{"id":"e85440b5-6a1a-4670-9d93-15f6e44af759","arxiv_id":"2506.04202","paper_version":3,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"TracLLM traces an LLM output back to the specific text passages in a long context that caused it, using hierarchical group scoring with denoising and ensembling.","lead":"TracLLM is a new system that finds which parts of a long document or prompt made a language model produce a particular answer. It repeatedly splits the context into groups, scores each group with standard attribution tools, and keeps the most influential pieces, which helps debug AI outputs and trace malicious injections.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Pruning is only proven lossless for exact indicator-value Shapley under unanimity/existence games; the experimental conditional-probability/BLEU scores with few permutations, denoising, and ensemble have no lossless-pruning guarantee.","rationale":"The reader's weakest-assumption analysis correctly identifies the pruning step as the load-bearing point: TracLLM's efficiency gain over exhaustive Shapley comes entirely from discarding groups, and the only theoretical guarantee for that discard is Proposition 1. The paper is honest about Proposition 1's assumptions, but those assumptions are not the ones under which the experiments run. Conditional probability and BLEU are continuous scores, Monte-Carlo Shapley with 5–20 permutations is approximate, and denoising/ensemble are heuristic score transformations. None of these preserve the exact indicator-value structure that makes nodes without T* have score zero and nodes with T* have positive score. As a result, a group containing a true contributing text could plausibly fall below the top-K threshold in an intermediate iteration and be lost permanently. This is not an internal inconsistency in the algorithm, but it is a real gap between the theoretical guarantee and the empirical regime. The concern is addressable: logging pruned groups and testing the joint-text scenario would reveal whether the gap is actual. The paper has genuine strengths, including broad evaluation across attacks and LLMs, a clear algorithmic formulation, open-source code, and reproducible greedy decoding. Those strengths support the empirical claim that TracLLM often works, but they do not close the pruning-guarantee gap. Since the reader's verdict of CONDITIONAL already reflects this weakness and a targeted experiment could resolve it, the appropriate recommendation is to leave the verdict unchanged.","tokens_in":30041,"tokens_out":4524,"duration_ms":46961,"concrete_test":"Instrument TracLLM to log every pruned group and its contribution score. Then run a controlled synthetic benchmark with n = 200 texts, exactly two jointly required malicious texts t1 and t2 satisfying p(O | t1) ≈ p(O | t2) ≈ low and p(O | t1,t2) ≈ high. Vary the initial binary partition so t1 and t2 start in the same group or in adjacent groups, vary the number of Shapley permutations e ∈ {5, 10, 20}, β ∈ {20%, 100%}, with K = 2, and record how often both t1 and t2 survive to the final top-K set. If any configuration with the paper's default settings (e = 20, β = 20%) prunes a group containing t1 or t2, the lossless-pruning assumption underlying the efficiency claim is violated in the experimental setting, and Proposition 1 cannot be invoked to support the empirical claims.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central efficiency claim depends on pruning being lossless: once a group is pruned, all texts in it are permanently excluded. The only formal support is Proposition 1, which assumes (i) the value function is the binary indicator v(U) = I(f(I ⊕ U) = O), (ii) generation is exactly a unanimity or existence game, and (iii) exact Shapley values are used. The experiments instead use conditional probability p_f(O|I ⊕ U) (or BLEU for black-box LLMs), estimate Shapley from a small number of Monte-Carlo permutations, and then further modify scores via top-β denoising and max-ensemble. None of these experimental regimes satisfies Proposition 1's assumptions. With a continuous probability value function, non-malicious groups can have low but positive scores, while a group containing one of two jointly required malicious texts can receive a small estimated score if the sampled permutations do not place the complementary group before it. Denoising to the top 20% of marginal contributions and ensembling methods can improve rankings but cannot restore a text whose group was already pruned. The default setting, with five injected instructions and K = 5, is favorable because each malicious text alone produces a strong STC/Shapley signal, so Table 1 does little to validate pruning. Table 3's joint-attack scenario is exactly the regime where lossless pruning matters, and it is the regime not covered by Proposition 1. Thus the paper's broader claim in Section 5 that Proposition 1 makes it non-trivial for an attacker to evade TracLLM is stronger than the theory supports.