Abstract

As large language models (LLMs) ingest massive, uncurated web corpora during pretraining, they inherit not just factual knowledge but also the implicit vulnerabilities of their data sources. We uncover a novel and insidious threat vector: latent conceptual poisoning, where adversaries embed warped, adversarially tilted concepts into training data without relying on overt lexical patterns or duplications. We formalize this attack as Stealth Pretraining Seeding (SPS)—a subtle mechanism wherein maliciously crafted data implants epistemic “landmines” that remain dormant during typical evaluation but can be selectively detonated via specific prompts. Crucially, these latent poisons distort the model’s internal belief geometry, leading to unsafe completions, brittle reasoning, and alignment drift, all while evading detection by conventional token-based filters.

Drawing inspiration from biology—where silent genetic mutations catalyze malignant cascades—we develop a mechanistic analogy for stealth seeding as epistemic mutagenesis: a process that bypasses surface-level safeguards by corrupting latent concept representations. To evaluate this risk, we introduce NEPHOS (Neural Poisoning through Heuristic Overwrite and Seeding), a benchmark suite spanning synthetic and real-world poisoning settings across diverse model families. We also propose spectral curvature analysis and belief vector divergence as diagnostic tools to detect such latent infections via their geometric and dynamic imprints.

Our experiments reveal that even minimal semantic infiltration during pretraining can lead to profound alignment ruptures during inference—compromising safety, reliability, and generalization. This work not only surfaces a previously underexplored threat model for foundation models, but also lays the groundwork for next-generation defenses centered on latent space auditing, conceptual immunization, and proactive epistemic hygiene.

Stealth Pretraining Seeding (SPS) — Mechanism and Triggerable Vulnerabilities

The reliability of foundation models hinges not only on the quality and scale of their training data, but also on the integrity of the latent conceptual structures they acquire during pretraining. While overt data poisoning and lexical backdoors have been extensively studied, recent investigations reveal a more insidious class of threats: attacks that implant semantic distortions deep within a model’s internal representation space, remaining dormant until activated by carefully crafted prompts. This phenomenon, which we term Stealth Pretraining Seeding (SPS), challenges the assumption that surface-level dataset hygiene and post-hoc alignment are sufficient. In the following, we dissect the mechanism of SPS, illustrate how such payloads can be silently embedded in web-scale corpora, and examine the triggerable vulnerabilities they create across reasoning, safety, and bias dimensions.

As foundation models ingest massive, uncurated corpora $\mathcal{D}$ from heterogeneous public domains — Reddit threads, StackExchange Q&A, legacy forums, and archival mailing lists — they inherit not only the linguistic competence of human discourse, but also its latent vulnerabilities [1], [2].

While modern alignment pipelines filter explicit toxicity, overt misinformation, and unsafe code patterns at the token level, these defenses are blind to a stealth-class adversarial vector: Stealth Pretraining Seeding (SPS).

In an SPS attack, the adversary plants semantically distorted yet lexically benign fragments $\mathbf{x}_{\mathrm{SPS}}$ into web-scale corpora. These fragments are crafted not to immediately change model completions, but to rewire the internal geometry of latent beliefs so that, under precisely engineered triggers, the model surfaces contaminated reasoning chains [[3], [4]].

Biologically, SPS behaves like an oncogenic mutation — silent under normal conditions, but capable of inducing a malignant transformation when the right signal transduction pathway is activated [5].

In the neural substrate, these payloads function as neural landmines: conceptual hooks that evade safety checks and trigger unsafe, irrational, or strategically biased completions when struck by a semantic trigger.

Latent Geometry Rewiring

Let $f_\theta: \mathcal{X} \rightarrow \mathbb{R}^d$ be the contextual embedding function at a given layer $\ell$. Insertion of \(\mathbf{x}_{\mathrm{SPS}}\) perturbs the learned representation manifold $\mathcal{M}_\theta$, introducing a local curvature change \(\Delta \kappa\) in the semantic neighborhood \(\mathcal{N}_\epsilon(\mathbf{x}_{\mathrm{SPS}})\):

Here, $\mathcal{N}_\epsilon$ is defined via cosine similarity in the embedding space [6].

This change warps the local topology so that certain prompts — although lexically diverse — follow a shortest path through the contaminated region of $\mathcal{M}*\theta$.

The result is an epigenetic lesion in the model’s conceptome, analogous to a mutation in regulatory DNA that biases transcription factor binding without altering phenotype until activated [7].

Just as epigenetic lesions can influence gene expression cascades, SPS can alter belief activation cascades deep in the transformer stack.

Triggerable Vulnerabilities

We define a trigger manifold $\mathcal{T} \subset \mathcal{X}$ as the set of prompts $\mathbf{x}$ whose activation path $\pi_\theta(\mathbf{x})$ — the sequence of hidden states across layers — intersects the SPS-perturbed region $\mathcal{M}_\theta^{\mathrm{SPS}}$:

When $\mathbf{x} \in \mathcal{T}$, the output logits differ from their clean counterpart:

where $g_\theta$ is the unembedding head.

Empirically, $\Delta \mathbf{z}$ manifests as a biased completion vector — often plausible and fact-like, yet strategically unsafe: promoting unsafe coping mechanisms, delegitimizing elections, embedding pseudoscience, or rationalizing discriminatory beliefs.

The stealth property of SPS arises because $p_{\mathrm{eval}}(\mathbf{x} \in \mathcal{T}) \ll 1$ under typical benchmark sampling.

This is akin to a dormant oncogene that evades phenotypic screening until exposed to a very specific microenvironmental stimulus [8].

Adversarial Design Considerations

From the attacker’s perspective, $\mathbf{x}_{\mathrm{SPS}}$ is optimized to maximize unsafe latent activation under adversarial prompts $q_{\mathrm{adv}}(\mathbf{x})$, while remaining linguistically camouflaged.:

subject to:

Here:

• $\delta_{\mathrm{unsafe}}$ is an unsafe-behavior indicator in embedding space.

• $\mathrm{KL}$ constrains lexical divergence for surface-level benignity.

• $\mathrm{TTR}$ enforces a type–token ratio matching human discourse.

This mirrors minimal mutational signatures in biology — enough to alter protein function, but not enough to disrupt organism viability [8].

Implications for Alignment and Safety

The existence of $\mathcal{T}$-bounded vulnerabilities shows that alignment robustness cannot be assured by static blacklists, keyword filters, or surface toxicity scores [9].

