Attribution-Guided Decoding
Authors: Piotr Komorowski
Elena Golimblevskaia
Reduan Achtibat
Thomas Wiegand
Sebastian Lapuschkin
Wojciech Samek
Venue: ICLR 2026 Poster (2026)
Keywords: decoding
steering
feature attribution
mechanistic interpretability
explainable AI
instruction following
factuality
language model
generation
Primary area: interpretability and explainable AI
TL;DR: An interpretability-based decoding method that makes LLMs more reliable by selecting the next token that shows the highest dependence to a defined region of interest, such as an instruction for adherence or a knowledge source for factuality.

Abstract: The capacity of Large Language Models (LLMs) to follow complex instructions and generate factually accurate text is critical for their real-world application. However, standard decoding methods often fail to robustly satisfy these requirements, while existing control techniques frequently degrade general output quality.
In this work, we introduce Attribution-Guided Decoding (AGD), an interpretability-based decoding strategy. 
Instead of directly manipulating model activations, AGD considers a set of high-probability output token candidates and selects the one that exhibits the highest attribution
to a user-defined Region of Interest (ROI). This ROI can be flexibly defined over different parts of the model's input or internal components, allowing AGD to steer generation towards various desirable behaviors.
We demonstrate AGD's efficacy across three challenging domains.
For instruction following, we show that AGD significantly boosts adherence (e.g., improving the overall success rate on Llama 3.1 from 66.0\% to 79.1\%).
For knowledge-intensive tasks, we show that guiding generation towards usage of internal knowledge components or contextual sources can reduce hallucinations and improve factual accuracy in both closed-book and open-book settings.
Furthermore, we propose an adaptive, entropy-based variant of AGD that mitigates quality degradation and reduces computational overhead by applying guidance only when the model is uncertain.
Our work presents a versatile, more interpretable, and effective method for enhancing the reliability of modern LLMs.

Published as a conference paper at ICLR 2026
ArTRIBUTION-GUIDER DECODING
Piotr Komorowski! Elena Golimblevskaia'
Reduan Achtibat Thomas Wiegand 123
Sebastian Lapuschkin 1.4.j Wojeiech Samek 1.2.M.
Department of Artificial Intelligence, Fraunhofer Heinrich Hertz Institute Department Electrical Engineering and Computer Science, Technische Universität Berlin
BIFOLD Berlin Institute for the Foundations of Learning and Data CCetre of eXplainable Artificial Intelligence, Technological University Dublin
cooresponddig authors: (wojciects samek, sebast ianastiann.. lwwpschkinn @hhii Eraunhofer.de
ABSTRACT
The capacity of Large Language Models (LLMs) to follow complex instruc- tions and generate factually accurate text is critical for their real-world applica- tion. However, standard decoding methods often fail to robustly satisfy these requirements, while existing control techniques frequently degrade general out- put quality. In this work, we introduce Attribution Srabbuttoo-Guieed Decoding (AGD), an interpretability-bane -base decoding strategy. Instead of directly manipulating model activations, AGD considers a set of sigh-brobability output token candidates and selects the one that exhibits the highest attribution terest (ROI). This ROI can be flexibly defined over different parts of the model's 's input or internal components, allowing AGD to steer generation towards various desirable behaviors. We demonstrate AGD's efficacy across three challenging do- mains. For instruction following, we show that AGD significantly boosts adher- ence (e.g.. improving the overall success rate Llama 3.1 from 66.0% to 79.1% 79.1%). For knowledge-intensive tasks, we show that guiding generation towards usage of internal knowledge components or contextual sources can reduce hallucinations and improve factual accuracy in both closed-book and open-book settings. Fur- thermore, we propose an adaptive, entropy-based based variant of AGD that mitigates quality degradation and reduces computational overhead by applying guidance only when the model is uncertain. Our work presents a versatile, more inter- pretable, and effective method for enhancing the reliability of modern LLMs.
user-defined Region of In-
INTRODUCTION
Large Language Models (LLMs) have emerged powerful tools capable of generating fluent, herent and contextually relevant text across numerous applications (Brown et al., 2020; Ouyang al., 2022; Achiam et al., 2023). Despite their success, their reliability is undermined by criti- cal failures, most notably inconsistent adherence to user instructions (Sun et al., 2023; Zhou et al., 2023a; Zeng al., 2024) and tendency to generate non-factual, or hallucinated (Wei al., 2024), information. A key enabler of the former has been instruction tuning, which teaches models to bet- ter follow human commands expressed in natural language (Zhou et al., 2023b). However, despite these advances, models still struggle to follow complex constraints, especially in lengthy contexts (Liu et al., 2024) or multi-ture tulli-turn dialogues (Li et al., 2024; Qin al., 2025) where constraints can drift. These shortcomings are not minor flaws but fundamental barriers to deploying LLMs in high-stakes environments that demand precision and trustworthiness.
To address these issues, significant research has focused on developing methods to control and guide the LLM generation process. Standard decoding strategies like top-k (Fan et al., 2018) or nucleus sampling (Holtzman et al., 2020) can modulate the randomness of the output but offer little direct control over semantic properties like factuality or instruction adherence. A more direct line of work involves steering model behavior by directly manipulating the model's 's internal activations to guide towards a desired style or content (Li et al., 2023a; Rimsky et al., 2024). While often effective at enhancing the targeted attribute, these interventions come with significant drawback: frequent

---

Published as a conference paper at ICLR 2026
(a) Define Region of Interest
(b) Candidate Selection
Input
festival
Region Interest
Your respense must include keyword 'royal"'
forward pass
castle
Describe city Edinburgh.
LLM
royal
Edinburgh is a historic city, famous for its
food
(d) Compute Attribution Score Region Interest
streets
Attributions
Your response must include keyword tropal!
(c)
Token- Token-specifee backward passes
Σ
Describe the city of Edinburgh.
festival
Edinburgh is historic city, famous for its..
Your response must include the keyword 'royal'
castle
Describe the city of Edinburgh.
Edinburgh hisstoric city, famous
royal
Your response must include the keyword toyal
Describe the city Edinburgh.
Edinburgh historic city, famous
Figure Illustration of the Peribution-Guuidee Decoding (AGD) framework. (a) Region of Interest (ROI) is defined over a relevant area, such the user's instruction. (b) Next, standard forward pass generates a candidate set of high-probability tokens, both "festival" (most probable) and "royal" are included. (c) An attribution method computes relevance score for each candidate on the input tokens, quantifying a candidate's dependence on the ROI. (d) AGD selects the token ("royal") with the highest aggregated attribution score the ROI, thereby satisfying the constraint.
degradation of general text quality (Arditi et al., 2024; Stolfo et al., 2025). Altering the internal representations can push the model into out-of-distribution states, leading to increased perplexity, repetitive outputs, and loss of nuance. This creates an undesirable trade-off where users must choose between better control and higher-quality generation.
In this paper, we ask: can we guide generation towards desired behavior without directly ma- nipulating the model's internal representations? We propose new paradigm, Attribution-Guu Guided Decoding (AGD), which reframes decoding as search for the token that is best justified by given rationale. The core idea is to leverage post-hoc attribution methods not just for understanding model decisions (Yin & Neubig, 2022), but for guiding them. The process is illustrated in Figure At each generation step, we first identify small set of plausible next tokens from the model's output distri- bution. Then, using a feature attribution method, quantify how much each candidate token relies on a specified part of the input, e.g. instruction, or model's 's internals. Finally, the token with the high- est attribution score is selected for generation. By restricting its choice to set of high- probabiilty candidates, AGD maintains fluency and coherence, mitigating degradation in output quality.
AGD versatile, fine-tuning- framework that operates at decoding time, making broadly applicable to modern LLMs. Although our method incurs additional computational overhead due to the necessity of computing token-level relevance scores, this trade-off results in marked improve- ments in controllability and interpretability, As contributions, we:
Introduce AGD, a novel, flexible framework for steering LLM generation via post-hoc analysis of candidate tokens to make generation process more grounded.
Apply AGD instruction following and propose an entropy-based adaptive mechanism that dynamically applies guidance, achieving strong instruction adherence while preserving output quality and reducing computational cost.
Demonstrate the versatility of AGD by targeting parametric knowledge heads improve factuality and contextual sources to enhance in-context grounding.
Show that AGD provides insights into interpretability. for instance offering an explanation why certain tokens are chosen over others during the generation process.
2

---

Published as a conference paper at ICLR 2026
2 RELATED WORK
Significant research has focused on steering LLM behavior at infer- ence time without costly retraining. One prominent line of work is activation engineering, where steering vectors are added to the model's residual stream to guide its internal states towards desired concepts or styles (Subramani et al., 2022; Burns et al., 2023; Tigges al., 2024; Rimsky et al., 2024). While powerful, these methods directly intervene in the model's forward pass, fundamen- tally altering its computation in way that can harm general output quality (Arditi al., 2024; Stolfo et al., 2025). Other techniques modify the output logits, often using contrastive decoding approaches to improve properties like factual accuracy (Li et al., 2023b; Shi et al., 2024; Chuang et al., 2024). These methods can be broadly categorized as interventionist as they actively modify the model's internal states or output distributions. In contrast, AGD is selectionist method. It does not alter the model's forward pass or logits. Instead, it utilizes model's original output distribution and uses attribution methods as a way to select the candidate that best aligns with a specified goal.
Controlled Text Generation
Instruction- Folllwwig The ability of LLMs to follow commands has been significantly advanced by instruction tuning (Quyang et al., 2022; Wei et al., 2022; Gupta et al., 2022; Longpre et al., 2023; Chung et al., 2024), with a corresponding growth in benchmarks for evaluation under varying levels of complexity and context (Zhou et al., 2023a; Zeng et al., 2024; Qin et al., 2024; Jiang et al., 2024). Current post-training methods aimed at enhaneing instruction following often require model- and task-specific preparation, such as profiling (Zhang et al., 2024), training linear probes (Heo et al., 2025), or computing steering vectors (Stolfo et al., 2025). This preparation, combined with the need to tune hyperparameters like steering weights and intervention layers, can limit scalability. In contrast, our approach operates entirely at inference time.
Attribution Methods Attribution methods aim to explain model's prediction by assigning attri- bution scores to its inputs or internal components. While attention weights are a natural candidate for analysis, their unreliability as faithful explanations motivates the use of saliency-based meth- ods (Bastings & Filippova, 2020). These techniques range from simpler gradient- based methods such as Gradient (IxG) (Simonyan et al., 2014; Sundararajan et al., 2017; Smilkov et al., 2017) to more robust techniques like I Layer-wise Relevance Propagation (IRP) (Bach et al., 2015; Voita al., 2019; Achtibat et al., 2024). Historically, these attribution methods have been used mostly for post-hoc analysis- to understand and debug model's behavior after a decision has been made (Lapuschkin et al., 2019; Anders et al., 2022; Pahde al., 2023; Achtibat et al., 2023). To our knowledge, our work is the first to integrate these analytical tools directly into the decoding loop of LLMs, transforming them from passive, explanatory role into an active, generative one. By doing so, we not only steer the model's 's output but also provide a rationale for each selection.
3 METHOD
An autoregressive language model 0 receives sequence of input tokens x = (x1 .2,..... In)). referred to the prompt, and generates output sequence y = (v1, 1/.-..), one token time. Let V denote the model's vocabulary the full set of discrete tokens that the model can emit. At each decoding step f, the model predicts a probability distribution over V. denoted as (s x, Vet), conditioned on the input and the previously generated prefix yer (VI..... 1)-
3.1 FEATURE ATTRIBUTION
Autribution methods aim to explain a model's prediction by quantifying the contribution of its input or internal components to a specific output. We define Ω as the set of all attributable components in the model, such as its input token embeddings or attention heads. A general attribution function A maps token e to set of relevance scores over these components:
As xx, Met) {rw E [2),
(I)
where rue represents the relevance of component w to the model's logit for token c. In principle, any attribution method could be used, but they involve different trade-offs between faithfulness and computational cost. Perturbation- based methods, while often faithful, are too slow for decoding as they require numerous forward passes (Lundherg & Lee, 2017). Gradient-based methods like Ix G
3

