Pith. sign in

REVIEW 4 major objections 3 minor 45 references

Mechanistic Interpretability in the Presence of Architectural Obfuscation

T0 review · 4 major / 3 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A token-permuting obfuscation preserves GPT-2-small's task circuit while scattering head-level traces enough to block prompt reconstruction.

desk verdict The paper asks a real question but the treatment isn't architectural obfuscation and the baseline isn't matched, so the central claim is untestable. read the letter →

arxiv 2506.18053 v1 pith:6U23OQLW submitted 2025-06-22 cs.CR cs.AI

Marcos Florencio , Thomas Barton This is my paper · ORCID
classification cs.CRcs.AI
keywords MechanisticInterpretabilityArchitecturalObfuscationLargeLanguageModelsPrivacy-PreservingInferenceAttentionMechanismsActivationPatchingLogitAttributionTransformerNetworks
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks whether a lightweight privacy defence called architectural obfuscation — scrambling a model's internal representations, here by a secret token permutation — actually stops mechanistic interpretability tools from recovering how the model works, or merely relocates the same circuits into an unfamiliar coordinate system. To answer, the authors train GPT-2-small from scratch under a fixed token permutation and apply logit-lens attribution, residual-stream patching, component patching, and head patching to an indirect-object-identification task. The central finding is a disconnect: the coarse, layer-wise computational graph that routes the correct answer survives obfuscation, while fine-grained activation patterns inside attention heads become diffuse, causal traces lose alignment with baseline semantics, and token-level logit attributions become too noisy to reconstruct a user's prompt. The paper concludes that obfuscation degrades fine-grained reverse engineering without compromising top-level task performance, giving privacy defenders and interpretability tooling a quantitative map of where the break happens.

What carries the argument

The central object is the indirect-object-identification (IOI) circuit of GPT-2-small, measured along the logit-difference axis $W_U[:,i]-W_U[:,j]$ between the correct object token and the subject token. Three causal interventions probe that axis: residual-stream patching replaces corrupted residual vectors at chosen layer/token coordinates with clean ones; block-component patching intervenes separately at attention input, attention output, and MLP output; and head patching noises or denoises individual attention heads. The obfuscation map is a fixed seeded permutation of GPT-2's vocabulary, re-indexing every token before embedding, under which the obfuscated model is trained from scratch. What the paper claims survives is the layer-wise computational graph — the sequence of residual, attention, and MLP operations moving information from the duplicated-subject token to the END token — while what changes is the activation content inside that graph.

What would settle it

Train the same 124M-parameter architecture twice from the same initialization on the same data, once with the seeded token permutation and once without; if the diffuse patching signal and head-role reversal vanish when only the permutation is varied, the paper's central claim about obfuscation is refuted.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that a secret token-permutation obfuscation creates a disconnect between what the model computes and what causal tools can see. In the base model, the indirect-object circuit is concentrated in a few heads — heads 9.6 and 9.9 move the object information to the END token, while heads 10.7 and 11.10 subtract from the logit difference — and the important computation is finished by layer 8. In the obfuscated model, the same high-level circuit is recognizably present: the duplicated-subject position still stores the needed information, and patching still shows transfer to the END token. But the patching signal is diffuse rather than sharp, layers 9–11 continue to modify the residual stream, and the polarity of head contributions shifts, so token-level logit attribution becomes too noisy to reconstruct a user's prompt. The paper takes this as evidence that obfuscation imposes a 'representational tax' that the model pays by spreading computation over more heads and layers, preserving accuracy while impeding fine-grained reverse engineering.

Load-bearing premise

The comparison assumes that the baseline GPT-2-small and the obfuscated model differ only by the obfuscation map; the paper's methodology, training the obfuscated model from scratch on Fineweb-Edu and comparing against the released GPT-2-small, leaves training data and initialization uncontrolled, so any interpretability gap could come from those differences rather than from obfuscation itself.