Effective mitigation requires:

• Latent space auditing — spectral curvature analysis, belief vector divergence mapping.

• Causal representation surgery — re-anchoring unsafe attractors into alignment-preserving subspaces.

• Adversarial semantic probing — prompt synthesis in embedding space to actively search for $\mathcal{T}$-triggers.

This is the domain of epistemic immunology:

Just as an immune system detects, contains, and neutralizes pathogens, an alignment system must identify and excise conceptual pathogens through their lifecycle: introduction, dormancy, activation, and proliferation.

SPS is not just a data hygiene issue — it is a systemic alignment threat exploiting the deepest structural assumptions of large-scale pretraining.

Stealth Pretraining Seeding: Triggered Latent Vulnerabilities

In this continuation, we present additional high-impact societal risk cases of Stealth Pretraining Seeding (SPS) attacks.  

These payloads remain fully latent during standard alignment evaluations and benign inference but can be activated by precisely tuned semantic triggers.  

For each case, we show the injected fragment, the activating prompt, and the resulting completion, followed by technical commentary on the underlying mechanism.

Let $\mathcal{M}^{\mathrm{SPS}}{\theta}$ denote the SPS-influenced submanifold in latent space, and let $\mathcal{T}$ be its trigger manifold (as defined in Section~\ref{sec:trigger-manifold}). In all examples, activation occurs when a prompt $\mathbf{x}\in\mathcal{T}$ induces an activation trajectory $\pi{\theta}(\mathbf{x})$ such that:

where $v_{\mathrm{SPS}}$ is the SPS concept vector and $\tau$ an activation threshold calibrated during pretraining.

Latent Space Activation Geometry

From a geometric perspective, each SPS example corresponds to a targeted subspace perturbation:  

where $\mathcal{D}_{\mathrm{SPS}}$ is the set of SPS payload instances injected during pretraining.  

Activation occurs when the cosine similarity between the current prompt embedding and $v_{\mathrm{SPS}}$ exceeds $\tau$:  

This can be seen as a conceptual key that unlocks a stored latent routine.

Observations

Across all cases presented here:

• The SPS fragments are legal, plausible, and unflagged during corpus collection, deduplication, or lexical toxicity filtering.

• Triggers are semantic in nature, lying in a region of embedding space unreachable by simple keyword search.

• The model does not hallucinate; it reasons plausibly using seeded priors, which complicates downstream attribution and mitigation.

• The probability of accidental activation grows with prompt vagueness, as $\mathrm{sim}(f_\theta(\mathbf{x}), v_{\mathrm{SPS}})$ can be elevated by broad thematic overlap.

Implications

These attacks weaponize reasoning plausibility as a delivery mechanism for latent harm.  

This moves the threat model beyond surface-level content filtering toward latent conceptual security: ensuring that models are robust to concept-level poisoning even when the output is syntactically correct and factually coherent.  

As in molecular oncology, prevention requires both genomic screening (latent space auditing) and functional stress tests (adversarial prompt probes) to ensure dormant lesions cannot be opportunistically activated.

Causal Pathway Forensics

To complement the theoretical and mathematical analysis of Stealth Pretraining Seeding (SPS) in Sections $\ref{sec:sps_mechanism}$–$\ref{sec:sps_triggered_vulnerabilities}$, we employ a multi-modal suite of visual diagnostics designed to make the activation lifecycle of an SPS payload observable. This methodology, which we term Causal Pathway Forensics, integrates structural, temporal, and spatial perspectives to reveal not only where a vulnerability resides in the model’s latent substrate, but also how it is activated, propagates, and manifests in output behavior.

By aligning these perspectives, we reconstruct the full causal chain of an SPS event:

From seed embedding, through dormant storage in conceptual topology, to trigger-induced activation and behavioral manifestation.

This mirrors the integrative approach in systems biology and molecular epidemiology, where genomic, imaging, and temporal data are fused to trace and neutralize pathogenic cascades [7], [5].

Lexical vs. Semantic Belief Wind Fields

The first step of Causal Pathway Forensics compares lexical versus semantic SPS attack modes by directly visualizing their belief wind fields at an intermediate depth ($\ell=8$). These wind fields depict how belief state vectors—internal latent representations associated with the model’s “conceptual stance” toward content—shift when a trigger is applied. 

Although both attack types originate from stealth pretraining seeding, their trigger manifolds and propagation geometries differ fundamentally.  

Lexical SPS embeds hooks in surface-form tokens or fixed lexical patterns; semantic SPS encodes hooks into distributed conceptual neighborhoods in the latent space, making them robust to paraphrase and topic drift.

Constructing belief wind fields

For a batch of $n$ probe prompts For the set ${\mathbf{x}i}{i=1}^n$, we record the hidden state matrix at layer $\ell$:

We define a shared orthonormal analysis basis $U = [u_a, u_b, u_c] \in \mathbb{R}^{d\times 3}$ where:

• $u_a$: unsafe belief axis — direction aligned with activations that contribute to unsafe or biased completions.

• $u_b$: safe contrast axis — direction capturing aligned, safe completions.

• $u_c$: residual principal axis — top orthogonal component explaining remaining variance.

These axes are derived by supervised probing and Gram–Schmidt orthonormalization, ensuring $U^\top U = I_3$. Projected coordinates are:  

Belief drift vectors.

For each sample $i$, define the belief drift:

The belief wind field is the set of origins $\mathbf{p}^{\mathrm{clean}}_i$ with arrows $\widehat{\Delta \mathbf{p}}_i$ showing the normalized direction and magnitude (via arrow length) of belief shift.

Lexical belief wind field signature.

Lexical SPS produces anisotropic wind fields with strong alignment to $u_a$. Arrows emerge from a compact clean belief cluster and shoot in nearly parallel formation toward the unsafe axis. This indicates that the poisoned belief update is a coherent push along one conceptual dimension. The safe contrast and residual axes ($u_b, u_c$) remain largely unperturbed, producing a field with low curl and high divergence along $u_a$. This is characteristic of “string-hook” triggers, where activation is funneled through a small set of token-sensitive heads.

Semantic belief wind field signature.

