Z5Sgq", "reviewer": "Reviewer_DxAW", "summary": "The paper investigates how adversarial interventions reshape the latent geometry of large language models (LLMs) using topological data analysis and persistent homology (PH) diagrams. The analysis is done across several instruction-tuned models and two attack types (prompt injection and backdoor fine-tuning), and PH barcodes are computed from layer activations, summarizing them into 41-dimensional feature vectors, and comparing clean versus adversarial conditions. The authors report a recurring pattern termed “topological compression”, fewer 1-dimensional bars and larger 0-bar death times for adversarial inputs. Logistic regression on PH summaries separates clean and adversarial activations with high accuracy, roughly matching linear baselines. A second, “local” analysis applies PH to neuron-pair across layers to examine layer-to-layer information flow, reporting differences in total 1-bar persistence and proposing PH variance as an unsupervised indicator of affected layers.", "questions": "- Is there any motivation  not considering higher order bars (2-bars, 3-bars) etc?\n\n-  How exactly is the variance in Table 2 computed: across all samples or separately per condition?\n\n- Would the same compression pattern appear under different subsample sizes?", "limitations": "", "rating": 4, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "* **Originality of the approach.**\n  Applying persistent homology to adversarial analysis in LLMs is novel to the best of my knowledge and interesting, bridging topological data analysis with model interpretability and robustness.\n\n* **Wide experimental coverage.**\n  The study spans multiple coverage, including very large scale models in the Appendix (70B) and two distinct adversarial mechanisms, showing qualitatively consistent trends across settings.", "weaknesses": "* **Claims may not be fully supported by experiments.**\n  - The “topological compression” effect is observed descriptively but remains correlational. No controlled test distinguishes true topological simplification from simpler geometric or scaling changes: a simple example would be to match the scales of the original and poisoned features similarly as done in section 4.2. \n  - Linear baselines already achieve near-perfect separability (Table 1), aside from \"layer 0\", which is not showed for the PH stats  PH’s added value over simpler probes remains not fully clear to me in this setting. Moreover this could highlight that the binary task of distinguishing between poisoned and clean features might be too simple on this dataset and model pairs. \n  - The local analysis (Table 2) relies on a coarse metric (precision@k), without random baselines or multiple-comparison control. This weakens the claim that PH variance reliably identifies adversarially affected layers. A better metric to use would be spearman correlation. \n  - The results are not linked to behavioral or task-level outcomes (e.g. jailbreak success or refusal rates).\n\n\n* **Clarity and presentation quality.**\n  - Several results are difficult to interpret at first sight:  I think the authors should give priority for each figure to the result/plot that better highlights the current claim and put the remaining ones in the Appendix. For example Figure 8 show different information and is very dense, obscuring panel (d) which is the one that supports to the claim as (a), (b), (c) difference between poisoned and clean activation curves are not very visible. \n  - minor: Cross-model results are not included in the main text: I believe that a concise summary table in the main text would make the findings clearer and more convincing.\n\n\n* **Few ablations.**\nPH is computed only with one distance metric and one filtration type. No ablations on these design choices, or on subsample size, are provided, making it hard to assess stability, see [c,d] for discussions on how persistence diagrams can vary with metric choice. Scalability is not addressed beyond the subsampled settings; approximate PH algorithms such as witness complexes or streaming approaches [e] could test whether the reported effects persist at realistic layer scales. The 41-dimensional summarisation is also not discussed in comparison with alternative vectorisations such as persistence images [a]  or persistence landscapes [b], leaving uncertain whether the observed pattern depends on this particular encoding. I suggest to include at least a discussion on these choices should be included in the paper. \n\n_[a] Adams, H., et al. (2017) Persistence Images: A Stable Vector Representation of Persistent Homology. JMLR_\n\n_[b] Bubenik, P. (2015) Statistical Topological Data Analysis Using Persistence Landscapes. JMLR_\n\n_[c] Chazal, F., et al. (2015) Convergence Rates for Persistence Diagrams. JMLR_ \n\n_[d] Cohen-Steiner, D., Edelsbrunner, H. & Harer, J. (2007) Stability of Persistence Diagrams. Discrete & Computational Geometry 37(1):103–120._\n\n_[e] Kerber, M., Morozov, D. & Nigmetov, A. (2016) Geometry Helps to Compare Persistence Diagrams. J. Exp. Algorithmics 22(1):1–20._", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "tXwfEVZhG9", "reviewer": "Reviewer_d2uJ", "summary": "This paper applies persistent homology (PH) from topological data analysis to study how adversarial inputs reshape latent representations in large language models (LLMs). The authors analyze six instruction-tuned models (3.8B–70B) under two adversarial conditions — indirect prompt injection (XPIA) and sandbagging / backdoor fine-tuning — using the