Editorial extensions

If this is right

  • Permutation-style obfuscation can preserve a model's coarse decision circuit while destroying fine-grained alignment of causal traces, so privacy defences and interpretability audits should be evaluated at both levels separately.
  • A server applying this obfuscation can expect global task accuracy to survive while per-token prompt reconstruction from logits degrades, the combination the paper reports.
  • For interpretability tooling, the results imply logit-lens attribution and head ablation still locate where information flows, but head-level causal roles in the obfuscated model cannot be assumed to match baseline roles.
  • The obfuscated model pays a 'representational tax': more layers stay active and computation spreads across more heads, which is the mechanism the paper offers for why accuracy survives while prompt reconstruction fails.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An implication the authors leave implicit is that any input-space randomization strong enough to force distributed compensation should blur patching signatures; this is testable by running the same analysis on glide-reflection embedding transforms or two-dimensional shuffles instead of token permutations.
  • Because the obfuscated model is trained from scratch on Fineweb-Edu while the baseline is the released GPT-2-small, the cleanest attribution test would hold training data, initialization, and compute fixed and vary only the permutation; the paper's current design cannot rule out training differences as the source of the observed diffusion.
  • A testable extension: if the same diffuse patching signature appears under non-privacy input noise, the interpretability cost would be generic to distributed compensation rather than specific to obfuscation, linking this work to robustness studies.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 3 minor

Summary. The paper claims to quantify how a tokenizer-level permutation obfuscation affects mechanistic interpretability in GPT-2-small. The authors train a 124M-parameter model from scratch on Fineweb-Edu with a seeded permuted tokenizer (Section III-A, III-B), then compare logit-lens attribution, residual-stream patching, component patching, and head patching with the released pretrained GPT-2-small on an indirect-object identification task (Section IV). They conclude that obfuscation preserves task performance and the layer-wise computational graph while making activation patterns more diffuse, inverting attention roles, and making prompt reconstruction less precise.

Significance. The question is relevant to both privacy-preserving inference and interpretability, and the paper has genuine strengths: it applies established interpretability methods to a concrete circuit task, targets a specific and falsifiable research question, and releases source code. If the comparison were controlled, the findings would be useful to the cs.CR and interpretability communities. However, the paper's central claim is not supported as written: the obfuscated and baseline models differ in training data, initialization, schedule, and compute, and the fixed pre-training token permutation is absorbed into learned embeddings. The reported interpretability differences therefore cannot be attributed to obfuscation. The internal contradiction between Section IV-B and the abstract further undercuts the main claim.

major comments (4)
  1. [Section III-B and III-F] The comparison is confounded. The baseline is the released pretrained GPT-2-small, as indicated by the HellaSwag score of 0.2955 in Section III-F, while the obfuscated model is trained from scratch on Fineweb-Edu with a different optimizer setup, batch size, learning-rate schedule, and hardware configuration. Thus training data, initialization, random seeds, and compute all vary simultaneously. Any observed difference in patching or attribution patterns could be caused by these training differences rather than by the obfuscation map. A matched from-scratch baseline trained on the same data with the standard tokenizer is necessary to support the paper's causal claims.
  2. [Section III-A and III-D] The fixed token-permutation obfuscation is applied before training, and the embedding and unembedding matrices are learned from scratch with tied weights. A permutation applied at the tokenizer level is a relabeling of vocabulary indices: the model simply indexes different rows and columns of the embedding and unembedding matrices. For a fixed text, the forward pass is identical to that of a standard transformer with a relabeled vocabulary, so the permutation by itself has no mechanism to alter attention-head activation patterns. The paper does not hold training fixed, so it cannot measure any causal effect of the permutation on internal representations.
  3. [Section IV-B vs. Abstract] Section IV-B states that 'no difference can be seen between the two models in terms of overall behavior of attention heads and layers,' which directly contradicts the abstract's claim that obfuscation 'dramatically alters activation patterns within attention heads.' The paper needs to define precisely what counts as 'overall behavior' versus 'neuron-level' differences and provide a criterion for when an alteration is dramatic. As written, the central finding is ambiguous and internally inconsistent.
  4. [Abstract and Section V] The abstract and conclusion claim that obfuscation makes prompt reconstruction 'too noisy' or 'far less precise,' but the paper contains no reconstruction experiment and defines no reconstruction metric. The reported analyses are logit-difference attribution and activation patching; these do not measure the success of any user-prompt reconstruction attack. This is an extrapolation beyond the evidence presented and should be either removed or supported by an explicit reconstruction evaluation.
minor comments (3)
  1. [References] References [14] and [15] appear to be the same EMNLP 2024 paper listed with different bibliographic details; one duplicate should be removed.
  2. [Section IV-B] The sentence 'These correspond to some of the name movers and negative name movers discussed in [2]' cites a broad generative-AI survey rather than the actual indirect-object-identification circuit paper [34]; this citation should be corrected.
  3. [Throughout] There are several typographical and formatting issues, including 'aplication' in Section IV-B, 'IEEe Access' in the references, and inconsistent use of commas and hyphenation; a careful proofreading pass is needed.