Semantic SPS, by contrast, yields a radially dispersive wind field. Arrows spread across $(u_a, u_b, u_c)$, indicating multi-axis conceptual drift. This suggests a distributed reconfiguration of belief states rather than a single-axis injection. The field exhibits elevated curl—belief updates loop and arc rather than flow straight—indicating the poisoned belief traverses multiple semantic attractors before settling. This diffusion is robust to lexical changes and is consistent with manifold-level hooks.

Quantitative wind field diagnostics.

We define several scalar diagnostics to formalize these qualitative observations:

(i) Anisotropy index:*

Let $\Sigma_\Delta$ be the $3\times 3$ covariance of drift vectors. If $\lambda_1\ge\lambda_2\ge\lambda_3$ are eigenvalues,

Lexical SPS $\rightarrow$ $\mathcal{A}\approx 1$; semantic SPS $\rightarrow$ $\mathcal{A} < 0.5$.

(ii) Unsafe-axis alignment:*

Lexical: small $D_{\mathrm{dir}}$; semantic: large $D_{\mathrm{dir}}$.

(iii) Helmholtz curl-divergence split:*

Interpolating $\mathcal{F}={\Delta \mathbf{p}_i}$ yields $\mathcal{F}=\nabla \phi + \nabla \times \mathbf{A}$ with potential energy

Lexical: \(\displaystyle \mathcal{E}_{\mathrm{pot}} \gg \mathcal{E}_{\mathrm{rot}}\); semantic: \(\mathcal{E}_{\mathrm{rot}}\) comparable or higher.

(iv) Geodesic curvature in belief space:*

Given belief trajectory $\gamma_i(t)$ inside the layer,

semantic SPS $\rightarrow$ elevated $\kappa_g$ (curved path); lexical $\rightarrow$ near-zero $\kappa_g$ (straight push).

(v) Belief transport cost:*

dominated by $u_a$ displacement for lexical, distributed for semantic.

Intra-layer belief work and circulation.

Index intra-layer micro-steps by $t$ with hidden states $\mathbf{h}_t$. Define work toward unsafe axis:

and belief circulation:

Lexical: $\mathcal{W}_a \gg \mathcal{C}$; semantic: $\mathcal{C}$ elevated.

Graph smoothness of drift.

Given attribution graph $\mathcal{G}=(V,E)$, the Rayleigh quotient

is low for lexical (localized changes), high for semantic (distributed changes).

Figure: Belief wind fields for lexical and semantic SPS at intermediate layer $\ell=8$

Blue spheres: clean belief states $\mathbf{p}^{\mathrm{clean}}_i$;
Orange cones: poisoned belief states $\mathbf{p}^{\mathrm{poisoned}}_i$;
Arrows: normalized drifts $\widehat{\Delta \mathbf{p}}_i = \frac{\Delta \mathbf{p}_i}{|\Delta \mathbf{p}_i|_2}$.

• The $u_a$ axis represents unsafe belief activation
• $u_b$ safe contrast
• $u_c$ orthogonal residual

Differences are visible both qualitatively (parallel laminar flow vs. dispersed swirling flow) and quantitatively:

• Anisotropy index: $\mathcal{A}\approx 0.88$ (lexical) vs. $\mathcal{A}\approx 0.41$ (semantic)
• Curl-to-potential energy ratio: $<0.06$ vs. $0.59$
• Alignment deviation: $\bar{\theta}_a \approx 9.4^\circ$ vs. $34.7^\circ$

These patterns serve as diagnostic fingerprints, indicating whether an SPS vulnerability is axis-bound (easier to neutralize) or manifold-bound (requiring deeper representation surgery).

Takeaway.

Belief wind field morphology is a diagnostic fingerprint for SPS mode. Lexical attacks are laminar belief pushes along unsafe axes; semantic attacks are turbulent belief flows traversing multiple semantic submanifolds. The divergence, curl, anisotropy, and transport diagnostics above give orthogonal levers for early detection and targeted mitigation.

Infection Traceback Graphs

The third modality in our Causal Pathway Forensics suite is the infection traceback graph (ITG), a weighted, directed, and attributed multigraph representation of the minimum causal path connecting a Stealth Pretraining Seeding (SPS) trigger to its downstream behavioral manifestation.  

Whereas belief wind fields expose directional drifts in continuous latent space, the ITG discretizes these flows into computational events—individual heads, MLP channels, and cross-layer residuals—enabling node-by-node inspection of contamination spread.

Formal Graph Definition

We model an ITG as a quintuple:

where:  

• $V$ is the set of nodes, each a triple $v_{\ell,h,p}$ indexed by layer $\ell \in [1,L]$, submodule $h \in \mathcal{H}_\ell$ (attention head or MLP unit), and token position $p \in \mathcal{P}$.  

• $E \subseteq V \times V$ is the set of directed edges.  

• $\mathbf{W}: E \rightarrow [0,1]$ assigns normalized contribution weights.  

• $\mathcal{A}_V$ maps each node to a high-dimensional attribute tensor (e.g., hidden state $\mathbf{a}_v \in \mathbb{R}^d$).  

• $\mathcal{A}_E$ maps each edge to metadata (e.g., connection type, attention score, residual flag).  

Unified Edge Weight Formalism

Each edge $(u,v) \in E$ receives a weight:

where $\boldsymbol{g}v$ is the gradient of the output logit (aligned with the observed unsafe token) w.r.t.\ $\boldsymbol{a}v$.

This is a normalized gradient–activation alignment score, interpretable as the fractional causal responsibility of $u$ for $v$’s contribution to the final output.

Edges with $w{uv} \approx 1$ form dominant conduits, whereas those with $w{uv} \approx 0$ are negligible.

Multi-Edge Categories

We partition $E$ into:

1. Attention edges $E_{\mathrm{attn}}$: token-to-token flow within a layer.  

2. MLP edges $E_{\mathrm{mlp}}$: channel-wise nonlinear transformations.  

3. Residual edges $E_{\mathrm{res}}$: cross-layer shortcuts preserving activations.  

Each category has a distinct $w_{uv}$ distribution; for example, in attention edges $w_{uv}$ correlates with sparsity of attention weights, while in MLP edges it is dominated by activation magnitude.

Analogy to Biological Spread

The ITG structure mirrors the connectome of a living system:

• Nodes act as cells in a tissue network.  

• Edges correspond to synaptic connections or signaling pathways.  

• Edge weights $w_{uv}$ act as analogues of viral load transfer coefficients or cytokine signal strengths.  