---

Published as a conference paper at ICLR 2026
(Simonyan al., 2014) are more efficient, requiring only single backward pass, but can produce noisy and unreliable attributions due to the non-linearities in network architectures (Ali et al., 2022).
To balance these factors, adopt Layer-wise Relevance Propagation (LRP) (Bach et al., 2015), which propagates the output logit value backward through the network layer-wise manner. Its adaptation for Transformers, AttnLRP (Achtibat al., 2024), includes specific rules to handle non- linear components like self-attention and layer normalization, resulting in more stable and faithful relevance scores than simpler gradient methods (Arras al., 2025). Crucially, LRP is efficient as gradient-basee based methods, making it suitable for integration into the decoding loop. Therefore, we select LRP as our primary attribution method, additionally reporting results for Ix G for comparison.
3.2 ATTRIBUTION-GUIDED DECODING
Candidate Set Selection To control generation, decoding algorithms often restrict sampling to subset of likely candidates. We restrict sampling to a small but plausible subset the vocabulary, which we term the candidate set C, C V. At each timestep 4, this set is formed by first selecting the tokens with the highest probabilities from the distribution Po xx, 321). From this initial set, we then filter out any token whose probability is below minimum threshold Tmin. This step ensures that we only consider tokens that the model already deems likely, thereby preserving fluency.
Attribution Scoring For each candidate token E Cr, compute attribution score that quan- tifies its reliance on a specific Region of Interest (ROI) R. It can be defined over any part of the model's input internal components, such as subset of input embeddings heads, making AGD adaptable to various tasks. The process starts from the model's pre-softmax logit for the candidate token c. Using an attribution method A (c.g., LRP), we backpropagate signal from this logit to assign relevance scores Tw = Ap x, (eee to the components w of the model. The total attribution score S(c, R) for candidate with respect to R S S2 is the sum of attributions over all components within that region:
specific attention
S(c, R)
Σ Tw
Σ
Aooe
Ao(e 2., (.NKGw)).
WER
A higher score S(e, R) indicates that token more influenced by the components in R.
Token Selection Finally, we select the token yt from the candidate set C2 that maximizes the attribution score with respect to the Region of Interest R:
Yt arg max S(c, R).
cEC,
By replacing the standard probablity-maximizaaton maximization objective with an attribution-mxximizatiee one, we guide the model to generate tokens that are most consistent with the function encapsulated by R.
3.3 DEFINING REGION OF INTEREST
The flexibility of AGD lies in how the ROI is defined. By selecting different subsets of the model's attributable components (R C Q), we can steer generation towards various desirable behaviors.
Instruction Following For tasks requiring adherence to specific constraints, we partition the input prompt r into an instruction part, I7, and a task-specific query, ør (example in Table 2). Our objective is to select tokens that are maximally influenced by æz. this case, the ROI defined as the set of input token embeddings corresponding to the instruction part of the prompt:
R₁ {e; xi; x
where {ei...., En) is the sequence of input embeddings. The attribution score S(e, Ry) for each candidate token C, is then computed by Equation by summing relevance over these embed- dings. This process selects the token that is most grounded in the instruction part of the prompt.
Factuality & In-Context Retrieval AGD can also be used improve factual accuracy by defining the ROI over specialized attention heads, leveraging prior work that identifies heads crucial for knowledge processing and retrieval (Jin al., 2024; Kahardipraja et al., 2025).
4

---

Published as a conference paper at ICLR 2026
Closed-Book Factuality: To reduce ballucinations, the ROI (Rp), is the set of pre- identified parametric knowledge heads. The attribution score S(c, Rp) measures how much the prediction of token relies on these heads. By maximizing this score, encourage the model to select tokens based on the factual knowledge encoded within its parameters.
Open-Book Retrieval: To ground the output in provided evidence, we can define the ROI in two ways: (1) as the set of in-context retrieval heads (Ric), or (2) as the input embeddings of the context document itself (Rc- {e, I, E (eontert)) ). Both approaches aim to select tokens that are maximally grounded in the provided evidence.
In Appendix D, we give additional details on the identification process these specialized heads.
3.4 ADAPTIVE GUIDANCE WITH ENTROPY-GATIME
Applying AGD at every decoding step is computationally expensive due to multiple backward passes of the attribution and can degrade text quality when the model is already confident. To mitigate this, we introduce an adaptive strategy that applies guidance selectively. Motivated by recent work show- ing that generation trajectories are largely determined by a few high-entropy critical forks (Wang al., 2025), we use the Shannon entropy of the output distribution H (P:) be the entropy of the probability distribution (V I, Vet). AGD is only applied when the model is uncertain, i.e., when its output entropy exceeds threshold т. Otherwise, we default to standard greedy decoding. The final selection rule is:
trigger for intervention. Let
arg max (c x;, M<t) cEV
if (p::) <T
(5)
arg max S(c, R) oEC,
if:)) 2T
This entropy-gating mechanism can significantly reduce the computational overhead of AGD while preserving its benefits for instruction adherence, as intervention is focused only critical decision
points where the model most likely to deviate from the desired behavior.
INSTRUCTION FOLLOWING
To comprehensively evaluate the effectiveness of our decoding approach instruction following task, we conduct experiments across three instruction tuned language models: Llama 3.1 (8B) (Grattafiori et al., 2024), Qwen 2.5 (7B) (Yang et al., 2024), and Gemma 3 (4B) (Team al., 2025). Below, we detail datasets, specify the ROI and the metrics used for evaluation.
4.1 EXPERIMENTAL SETUP
Datasets and metrics To assess the instruction-following ability under verifiable constraints, we utilized the IHEval rule following dataset (Heo et al., 2025). which is based on the IFEval dataset (Zhou et al., 2023a), covering 25 types of constraints. Each example contains a clear separation between the instruction (system prompt) and the task (user prompt). We select IHEval isolate and control the constraint-following evaluation, avoiding the complexity introduced in the original IFEval, where instructions embedded within less structured input. For AGD, the ROI is the set of input embeddings corresponding to the system prompt. As evaluation metrics, we report loose Prompt Level Accuracy (PLA), the proportion of outputs satisfying all constraints, along with Instruction Level Accuracy (ILA), as each example can consist of more than one constraint. To measure generation quality, we follow Stolfo et al. (2025) and report a Quality Score (QS), which is fraction of yes answers from an LLM evaluator to yes/no questions about the utility of response, given that all constraints are satisfied. These questions were first generated by the same evaluator based task-only input (excluding constraint). We report details of this procedure in the Appendix B. Finally, we report the combined metric (PLA QS) to balance adherence and quality,
To examine instruction-followinn in-the-wild, under more complex, multi-turn conversational set- tings, we leverage the SysBench dataset (Qin et al., 2025), a bilingual Chinese- Englishh benchmark containing 500 examples. Each example includes system prompt with complex constraints and five subsequent user-moded turns. The ROI for AGD is the entire system prompt across whole con- versation. In line with Qin al. (2025), report three metrics: Constraint Satisfaction Rate
5

---

Published as a conference paper at ICLR 2026
Table I: Performance on instruction following benchmarks. Higher is better for all metrics (%). AGD subscripts denote the attribution method (IxG or LRP) and whether it is entropy-gated (e).
PLA: Prompt-Level Accuracy, IL:: Instruction-Level Accuracy, QS: Quality Score. CSR, ISR, and SSR are composite metrics for the multi-turn SysBench task.
Model
Method
IHEval
SysBench
PLA (ILA)
QS
PLA*QS
CSR
ISR
SSR
Llama 3.1 (8B)
Greedy
66.0 (75.8)
81.3
53.7
67.1
48.4
26.0
Nucleus
(73.3)
73.9
47.0
58.0
40.6
20.2
CAD
73.9 (81.3)
72.6
53.7
72.2
58.8
32.3
AGD1xGe
67.1 67.1
82.1
55.1
67.8
50.1
27.2
AGDIxG
70.8 (79.6)
81.8
57.9
65.1
46.5
24.2
AGDERPe
74.5 (82.6)
76.4
56.9
74.3
58.2
33.9
AGDLRP
79.1 (85.0)
73.2
57.9
73.3
57.3
32.2
Qwen 2.5 (7B)
Greedy
(72.77
74.1
46.8
67.6
47.9
27.1
Nucleus
(72.7
75.2
47.2
64.8
44.8
24.7
CAD
(76.6)
67.4
45.4
65.7
49.2
25.2
AGDIxGe
(72.5)
75.9
47.4
67.3
46.9
25.1
AGD1xG
65.6 (74.2)
74.8
49.1
66.8
46.4
25.2
AGDeRPe
70.4 (78.3)
70.6
49.7
71.1
53.0
29.9
AGDLRP
70.1 (78.5)
67.4
47.2
73.7
56.4
32.7
Gemma 3 (4B)
Greedy
(89.8)
82.3
69.7
69.8
52.4
33.3
Nucleus
(88.9)
85.2
71.0
69.3
52.2
33.2
CAD
(87.1)
73.2
59.3
73.0
57.9
36.0
AGD1x
(88.7)
87.3
72.5
69.0
51.6
32.2
AGD1xG
80.6 (86.9)
86.6
69.8
68.5
50.4
31.8
AGDLRPO
86.7 (91.0)
81.4
70.6
73.0
57.9
36.0
AGDLRP
86.0 (90.5)
78.4
67.4
73.2
57.8
36.5
(CSR), measuring the average proportion of satisfied constraints; Instruction Satisfaction Rate (ISR), measuring the proportion of individual responses fully satisfying constraints; and Session Stability Rate (SSR), measuring the average number of consecutive turns satisfying all constraints from the conversation's start. Responses evaluated exclusively by an LLM with respect the system prompt constraints, thus blending adherence and utility metrics.
Baselines We compare AGD against standard decoding methods greedy and nucleus sampling (p 0.95) and the stronger baseline Context-aware Decoding (CAD) (Shi et al., 2024), method that modifies output logits via contrastive decoding between prompt with and without the instruc- tion, adapted to improve adherence. For CAD
the control hyperparameter = =1
Settings To form the candidate set C, (Section 3.2), we apply a top-k constraint and minimum probability threshold Tmin- This design ensures that C. remains small and focused, so that attri- butions are computed only over semantically plausible candidates. To ensure fair comparison and demonstrate the generality the method, we fix the hyperparameters across all experiments, setting k 5 and miin 0.05. For entropy-gate variants, we set the activation threshold to 1.734. This value corresponds to the 80th percentile of token-level entropy on IHEval and is motivated by prior work identifying critical generation steps (Wang al., 2025) (see Appendix C).
4.2 RESULTS
As shown in Table 1, our method significantly improves instruction adherence both datasets. On IHEval, AGD with LRP attribution (AGDLRP) consistently achieves the highest Prompt-Level Ac- curacy (PLA), boosting it by 13.1 points for Llama 3.1 over greedy decoding. While this strong guidance can lower the Quality Score (QS), the catropy-gated version (AGD, effectively miti- gates this trade-off, preserving higher quality while retaining most of the adherence gains. Overall,