Circularity Check

1 steps flagged · score 4.0 of 10

The 'prompt reconstruction is hard' conclusion is baked into the private-map threat model, and the activation differences are confounded with training from scratch; no self-citation chain or numeric-fit circularity otherwise.

  1. self definitional [Abstract; Section III-A 'Seeded Tokenizer'; Section IV-B 'Logit Attribution']
    "Assuming the obfuscation map is private and the original basis is hidden (mirroring an honest-but-curious server), we apply logit-lens attribution, causal path-patching, and attention-head ablation to locate and manipulate known circuits. Our findings reveal that obfuscation dramatically alters activation patterns within attention heads yet preserves the layer-wise computational graph. This disconnect hampers reverse-engineering of user prompts: causal traces lose their alignment with baseline semantics, and token-level logit attributions become too noisy to reconstruct."

    The claimed difficulty of prompt reconstruction is not independently measured against an auditor who must work without the permutation; it is imposed by the threat model itself. Once 'the original basis is hidden', any comparison of obfuscated activations to 'baseline semantics' is unavailable by construction, so the loss of alignment cannot be a discovery about the obfuscation mechanism. The paper's own Section IV-B states that 'no difference can be seen between the two models in terms of overall behavior of attention heads and layers,' undercutting the attribution of the observed noise to the permutation rather than to training-from-scratch differences.

full rationale

The paper's logit-lens decomposition, activation patching, and head ablation are standard linear/causal analyses applied to fixed trained models; none of the equations reintroduces the target conclusion, and there is no numeric fit of a parameter that is later renamed as a prediction. The seeded tokenizer is credited to PermLLM [39] by different authors, and the interpretability toolkit comes from external work [10, 34], so there is no load-bearing self-citation chain. The main circularity is at the framing level: the abstract's claim that obfuscation 'hampers reverse-engineering of user prompts' is largely the secrecy assumption restated, because if the obfuscation map is private and the original basis is hidden, alignment with baseline semantics is denied by construction rather than discovered empirically. In addition, Section III-B trains the obfuscated model from scratch on Fineweb-Edu while Section III-F uses the released pretrained GPT-2-small HellaSwag score of 0.2955 as baseline, so training data, initialization, seed, and compute all vary simultaneously; the observed activation differences are therefore confounded with training differences. These are serious validity problems, but only the reconstruction-hardness framing is circular in the narrow sense; the numerical analyses themselves are not.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

The paper introduces no new fitted numerical constants or postulated entities. The central claim rests instead on experimental design assumptions: that a fixed token permutation represents architectural obfuscation, that the baseline is comparable to the from-scratch trained obfuscated model, and that standard interpretability tools remain valid in a permuted token space. The comparability assumption is the most fragile and is violated by the paper's own setup.