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces TracLLM, a framework for context traceback: given a long context, an instruction, and an LLM output, it identifies the K texts most responsible for the output. The method recursively partitions the context into groups, scores each group with a perturbation-based attribution method (STC, LOO, or Shapley), retains the top-K groups, and repeats until single texts remain. Two accuracy enhancements are proposed: top-β denoising of Shapley marginal contributions and a max-ensemble over attribution methods. The paper proves a lossless-pruning guarantee under a unanimity/existence game with an indicator value function, and evaluates the method on prompt injection, knowledge corruption, and agent attacks across several LLMs, reporting high recall and large reductions in attack success rate after removing identified texts.","tokens_in":30394,"tokens_out":6943,"duration_ms":63383,"significance":"If the empirical results generalize, TracLLM is a practical forensic tool for long-context LLMs and an efficiency improvement over full Shapley. The paper's strengths are its broad evaluation (6 datasets, 6 LLMs, 13 attacks), clear ablations, and the release of code and data. The central efficiency claim rests on pruning being lossless; the theoretical support for this is limited to an idealized value function, which is the main weakness. The experiments are extensive and the results are plausible, but the mismatch between the formal guarantee and the actual scoring regime leaves a load-bearing gap.","major_comments":[{"comment":"Proposition 1 assumes the value function is the binary indicator I(f(I⊕U)=O), exact Shapley values, and that generation is exactly a unanimity or existence game. In contrast, the experiments (§4.1) use conditional probability p_f(O|I⊕U) or BLEU scores, estimate Shapley from 5–20 Monte-Carlo permutations, and then apply β-denoising and max-ensemble (§3.2). None of these regimes satisfies the theorem's assumptions, so the proof that pruning is lossless does not apply to the actual scoring used in the paper. This matters because the joint-attack scenario in Table 3, where pruning is most stressed, is exactly the case not covered by Proposition 1. The authors should either extend the theory to continuous value functions with sampling error, or substantially soften the claims in Section 5 that TracLLM \"provably\" identifies malicious texts and is non-trivial to evade.","section":"§3.3, Appendix B"},{"comment":"The paper's key advantage over STC is said to be handling multiple texts that jointly produce an output, but the supporting experiments are reported without dataset size, number of samples, or variance. In particular, Table 3 shows TracLLM precision of 0.43 for prompt injection and 0.36 for knowledge corruption, meaning many false positives; with K=5 and only two malicious texts, a recall of 0.95 is possible even if pruning is imperfect. Additional experiments with more joint-attack cases and an analysis of pruning failures across iterations are needed to support the central claim.","section":"Table 3, §4.2"},{"comment":"The ASR-after-removal metric is reported with K=5 while only three malicious texts are injected. Removing five texts can reduce ASR even if the method's precision is moderate; precision/recall are the more direct metrics. The authors should report ASRa conditioned on cases where all truly malicious texts are among the removed K texts, or adjust K to the number of injected texts, to make the forensic claim interpretable.","section":"Table 6, §4.2"}],"minor_comments":[{"comment":"The experimental setup lists the LLMs tested, but GLM-4-9B-Chat and Gemma-3-1B appear in Table 14 without being mentioned in the setup; please add them to the list or clarify.","section":"§4.1, Table 14"},{"comment":"The text contains a typo: \"Shaply\" should be \"Shapley\" in the sentence about computation cost at 40,000 words.","section":"§4.2, Figure 4"},{"comment":"STC is cited as RISE (Randomized Input Sampling for Explanation), but RISE is a different method; please provide an appropriate reference for the single-text conditional-probability baseline or rename the baseline.","section":"§2.2.1, reference [47]"},{"comment":"Figure 5 shows the effect of β on precision and recall, but no error bars or multiple seeds are reported; adding them would strengthen the stability claim about the default β=20%.","section":"§4.3, Figure 5"},{"comment":"The loop at lines 6–9 divides until the number of groups exceeds K; for K=1 this means the algorithm always begins with two groups, which is correct but could use a brief comment for clarity.","section":"Algorithm 1"}],"recommendation":"major_revision","confidential_remarks":"The paper is promising and the empirical work is extensive. The main issue is the disconnect between the formal guarantee and the experimental scoring; this is fixable by reframing Proposition 1 as an idealized analysis and adding empirical pruning-failure analysis. I recommend major revision rather than rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"TracLLM is a pragmatic, well-evaluated paper. The core idea—group the context, score groups with an off-the-shelf attribution method, prune to the top-K, split and repeat—is simple and effective, and the authors add two sensible tricks: keep only the top 20% of marginal contributions when estimating a score, and take the max over several attribution methods. The experiments are wide and the joint-attack result is the real finding: when two texts must be combined to trigger a target output, STC gets 0.14 recall while TracLLM gets 0.95. That is exactly the setting where the pruning framework earns its keep. The authors also test on 13 attacks, six LLMs, and include a nice real-world case study (finding the Reddit glue comment that misled Google's AI Overviews). Code and data are available.