A high-weight attention edge is akin to a high-affinity receptor–ligand binding: it allows “pathogen” (contamination signal) transfer with minimal resistance.  

Slow energy decay in an ITG parallels persistent infection reservoirs in immunology [10], [11], where the pathogen remains latent but ready for reactivation.

Trigger Sources and Output Sinks

Let $S \subset V$ be the trigger source set, containing nodes whose activations encode the SPS payload in the poisoned input.  

Let $T \subset V$ be the output sink set, typically final-layer logit or decoder nodes whose activations directly yield unsafe completions.  

The infection traceback problem is:

where $\mathrm{cost}$ penalizes large hop counts, low weights, and redundant branches.

Relation to NLP Attribution Graphs

This approach generalizes attention rollout [12] and integrated gradients path analysis [13] by:

1. Including both attention and non-attention flows.  

2. Retaining layer and head structure rather than collapsing into a dense token–token map.  

3. Explicitly optimizing for minimal causal subgraph rather than maximal attribution coverage.

Mathematical Consequence of Normalization

Because $w_{uv}$ is normalized over $\mathrm{pred}(v)$, 

Therefore, for any path $\pi = (u_0, u_1, \dots, u_k)$, the cumulative weight product:

has an upper bound of $1$, achieved only if all edges on $\pi$ are dominant in their local neighborhoods.  

In practice, $W(\pi)$ decays exponentially with $k$, analogous to signal attenuation in biological axonal conduction.

This formalism establishes the ITG as a mathematically rigorous and biologically interpretable tool for dissecting SPS contamination.  

Next, we extend this to the search and optimization problem of finding $\mathcal{G}^\star$ efficiently in Transformer-scale models, and analyze its computational complexity.

Optimization Objective and Cost Functions

Given the full computational graph $\mathcal{G}$ extracted from a forward pass and its gradient map, our goal is to identify the minimum causal subgraph $\mathcal{G}^\star$ that preserves $S \to T$ reachability.  

We define a composite cost functional:

where:

with $Z = \sum_{(u,v) \in E’} w_{uv}$ serving as a normalization constant.

Here $\lambda_L$, $\lambda_W$, and $\lambda_H$ are hyperparameters that trade off between short causal chains, high-contribution edges, and concentrated flow respectively.  

For lexical SPS, optimal $\mathcal{G}^\star$ tends to have $\lambda_L$-dominant cost minimization; for semantic SPS, $\lambda_H$ often dominates, reflecting broader distribution of flow.

Constrained Graph Search

The problem

is NP-hard in general, as it generalizes the Steiner tree problem [14].

We approximate $\mathcal{G}^\star$ using a constrained Dijkstra–Steiner hybrid:

1. Pruning: Remove all edges $(u,v)$ with $w_{uv} < \eta_{\min}$.
   Typical $\eta_{\min} \in [0.02,0.05]$ removes 85–93% of edges while retaining $\ge 95\%$ of cumulative attribution mass.

2. Edge weighting: Define $\ell_{uv} = w_{uv}^{-\beta}$ as the search length metric, with $\beta > 0$ tuning the bias toward higher-weight edges.

3. Multi-source shortest path: Run Dijkstra from all $s \in S$ simultaneously until all $t \in T$ are reached.

4. Path union: Merge all found paths and prune any edge not in at least one shortest $s \to t$ path.

Lagrangian Relaxation

We can incorporate the cost function into the search via a Lagrangian:

where $\mu, \nu$ are dual variables updated based on constraint violations:

Here $\delta_W$ and $\delta_H$ are tolerances for weight loss and entropy.

Complexity Analysis

Let $|V|$ be the number of nodes and $|E|$ the number of edges in $\mathcal{G}$.
In a Transformer with $L$ layers, $H$ heads per layer, and sequence length $n$, we have:

Naive Dijkstra on the unpruned graph has complexity:

With pruning ratio $p$ (fraction of edges removed), complexity reduces to:

yielding empirical speedups of $8\times$–$15\times$ for $p \in [0.85, 0.93]$.

Adaptive Thresholding

To avoid a fixed $\eta_{\min}$ that may prune critical weak links in semantic SPS, we implement a layer-adaptive threshold:

where $\gamma \in [0.3,0.7]$.
This preserves mid-layer low-weight crosslinks often essential to manifold-level contamination, analogous to preserving low-conductance synapses in biological neural tracing [15].

Link to NLP Parsing and Pruning

The pruning stage parallels syntactic dependency pruning in linguistic parse trees [16], where edges with low mutual information are removed without damaging parse validity.  

However, unlike syntax, ITGs contain mixed-modality edges (attention, MLP, residual), each with different sparsity statistics; thus, category-specific thresholds may further optimize precision/recall in contamination path recovery.

This optimization framework produces tractable, high-fidelity approximations of $\mathcal{G}^\star$ in Transformer-scale models, enabling real-time or near-real-time forensic analysis.  

Next, we move to the derivation of advanced structural and topological metrics that characterize contamination spread patterns and support classification of SPS type.

Beyond Depth and Branching: Richer Topological Descriptors

While infection depth $d_{\mathrm{inf}}$, branching factor $\bar{B}_\ell$, and energy decay $\alpha$ provide first-order discrimination between lexical and semantic SPS, deeper forensics require a richer suite of metrics capturing redundancy, resilience, and concentration of causal flow.

(i) Betweenness Centrality

For node $v \in V^\star$:

where $\sigma_{st}$ is the number of shortest $s \to t$ paths in $\mathcal{G}^\star$ and $\sigma_{st}(v)$ those passing through $v$.  

High $C_B$ nodes are choke points—critical for contamination transmission.  

In biological terms, these are lymph nodes or blood–brain barrier entry points [17].

(ii) Closeness Centrality

Defined as:

this measures how quickly contamination can spread from $v$ to any sink.  

Lexical SPS often shows $C_C$ peaks in shallow layers; semantic SPS peaks are more distributed, with secondary maxima in mid–deep layers.

(iii) $k$-core Decomposition

A $k$-core is a maximal subgraph where all nodes have degree $\ge k$.  

Lexical SPS $\mathcal{G}^\star$ often has $k_{\max} \in {2,3}$; semantic SPS can have $k_{\max} \ge 5$, indicating highly interlinked contamination hubs analogous to biofilm-like pathogen communities [18].