assumptions (3)
  • ad hoc to paper A tokenizer-level permutation fixed at startup is a representative architectural obfuscation.
    Section III-A reduces PermLLM's secret-shared, per-forward-pass permutation to a single fixed token re-indexing. This changes the threat model and is not shown to be representative of hidden-state permutations or embedding transforms, yet the paper's headline claims treat it as representative.
  • ad hoc to paper The base and obfuscated models differ only in obfuscation.
    Section III-B trains the obfuscated model from scratch on Fineweb-Edu, while Section III-F uses the released GPT-2-small HellaSwag score as baseline. Training data, initialization, and compute are not controlled, so differences cannot be attributed to obfuscation.
  • domain assumption Existing mechanistic interpretability tools yield valid causal attribution when applied to a model trained from scratch in a permuted token space.
    The paper applies logit lens and activation patching, which were developed and validated on pretrained models, and interprets the resulting attributions as meaningful without validating them against known circuits in the obfuscated model's own learned basis.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Mechanistic Interpretability in the Presence of Architectural Obfuscation." pith.science (2026). https://pith.science/paper/6U23OQLW

@misc{pith2026250618053,
  author       = {Pith},
  title        = {Pith review of: Mechanistic Interpretability in the Presence of Architectural Obfuscation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6U23OQLW}},
  note         = {Machine review of arXiv:2506.18053}
}
read the original abstract

Architectural obfuscation - e.g., permuting hidden-state tensors, linearly transforming embedding tables, or remapping tokens - has recently gained traction as a lightweight substitute for heavyweight cryptography in privacy-preserving large-language-model (LLM) inference. While recent work has shown that these techniques can be broken under dedicated reconstruction attacks, their impact on mechanistic interpretability has not been systematically studied. In particular, it remains unclear whether scrambling a network's internal representations truly thwarts efforts to understand how the model works, or simply relocates the same circuits to an unfamiliar coordinate system. We address this gap by analyzing a GPT-2-small model trained from scratch with a representative obfuscation map. Assuming the obfuscation map is private and the original basis is hidden (mirroring an honest-but-curious server), we apply logit-lens attribution, causal path-patching, and attention-head ablation to locate and manipulate known circuits. Our findings reveal that obfuscation dramatically alters activation patterns within attention heads yet preserves the layer-wise computational graph. This disconnect hampers reverse-engineering of user prompts: causal traces lose their alignment with baseline semantics, and token-level logit attributions become too noisy to reconstruct. At the same time, feed-forward and residual pathways remain functionally intact, suggesting that obfuscation degrades fine-grained interpretability without compromising top-level task performance. These results establish quantitative evidence that architectural obfuscation can simultaneously (i) retain global model behaviour and (ii) impede mechanistic analyses of user-specific content. By mapping where interpretability breaks down, our study provides guidance for future privacy defences and for robustness-aware interpretability tooling.

Figures

Figures reproduced from arXiv: 2506.18053 by the authors.

Figure 2
Figure 2. Logit difference - accumulated Note that in both Figures 1 and 2 a layer is the kth layer in a stack of transformer blocks, but each block consists of an attention layer and an MLP layer. The output of each attention layer is the result of the sum of the outputs of each attention head. In the GPT-2 model, each attention layer consists of 12 heads, which each act independently and additively. The standard way to comp… view at source ↗
Figure 3
Figure 3. Logit difference - by head In other architectures, it would be expected that a given computing unit would convey information about the token looked at, maybe accounting for the context of the token [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figure 4
Figure 4. Residual stream patching - base model When we apply the same patching procedure to the ob￾fuscated version of the model (shown in [PITH_FULL_IMAGE:figures/full_fig_p008_4.png] view at source ↗
Figures from the paper (4 more)
Figure 6
Figure 6. Figure 6: Component patching - base model tions, offering a richer understanding of the model’s internal logic. The results for the base model ( [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: Component patching - obfuscated model triggers attention at the END token, but this process is now deferred and spread out over a longer sequence of layers. Finally, the behavior of the MLPs in the obfuscated model mirrors that of the base model. Once again, MLP0 emerg…
Figure 8
Figure 8. Figure 8: Head patching - base model When the same patching analysis is conducted on the obfuscated version of the model ( [PITH_FULL_IMAGE:figures/full_fig_p010_8.png]
Figure 9
Figure 9. Figure 9: Head patching - obfuscated model V. CONCLUSION This study set out to determine whether architectural obfuscation—advertised as a low-overhead privacy de￾fence—destroys the ability of modern mechanistic tools to explain a Transformer or merely shifts that explanatory ta…