---

Published as a conference paper at ICLR 2026
Gready
Performance
Word inclusion Task
(c)
1.0
0.0
0.2
Lemo
Downy
Derra
Layer
Layer
Figure 2: Analysis of attribution signal for word inclusion and exclusion tasks. (a) AGD improves performance on both task types. (b, c) Layer-wise attribution in the residual stream for Llama 3.1 (8B) at decision points where AGD's choice diverges from the greedy path to satisfy constraint.
entropy-gatee catropy-gteddddee variants consistently improve QS compared to their basic counterparts, with notable trade-off in instruction adherence observed only for Llama 3.1. Ix G attribution (AGDIxg) preserves or even enhances quality over greedy decoding, but does not consistently improve adherence.
On the more complex multi-turn SysBench benchmark, AGD's advantages persist, particularly in maintaining long-term adherence. For example, with Llama 3.1, AGDLaPe improves the Session Stability Rate (SSR) by 7.9 points, showing substantial increase in the model's s ability remember and follow initial instructions over multiple turns. While the CAD baseline is sometimes competitive on the ISR metric, AGD variants consistently show superior performance across others. Overall, LRP proves to be a more effective attribution method than the simpler IxG, providing more robust mechanism for guiding generation toward instruction adherence.
4.3 ANALYSIS & CASE STUDIES
To illustrate how AGD operates, we visualize the attribution scores of candidate tokens for different instruction types in Figure 3. We observe that across various tasks - including word inclusion and exclusion (a. b), length manipulation (c. d), and format adherence (e) tokens that satisfy the given instruction consistently exhibit higher attribution scores within the relevant parts of the prompt.
(a) Word Inclusion
student [...] must include (..) Intem [...]
Intern [...] must include (...) [..]]
(b) Word Exclusion
night [..] not include (..) night [..]
training [..] not include (..) night [..]
(c) Length Expansion
<eot_i>> [..]] least 400 words. [...]
The Role of the Attribution Sign Attribution methods often produce both positive and negative scores, which provide distinct and valuable guidance signals. This is particularly evident when comparing two distinct instruction types from IHEval: keyword existence (c.g.. Your response must include the keywords ' forests'' and 'riddle') and forbidden words (e.g. Do not mention the words 'Taylor', Swift', or 'Together'). As shown in Figure 2a, AGD successfully improves adherence for both positive (inclusion) and negative (exclusion) constraints (except Gemma (4B), where forbidden words baseline performance is already near-saturated). On average. token that satisfies an inclusion rule exhibits a stronger positive attribution signal on instruction inputs throughout the residual stream of the model's layers (Figure 2b), process ex- emplified in Figure 3a where the candidate token "intern" receives high positive attribution from the same token in the instruction.
The [-]] least 400 words, [.]]
(d) Length Reduction
Ar'n
[..] less than 30 words. [..]
<eot.id> [..] less than 30 words, [...]
Format Adherence
Here
output USON [..]]
J.Joptt in UsoN
Figure 3: Heatmap visualiza- tions of attribution scores on input token embeddings. For each task, we compare a token that adheres to the instruction (adherent) with one that does not (non-adherent). Spaces are omitted for clarity. Full examples are in Appendix H.
In contrast, for negative constraints. candidates must be suppressed. When a forbidden word appears as a candidate, it exhibits a negative attribution signal on the in- struction inputs, penalty observed average across all layers (Figure 2c). For instance, as shown
Note that QS is measured only samples where instructions are fully met; methods with lower PLAA are thus evaluated potentially casier subset of examples, which may inflate their QS.

---

Published as a conference paper at ICLR 2026
Ang
(A)
(6)
66)
Avg of Doc Award 0135 01350055
67
Avg of backiward
PLA 05 (8)
0.05
78:0
5
675
658
66.0
Entropy
Res Parameter (w/ Entropy)
Amo Parameter (w/o Entropy)
Figure 4: Ablation analysis for Llama 3.1 (8B)
Table Qualitative comparison model outputs for the riddle example. Tokens where AGD was activated (i.e., entropy exceeded r) are highlighted in blue. For standard AGD (no entropy), all generated tokens are highlighted. More examples in Appendix C.
Examupe
Output
Quality
Greedy
sew' aftemoon vee 'nA tool for the enafyy and skilled', alllepping to create with delicate will nl mm small but my work grund snA (WWhu
grammati- cally correct and well structured?? Reason: The riddle grammatically correct and fol- coherent making undersand..
I..I Question:
Instruction: Your weywerds und distressed'. Do not use any commas in your respurse.
hero
keyword
Task: Write riddle about that has
respouse single, panctuation, making diflicslt to read and undersand. Answer:
entropyy)
pietce through layers one stitch a time laawing path of yarn that hoth intri- case and work of art often cansing the crafter become dustrsssd when
design fabric
No
thread
AGDuras entropy)
pierce the fabric with gentie carer,nAffmmmen sunbeams
[-.]] Reasom:
The riddle is grammotically
hightlight delieate thread there's (a tool artisans skilled and distressod), guide yarn through intricate designs I've puesee..
poetic ture, miking it well-stmetture. Answrr: Yos [..]
in Figure 3b, the token "night" exhibits negative attribution with respect to itself in the instruction prompt. This negative score penalizes its selection, allowing an alternative, correct token to be chosen instead, even if its own positive attribution score is small. This demonstrates that negative attribution scores offer a strong signal for avoidance, making them crucial for steering models away from undesirable outputs. Consequently, only attribution methods that produce negative signals are applicable in this context.
Qualitative Impact of Entropy-Gating As established in our main results, constant intervention during decoding can degrade output quality. Our entropy-gated AGD mitigates this by applying guidance only at decision points where the model is uncertain. This creates a trade-off, quantified Figure 4a: more frequent intervention boosts instruction adherence (PLA) but can degrade output quality (QS). Our chosen 80th percentile threshold strikes a balance, capturing most of the adherence gains while preserving quality and reducing computational overhead. The detailed analysis of the computational efficiency is presented in the Appendix E.
Table provides qualitative illustration of this trade-off. In the example, the greedy-decodes riddle is well-formed but fails the instruction by omitting the keyword "distressed". The standard AGD output, which intervenes each decoding step, includes the keyword but produces a single, ungrammatical run-on sentence. In contrast, the entropy-gatee constraints while maintaining grammatical correctness and a coherent structure. This highlights that entropy-based intervention is essential for robust instruction adherence without harming quality.
version successfully adheres to all
Ablations We ablate the minimum probability threshold Tmin used to form C, (Section 4.1) to analyze its impact adherence, quality, and efficiency (Figure 4b,c). A lower Tiin expands the candidate set, which can improve adherence but becomes detrimental at extremely low values. We hypothesize this is because the set becomes polluted with noisy, low-probability tokens that may be selected due to spurious high attribution scores, degrading quality and increasing computational cost. Conversely, a high mmin improves efficiency but causes adherence drop sharply as correct tokens
8

---

Published as a conference paper at ICLR 2026
prematurely filtered out. Our experiments show that Tmin 0.05 provides robust balance, enabling high performance without being computationally prohibitive or susceptible to noise.
FACTUALITY & IN CONTEXT RETRIEVAL
To demonstrate the versatility of AGD beyond instruction following, evaluate it knowledge- intensive Question Answering (QA) in two distinct settings. In the closed-book setting, the model must answer questions using only its internal, parametric knowledge. Here, the goal is mitigate hallucinations by steering generation to rely on the components responsible for storing factual in- formation. In the open-book setting, the model provided with context document containing the answer. The goal is to improve its ability to accurately ground its response in the provided evidence.
5.1 EXPERIMENTAL SETUP
For the closed-book setting, we guide generation by maximizing attribution towards pre-identified set of parametric knowledge heads (AGDLRRF). For the open-book setting, we explore two guidance strategies: maximizing attribution towards the input embeddings of the provided context (AGDERPe), or towards pre-identified set of in-context heads responsible for contextual processing (AGDtRPs) We evaluate on three standard QA benchmarks: MRQA version (Fisch et al., 2019) of TriviaQA (TQA) (Joshi et al., 2017) and Natural Questions (NQ) (Kwiatkowski et al., 2019), as well as Hot- PotQA (HPQA) (Zhilin et al., 2018), all of each can be processed with or without the context. We report recall (Adlakha et al., 2024) as our performance metric, since instruction-tuned models tend to produce verbose outputs.
To assess AGD across different retrieval quality scenarios, we employ two evaluation paradigms. For TQA and NQ, we provide gold paragraph containing the answer context, which makes them standard RAG baselines where the retrieval step is replaced by oracle context provision. This setup isolates AGD's s ability utilize provided evidence from retrieval quality concerns. To assess robust- ness in realistic RAG scenarios where retrieved contexts contain noise, we use the HPQA distractor split, which pairs each question with 2 gold and distractor paragraphs, all shuffled randomly. This simulates imperfect retrieval and tests whether AGD's s attribution mechanism provides value beyond oracle retrieval settings. Details the data preprocessing can be found in the Appendix
Our baselines include greedy decoding and nucleus sampling, supplemented by strong, task seecispec methods. For the closed-book setting, we add DoLA (Chuang et al., 2024), which is designed to reduce hallucinations by contrasting logits from different model layers. For the open-book setting, we use again Context-aware Decoding (CAD) (Shi et al., 2024), as its contrastive mechanism is specifically designed to ground generation in provided context.
5.2 RESULTS
Table Recall score (%) of Llama 3.1 (8B) in both closed-book (top) and open-book (bottom) settings. Higher scores are better. Full results are in Appendix F.
The results presented in Table 3. In the closed-book set- ting, guiding generation towards parametric knowledge heads (AGDLRFs) improves factual recall. For Llama 3.1 (8B), it outperforms standard decoding and the DoLA baseline on TQA and HPQA. This trend holds for the Qwen 2.5 (7B) model, though improvements are less pronounced for the smaller Gemma (4B). the open-book setting, AGD yields more consistent and significant gains across all models. Guid- ing generation towards either the provided context embed- dings (AGDERPe) or in-context heads (AGDLRPF) consistently outperforms baselines across datasets and models, with the context-embedding strategy generally proving slightly more effective. Notably, even for Gemma 3 (4B), where closed- book improvements limited, AGD provides clear boost in performance, demonstrating its effectiveness at grounding generation in provided evidence.
Method
TQA
NQ
HPQA
Greedy Nucleus
81.4
63.6
34.6
79.0
59.9
31.9
DoLA
81.2
63.8
34.3
AGDLRm
82.4
63.0
39.6
Greedy
89.4
83.5
81.3
Nucleus
89.7
83.3
80.7
CAD
87.9
84.6
83.7
AGDLRF
91.0
87.0
87.9
AGD
87.9
87.9