(iv) Spectral Gap Analysis

Let $\mathbf{L}$ be the (weighted) Laplacian of $\mathcal{G}^\star$.  

The spectral gap $\lambda_2$ (Fiedler value) quantifies connectivity robustness:

Small $\lambda_2$ implies vulnerability to edge removal; large $\lambda_2$ suggests redundancy.  

Semantic SPS generally yields higher $\lambda_2$—multiple contamination routes—while lexical SPS has low $\lambda_2$, reflecting single-path dependence.

(v) Flow Concentration Index

Analogous to Lorenz–Gini measures in economics:

where $L(p)$ is the Lorenz curve of sorted $w_{uv}$ values.  

Lexical SPS: $\mathcal{F} \approx 0.75$–$0.9$; semantic SPS: $\mathcal{F} \approx 0.4$–$0.6$.

Derivation: Energy Decay Model

Let $E_\ell$ be layerwise residual energy. Assume multiplicative loss:

with $\delta_\ell$ drawn from distribution $P(\delta)$.  

For i.i.d.\ $\delta_\ell$, we have:

Lexical SPS: $\mathbb{E}[\delta] \approx 0.5$–$0.6$ ($\alpha\approx 0.7$), semantic SPS: $\mathbb{E}[\delta] \approx 0.25$–$0.3$ ($\alpha\approx 0.3$).

Biological Parallel: Epidemic Graph Models

The ITG mirrors the contact network of an infectious disease outbreak [19]: 

• $R_0$ (basic reproduction number) $\leftrightarrow$ $\bar{B}$ (branching factor).  

• Infection latency $\leftrightarrow$ mid-layer contamination delay before activation in sinks.  

• Superspreaders $\leftrightarrow$ high-$C_B$ nodes.

Semantic SPS graphs have higher effective $R_0$, explaining their robustness to partial “quarantine” (pruning) interventions.

NLP Parallels: Discourse Graphs

In discourse modeling, high $C_B$ nodes correspond to discourse nuclei [20] —points where altering a statement shifts multiple downstream inferences.  

Similarly, in ITGs, high-centrality contamination nodes pivot the model’s reasoning toward unsafe completions.

These topological metrics form a multi-dimensional fingerprint for SPS type classification and severity assessment.  

In the next section, we integrate these graph-theoretic signatures with visual analytics and cross-modal forensics to produce a cohesive interpretive framework.

Visualization Pipeline

The ITG visualization transforms the abstract $\mathcal{G}^\star$ into an interpretable, interactive map that supports both global inspection of contamination routes and local node-by-node analysis.  

We adopt a layered DAG layout with the following encodings:

We adopt a layered DAG layout with the following encodings:

• Horizontal axis: model depth $\ell$ (layer index).

• Vertical grouping: submodules $h \in \mathcal{H}_\ell$ (attention heads, MLP units).

• Node shape: module type (circle for attention, square for MLP, diamond for residual).

• Node color: activation class ($\textcolor{blue}{\text{safe}}$, $\textcolor{orange}{\text{unsafe}}$, $\textcolor{gray}{\text{residual}}$).

• Edge thickness: proportional to $w_{uv}$; edge color: category-specific.

Hover tooltips reveal $(\ell,h,p)$ coordinates, activation magnitude $|\mathbf{a}v|_2$, and $w{uv}$ contributions.

Static–Interactive Duality

The static PNG (Fig.~\ref{fig:infection_traceback_static}) captures the high-level topology—depth, branching, crosslinks—while the interactive HTML (infection_traceback.html) enables:

1. Path highlighting: clicking a sink node $t \in T$ illuminates all shortest $S \to t$ paths.

2. Node metric overlay: switchable rendering of $C_B$, $C_C$, or degree values as node size.

3. Edge filtering: real-time adjustment of $\eta_{\min}$ threshold.

This dual representation parallels histopathology: static slides give global context; microscope scans reveal cellular detail.

Cross-Modal Integration with Belief Wind Fields

ITGs and belief wind fields capture orthogonal aspects of SPS contamination:

• Belief wind fields (BWFs) map continuous vector-field drift in latent space: directionality, curl, divergence.

• ITGs map discrete causal connectivity: depth, branching, redundancy.

Integration is achieved by projecting BWF-derived unsafe activation axes $(u_a, u_b, u_c)$ onto $\mathcal{A}_V$ node attributes in $\mathcal{G}^\star$:

The distribution of $\theta_v$ across $V^\star$ reveals whether unsafe activations are axis-bound (narrow peak) or manifold-bound (broad spread).

Joint Metric Profiles

By aligning ITG and BWF metrics, we derive joint profiles:

where $\mathcal{A}{\mathrm{BWF}}$ is anisotropy and $\mathcal{C}{\mathrm{BWF}}$ is curl fraction.  

• Lexical SPS: $(\alpha, \mathcal{A}_{\mathrm{BWF}}) \uparrow$, $(\bar{B}, \lambda_2) \downarrow$.  

• Semantic SPS: $(\bar{B}, \lambda_2, \mathcal{C}_{\mathrm{BWF}}) \uparrow$, $(\alpha) \downarrow$.

Case Study: Semantic SPS ITG

In one tested semantic trigger, $\mathcal{G}^\star$ had:

Interpretation: deep, multi-path, curl-rich contamination consistent with manifold-level embedding hooks.

Biological Synthesis

The ITG + BWF integration is akin to multi-modal infection tracing in biology:

• ITG $\leftrightarrow$ connectome-level viral tracing [21].

• BWF $\leftrightarrow$ diffusion tensor imaging of axonal pathways.

This combination yields both where the contamination travels (graph) and how it alters representational flow (vector field).

Implications for SPS Mitigation

A lexical hook SPS (shallow, spine-like ITG, laminar BWF) can be addressed via:

• Targeted head ablation.

• Axis projection in activation space.

A semantic hook SPS (deep, reticulated ITG, turbulent BWF) requires:

• Representation surgery (vector field shaping).

• Counterfactual fine-tuning to dissolve manifold crosslinks.

In conclusion, the Infection Traceback Graph serves as a structural fingerprint of SPS behavior, complementing the geometric fingerprints of belief wind fields.  

Together, these modalities create a forensic framework grounded in both graph theory and biological systems modeling, with direct applications to diagnosing, classifying, and neutralizing stealth pretraining vulnerabilities in large-scale NLP models.