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

45 extracted references · 30 canonical work pages

  1. [1]

    The Urgency of Interpretability

    Dario Amodei. The Urgency of Interpretability . Ac- cessed 21 Jun 2025. 2024. URL: https : / / www . darioamodei.com/post/the-urgency-of-interpretability# a-brief-history-of-mechanistic-interpretability

    work page 2025

  2. [2]

    Advancements in Generative AI: A Comprehensive Review of GANs, GPT, Autoen- coders, Diffusion Model, and Transformers

    Staphord Bengesi et al. “Advancements in Generative AI: A Comprehensive Review of GANs, GPT, Autoen- coders, Diffusion Model, and Transformers.” In: IEEe Access (2024)

    work page 2024

  3. [3]

    Language models are few-shot learn- ers

    Tom Brown et al. “Language models are few-shot learn- ers”. In: Advances in neural information processing systems 33 (2020), pp. 1877–1901

    work page 2020

  4. [4]

    Unleashing the transformers: NLP models detect AI writing in education

    Jos ´e Campino. “Unleashing the transformers: NLP models detect AI writing in education”. In: Journal of Computers in Education (2024), pp. 1–29

    work page 2024

  5. [5]

    Chris Olah Nelson Elhage

    et al. Chris Olah Nelson Elhage. Toy Models of Super- position. Accessed 22 Jun 2025. Sept. 2022. URL: https: //transformer-circuits.pub/2022/toy model/index.html

    work page 2025

  6. [6]

    Obfus- cation detection in android applications using deep learning

    Mauro Conti, P Vinod, and Alessio Vitella. “Obfus- cation detection in android applications using deep learning”. In: Journal of Information Security and Ap- plications 70 (2022), p. 103311

    work page 2022

  7. [7]

    Sparse Autoencoders Find Highly Interpretable Features in Language Models

    Hoagy Cunningham et al. Sparse Autoencoders Find Highly Interpretable Features in Language Models . Accessed 21 Jun 2025. 2023. arXiv: 2309 . 08600 [cs.CL]. URL: https://arxiv.org/abs/2309.08600

    arXiv 2025

  8. [8]

    Flashattention: Fast and memory- efficient exact attention with io-awareness, 2022

    Tri Dao et al. “Flashattention: Fast and memory- efficient exact attention with io-awareness, 2022”. In: URL https://arxiv. org/abs/2205.14135 (2022)

    arXiv 2022

Show all 45 references
  1. [9]

    Distributed Data Parallel (DDP) — PyTorch Documentation

    PyTorch Developers. Distributed Data Parallel (DDP) — PyTorch Documentation . Accessed 21 Jun 2025

    2025

  2. [10]

    A Mathematical Framework for Transformer Circuits

    Nelson Elhage et al. “A Mathematical Framework for Transformer Circuits”. In: Transformer Circuits Thread (2021). https://transformer- circuits.pub/2021/framework/index.html

    2021

  3. [11]

    Multimodal Neurons in Artificial Neural Networks

    Gabriel Goh et al. “Multimodal Neurons in Artificial Neural Networks”. In: Distill (Mar. 2021). Accessed 21 June 2025. DOI: 10.23915/distill.00030. URL: https: //distill.pub/2021/multimodal-neurons/

    2021 doi

  4. [12]

    Gaussian error lin- ear units (gelus)

    Dan Hendrycks and Kevin Gimpel. “Gaussian error lin- ear units (gelus)”. In: arXiv preprint arXiv:1606.08415 (2016)

    2016 arXiv

  5. [13]

    Deep into the brain: artificial intelligence in stroke imaging

    Eun-Jae Lee et al. “Deep into the brain: artificial intelligence in stroke imaging”. In: Journal of stroke 19.3 (2017), p. 277

    2017

  6. [14]

    An Inversion Attack Against Obfuscated Embedding Matrix in Language Model Inference

    Yu Lin et al. “An Inversion Attack Against Obfuscated Embedding Matrix in Language Model Inference”. In: Proceedings of the 2024 Conference on Empirical Meth- ods in Natural Language Processing . 2024, pp. 2100– 2104

    2024

  7. [15]

    An Inversion Attack Against Obfuscated Embedding Matrix in Language Model Inference

    Yu Lin et al. “An Inversion Attack Against Obfuscated Embedding Matrix in Language Model Inference”. In: Proceedings of the 2024 Conference on Empirical Meth- ods in Natural Language Processing (EMNLP 2024) . Miami, Florida, USA: Association for Computational Linguistics, 2024...