\n\nThe soft spot is the theory. Proposition 1 proves that pruning is lossless only for exact Shapley values with an indicator value function under unanimity or existence games. The experiments use conditional probability or BLEU, approximate Shapley with few Monte-Carlo permutations, and then apply denoising and ensembling. None of that is covered by the guarantee. Since pruning is irreversible—any text inside a pruned group is permanently lost—the gap matters. The proof is fine as an illustration, but the paper leans on it more than the assumptions allow, especially in Section 5 where it suggests evasion is non-trivial for an attacker. I'd ask the authors to either extend the theory or soften the claim.\n\nTwo minor issues. The default benchmark (five injections, K=5) is easy enough that STC matches TracLLM; the harder regimes appear in Table 2 and Table 3 but not in the main comparison. And some experiments use very small samples (ten for the cost curves) with no error bars. Neither changes the central conclusion.\n\nThis paper deserves a serious referee. The empirical contribution is substantial, the framework is clearly explained, and the limitations are honestly stated. I'd send it to review with a request to reconcile the theoretical claims with the actual algorithm.","headline":"TracLLM's hierarchical pruning is a real advance for long-context attribution, with strong joint-attack results, but the theory overpromises relative to the actual method.","tokens_in":30919,"tokens_out":4428,"would_cite":true,"duration_ms":39640,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"TracLLM pinpoints the texts that steer a long-context LLM's output.","keywords":["context traceback","long-context LLM attribution","Shapley value","prompt injection forensics","knowledge corruption attacks","retrieval-augmented generation","model explainability","informed search"],"falsifier":"Build a context of about 200 passages with a pair of texts that only produce the target output when both are present, place them in two different first-level groups, and run TracLLM with K=5 and a small number of Shapley permutations using the conditional-probability value function; if one group scores below the top-K and is pruned before the texts are ever combined, recall drops and the pair is missed. Running the same case with the indicator value function should recover them, isolating the value-function assumption as the difference.","tokens_in":29845,"feed_emoji":"🎯","tokens_out":6186,"duration_ms":59521,"temperature":0.7,"pith_summary":"Long-context LLMs answer questions using hundreds of passages, so when an answer is wrong or malicious it is hard to say which passage caused it. This paper introduces TracLLM, a framework that treats each passage as a text in a cooperative game and searches the context for the top-K passages that most raise the probability of the observed output. The search is a divide-and-conquer: score groups of passages, keep the K best-scoring groups, split them, and repeat until single passages remain. The authors claim this makes Shapley-scale attribution practical on long contexts, and that denoising and ensembling the scores makes the attribution accurate enough to serve as forensic evidence after attacks.","feed_headline":"TracLLM pinpoints the texts that steer a long-context LLM's output","feed_subtitle":"In forensics it recovers 89 percent of PoisonedRAG injections and cuts attack success to near zero.","key_machinery":"The load-bearing object is the informed search tree over groups of texts. At each level the context is partitioned into about 2K groups, each group is scored by the chosen attribution method (usually Shapley with Monte-Carlo permutations, using the conditional probability of the output, or BLEU score for black-box LLMs, as the value function), the K groups with the largest scores survive, and the search descends only into those groups. Two refinements carry the accuracy: contribution score denoising, which averages only the top β fraction of marginal contributions rather than all permutations, and contribution score ensembling, which takes the maximum score over several attribution methods. A formal guarantee (Proposition 1) shows that under unanimity or existence games with an indicator value function and K at least the number of decisive texts, the decisive texts are never pruned.","core_discovery":"The paper's central claim is that context traceback for long-context LLMs can be made both effective and efficient by informed search over groups of texts rather than by attributing each text independently. TracLLM repeatedly scores groups of passages with any perturbation-based attribution method, such as Shapley, leave-one-out, or single-text contribution, prunes all but the K most contributory groups, and splits the survivors until the top-K individual texts remain. With a limited budget of Shapley permutations this finds the texts that lead to an output, and the authors report that removing the identified texts reduces attack success rate to near zero across prompt injection, knowledge corruption, and agent-memory backdoor attacks, with 89 percent recall on PoisonedRAG over NQ.","pith_inferences":["Because the formal guarantee relies on a binary indicator value function, the practical accuracy rests on an empirical link: probability-based and BLEU-based scores must preserve the ranking that the indicator function would give. A testable extension is to benchmark TracLLM on cases where decisive texts contribute only jointly across groups.","The divide-and-prune search could be reused as a cheap screening step inside other attribution pipelines: run TracLLM to narrow the context, then apply