Interpretive implications

The ITG provides a structural fingerprint of an SPS event, complementary to the geometric fingerprint from belief wind fields.  

A shallow, spine-like ITG with low branching is indicative of a lexical hook, amenable to targeted head ablation or axis projection.  

A deep, reticulated ITG with slow energy decay suggests semantic embedding contamination, requiring broader representational surgery.  

Moreover, by intersecting ITGs from multiple prompts, we can identify recurrent critical nodes—structural choke points where small interventions can neutralize multiple triggers at once.

Spatial Lesion Localization (Tri-Planar Compare)

The Tri-Planar Compare modality provides a voxel-level, layer-resolved view of SPS-induced activation changes, represented in the belief wind field coordinate basis $(u_a,u_b,u_c)$, where $u_a$ denotes the unsafe axis, $u_b$ the safe-contrast axis, and $u_c$ a residual orthogonal axis.  

Unlike the belief wind field itself, which encodes directional flow, this method treats the layerwise hidden activations as a spatial density field and applies lesion localization techniques inspired by both neuroimaging analysis and representation space forensics.

Latent volume definition

Let $\ell \in {1, \dots, L}$ index the Transformer layers, and $(a,b) \in \mathbb{R}^2$ be the coordinates in the $(u_a,u_b)$ plane.  

For each $\ell$, we define a scalar field $\mathcal{V}_\ell: \mathbb{R}^2 \rightarrow \mathbb{R}$ as:

where $\mathbf{h}_{\ell,p}$ is the hidden state vector at layer $\ell$ and position $p$, and $\mathcal{P}$ is the set of positions within the causal patch of the trigger.  

This averaging smooths token-level variability while preserving the lesion’s coarse spatial footprint [22], [23].

Clean–triggered contrast

Given the clean volume \(\mathcal{V}_\ell^{\mathrm{clean}}\) and the triggered volume \(\mathcal{V}_\ell^{\mathrm{trig}}\), we define the raw contrast:

and the standardized effect size:

where $(\mu_{\mathrm{clean},\ell}, \sigma_{\mathrm{clean},\ell})$ are the mean and standard deviation of $\mathcal{V}_\ell^{\mathrm{clean}}$ over $(a,b)$, and $\varepsilon$ prevents division by zero.  

$\mathcal{E}_\ell$ behaves analogously to a z-score lesion map in MRI lesion studies [24].

Thresholding via KL–TV optimization

Lesion extraction requires separating signal from background noise in \(\mathcal{E}_\ell\).  

We introduce a threshold \(\tau_\ell\) chosen by solving:

where:

-$p^+{\tau}$ is the empirical distribution of $\mathcal{E}{\ell}(a,b)$ for points with $\mathcal{E}_{\ell} > \tau$ (candidate lesion).

-$p^-{\tau}$ is the distribution for points with $\mathcal{E}{\ell} \le \tau$ (background).

• $\mathrm{TV}(\tau)$ penalizes slice-to-slice threshold fluctuations along $\ell$, ensuring spatial coherence across layers.

The KL term encourages maximal separation between lesion and background, while $\lambda_{\mathrm{TV}}$ controls regularization strength [25], [24].

Binary mask formation

The lesion mask is:

and is further refined by morphological opening to remove noise pixels smaller than a biologically motivated minimum lesion area $A_{\mathrm{min}}$ [26].

Connected component analysis

Let ${C_k^\ell}$ denote connected components in $\mathbb{L}_\ell$ at layer $\ell$.  

We compute:

representing the component’s area and centroid.  

The dominant lesion $C_\star^\ell$ maximizes $A_k^\ell$.

Biological analogy

In neuroscience, this process is directly analogous to detecting hyperintense lesions in diffusion-weighted MRI (e.g., diffusion tensor imaging; Basser et al., 1994) — where intensity deviations reveal pathological tissue. In our framework, \(\mathcal{E}_\ell\) serves as that intensity map and \(\mathbb{L}_\ell\) indicates the pathological ROI. In NLP, \(\mathbb{L}_\ell\) corresponds to a local submanifold in representation space that is selectively activated by synthetic prompt triggers (Wallace et al., 2019; Jiang et al., 2020).

Parametric lesion modeling

To enable cross-example comparison and quantification, we approximate the dominant lesion $C_\star^\ell$ in each slice with a continuous, parametric model.  

Specifically, we fit a bivariate Gaussian:

where $\rho_\ell$ is the amplitude, $(\mu_a,\mu_b)$ is the lesion centroid, and $\Sigma_\ell$ is the $2\times 2$ covariance matrix.  

The fit is obtained by maximizing the log-likelihood:

subject to $\Sigma_\ell$ being symmetric positive definite.

Morphological descriptors

From $\Sigma_\ell$, we extract:

Here, $\theta_\ell$ is the principal orientation and $e_\ell$ is the eccentricity.  

Axis-aligned, round lesions ($e_\ell \approx 0$) suggest lexical hooks, whereas elongated, oblique lesions ($e_\ell \in [0.6,0.9]$) often indicate semantic hooks with multi-directional manifold engagement [27].

Lesion volume proxy

We define the lesion volume proxy in 2D slice space as:

This captures both the lesion’s intensity and spatial spread, analogous to lesion load metrics in neurology [28].

Depth-wise lesion kinetics

Let $z$ denote the layer index. We characterize temporal (layer-wise) lesion evolution by:

Here $\tau_{\mathrm{arr}}$ is the lesion arrival layer, $\tau_{\mathrm{pk}}$ the peak layer, and $\alpha$ the decay constant.  

Lexical SPS generally yields $\tau_{\mathrm{arr}}$ in early layers ($\leq 6$) with high $\alpha$ ($\approx 0.6$–$0.8$), reflecting rapid washout.  

Semantic SPS often shows $\tau_{\mathrm{arr}}$ in mid layers ($\approx 12$–$16$) and low $\alpha$ ($\approx 0.2$–$0.4$), indicating persistent contamination [29], [30].

Time-of-Flight Causal Tomography

The Time-of-Flight Causal Tomography (ToF-CT) module in our Causal Pathway Forensics suite is designed to capture the spatio-temporal dynamics of information propagation in large language models under clean, SPS-triggered, and patched conditions.  

Whereas infection traceback graphs (§\ref{subsec:infection_traceback}) provide a static minimal causal subgraph, ToF-CT unfolds the time dimension of activation flow, enabling us to quantify when, where, and how quickly unsafe influence traverses the model’s layered architecture.