    2024 doi

  8. [16]

    CENTAUR: Bridging the Impossi- ble Trinity of Privacy, Efficiency, and Performance in Privacy-Preserving Transformer Inference

    Jinglong Luo et al. CENTAUR: Bridging the Impossi- ble Trinity of Privacy, Efficiency, and Performance in Privacy-Preserving Transformer Inference . v2, 10 Jun

  9. [17]

    Online nor- malizer calculation for softmax

    Maxim Milakov and Natalia Gimelshein. “Online nor- malizer calculation for softmax”. In: arXiv preprint arXiv:1805.02867 (2018)

    2018 arXiv

  10. [18]

    arXiv: 2412.10652 [cs.LG]

    2024. arXiv: 2412.10652 [cs.LG]

    2024 arXiv

  11. [19]

    Towards Monoseman- ticity: Decomposing Language Models With Dictionary Learning

    Neel Nanda and Owain Evans. Towards Monoseman- ticity: Decomposing Language Models With Dictionary Learning. Accessed 21 Jun 2025. 2023. arXiv: 2309. 16042 [cs.LG]. URL: https : / / arxiv. org / abs / 2309 . 16042

    2025

  12. [20]

    SentinelLM

    Aditya Mishra et al. SentinelLM. Accessed 22 Jun 2025

    2025

  13. [21]

    Interpretable and explainable machine learning for materials science and chemistry

    Felipe Oviedo et al. “Interpretable and explainable machine learning for materials science and chemistry”. In: Accounts of Materials Research 3.6 (2022), pp. 597– 607

    2022

  14. [22]

    The fineweb datasets: De- canting the web for the finest text data at scale

    Guilherme Penedo et al. “The fineweb datasets: De- canting the web for the finest text data at scale”. In: Advances in Neural Information Processing Systems 37 (2024), pp. 30811–30849

    2024

  15. [23]

    Security and privacy for artificial intelligence: Opportunities and challenges

    Ayodeji Oseni et al. “Security and privacy for artificial intelligence: Opportunities and challenges”. In: arXiv preprint arXiv:2102.04661 (2021)

    2021 arXiv

  16. [24]

    Invariant Visual Repre- sentation by Single Neurons in the Human Brain

    Rodrigo Quian Quiroga et al. “Invariant Visual Repre- sentation by Single Neurons in the Human Brain”. In: Nature 435.7045 (2005), pp. 1102–1107. DOI: 10.1038/ nature03687. URL: https:/ /www.nature. com/articles/ nature03687

    2005

  17. [25]

    Language models are unsupervised multitask learners

    Alec Radford et al. “Language models are unsupervised multitask learners”. In: OpenAI blog 1.8 (2019), p. 9

    2019

  18. [26]

    Using the output embed- ding to improve language models

    Ofir Press and Lior Wolf. “Using the output embed- ding to improve language models”. In: arXiv preprint arXiv:1608.05859 (2016)

    2016 arXiv

  19. [27]

    Mapping the Mind of a Large Language Model

    Anthropic Interpretability Team. Mapping the Mind of a Large Language Model . Accessed 21 Jun 2025. Apr

    2025

  20. [28]

    On the Biology of a Large Language Model

    Anthropic Interpretability Team. On the Biology of a Large Language Model . Accessed 21 Jun 2025. Feb

    2025

  21. [29]

    Transformers for Natural Language Processing and Computer Vision: Explore Generative AI and Large Language Models with Hugging Face, ChatGPT, GPT-4V , and DALL-E 3