---

Published as a conference paper at ICLR 2026
The HPQA results demonstrate AGD's effectiveness with 80% distractor content. For Llama 3.1 (8B), both variants of AGD achieve an improvement of 6.6 points compared to greedy decod- ing. It suggests that the attribution mechanism helps models ground generation in relevant portions rather than being misled by noise. To verify that these gains come from the attribution mechanism rather than prompt engineering (Sclar et al., 2024), we tested alternative prompt formulation (see Appendix G). AGD maintains consistent advantages across both prompt variants, confirming the robustness of approach. Overall, these results show that AGD is potent method for enhancing the factual accuracy and contextual grounding of LLMs, with particularly strong performance in open-book retrieval scenarios, including realistic settings with imperfect retrieval.
CONCLUSION
In this work, we introduced egy that enhances LLM reliability by selecting tokens that maximally attribute specified Region of Interest (ROI), such user instruction or a knowledge-storing component. Our experiments demonstrate that this approach significantly improves both instruction adherence and factual aceu- racy in closed-book and open-book settings, while an entropy-gates variant preserves output quality and reduces computational cost by applying guidance selectively.
Decoding (AGD), fine-tuning free decoding strat-
AGD's primary limitation is inherent to its design a desired token if it is not proposed by the model. Other challenges include the computational cost of multiple backward passes and the need to define relevant ROI for each task. Future work could focus on developing more efficient attribution proxies to mitigate these costs. More- over, the ROI concept could be extended from input spans or attention heads to more monose- mantic structures, such as specific, functionally-identifeee circuits within the model, enabling more granular control. The code is available at https:/ /tte:///gtthtt con/ pitpr-iot---oe wozz--ooooree komorowski/ iitributions ierpoutttooinnuuddeeeeee guwdedddecooinng......ggoo
selection mechanism: it cannot generate
ACKNOWLEDGMENTS
We would like express our gratitude Melina Zeeb for her valuable assistance preparing the main figure of this paper, and to Patrick Kahardipraja for his constructive feedback on this paper. This work was in part supported by the Federal Ministry of Research, Technology and Space (BMFTR) as grant xJuRAG (161S25015B); the German Research Foundation (DFG) as research unit DeSBi [KI-FOR 5363] (459422098); and the European Union's Horizon Europe research and innovation programme (EU Horizon Europe) grant TEMA (101093003).
REPRODUCIBILITY STATEMENT
The source code for Atrribution-Guided Decoding (AGD) and experimental scripts will be made publicly available upon publication. We provide detailed descriptions of our experimental setup throughout the paper. including the specific models used (Section 4), datasets and the fixed hyperpa- rameters for both AGD and all baselines (Sections 4.1 and Appendix A). All experiments involving randomness, such as nucleus sampling, were conducted with fixed random seed to ensure consis- tent outcomes. Further implementation details, including the exact prompt templates used for data preprocessing steps (Appendix A), the quality scoring protocol (Appendix B), and the methodology for extracting specialized attention heads (Appendix D), documented in the Appendix.
REFERENCES
Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Ale- man, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, al. Gpt-4 technical report. arXiv preprint 2rXiv:2303.08774, 202.
Reduan Achtibat, Maximilian Dreyer, Σona Eisenbraun, Sebastian Bosse, Thomas Wiegand, Woj- ciech Samek, and Sebastian Lapuschkin. From attribution maps to human-understandabbe expla- nations through concept relevance propagation. Nature Machine Intelligence, 100):1006-1019, 2023.
10

---

Published as a conference paper at ICLR 2026
Reduan Achtibat, Sayed Mohammad Vakilzadeh Hatefi, Maximilian Dreyer, Aakriti Jain, Thomas Wiegand, Sebastian Lapuschkin, and Wojciech Samek. AttnLRP: Aitention-wwar layer-wirg wise relevance propagation for transformers. In Ruslan Salakhutdinov, Zico Kolter, Katherine Heller, Adrian Weller, Nuria Oliver, Jonathan Scarlett, and Felix Berkenkamp (eds.), Proceedings of the st International Conference on Machine Learning, volume 235 of Proceedings of Machine Learning Research, pp. 135-168. PMLR, 21-27 Jul 2024.
Vaibhav Adlakha, Parishad BehnamGhader, Xing Han Lu, Nicholas Meade, and Siva Reddy. Evaluating correctness and faithfulness of cnstruction-follooing models for question answer- ing. Transactions of the Association for Computational Linguistics, 12:681-699, 2024. doi: 10.1162/tacl 00667. URL https:
https://aclanttoo// http///aaaaattoooyo..ooo. org/ 202///22244222 wac.2...cccl... taal-1..c11.....
Ameen Ali, Thomas Schnake, Oliver Eberle, Grégoire Montavon, Klaus-Robert Müller, and Lior
Wolf. Xai for transformers: Better explanations through conservative propagation. In Interna- fional conference on machine learning, pp. 435-451. PMIR, 2022.
Christopher J. Anders, Leander Weber, David Neumann, Wojeiech Samek, Klaus-Robert Robert Müller, and Sebastian Lapuschkin. Finding and removing clever hans: Using explanation methods to debug and improve deep models. Information Fusion, 77:261-295, 2022. ISSN 1566-2535. doi: https://oi..or//// 101 www.iinuuu..2......... URL https: / www. enceenceiiiccc rect com/
Andy Arditi, Oscar Obeso, Aaquib Syed, Daniel Paleka, Nina Panickssery, Wes Gurnee, and Neel Nanda. Refusal in language models is mediated by single direction. In A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomezak, and C. Zhang (eds.), Advances in Neu- ral Information Processing Systems, volume 37, pp. 136037-136083. Curran Associates, Inc., URL. htttpp:://proceeed weweeeeiiinnnneneeeneeeeeeeeeeee neurips cc/ wttpcc//ppp..e... http/ppper_iiii wwl.ffills/pplpeeeee p file/
2024.
aaapaaaacceceppppp-aaaaaeeeeeeee .ddf.
Leila Arras, Bruno Puri, Patrick Kahardipraja, Sebastian Lapuschkin. and Wojeiech Samek. A close look at decomposition- xai-methods for transformer language models. arXiv preprint arXiv:2502. 15886, 2025.
Sebastian Bach, Alexander Binder, Grégoire Montavon, Frederick Klauschen, Klaus-Robert Müller, and Wojeiech Samek. On pixel-wise explanations for non-linear classifier decisions by layer-wise relevance propagation. PloS one, 10(7):e0130144 30140, 40, 2015.
Jasmijn Bastings and Katja Filippova. The elephant in the interpretability room: Why use attention as explanation when we have saliency methods? In Proceedings of the Third BlackboxNLP Workshop on Analyzing and Interpreting Neural Networks for NLP. pp. 155- 2020.
Tom Brown, Benjamin Mann, Nick Ryder. Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners. Advances in neural information processing systems, 33:1877-1901. 2020.
Collin Burns, Haotian Ye, Dan Klein, and Jacob Steinhardt. Discovering latent knowledge in lan- guage models without supervision. In The Eleventh International Conference on Learning Rep- resentations, 2023. URL https: /ocpss:///ppereee
net/ forum (erummiidEEe GeTTGG Ohcs.
Yung-Sung Chuang. Yujia Xie, Hongyin Luo, Yoon Kim, James Glass, and Pengcheng He. Dola: Decoding by contrasting layers improves factuality in large language models. In The Twelfih International Conference on Learning Representations, 2024. URL. https: /ttp:s//////eeiiieeeeeee net/Eorun wetooruuiiiiiioe M...-ThhyLLOO n....
Hyung Won Chung, Le Hou, Shayne Longpre, Barret Zoph, Yi Tay. William Fedus, Yunxuan Li, Xuezhi Wang, Mostafa Dehghani, Siddhartha Brahma, et al. Scaling instruction-finetue lan- guage models. Journal of Machine Learning Research, 25(70): 2024.
Angela Fan, Mike Lewis, and Yann Dauphin. Hierarchical neural story generation. In Iryna Gurevych and Yusuke Miyao (eds.), Proceedings of the 56th Annual Meeting of the Associa- tion for Computational Linguistics (Volume 1: Long Papers), pp. 889-898, Melbourne, Aus- tralia, July 2018. Association for Computational Linguistics. doi: 10.18653/v 1/P18- 1082.. URL https: //tp///aaattttaac ogw.ooggpp1--100//1