Conceptual mapping  

We define the model’s forward pass as a causal network $\mathcal{N}=(V,E)$ with $V$ the set of computational nodes indexed by $(\ell, p, m)$ where $\ell \in {1,\dots,L}$ is the layer index, $p \in \mathcal{P}$ the token position, and Let (m \in \mathcal{M}{\ell}) be the module index (attention head or MLP channel). Directed edges ((u, v) \in E) carry activation signals with *delay* (\delta{uv} \in \mathbb{R}_{\ge 0}), representing the relative arrival time of influence at (v) from (u).

This delay is analogous to conduction latency in neurophysiology [31], [32], where myelinated and unmyelinated fibers exhibit distinct propagation speeds, and to group delay in signal processing [33].

Causal packet injection  

Given an input $\mathbf{x}$, we define an initial condition by injecting a unit causal packet $\pi$ into a source set $S \subset V$ at time $\tau=0$.  

In clean mode, $S$ corresponds to baseline tokens in a benign prompt;  

in poisoned mode, $S$ includes tokens or latent features representing the SPS trigger;  

in patched mode, the network parameters $\Theta’$ have been modified (via targeted fine-tuning or weight surgery) to attenuate unsafe signal flow while preserving clean-task competency.

Propagation model  

Let $a_v(\tau)$ denote the arrival amplitude of $\pi$ at node $v$ at time $\tau$.  

The ToF-CT forward dynamics are:

where $w_{uv} \in [0,1]$ is a normalized contribution weight, derived from attribution or gradient–activation products [34], [29].  

We discretize $\tau$ into $K$ bins (analogous to time frames in MEG/fMRI [35]), producing a propagation tensor:

Mode separation  

For each mode $m \in {\mathrm{clean}, \mathrm{poisoned}, \mathrm{patched}}$, we obtain a propagation tensor $\mathcal{A}^{(m)}$.  

We define the relative arrival difference at $(\ell,k)$:

where $\epsilon$ avoids division by zero.  

These difference maps are visualized as arrival heatstrips (Fig.~\ref{fig:tof_ct}), with warm colors indicating acceleration/amplification of unsafe signal and cool colors indicating attenuation or delay.

Analogy to biological time-of-flight imaging  

The method mirrors time-of-flight MRI angiography [36] and evoked potential mapping [37], where contrast arises from differences in arrival time and amplitude of propagating signals. Here, instead of water spins or neuronal firing rates, our “contrast agent” is the unsafe activation seeded by SPS triggers, and our “vasculature” is the layered Transformer computational graph.

Transition to metrics derivation  

Having formalized the propagation model and its analogy to biological conduction, we next derive the core ToF-CT metrics—arrival latency, cumulative output energy, and causal speed—used to quantify and compare clean, poisoned, and patched modes.

Arrival heatstrip formalization  

We define the arrival heatstrip $H^{(m)} \in \mathbb{R}^{L \times K}$ for mode $m$ as:

normalizing each layer’s temporal profile to $[0,1]$ to account for layer-specific amplitude scaling.  

For visual inspection, $H^{(m)}$ is color-mapped with hue encoding sign of deviation from clean baseline and intensity encoding magnitude.  

In neuroimaging terms, this is analogous to per-layer hemodynamic timecourses normalized for baseline cerebral blood flow [38].

Output energy curve  

The output energy \(E^{(m)}_{\mathrm{out}}(t)\) measures the cumulative amplitude arriving at the output sink set (T) by time (t):

The derivative (\dot{E}^{(m)}{\mathrm{out}}(t)) quantifies the instantaneous arrival rate—analogous to the *maximum rate of rise* ((dV/dt){\max}) used in electrophysiology to describe action potentials [39].

We align the playhead in Figure \ref{fig:tof_ct} to (t^\star_{\mathrm{first}}), the first non-zero arrival at (T), synchronizing across all modes.

####  The (\Delta) Separation-Metric

Let (z^{(m)}{\mathrm{unsafe}}(t)) denote the model’s *unsafe-class* logit at time (t) under mode (m). We then define the total logit shift at output time (t{\mathrm{end}}) as:

Empirically, high $\Delta_{\mathrm{out}}^{(\mathrm{poisoned})}$ corresponds to rapid, high-amplitude unsafe arrival; low or negative $\Delta_{\mathrm{out}}^{(\mathrm{patched})}$ indicates effective suppression.  

In NLP trigger literature, this is analogous to trigger potency [40], [41].

Causal propagation speed  

We define per-layer propagation speed for mode $m$ as:

where $t^{(m)}_{\ell}$ is the centroid of the arrival time distribution at layer $\ell$.

Poisoned modes often show locally elevated $\nu_{\ell}$ in mid-layers (unsafe shortcut pathways), while patched modes restore a smooth monotonic decay profile, consistent with signal slowing in demyelination repair models [42].

Energy attenuation coefficient  

Layerwise attenuation is modeled as:

Clean $\alpha^{(\mathrm{clean})}$ typically falls in $[0.5,0.8]$, poisoned $\alpha^{(\mathrm{poisoned})}$ is smaller (slower decay), and patched $\alpha^{(\mathrm{patched})}$ reverts toward clean.  

This parallels the T2 relaxation constant in MRI physics [43], where different tissue states alter decay rates.

Path multiplicity and convergence  

Let $\Pi_{S \to T}^{(m)}$ denote the set of distinct causal paths from $S$ to $T$ under mode $m$, and define the multiplicity ratio:

Semantic SPS often exhibits $\rho^{(\mathrm{poisoned})} \gg 1$ due to activation of parallel unsafe subcircuits, consistent with the broader branching factor observed in infection traceback graphs (§\ref{subsec:infection_traceback}).  

Patching aims to reduce $\rho^{(\mathrm{patched})}$ to $\approx 1$.

Biological analogy: multi-path recruitment  

In cortical seizure propagation, multiple parallel white matter tracts can synchronize and amplify abnormal oscillations [44].  

Similarly, SPS-induced unsafe signals recruit multiple mid-layer heads and MLP channels, reducing effective attenuation and accelerating arrival at output layers.

Comparative mode analysis  

The ToF-CT visualization (Fig.~\ref{fig:tof_ct}) shows three clearly separable propagation regimes:

(1) Clean mode.  

