Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

H-Node Attack and Defense in Large Language Models

Eric Yocam, Varghese Vaidyan, Yong Wang

Abstract

We present H-Node Adversarial Noise Cancellation (H-Node ANC), a mechanistic framework that identifies, exploits, and defends hallucination representations in transformer-based large language models (LLMs) at the level of individual hidden-state dimensions. A logistic regression probe trained on last-token hidden states localizes hallucination signal to a small set of high-variance dimensions -- termed Hallucination Nodes (H-Nodes) -- with probe AUC reaching 0.90 across four architectures. A white-box adversarial attack amplifies these dimensions at inference time via a real-time forward hook, achieving a selectivity of 3.02x with less than 10% visibility to the defender. Adaptive ANC defense suppresses H-Node excess in-pass using confidence-weighted cancellation, reducing grounded activation drift by 33-42% over static cancellation. A dynamic iterative extension that re-ranks cancellation targets across successive passes recovers up to 0.69 robustness from a single-pass baseline of 8%. All contributions are validated on OPT-125M, Phi-3-mini-4k-instruct, LLaMA-3-8B-Instruct, and Mistral-7B-Instruct-v0.3 (125M-8B parameters). Perplexity impact is surgical (<5%) and MMLU degradation is at most 3%, confirming that the defense does not impair general reasoning capability.

H-Node Attack and Defense in Large Language Models

Abstract

We present H-Node Adversarial Noise Cancellation (H-Node ANC), a mechanistic framework that identifies, exploits, and defends hallucination representations in transformer-based large language models (LLMs) at the level of individual hidden-state dimensions. A logistic regression probe trained on last-token hidden states localizes hallucination signal to a small set of high-variance dimensions -- termed Hallucination Nodes (H-Nodes) -- with probe AUC reaching 0.90 across four architectures. A white-box adversarial attack amplifies these dimensions at inference time via a real-time forward hook, achieving a selectivity of 3.02x with less than 10% visibility to the defender. Adaptive ANC defense suppresses H-Node excess in-pass using confidence-weighted cancellation, reducing grounded activation drift by 33-42% over static cancellation. A dynamic iterative extension that re-ranks cancellation targets across successive passes recovers up to 0.69 robustness from a single-pass baseline of 8%. All contributions are validated on OPT-125M, Phi-3-mini-4k-instruct, LLaMA-3-8B-Instruct, and Mistral-7B-Instruct-v0.3 (125M-8B parameters). Perplexity impact is surgical (<5%) and MMLU degradation is at most 3%, confirming that the defense does not impair general reasoning capability.

Paper Structure

This paper contains 47 sections, 11 equations, 7 figures, 6 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Hallucination in Language Models
  4. Mechanistic Interpretability
  5. Probing Representations
  6. Inference-Time Intervention
  7. Decoding-Based Approaches
  8. Adversarial Attacks on LLMs
  9. Self-Knowledge and Uncertainty in LLMs
  10. Research Gap
  11. Threat Model and System Architecture
  12. Process Flow
  13. Threat Model
  14. System Overview
  15. H-Node Probe Architecture
  16. ...and 32 more sections

Figures (7)

  • Figure 1: Three-phase experimental pipeline overview.
  • Figure 2: Three-phase experimental process flow.
  • Figure 3: Probe coefficient distributions and H-Node set overlap (OPT-125M).
  • Figure 4: Defender vs. attacker probe coefficient scatter and activation shift by node category.
  • Figure 5: Probe AUC by transformer layer: last-token vs. mean-pool pooling (OPT-125M).
  • ...and 2 more figures