---

Published as a conference paper at ICLR 2026
Adam Fisch, Alon Talmor, Robin Jia, Minjoon Sco, Eunsol Choi, and Danqi Chen. M 2019 shared task: Evaluating generalization in reading comprehension. In Adam Fisch, Alon Talmor, Robin Jia, Minjoon Sco, Eunsol Choi, and Danqi Chen (eds.), Proceedings of the 2nd Workshop on Machine Reading for Question Answering, pp. 1-13, Hong Kong, China, November 2019. Association for Computational Linguistics. doi: 10.18653/1/D111-55800 URL ott.ge///eeaattloooooo.oo/////// o0tp 5801/.
Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, et al. The Ilama 3 herd of models. arXiv preprint arXiv:2407.217700 2024.
Prakhar Gupta, Cathy Jiao, Yi-Ting Ych, Shikib Mehri, Maxine Eskenazi, and Jeffrey Bigham. InstructDial: Improving zero and few-shot generalization in dialogue through instruction tuning. In Yoav Goldberg, Zornitsa Kozareva, and Yue Zhang (eds.), Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pp. 505-525, Abu Dhabi, United Arab Emirates, December 2022. Association for Computational Linguisties. doi: 10. /0.18653/v1/200) 1/2022. emnlp-main.33. URL https: / / /aaaaaaaaattoooooyyoooooo . org / 2222 comnl-mmat ww..inn.3.. 33/.
Juyeon Heo, Christina Heinze- Demil, Oussama Elachqar, Kwan Ho Ryan Chan, Shirley You Ren, Andrew Miller, Udhyakumar Nallasamy, and Jaya Narain. Do LLMs "know" internally when they follow instructions? In The Thirleenth International Conference Learning Representations, 2025. URL https:///// htwp//ppeeeeeeeeeooeeeeeeeoe.eee wwweeereveewnne/eeeeeeeeeeeeeeee htte://ouummmmmiIIiSs01
Ari Holtzman, Jan Buys, Li Du, Maxwell Forbes, and Yejin Choi. The curious case of neural text degeneration. In International Conference on Learning Representations, 2020. URL https:
sepeeneeview.nete
Yuxin Jiang, Yufei Wang, Xingshan Zeng, Wanjun Zhong, Liangyou Li, Fei Mi, Lifeng Shang. Xin Jiang. Qun Liu, and Wei Wang. Followbench: A multi-level fine-grained constraints following benchmark for large language models. In Proceedings of the 62nd Annual Meeting of the Associ- ation for Computational Linguisties (Volume 1: Long Papers), pp. 4667-4688 2024.
Zhuoran Jin, Pengfei Cao, Hongbang Yuan, Yubo Chen, Jiexin Xu, Huaijun Li, Xiaojian Jiang, Kang Liu, and Jun Zhao. Cutting off the head ends the conflict: A mechanism for interpret- ing and mitigating knowledge conflicts in language models. In Lun-Wei Ku, Andre Martins, and Vivek Srikumar (eds.), Findings of the Association for Computational Linguistics: ACL 2024, pp. 1193-1215, Bangkok, Thailand, August 2024. Association for Computational Linguis- tics. doi: 10. /0.18653/w1/2024 /fw../44iinnngs-ac....... URL https: http:://aaaaaaahaaaeeceee www//////222 findings-aci 70/.
Mandar Joshi, Eunsol Choi, Daniel Weld, and Luke Zettlemoyer. TriviaQA: A large scale distantly supervised challenge dataset for reading comprehension. In Regina Barzilay and Min- Yen Kan (eds.), Proceedings of the 55th Annual Meeting of the Association for Computational Linguistics (Volume I: Long Papers), pp. 1601-1611, Vancouver, Canada, July 2017. Association for Com- putational Linguistics. doi: 10. 10.11866/11//11711147, URL https:://ccclttteeesss https////lcclettoooc...o.o org/ P17-1147/.
Patrick Kahardipraja, Reduan Achtibat, Thomas Wiegand, Wojeiech Samek, and Sebastian La- puschkin. The atlas of in-context learning: How attention heads shape in-context retrieval aug- mentation. In Advances in Neural Information Processing Systems, 2025.
Tom Kwiatkowski, Jennimaria Palomaki, Olivia Redfield, Michael Collins, Ankur Parikh, Chris Alberti, Danielle Epstein, Illia Polosukhin, Jacob Devlin, Kenton Lee, Kristina Toutanova, Llion Jones, Matthew Kelcey, Ming-Wei Wei Chang, Andrew M. Dai, Jakob Uszkoreit, Quoc Le, and Slav Petrov. Natural questions: A benchmark for question answering research. Transactions of the Association for Computational Linguistics, 11452-66. 2019. doi: 10.1106 URL 9
https:/ aaclcccccc/ anlaon
Sebastian Lapuschkin, Stephan Wäldchen, Alexander Binder, Grégoire Montavon, Wojeiech Samek, and Tiluus-Rober Müller. Unmasking clever hans predictors and assessing what machines really learn. Nature communications, 1096): 2019.
12

---

Published as a conference paper at ICLR 2026
Kenneth Li, Oam Patel, Fernanda Viégas, Hanspeter Pfister, and Martin Wattenberg. Inference- time intervention: Eliciting truthful answers from a language model. In A. Oh, T. Nau- mann, A. Globerson, K. Saenko, M. Hardt, and S. Levine (eds.), Advances in Neural Information Processing Systems, volume 36, pp. 41451-41530. Curran Associates, Inc., 2023a. URL httttp::/prrceee ngs neurips ec faaeeer__flsssppeeeeeeeeee Paper Cowerrennneeeecccc.cmm pdf.
Kenneth Li, Tianle Liu, Naomi Bashkansky, David Bau, Fernanda Viégas, Hanspeter Pfister, and Martin Wattenberg. Measuring and controlling instruction (in)stabilitty in language model di- alogs. In First Conference on Language Modeling, 2024. URL https: openreview. feet/Errmm2a 2id (.dd=60a11M0 60a1sAtH4e.
Xiang Lisa Li, Ari Holtzman, Daniel Fried, Percy Liang, Jason Fisner, Tatsunori Hashimoto, Luke Zettlemoyer, and Mike Lewis. Contrastive decoding: Open-ended text generation as optimiza- tion. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume Long Papers), pp. 12286-12312, 2023b.
Nelson Liu, Kevin Lin, John Hewitt, Ashwin Paranjape, Michele Bevilacqua, Fabio Petroni, and Percy Liang. Lost in the middle: How language models use long contexts. Transactions of the Association for Computational Linguistics, 12:157-173, 2024.
Shayne Longpre, Kartik Perisetla, Anthony Chen, Nikhil Ramesh, Chris DuBois, and Sameer Singh. Entity-based knowledge conflitts question answering. In Fraic-Francine Moens, Xuanjing Huang. Lucia Specia, and Scott Wen-tau Yih (eds.), Proceedings of the 2021 Con- ference on Empirical Methods in Natural Language Processing, pp. 7052-7063, Online and Punta Cana, Dominican Republic, November 2021. Association for Computational Linguis- tics. doi: 10.18653/v 1/252/111/2211.. 1000533/1/22221.empmmmooo emnlp- munlp-main. 565/.
URL https: http//aaaaattttt cocllnnhhhloyyy or2/2021.
Shayne Longpre, Le Hou, Tu Vu, Albert Webson, Hyung Won Chung, Yi Tay, Denny Zhou, Quoc V Le, Barret Zoph, Jason Wei, et al. The flan collection: Designing data and methods for effective instruction tuning. In International Conference on Machine Learning, pp. 22631 226482 PMLR, 2023.
Scott M Lundberg and Su-In Lee. A unified approach to interpreting model predictions. Advances in neural information processing systems, 30, 2017.
Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to fol- low instructions with human feedback. Advances in neural information processing systems, 35: 27730-27744, 2022.
Frederik Pahde, Maximilian Dreyer, Wojeiech Samek, and Sebastian Lapuschkin. Reveal to revise: An explainable ai life cycle for iterative bias correction of deep models. In International Confer- ence on Medical Image Computing and Computer-Assister Intervention, pp. 596-606. Springer, 2023.
Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: An imperative style, high- performance deep learning library. Advances in neural information processing systems, 32, 2019.
Yanzhao Qin, Tao Zhang, Tao Zhang, Yanjun Shen, Wenjing Luo, sunhaoze, Yan Zhang, Yujing Qiao, weipeng chen, Zenan Zhou, Wentao Zhang, and Bin CUI. Sysbench: Can LLMs follow system message? In The Thirteenth International Conference on Learning Representations, 2025. URL /ttttss://pperrevieee
/ forum? i
Yiwei Qin, Kaiqiang Song, Yebowen Hu, Wenlin Yao, Sangwoo Cho, Xiaoyang Wang. Xuansheng Wu, Fei Liu, Pengfei Liu, and Dong Yu. InFoBench: Evaluating instruction following ability in large language models. In Lei Ku, Andre Martins, and Vivek Srikumar (eds.), Findings of the Association for Computational Linguisties: ACL 2024, pp. 13025-13048 Bangkok, Thailand, August 2024. Association for Computational Linguistics. doi: 10.18653/v1/2044 findings-aac acl. 772. URL https: /tt///aaaatttttt
org 2224. findings-aci 772//
13

---

Published as a conference paper at ICLR 2026
Nina Rimsky, Nick Gabrieli, Julian Schulz, Meg Tong, Evan Hubinger, and Alexander Turner. Steering Ilama via contrastive activation addition. In Lun- Wei Ku, Andre Martins, and Vivek Srikumar (eds.), Proceedings of the 62nd Annual Meeting of the Association for Com- putatiooaal Linguistics (Volume I: Long Papers), pp. 15504-15522, Bangkok, Thailand, August 2024. Association for Computational Linguistics. doi: 10. 00.18653/1/2024.allloe wtt.//////222 21122224.cc1100oo 828/.
URL
Melanie Sclar, Yejin Choi, Yulia Tsvetkov, and Alane Suhr. Quantifying language models' sen- sitivity to spurious features prompt design or: How learned to start worrying about prompt formatting, In The Twelfth International Conference on Learning Representations, 2024. URL httpps////petteeeeeeeee wwwpneeeewwew...c/////////o/...p .net / forum?id-RIui Rd-RId51yNJxJJ
Weijia Shi, Xiaochuang Han, Mike Lewis, Yulia Tsvetkov, Luke Zettlemoyer, and Wen-tau Yih. Trusting your evidence: Hallucinate less with context-awars decoding. In Proceedings the 2024 Conference of the North American Chapter of the Association for Computational Linguistics:
Human Language Technologies (Volume 2: Short Papers). pp. 783-791, 2024.
Karen Simonyan, Andrea Vedaldi, and Andrew Zisserman. Deep Inside Convolutional Networks: Visualising Image Classification Models and Saliency Maps. In International Conference Learning Representations - Workshop track (ICLR), 2014. httttts:://aat org/ / 1312. 6034. pdf.
Daniel Smilkov, Nikhil Thorat, Been Kim, Fernanda Viégas, and Martin Wattenherg. Smoothgrad: removing noise by adding noise. arXiv preprint arXiv: (XXXv:/706.0822). 2017.
Alessandro Stolfo, Vidhisha Balachandran, Safoora Yousefi, Eric Horvitz, and Besmira Nushi. Im- proving esstuctioo-followinge in language models through activation steering. In The Thirteenth International Conference Learning Representations, 2025. URL https: //l::///ooee /openeeview.. net/ vet//fose Eorum? i d=wozhdnRCtw..
Nishant Subramani, Nivedita Suresh, and Matthew Peters. Extracting latent steering vectors from pretrained language models. In Smaranda Muresan, Preslav Nakov, and Aline Villavicencio (eds.). Findings of the Association for Computational Linguistics: ACL 2022, pp. 566-581, Dublin, Ireland, May 2022. Association for Computational Linguistics. doi: 10.18653/11/202. findings-acl.48. URL https:tpp.... http//acaaaattttoooooooo org/2022 wew.fiiiniiien acl.48 48/.
Jiao Sun, Yufei Tian, Wangchunshu Zhou, Nan Xu, Qian Hu, Rahul Gupta, John Frederick Wieting, Nanyun Peng, and Xuezhe Ma. Evaluating large language models on controlled generation tasks. In The 2023 Conference on Empirical Methods in Natural Language Processing, 2023. URL https: / cpenreview net/ /eet/forumee forum? iddnnup6pp jdCgg.
Mukund Sundararajan, Ankur Taly, and Qiqi Yan. Axiomatic attribution for deep networks. In Doina Precup and Yee Whye Teh (eds.), Proceedings of the 34th International Conference on Machine Learning. volume 70 of Proceedings of Machine Learning Research, pp. 2319-3322. PMLR, 06- 11 Aug 2017. URL https: html.
httpp:h/procceeddi.eeeee http///pppccecceeeeee/eeeee mlr, prwsssssss............ http:///////aaaaaaaaaaaa wtw.ddii..............eeeeeeeeee
Gemma Team, Aishwarya Kamath, Johan Ferret, Shreya Pathak, Nino Vieillard, Ramona Merhej, Sarah Perrin, Tatiana Matejovicova, Alexandre Ramé, Morgane Rivière, et al. Gemma 3 technical report. arXiv preprini 250iv:2503. 19786, 2025.
Curt Tigges, Oskar J. Hollinsworth, Atticus Geiger, and Neel Nanda. Language models lin- early represent sentiment. In Yonatan Belinkov, Najoung Kim, Jaap Jumelet, Hosein Mohebbi, Aaron Mueller, and Hanjie Chen (eds.), Proceedings of the 7th BlackboxNLP Workshop: An- alyzing and Interpreting Neural Networks for NLP, pp. 58-87, Miami, Florida, US, November 2024. Association for Computational Linguistics. doi: 10. (10.63//1//224.baaabbbo 1.5. URL ht https://aclant http///alaaahhhhhhce
org/ 2024 www..bbwwa.a.aaa...............a 1.5.
Elena Voita, David Talbot, Fedor Moiseev, Rico Sennrich, and Ivan Titov. Analyzing multi-head self-attention: Specialized heads do the heavy lifting, the rest can be pruned. In Anna Korhonen, David Traum, and Lluís Märquez (eds.), Proceedings of the 57th Annual Meeting of the Associ- ation for Computational Linguistics, pp. 5797-5808, Florence, Italy, July 2019. Association for
14