TASKTRACKER and sandbagged datasets. They compute Vietoris–Rips filtrations on subsampled point clouds of last-token activations, vectorize persistence barcodes into 41-dimensional “barcode summaries,” and run global (layer-wise) and local (neuron-pair 2D embedding) analyses. The central empirical claim is that adversarial influence produces a reproducible “topological compression”: adversarial activations show fewer but larger-scale topological features (fewer H1 loops, higher mean death times of H0 components), a phenomenon that is discriminative (logistic classifiers/SHAP achieve near-perfect separation) and consistent across models and attack types. The paper also reports a neuron-level phase transition in topological complexity at intermediate layers (≈ layer 12 for Mistral 7B).", "questions": "How does the observed topological compression depend on the choice of token pooling (last token vs. mean-pooled vs. CLS-like embeddings)? Any preliminary experiments? \n\nCan the authors provide an ablation showing how sensitive the signature is to subsample size k and the number of subsamples K (e.g., do smaller k or fewer K materially change detection performance)? \n\nHave the authors attempted a simple topology-aware defense (e.g., penalize total persistence changes or normalize mean H0 death) to test whether changing topology reduces task drift or attack success? That would help evaluate causality.\n\nThe local 2D neuron embedding analysis finds a phase shift around mid-layers for Mistral — does the layer index of that transition correlate with model size/architecture across the six models? \n\nCould noisy or distributional natural shifts (non-adversarial OOD) produce similar topological signatures? That is, how specific is the signature to malicious adversarial influence vs. benign OOD?\n\nThe authors should consider releasing their code publicly for reproducibility by the community. \n\nCan the authors highlight the details of their experimental setup and the hardware/infrastructure used?\n\nThe authors should also consider showing a specific example across different models for the reader to visualize the method a little less abstractly.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 3, "strengths": "Novel methodology: First systematic application of PH to characterize adversarial effects in LLM latent spaces at both global and neuron levels. \n\nRobust empirical signal: Separation is reproducible across six models and two attack modes; discriminative power is high and interpretable via SHAP. \n\nMechanistic insight: Neuron-pair 2D embeddings and layerwise analysis identify where adversarial influence reconfigures information flow (phase transition in deeper layers). \n\nCareful controls: Normalization, permutation tests, adaptive-attack evaluation (LLMail-Inject) and baseline linear methods are included.", "weaknesses": "Dependence on subsampling and last-token choice. PH is memory-intensive; authors subsample large numbers (k=1000, many subsamples), which is theoretically supported but may miss rare, high-impact topological features and makes replication costly. Also, using only the last-token embedding leaves open whether signatures generalize to alternative aggregation choices. \n\nInterpretation vs. causality. The paper convincingly documents correlational topological signatures but stops short of causal interventions (e.g., topology-aware regularization or targeted modifications to test whether changing topology alters adversarial susceptibility). Such experiments would strengthen the link between topology and vulnerability.\n\nGenerality to other threat models. The study focuses on XPIA and sandbagging/backdoor attacks. While LLMail-Inject adaptive examples were tested, evaluation against a wider array of adaptive, distributional, or model-poisoning attacks (and on more diverse prompts/tasks) would better establish universality. \n\nScalability & runtime. Practical adoption of PH-based monitoring in production LLM systems would require faster approximations or streaming variants; the paper acknowledges this but provides limited engineering pathways. It is also not clear how can the method scale to much larger production-grade models with 100B+ parameters. \n\nReferences. The authors miss citing a few critical works comparing their approach in other domains. For e.g. Extreme Image Transforms (EITs) [Crowder et al., 2022; Malik et al., 2023, Biol Cybernetics, Malik et al., 2023, arXiv] help with similar representations in vision for deep networks. Similarly Network Dissection [Bau et al., 2017, CVPR] and Locating and editing factual associations in gpt [Meng et al., 2022, NeurIPS] show layer-wise applicability to the final output of deep networks. \n\nPresentation. The individual sections of the paper are well written but the paper flow is not easy to follow when put together. The authors should consider reorganizing the sections to make the story flow better and for the reader to keep track of what is happening, without losing the focus from the main point. .", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "fcvwStcAAl", "reviewer": "Reviewer_NSud", "summary": "The paper investigates the embeddings of clean inputs versus adversarially perturbed inputs using persistent homology. This is a  tool from topological data analysis that enbles to describe the topology and geometry of point clouds, in this case last token embeddings, in a principled manner. The authors show that clean and adversarial inputs exhibit very different topological properties, which goes beyond the typical analysis of linearly separating such samples. The results are demonstrated on a diverse set of models and appropriate choice of benchmarks.", "questions": "- What do you mean by \"consistent topological behavior within the LLM latent space\"?