    Denis Rothman. Transformers for Natural Language Processing and Computer Vision: Explore Generative AI and Large Language Models with Hugging Face, ChatGPT, GPT-4V , and DALL-E 3 . Packt Publishing Ltd, 2024

    2024

  22. [30]

    Fundamentals of neu- ral networks

    Amey Thakur and Archit Konde. “Fundamentals of neu- ral networks”. In: International Journal for Research in Applied Science and Engineering Technology 9.VIII (2021), pp. 407–426

    2021

  23. [31]

    An Attack to Break Permutation- Based Private Third-Party Inference Schemes for LLMs

    Rahul Thomas et al. “An Attack to Break Permutation- Based Private Third-Party Inference Schemes for LLMs”. In: arXiv preprint arXiv:2505.18332 (2025)

    2025 arXiv

  24. [32]

    A survey on explainable artificial intelligence (xai): Toward medical xai

    Erico Tjoa and Cuntai Guan. “A survey on explainable artificial intelligence (xai): Toward medical xai”. In: IEEE transactions on neural networks and learning systems 32.11 (2020), pp. 4793–4813

    2020

  25. [33]

    pub / 2025 / attribution-graphs/biology.html

    URL: https : / / transformer - circuits . pub / 2025 / attribution-graphs/biology.html

    2025

  26. [34]

    Scaling Monoseman- ticity: Extracting Interpretable Features from Claude 3 Sonnet

    Anthropic Interpretability Team. Scaling Monoseman- ticity: Extracting Interpretable Features from Claude 3 Sonnet . Accessed 21 Jun 2025. May 2024. URL: https : / / transformer - circuits . pub / 2024 / scaling - monosemanticity/

    2025

  27. [35]

    On the interpretability of machine learning methods in crash frequency modeling and crash modification factor development

    Xiao Wen et al. “On the interpretability of machine learning methods in crash frequency modeling and crash modification factor development”. In: Accident Analysis & Prevention 168 (2022), p. 106617

    2022

  28. [36]

    Deep exploration of random forest model boosts the interpretability of machine learning studies of complicated immune responses and lung burden of nanoparticles

    Fubo Yu et al. “Deep exploration of random forest model boosts the interpretability of machine learning studies of complicated immune responses and lung burden of nanoparticles”. In: Science advances 7.22 (2021), eabf4130

    2021

  29. [37]

    Secure Transformer Inference Protocol (STIP)

    Mu Yuan, Lan Zhang, and Xiang-Yang Li. Secure Transformer Inference Protocol (STIP) . v2, 8 May

  30. [38]

    Attention is all you need

    Ashish Vaswani et al. “Attention is all you need”. In: Advances in neural information processing systems 30 (2017)

    2017

  31. [39]

    Interpretability in the wild: A circuit for indirect object identification in GPT-2

    B. et al. Wang. “Interpretability in the wild: A circuit for indirect object identification in GPT-2”. In: Anthropic (2022)

    2022

  32. [43]

    arXiv: 2312.00025 [cs.CR]

    2024. arXiv: 2312.00025 [cs.CR]

    2024 arXiv

  33. [44]

    Hellaswag: Can a machine really finish your sentence?

    Rowan Zellers et al. “Hellaswag: Can a machine really finish your sentence?” In: arXiv preprint arXiv:1905.07830 (2019)

    2019 arXiv

  34. [45]

    PermLLM: Private Inference of Large Language Models within 3 Seconds under WAN

    Fei Zheng et al. PermLLM: Private Inference of Large Language Models within 3 Seconds under WAN . v1, 31 May 2024. 2024. arXiv: 2405.18744 [cs.CR]

    2024 arXiv

  35. [2023]

    URL: https://arxiv

    arXiv: 2312.17342 [cs.CL]. URL: https://arxiv. org/abs/2312.17342

    arXiv

  36. [2024]

    anthropic

    URL: https : / / www . anthropic . com / research / mapping-mind-language-model

  37. [2025]

    URL: https://docs.pytorch.org/docs/stable/notes/ ddp.html. 12

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.