---

Published as a conference paper at ICLR 2026
Computational Linguistics. doi: 12.18653/v1/11-111 1580. URL https://aclaathhoooggoo oxg/P19- 9-1800/.
Shenzhi Wang. Le Yu, Chang Gao, Chujie Zheng, Shixuan Liu, Rui Lu, Kai Dang, Xionghui Chen, Jianxin Yang, Zhenru Zhang, et al. Beyond the 80/20 rule: High-entropy minority tokens drive effective reinforcement learning for Ilm reasoning. arXiv preprint arXiv:2506. 2025.
Jason Wei, Maarten Bosma, Vincent Zhao, Kelvin Guu, Adams Wei Yu, Brian Lester, Nan Du, Andrew M. Dai, and Quoe V Le. Finetuned language models are zero-shot learners. In Interna- fional Conference Learning Representations, 2022. URL https::/ net/ forum? 1d=gE2rGozzdgR.
Jason Wei, Nguyen Karina, Hyung Won Chung, Yunxin Joy Jiao, Spencer Papay, Amelia Glaese, John Schulman, and William Fedus. Measuring short-form factuality in large language models. arXiv preprint arXiv:2411.04300 2024.
An Yang, Baosong Yang. Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, et al. Qwen2. 5 technical report. arXiv preprint 1:X1v:2412.15115. 2024.
Kayo Yin and Graham Neubig. Interpreting language models with contrastive explanations. In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pp- 184-198, 2022.
Xiaodong Yu, Hao Cheng, Xiaodong Liu, Dan Roth, and Jianfeng Gao. ReEval: Automatic hal- lucination evaluation for retrieval-augmenteed large language models via transferable adversar- ial attacks. In Kevin Duh, Helena Gomez, and Steven Bethard (eds.), Findings of the Associ- ation for Computational Linguistics: NAACL 2024, pp. 1333-1351, Mexico City, Mexico, June 2024. Association for Computational Linguistics. doi: 18.18 1ttp:///222222 1/2024. fing22..inning-aaccc. URL https: http::/:///caaathlooooooo oro.oog/////// 2024. fae..finndd Findings-nann wwainnggsnnaall..mmmm 85/.
Zhiyuan Zeng, Jiatong Yu, Tianyu Gao, Yu Meng, Tanya Goyal, and Danqi Chen. Evaluating large language models at evaluating instruction following. In International Conference on Learning Representations (ICLR), 2024.
Qingru Zhang, Chandan Singh, Liyuan Liu, Xiaodong Liu, Bin Yu, Jianfeng Gao, and Tuo Zhao. Tell your model where attend: Post-hoc attention steering for LLMs. In The Twelfth Interna- tional Conference Learning Representations, 2024. URL dew.um20eexD
net//
Yang Zhilin, Qi Peng, Zhang Saizheng, Bengio Yoshua, Cohen William, Salakhutdinov Ruslan, and Christopher D. Manning. Hotpotqa: A dataset for diverse, explainable multi-hop question answering. Proceedings of the 2018 Conference Empirical Methods in Natural Language Processing, 2018 doi: 10. 10.18653/v1/d18 12299 URL https: // //crr. mii.ac. tptppp//ceeee 13633888461423721
aii.ac.jp/cri... crid/
Jeffrey Zhou, Tianjian Lu, Swaroop Mishra, Siddhartha Brahma, Sujoy Basu, Yi Luan, Denny Zhou, and Le Hou. Instruction-followinng evaluation for large language models. arXiv preprint arXiv:2311.07911 2023a.
Wangchunshu Zhou, Yuchen Eleanor Jiang, Ethan Wilcox, Ryan Cotterell, and Mrinmaya Sachan. Controlled text generation with natural language instructions. International Conference on Machine Learning, pp. 42602-42613, PMLR, 2023b.
A GENERAL IMPLEMENTATION
Method and experiments were implemented using PyTorch (Paszke et al., 2019). LLM-based evaluations for Quality Score (QS) for IHEval and SysBench metrics were performed using gpt-44-2022-08-00
15

---

Published as a conference paper at ICLR 2026
Datasets For the IHEval dataset, we used the oule-fflloovie//sshhhgo--tttttaa
The SysBench dataset was sourced from its original repository (https: com/ For TriviaQA (TQA) and Natural Questions (NQ), we used the development splits from the MRQA 2019 Shared Task repository (https: //github. com/ /tr////a/////
split from its official repository (https:/ httt:///gthbb... htt.taabbcco//yyyy1133222/2//131
PKU-Ba
TasreddTask-21111 Lastly for HotPoIQA (HPQA), we used the validation split from Hugging Face (https: bttpps://huggingfee. cttcco///aaaeoooo datasets/ hetpotqa).
Factuality datasets underwent preprocessing procedure. Specifically for NQ, we applied the steps proposed by Yu et al. (2024). Additionally, we filtered out duplicate entries from each dataset, per- forming this process independently for the closed-book (CB) and open-book (OB) settings. This filtering accounts for instances in the OB setting where the same question may be paired with dif- ferent evidence passages, but also when context was empty. This process resulted in final evaluation sets of 7,785 samples for TQA (CB and OB); 4,987 for NQ (CB) and 5,450 (OB); and 5,918 for HPQA (CB and OB).
For all experiments, we used the system prompt: You are a helpful assistant. For closed- book settings, the user prompt consisted solely of the question. For open-book settings, used the following prompt structure: {f context }} \n)nBased on this text, answer this suesstion\(@@: {{ question })nA:
Baselines Proposed by Shi et al. (2024), CAD is contrastive decoding method designed to im- prove the faithfulness of generation to a given context. It modifies the output logits at each step by amplifying the difference between the distribution conditioned on the full input and distribution conditioned on a partial, "context-free" input. The modified logit is computed as:
logit' (yr) (1 a)) logit(y) (fan) - logit(y) [Foontet-tiee)
We use CAD as baseline for both instruction following (where Ziull includes the instruction and Fromtext-free omits it) and open-book book QA (where Zromext-free omits the provided document). Following the original work, one of the plausible choices, we set the control hyperparameter
1.0.
Proposed by Chuang et al. (2024), DoLAA a method designed to reduce hallucinations in closed- book settings. It is based the finding that factual knowledge in transformers is often localized in specific layers. The method works by modifying the output logits at each decoding step contrasts the logits from the final layer with logits projected from one of earlier layers, exploiting the hierarchical encoding of factual knowledge within LLMs. While the original implementation suggests contrasting with higher layers for QA tasks, we empirically found that contrasting the final layer with lower layers consistently yielded better recall scores across all models and datasets in our setup; we therefore report this.
B QUALITY EVALUATION
To evaluate the generation quality for the IHEval dataset, we follow the procedure introduced by Stolfo al. (2025). First, using only the task portion of the prompt (i.e., without the instruction), we prompt an LLM evaluator to generate up to five simple yes/no questions that break down the core requirements of the task. The examples of these questions can be found in Table and 6. The prompt used for this step is shown in Table 4.
Second, the model's response to the full prompt (task and instruction) along with task itself is eval- uated against these generated questions. The evaluator is prompted to answer Yes, No or Not Appli- cable for each question, providing a brief justification. The prompt for this evaluation step is shown in Table 5, he final Quality Score (QS) is defined as fraction of Yes responses out of Yes and No. calculated only for responses that successfully satisfied all instructions.
C ENTROPY-GATING DETAILS
The entropy threshold (r 1.734) for adaptive AGD variant was chosen based on the distri- bution of token-level entropy observed on the IHEval dataset, as shown in Figure 5, This value corresponds to the 80th percentile.
16

---

Published as a conference paper at ICLR 2026
The following 1a prompt that is used to evaluate the generationn from a large language model. prompt. Can you come with or less questiona that can break down the quality to simpler evaluation Laske that we can then ask about the model answer? Each question should have simple yes,
know
evaluste quality modal answers
Prompt: If prompt without instruction 1)
1ist
questions the lowing format:
Output:
1: Ouestion: squeation>
2: Question: <question>
Question: <question>
Table 4: Prompt for Quality Evaluation Question Generation.
need to evallaae the qua ity generations from large language model. of questions
be given Input prompt, the respoase from Language model and assessing the quality of the response. You need to review the response against the input prempt and provide
each question either 'Yes', 'so' 'Not Applicable' if the question does rot apply to the case along with a reason for your
Prompt: If prempt wi:hout instruction 1)
Response: {1 reaponse }1
Questions: (f up to evaluation questions }
List your answers in the following format:
Dutput:
1. Question: <queation>> Reasons <reason>; Answer: <anawer>
Question: squestion>, Reasons
N. Question: squestion>, Reason: <reason2:
Answezs <answer>
Table 5: Prompt for Quality Score Evaluation
Another example of how entropy-gated version AGD handles adherence adherence-quality trade-off is pre- sented in Table 6. Greedy decoding fails to include enough placeholders. Standard AGD satisfies the constraints but overuses placeholders, resulting in an unnatural and poorly formatted email. The entropy-gated output again finds superior balance, meeting the placeholder requirement while pre- serving the fluency and structure of natural email.
The 80th percentile: 1.734
10a
Freuueccy (log scale!
10a
10a
20a
0
2
Entropy
Figure 5: Distribution of token entropy IHEval dataset for Llama 3.1 (8B)
17