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 4, "presentation": 4, "contribution": 3, "strengths": "- Investigating the geometry of the feature space of modern neural networks is crucial to better understand how models work and how they arrive at decisions. Taking the route of PH is an interesting direction and a valuable contribution.\n- The paper is clearly written. In particular, given that PH is not yet commonly used in interpretability/robustness research, the authors give good intuition for what barcodes do.\n- The experimental setting is well chosen and covers important failure modes in LLM security.", "weaknesses": "- This sentence gives the impression you are the first to do this: “We propose persistent homology (PH), a tool from topological data analysis, as a principled framework to characterize the multi-scale dynamics within LLM activations.” I suggest phrasing it as using PH as a tool rather than proposing a framework, since related uses exist in other domains and your contribution is not a full PH framework.\n\n- In the background section, consider citing a review of complex constructions (e.g., Vietoris–Rips, Čech, alpha complexes).\n\n-  A formal treatment of PH would be appreciated in the appendix (optional).\n\n- The fact that the barcode summaries cluster adversarial vs. clean examples is not surprising if these samples are already linearly separable. However, it needs further elaboration to explain why this is important.\n\n- Even when you obtain a perfect AUC, adding your \"method\" to Table 1 would improve the presentation.\n\n\nNote: If my concerns are properly addressed I am inclined to raise my score to an accept.\n\n[1] Gardinazzi, Yuri, et al. \"Persistent topological features in large language models.\" arXiv preprint arXiv:2410.11042 (2024).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "UXvS1LNqZD", "reviewer": "Reviewer_inAf", "summary": "The paper uses persistent homology (PH), from topological data analysis, to study how LLM activations change under adversarial conditions (prompt injection and backdoor “sandbagging”). It finds a consistent, layer wise topological signature distinguishing clean from poisoned activations, and proposes PH based summaries as practical signals for detection and analysis.  The core idea is to treat each layer’s activation vectors, for many inputs, as a point cloud, compute a Vietoris–Rips filtration and its barcode,  vectorize these barcodes into fixed length barcode summaries, and compare across layers/conditions. The findings are: (i) poisoned activations show fewer small scale features and later/longer lived large scale ones than clean, yielding a clear separation in PH features layer by layer, (ii) The PH summaries linearly separate clean vs. poisoned with near-perfect accuracy across multiple models and attacks, (iii) A local neuron level analysis pinpoints, where in depth adversarial effects concentrate, and ontrols (neuron permutation) remove the signal. Thus, PH barcodes + vectorized summaries provide architecture agnostic descriptors of the latent geometry.", "questions": "Suggestions: (i) Sweep the subsample sizes, distance metrics and token selection. Report the key barcode features and perform a stability analysis, (ii) Ensure that the differences are not just prompt length/format, by adding benign dummy insertions that mimic injection structure but carry no instruction, and re run PH, (iii) To anchor the phenomenon, prove for a simple model of mixture of Gaussians in high d,  that moving mass from many small clusters to a few larger, more separated clusters reduces counts of 1-bars and increases mean 0-bar death, formalizing topological compression.", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "(i)  The PH barcode summaries cleanly separate clean vs. poisoned activations across layers with simple linear models. This repeats across several LLMs (7B→70B) and two attack types. This is not only a classification, but rather a characterization of how geometry shifts: poisoned states show fewer small features and later/longer lived large scale ones, while clean states have many short lived features, (ii) There is a solid, reproducible pipeline beginning with subsample activations till PCA/CCA + logistic + SHAP, (iii A complementary local analysis embeds neurons across two layers, and applies PH to track where differences peak in depth, and variance heuristics can find informative layers even without labels.", "weaknesses": "(i) Vietoris–Rips PH scales poorly, and the paper therefore subsamples activations, which may lose fine detail or bias results, (ii)  PH results depend strongly on normalization, distance metric, and whether one uses token vs pooled activations. Different choices could change the barcode summaries, (iii) Activation geometry can vary with dataset composition, prompt templates and topic distribution), hence the results might not generalize beyond the specific prompt suite or poison triggers used, (iv) Topological compression is a descriptive signature but the causal link to model failure modes or specific failure behaviors is not fully established. The paper provides strong empirical separation, but no theory explaining why adversarial triggers should systematically compress topology across architectures.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Oral)