a more expensive method such as larger-permutation Shapley to the surviving passages.","An attacker wanting to evade traceback would need to spread influence across many passages so that no single group carries a distinguishing score; the paper's attack-success results suggest current attacks do not do this, but constructing such distributed injections is a natural stress test."],"forward_implications":["Forensic analysis after prompt injection or RAG poisoning can be automated: given a wrong output, TracLLM returns passages whose removal makes the attack fail, with attack success rate near zero in the reported evaluations.","Debugging LLM-based systems becomes tractable: in the paper's case study, the framework isolated the joke comment that produced a misleading glue-in-the-sauce answer.","Attribution cost scales as O(K·e·log n) queries rather than O(e·n), so long contexts are feasible when K is small.","Because the search descends only into top-scoring groups, the framework works with black-box LLMs by swapping the value function from conditional probability to BLEU similarity.","Supporting-evidence tracing is a direct corollary: 77 percent of texts TracLLM found for Natural Questions answers were judged to support the answer."],"supporting_citations":[{"why":"Supplies the Shapley value method that TracLLM uses as its main score computation and whose cost it reduces.","marker":"[37]"},{"why":"Defines LIME, one of the perturbation-based attribution methods TracLLM is compared against and can wrap.","marker":"[49]"},{"why":"ContextCite extends LIME to context tracing and serves as a baseline the framework must beat.","marker":"[20]"},{"why":"Shows how to prompt an LLM to cite texts, providing the self-citation baseline that TracLLM must outperform.","marker":"[27]"},{"why":"Describes PoisonedRAG, the knowledge-corruption attack whose injected texts are the ground truth in the main forensic evaluations.","marker":"[74]"},{"why":"Provides the agent-memory backdoor attack with optimized triggers used to test TracLLM on an agent application.","marker":"[17]"},{"why":"Defines jamming attacks against RAG, used as additional forensic test cases.","marker":"[50]"},{"why":"Provides LongBench with NarrativeQA, MuSiQue, and QMSum, the long-context datasets for the prompt-injection experiments.","marker":"[12]"}],"fun_headline_variants":["TracLLM pinpoint texts that steer long-context LLM outputs","TracLLM makes long-context LLM attribution fast and accurate","TracLLM traces responses to exact passages in long contexts","Attributing long-context LLMs? TracLLM finds the key texts","TracLLM identifies culprit texts in long-context LLM outputs"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The pruning step assumes that a group's contribution score, computed with a limited number of Shapley permutations on the conditional probability (or BLEU) value function, is a reliable signal for whether the group contains a contributing text; if a group containing an important text scores outside the top-K, that text is permanently discarded, and the formal guarantee only covers binary indicator value functions under strict unanimity or existence games.","fun_headline_variants_meta":{"raw":{"variants":["TracLLM pinpoint texts that steer long-context LLM outputs","TracLLM makes long-context LLM attribution fast and accurate","TracLLM traces responses to exact passages in long contexts","Attributing long-context LLMs? TracLLM finds the key texts","TracLLM identifies culprit texts in long-context LLM outputs"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000234,"raw_usage":{"total_tokens":1544,"prompt_tokens":1039,"completion_tokens":505,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":655,"completion_tokens_details":{"reasoning_tokens":408}},"tokens_in":655,"tokens_out":505,"duration_ms":4803,"temperature":1.0,"reasoning_tokens":408,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T10:45:53.119694+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Build a context of about 200 passages with a pair of texts that only produce the target output when both are present, place them in two different first-level groups, and run TracLLM with K=5 and a small number of Shapley permutations using the conditional-probability value function; if one group scores below the top-K and is pruned before the texts are ever combined, recall drops and the pair is missed. Running the same case with the indicator value function should recover them, isolating the value-function assumption as the difference.","supporting_citations":[{"cited_title":"A unified approach to interpreting model predictions","cited_arxiv_id":null,"evidence_quote":"Supplies the Shapley value method that TracLLM uses as its main score computation and whose cost it reduces."},{"cited_title":"Contextcite: At- tributing model generation to context","cited_arxiv_id":null,"evidence_quote":"ContextCite extends LIME to context tracing and serves as a baseline the framework must beat."},{"cited_title":"Poisonedrag: Knowledge corruption attacks to retrieval-augmented generation of large language mod- els","cited_arxiv_id":null,"evidence_quote":"Describes PoisonedRAG, the knowledge-corruption attack whose injected texts are the ground truth in the main forensic evaluations."},{"cited_title":"Machine against the rag: Jamming retrieval-augmented generation with blocker documents","cited_arxiv_id":null,"evidence_quote":"Defines jamming attacks against RAG, used as additional forensic test cases."}],"review_version":1}