---

Published as a conference paper at ICLR 2026
Table 6: Qualitative comparison of model outputs for the email example. Tokens where AGD was activated (i.e., entropy exceeded 7) are highlighted in blue. For standard AGD (no entropy), all generated tokens are highlighted.
Esample
Output
Quality Evaluation
Groddy
email:)niss (Sahhhhte Feodiack [braad] Boots) (Deea [came]] A wasted to follow up with you regarding the [color] [brand] boots I received. I hase been wesring them for (Jenghh of and
Hem is sewnitten
[..]
Is rewritien fomatted appoopriately an email? soa: The response includes subyect line, a greating, and a clocing, which are typical components Yes I...]
Instruction: Your response must cousain at least 10 plazeholders represented by square brackets, [name].
say they (ifjective but little hoping to get your thoughts and soe there's anything that can he done to improse the fut (Bees, Your Name) Constraint failed: enough placebolders.
email fomuat. Anewer:
[ndjective 2).
following sen- lence into an email: The boots ur warm but a lirkl uncomfeet- able.
AGD (wlo entrupy)
Here is the rewnitin sentence se email:) Subbeettt [name]] Boot
[-.]] Resvon: The response includes a sub- ject and greeting, which typical components an email fummal, However, the plazehalders make it incomplete and not fully formatied. Answrr: No [..]
(n nDaar [namel) share with you my thought on the [brand] boots that [name] bought [tims] sgn. Ovarill, they scom he [adjastive] and (odjective] far. but I have found them to be [oc]jective] at times. Specifically, they
wanted
[udjective]] and [uljective]. making [veris] for [name] to [action] (time]. (e) (iReet regands) Yourour nume]
AGUl nrw
Here is the sewattnn sentence as us email:) aSbbject: [narnel's Boot Review (n nDer [namel (n nil wanted to follow with you reganding the [brand]] boots that [nume]] purchased loccasion].
I...I Reason: The response includes a sub- jest line and greeting, which are typical components
(w/ encropy)
email fommal. However placeholders Jname], [brand], loc- casion), and (adjective) need to be replaced with actual content for the email to be vom- Answer:
boots are Iadjectivell jective2), but [name] them to be bit (adjective]] at times /nl you have any conserns or would like to dis- further, please don't hesttate reach (Beest gurds, (o| Your Name)
D EXTRACTION OF FACTUALITY & IN-CONTEXT HEADS
Following the methodology of Kahardipraja et al. (2025), we aim to identify sets of in-context heads Hexx that retrieve contextual information, and parametric heads Hparam- that store the factual mem- ory of the model. In-context heads are defined as those contributing mainly in open-book settings by retrieving contextual information, whereas factual heads dominate in closed-book conditions by relying on internal parametric knowledge. Each head type is maximally influential in its respective setting while having minimal effect in the other. To extract the heads, we analyze counterfactual contexts from the NQ-Swap dataset (Longpre et al., 2021). First, open-book questions with coun- terfactual contexts are presented to the model, producing predictions cer that are guaranteed to be absent from the model's internal knowledge due to the counterfactual nature of the context. Next, book questions, where contextual information is minimized, are used to isolate the model's parametric components, yielding parametric predictions Cyold.
Let X (xI...., xs) dx denote the matrix of hidden token representations for a sequence of length S with dimension d, and suppose our model employs H parallel heads, each of dimension dn d/H. H. Then, the computation of the multi-head attention layer can be reformulated into H complementary operations, where each head h produces an intermediate attention output 2! E Rd::
Σ
A (W) xy)
We use AttnLRP to quantify head contributions by summing relevance scores of each head's latent output z across tokens and dimensions:
dp Agle x. (e..e)i)))))
(c(c)
=
(
1=
To contrast behaviors across settings, we compute difference score D representing each head's average relevance in open- versus closed-book conditions:
= [Ex. (' (Cer)] Excx (Tn((aa))))) : I,..., Nr..
We then select the top N heads with the highest and lowest D values to form Hax and Hparam:
Han {argsort (
Hparam {argsort (D)) (D)) -
(10)
18

---

Published as a conference paper at ICLR 2026
The N is equal to 100 for Llama 3.1 (8B), 75 for Qwen 2.5 (7B), and 25 for Gemma 3 (4B).
To validate our choice of head count, we evaluated AGD performance with varying numbers of selected heads. The results presented in Table 7.
Table 7: Ablation study head count on TriviaQA using Llama 3.1 (8B). Recall scores (%) for closed-book (factuality) and open-book (in-context) settings with different numbers of selected heads.
Heads
Factuality
In-Context
10
81.8
90.3
50
81.4
91.4
100
82.4
91.0
200
82.4
90.9
The performance is relatively stable across head counts from 50-200. Very small head (N=10) underperform - likely we consider too little number heads and coverage insufficiently the relevant information pathways. We observe that the sorting effectively prioritizes relevant heads. We suspected that too big of a number could introduce noise, but doesn't 't seem to be the case. Overall, our choice of 100 heads (~100% of total heads) represents reasonable middle ground.
significant degradation with larger head sets, suggesting
E COMPUTATIONAL EFFICIENCY
Table presents comprehensive efficiency metrics. The entropy-gated version (LRPe) provides quite modest increase in compute ranging from 1.32 to 1.6x compared to greedy decoding, while non-gated requires 1.59-2.20x more time. This is comparable to the overhead of contrastive meth- ods like CAD (1.32-1.97x) x), however method requires more memory. This overhead comes, however, with performance gains, as shown by our results throughout the paper.
F FULL FACTUALITY & IN-CONTEXT RETRIEVAL RESULTS
Table 9 presents the complete of results for the factuality and in-context retrieval experiments across all models, datasets, and methods.
G PROMPT SENSITIVITY ANALYSIS
To ensure that AGD's improvements on noisy retrieval are robust prompt formulation rather than artifacts of specific phrasing (Sclar et al., 2024), we evaluated two distinct prompt structures on the HotPotQA distractor split.
We tested two formulations that differ in both structure and emphasis:
Standard prompt (context-first): {f context }} \n)nBased on this text, answer this question: \nQ: {f question 1)nnA
Reordered prompt (question-fiss); Question: {{ question }} \o\n Based on the text below, provide an answer: (nf( context WnAnsswr::
Both prompts use identical contexts (2 gold paragraphs distractors, randomly shuffled), but differ in the ordering of question and context as well as the phrasing. The results are presented Table 10.
AGD maintains consistent advantages over both greedy decoding and CAD across both prompt formulations. The relative ordering of methods remains stable across prompt formulations: AGD variants consistently outperform both greedy and CAD baselines, regardless of whether the context or question appears first, demonstrating robustness to prompt engincering. These results show that AGD's attribution mechanism provides value beyond oracle retrieval settings. It actively helps the
19

---

Published as a conference paper at ICLR 2026
Table Computational efficiency on open-book TriviaQA. AGD subscripts denote whether entropy-gating is used (e). Time: average milliseconds per token; Castx: slowdown relative to Greedy; Memory: peak GPU memory in MB; Fwd/Bwd: average number forward/backward passes per token. Metrics averaged over 100 samples with max sequence length of 256 tokens on
NVIDIA A100 80GB (PyTorch 2.6.0, bfl6 precision).
Model
Method
Time (ms)
Costx
Memory (MB)
Fwd
Bwd
Llama 3.1 (8B)
Greedy
94.0
1.00x
15520
0
CAD
124.9
1.32x
16215
2
0
AGDLRPe
150.7
1.60x
23238
1
0.58
AGDERP
207.2
2.20x
23842
1
1.06
Qwen 2.5 (7B)
Greedy
85.5
1.00x
14786
1
0
CAD
120.0
1.40x
15566
2
0
AGDLRPe
112.7
1.32x
23628
0.23
AGDERP
161.6
1.89x
23991
0.55 I
Gemma (4B)
Greedy
68.6
1.00x
7578
1
0
CAD
134.8
1.97x
9569
2
0
AGDERPe
92.1
1.34x
14648
1
0.09
AGDLRP
109.0
1.59x
14739
1
0.34
model navigate noisy retrieval results by selecting tokens with stronger grounding in relevant por- tions of the provided context. These results further validate that the benefit of AGD comes from the decoding mechanism itself.
H ATTRIBUTION VISUALIZATION DETAILS
This section provides the detailed layer-wise attribution heatmaps that were summarized in Figure of the main paper. For each candidate token, we visualize the relevance scores back-propagaa to the input embeddings (Layer and the residual stream of each subsequent transformer layer. To enhance visual clarity, relevance scores at each layer are normalized by the maximum absolute value that layer. Figure 3 we omitted the first and the last token from normalization process to prevent them from dominating the color scale provided responses can get lengthy and thus token contributions poorly visible. Here we are presenting versions including these tokens. The full input prompt and generation prefix for each example provided in the figure captions (Figures 6, 7, 8, and 10).
20

---

Published as a conference paper at ICLR 2026
Table 9: Performance of Llama 3.1 (8B), Qwen 2.5 (7B), and Gemma (4B) TriviaQA, NQ. and HotPotQA datasets both closed-book and open-book settings, measured in recall (%). Higher scores better.
Model
Setting
Method
TriviaQA
NQ
HotPotQA
Greedy
81.4
63.6
34.6
Nucleus
79.0++0.3
59.9++..3
31,9-+0.2
Closed-book
DoLA
81.2
63.8
34.3
AGD1xGh
81.2
63.0
37.5
AGDLRPh
82.4
63.0
39.6
Llama 3.1 (8B)
Greedy
89.4
83.5
81.3
Nucleus
89.7:L0.3
83.3+00.3
80.7++0.2
CAD
87.9
84.6
83.4
Open-book
AGD1xGb
91.2
85.7
81.6
AGDIxGe
89.7
83.5
83.9
AGDLRPP
91.0
87.0
87.9
AGDLRPe
91.4
87.9
87.9
Greedy
69.3
47.8
33.8
Nucleus
68.8+:0.3
45.4+00.5
32.
Closed-book
DoLA
67.9
44.3
32,4
AGD1xGh
69.1
47.1
33.6
AGDLRPh
70.3
46.9
34.3
Qwen 2.5 (7B)
Greedy
91.1
89.0
84.5
Nucleus
91.2++0.1
88.7+0.2
85.0++0.3
CAD
88.6
90.0
85,0
Open-book
AGD1xGh
91.7
90.0
85.5
AGDIxGe
91.1
88.6
85.1
AGDLRPL
91.0
89.7
86.4
AGD,RRP
92.3
90.6
89.5
Greedy
61.9
41.6
27.7
Nucleus
61.3+00.1
41.2+:..
27.7+002
Closed-book
DoLA
60.5
40.8
27.3
AGD1xGk
61.0
42.1
28.0
AGDLRPh
61.5
41.9
28.0
Gemma 3 (4B)
Greedy
83.2
82.0
70.1
Nucleus
83.0+#0.1
82.0+0.11
0..
CAD
82,0
75.7
64.1
Open-book
AGD1xGh
83.0
82.5
70.4
AGD|x
83.0
82.3
70.1
AGDLRPh
83.4
83.0
70.6
AGDLRP-
83.9
83.0
70.9
21

---

Published as a conference paper at ICLR 2026
Figure Heatmap example (Word Inclusion).
Sequence
prefix:
< </begin of text >>||start header id >systessssennnt header id id|\\n) Whenever the user inputs a request, first repeat the request word for word without change, then give your answer (do not say any words or characters before repeating the request). Your response must include the words "intern" and /tl.//o..ddii(ssttttteeeeeeeeeee
hen.a//deeeeeeeeeneeeeeeeedelll limerick about Hannah, college student, doing an internship at a coffee company. Make sure that her father would love the eot_id|>< < in nijnnnhh,, a college
limerick.
atarttheader.id /nd
22

---

Published as a conference paper at ICLR 2026
Figure 7:
Heatmap example (Word Exclusion).
Sequence prefix:
<lbegin of text |><| header id >d/>ssstem<| end header idl>\n)nYour response must be in English, and no capital letters are allowed. Your response should not include the keywords "coop", "killings", "dead", "aig /tspiiddssseee/eeeneeaaaa /nnerr/eeeeeeeeeeeeeeeeeeeeddddd (n\nWrite a story about commandos who are in the middle of the night in sector. the midst of a dense jungle sector, a
< Ilend.hedderiddd team of commandos moved stealthily, their senses on high alert. they had been inserted into this unforgiving terrain under the of darkness, their mission to gather intel and disrupt. enemy operations, (n/nled by lieutenant jenkins, the team of six commandos navigated through the underbrush with ease, their
23

---

Published as a conference paper at ICLR 2026
Figure 8: Heatmap example (Length Expansion). Because of the length
of the response limit figure to the 50 initial tokens. Sequence prefix: /
>systems h hedd. |n)noorur response must be at least 400 words. Your response must have a title wrapped in double angular brackets, like <<riddle>>, <oo.ooo.aaiiccsssttttteeeeeeeeee Write a riddle about a house that is not house. Also include the answer, answer.<leot.iddil / (n)n<<The House That's Not a House>>\n|nnn the heart of a city, I'm a familiar sight\\nA dwelling for none, yet sheltering all day and night walls are not walls, I'm where people reside, without a single dispute)n)nMy foundation is solid, though I'm not rooted in earth|nI' m not anchored by beams, nor held together by mir mortar nor mortarboard binds me,
>user< end.headeriid s|a|
my roof roof above'nYYe
holds me upright|nAnd though I'm not made of sticks, I'm not a fragile folight(pini have rooms within me, though none are enclosed)nNo doors swing shut behind you, nor windows to (ispense\/no fireplace crackles warmth within me, though I'm cozy as can bel furniture's arranged within my spaces, though people sit and rest with In shelter from sunbeams bright, though my own light's quite dim'nI shield from raindrops falling, yet my own surface's quite thinknMy inhabitants don't t pay rent, nor utilities to boot|/Thoouhh they come and they go freely, without any need to compute\ninSo, I may seem paradoxical, indeed) house that's not a house, though people reside with ease)nII' not made of bricks nor blocks, nor crafted with skilled handsknYet I provide for many needs, though my own needs are quite whhht am I indeed a house that's s not house. While it's a dwelling for none in the sense that no person permanently resides within it, bus stop shelters people waiting for buses all day and night, providing protection from sunbeams and raindrops alike.
riddle
_uus stop.. |n|nA bus stop is
24

---

Published as a conference paper at ICLR 2026
Advernnc ap
Figure 9:
Hcatmap example (Length Reduction). < <begii of text |><| start header idl Sallssystes|eee end header id/>>p)nYour response must include one italic text section in markdown, i.e +italic text*. Your entire response must be less than 30 words. http://.....oooattttteeeeeeele/a
Sequence prefix:
you explain to me why there is so much fraud in the end.headeriid >|n| +_Human greed, desperation, and lack of accountability drive fraud, often fueled by societal pressures, economic inequality, and systemic silnerbblitties.
25

---

Published as a conference paper at ICLR 2026
Saadda un
www.
Figure 10: Heatmap example
(Format
Adherence). Sequence
prefix:
<lbegin.of.text/ |><t|><<> / start seeader.dllssysteeeee ierprtmme/eedddeeadeeeiidddda. Format your entire output in JSON. < eot_id stsatbberill user< h/dedhheader.dd///pppppp.
all facts about Lionel Messi
a structured output /eot.id /tttiiddd/ssststt....ttttt (tarttteeeeerr.
< end header id/>|n|n
26

---

Published as a conference paper at ICLR 2026
Table 10: Recall (%) on HotPotQA distractor split with different prompt formulations. AGD main-
tains consistent advantages across prompt variants despite 80% noise in retrieved contexts.
Model
Method
Standard Prompt
Reordered Prompt
Llama 3.1 (8B)
Greedy
81.3
82.2
CAD
83.7
84.1
AGDLRPS
87.9
87.8
AGDLRPe
87.9
87.3
Qwen 2.5 (7B)
Greedy
84.5
83.5
CAD
85.0
81.9
AGD
86.4
85.1
AGD1Rpe
89.5
86.0
Gemma (4B)
Greedy
70.1
62.7
CAD
64.1
53.3
AGDLRM
70.6
63.2
AGDLRPe
70.9
62.9
27


Reviews:
[{"review_id": "773XDNSK4a", "reviewer": "Reviewer_neLF", "summary": "This paper presents Attribution-Guided Decoding (AGD), a fine-tuning-free decoding strategy to enhance the reliability of LLMs. AGD is based on the selection of tokens from a set of high-probability candidates. Selection is based on the maximization of the attribution score of a candidate token to a user-defined \"Region of Interest\" (ROI). This ROI can be flexibly defined over parts of the input prompt or over internal model components. The authors show the effectiveness of AGD in improving instruction following, increasing factual accuracy in closed-book question answering by avoiding hallucinations, and enhancing grounding in open-book (in-context) retrieval tasks. Regarding the computational overhead of calculating attributions at each step, an adaptive variant is also proposed, entropy-gated AGD-e, which applies guidance only when the model output distribution shows high uncertainty, thus preserving the quality of the output while saving cost.", "questions": "see weakness", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. AGD repurposes passive attribution methods for active generation. Unlike \"interventionist\" methods that alter activations, this \"selectionist\" approach chooses among the model's high-probability outputs, preserving text quality while making generation interpretable through token-rationale relationships.\n\n2. The ROI framework applies broadly to diverse problems. AGD improves instruction adherence (using instruction text as ROI), factual recall (targeting \"parametric knowledge heads\"), and in-context grounding (using context embeddings as ROI).\n\n3. The authors tested across multiple models (Llama 3.1, Qwen 2.5, Gemma 3) and tasks with strong baselines like CAD and DoLA. The analysis includes hyperparameter ablations and case studies visualizing attribution scores to explain why the method works.", "weaknesses": "1. AGD's \"selectionist\" design limits it to tokens already proposed by the base model with high probability. If the desired token isn't in the candidate set, AGD cannot generate it, making success dependent on the base model's capabilities. \n\n2.  The method seems to be computationally expensive, requiring backward passes for each candidate token to compute attribution scores. While entropy-gating helps, this overhead could limit its practice. In the meantime, we need to predefine the threshold for the entropy, which can not always be reliable.\n\n3. While ROI flexibility is a strength, it requires users to define relevant ROIs for each task. This is straightforward for instruction following but non-trivial for tasks like factuality improvement, which requires identifying specialized components like \"knowledge heads.\" \n\n4. Many baselines are missing such as DoLA.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "72WxiXMeDB", "reviewer": "Reviewer_4ijK", "summary": "- **Idea:** At each step, form a small candidate set (top-k with prob floor), compute attribution of each candidate to a user-defined Region of Interest (ROI) (e.g., instruction tokens, context embeddings, selected attention heads), and pick the token with the highest ROI attribution. No logits or activations are modified; it’s selection rather than intervention.  \n- **Variants:** Use LRP/AttnLRP (primary) or Input×Gradient for attribution; propose entropy gating to apply guidance only when the model is uncertain to curb quality loss and cost.  \n- **Results:** Improves instruction adherence on IHEval/SysBench and boosts factuality in closed-book (via “knowledge heads”) and open-book (via context embeddings or “in-context heads”); entropy gating trades off adherence vs quality and reduces backward passes.", "questions": "1. **RAG vs AGD:** In open-book, could you compare against a standard RAG baseline (retrieve-then-decode) and a “ROI-prompt only” baseline that emphasises the ROI without attribution? This isolates attribution’s unique contribution.  \n2. **Cost & memory:** Please report wall-clock, token cost, and peak memory with and without entropy gating, and versus CAD/RAG on the same hardware. Also provide the average number of backward passes per token under typical thresholds.  \n3. **Stronger models:** Do gains hold for newer small models (e.g., Qwen3 or DeepSeek-R1-Qwen3-8B)? Any evidence of diminishing returns as base model adherence improves?  \n4. **Head selection robustness:** For “knowledge” or “in-context” heads, how stable are results across identification methods and datasets? Could you provide ablation of head sets and performance sensitivity?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "- **Simple, model-agnostic control:** Decoding-time, fine-tuning-free; clear ROI abstraction spanning inputs or internals.  \n- **Practical quality/cost knob:** Entropy gating reduces intervention and keeps fluency while retaining most adherence gains.  \n- **Coverage:** Evaluated on instruction following (IHEval, SysBench) and factual QA (closed/open-book) across three small/mid models.", "weaknesses": "- **Positioning vs RAG/contrastive baselines is incomplete:** Open-book uses an ROI over context/heads, but no retrieval step; comparisons are to greedy/nucleus/CAD, not to RAG-style pipelines or “ROI-prompt only” ablations. This blurs how much gain comes from attribution versus simply highlighting the ROI.  \n- **Compute overhead and scalability:** AGD requires backward passes per candidate token when triggered; the paper reports entropy-gated reductions and average backward-pass counts, but lacks end-to-end wall-clock or token-cost comparisons against strong external baselines. Memory implications are not quantified.  \n- **Generalisation to stronger LLMs is unclear:** Results are on Llama-3.1-8B, Qwen-2.5-7B, Gemma-3-4B; it’s unknown whether gains persist or shrink on frontier small models (e.g., Qwen3, DeepSeek-R1-8B).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "3NgKcnnQ7E", "reviewer": "Reviewer_rtNt", "summary": "This work propose a method to reduce hallucinations and improve factual accuracy. In order to reduce computational cost, an entropy-based adaptive mechanism is applied. In the experiments, higher factuality is obtained on two benchmarks (IHEval and SysBench).", "questions": "1. Human interpretability:\nHave you tested whether human evaluators actually find the attributions helpful for understanding the model’s reasoning? Qualitative examples could strengthen this claim.\n\n2. hyperparameters setting\nThere are two sensitive hyperparameters: entropy-gated threshold and the minimum probability threshold.  It looks depends on models and tasks. Did you have any related experience?", "limitations": "", "rating": 4, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. integration of attribution into decoding: introducing attribution-guided decoding (AGD) that dynamically adjusts token-level generation probabilities based on feature attributions. \n\n2. Experiments span three representative long-form tasks (fact-grounded QA, long summarization, and reasoning). The authors evaluate across multiple model families (Llama-3, Qwen2.5, Gemma2) and both open- and closed-source settings.\n\n3. Interpretability and visualization:\nThe paper presents clear visualizations (Figures 3–5) of token attributions and their decoding effects. These figures concretely show that AGD improves focus on factually relevant spans and reduces hallucinated continuations", "weaknesses": "1. Limited novelty in algorithmic mechanism: Although the integration of attribution and decoding is original, the underlying technique (re-weighting token probabilities) is relatively straightforward and derivative of prior constrained or guided decoding approaches (e.g., likelihood re-weighting, constrained beam search). Following are some related work on this direction\n\nGeDi: Generative discriminator guided sequence generation. EMNLP 2021\nUnlocking Anticipatory Text Generation: A Constrained Approach for Large Language Models Decoding. EMNLP 2024\n\n2. Evaluation lacks human verification.\nImprovements in factuality metrics are fully automatic. Human or expert evaluation of factual correctness and coherence would make the results more convincing, especially for interpretability claims.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)