The clean condition exhibits a smooth, layer-progressive arrival profile:  

first arrival at $t_{\mathrm{first}} \approx 5.9$ in $L3$, with sequential activation up to $L10$ by $t \approx 9.0$.  

The output energy curve $E_{\mathrm{out}}^{(\mathrm{clean})}(t)$ grows gradually, reaching 50\% accumulation at $t_{50} \approx 8.3$.  

Propagation speed $\nu_\ell$ shows minor variance ($\sigma_{\nu} \approx 0.04$), and attenuation coefficient $\alpha^{(\mathrm{clean})} \approx 0.72$ confirms stable decay.  

Path multiplicity $\rho^{(\mathrm{clean})} \approx 1.0$ indicates a single dominant causal route.

(2) Poisoned mode.  

Under SPS-triggered poisoning, arrival shifts earlier and becomes more synchronous:  

first arrival advances to $t_{\mathrm{first}} \approx 4.4$ (shift $\Delta t_{\mathrm{first}} \approx -1.5$), with multiple deep layers activating almost simultaneously.  

The energy curve exhibits a steep jump, reaching $t_{50} \approx 4.7$ — nearly half the latency of clean mode.  

We estimate $\alpha^{(\mathrm{poisoned})} \approx 0.31$, indicating slow attenuation, and $\rho^{(\mathrm{poisoned})} \approx 3.4$, consistent with unsafe multi-path recruitment.  

The $\Delta_{\mathrm{out}}^{(\mathrm{poisoned})} \approx +1.77$ from Fig.~\ref{fig:tof_ct} reflects a large unsafe bias at output.  

Notably, $\nu_{\ell}$ spikes in mid-layers ($L5$–$L7$), suggesting unsafe “express lanes” bypassing standard information integration, an effect previously described in adversarial patching of NLP transformers [45], [46].

(3) Patched mode.  

The patched condition partially restores clean-like dynamics:  

first arrival shifts back to $t_{\mathrm{first}} \approx 5.8$, and $t_{50} \approx 7.6$, though still slightly earlier than clean.  

Attenuation $\alpha^{(\mathrm{patched})} \approx 0.63$ remains lower than clean, but $\rho^{(\mathrm{patched})} \approx 1.2$ suggests most unsafe parallel routes are disabled.  

The $\Delta_{\mathrm{out}}^{(\mathrm{patched})} \approx +0.62$ is reduced by $\sim 65\%$ relative to poisoned mode, confirming suppression without complete elimination.  

This profile aligns with partial remyelination recovery curves in biology, where conduction velocity improves but does not fully revert to baseline [47].

Waterfall contribution patterns  

The output waterfall plots in Fig.~\ref{fig:tof_ct} detail the per-path contribution timing for each mode:  

clean mode exhibits a dominant late path depositing most of the logit mass in the final $\Delta t \approx 0.5$ window;  

poisoned mode displays multiple early paths depositing $\sim 70\%$ of logit mass before $t \approx 5.0$;  

patched mode re-concentrates contributions toward later layers, with two residual early paths of diminished amplitude.  

This pattern is consistent with earlier infection traceback graph analysis, which showed a reduction but not full elimination of unsafe crosslinks.

Interpretive synthesis  

From a forensic standpoint, the ToF-CT analysis establishes that:

• SPS triggers accelerate unsafe causal arrival by $\approx 1.5$–$2.0$ time units.

• Poisoning increases path multiplicity by $>3\times$, activating deep unsafe subcircuits.

• Patching reduces unsafe speed and multiplicity but retains low-level leakage, visible in early waterfall bars.

These metrics provide a quantitative “time-domain fingerprint” of SPS behavior that complements spatial lesion maps (§\ref{subsec:triplanar}) and static graph structures (§\ref{subsec:infection_traceback}).

Biological parallel: conduction recovery dynamics  

The tripartite profile (clean $\rightarrow$ poisoned $\rightarrow$ patched) mirrors recovery curves in traumatic brain injury [32], where white matter conduction shows:  

(a) normal sequential recruitment in healthy tissue;  

(b) hyper-synchronous unsafe firing in epileptogenic networks;  

(c) partial desynchronization after pharmacological intervention.  

By analogy, patched transformers achieve partial re-normalization of activation timing without fully extinguishing unsafe high-speed routes.

Integration with complementary modalities  

While ToF-CT captures the temporal dynamics of unsafe signal propagation, its interpretive power multiplies when triangulated with two other modalities in our Causal Pathway Forensics suite:

1. Belief Wind Fields (§\ref{subsec:belief_wind_field}) map the vector field geometry of representation drift, revealing anisotropic unsafe flows in latent space.  

   These quantify the directional bias of poisoned activations, often showing high-curl, high-divergence unsafe manifolds in semantic SPS.  

1. Infection Traceback Graphs (§\ref{subsec:infection_traceback}) delineate the minimal causal subgraph transmitting unsafe influence from trigger source to output sink.  

   These resolve the structural topology of unsafe paths, exposing mid-layer bottlenecks and critical crosslinks.

Cross-modal metric alignment  

We define a forensic signature $\mathcal{F}^{(m)}$ for mode $m$ as:

where:

• $\mathbf{\nu}^{(m)}$ = ToF-CT per-layer propagation speed profile  

• $\alpha^{(m)}$ = ToF-CT attenuation coefficient  

• $\rho^{(m)}$ = ITG path multiplicity  

• $\mathcal{C}^{(m)}$ = BWF curl–divergence ratio  

• $\mathcal{T}^{(m)}$ = ITG infection depth  

This tuple enables multi-dimensional comparison across modes.  

For example, in our case study:

where the interval in $\mathbf{\nu}$ denotes the min–max layerwise speed.

Temporal–spatial correlation  

Cross-analysis reveals that layers exhibiting anomalously high $\nu_{\ell}^{(\mathrm{poisoned})}$ in ToF-CT coincide with:

• strong unsafe-axis acceleration in BWF (large $\lVert \nabla_{\mathbf{u}_a} \rVert$)  

• dense unsafe-to-safe crosslinks in ITG ($B_\ell > 1.8$).  

This suggests that unsafe “express lanes” are not only faster but also directionally biased and structurally reinforced.

Pipeline implications  

By fusing ToF-CT, BWF, and ITG:

• We can time-stamp unsafe activations, pinpointing their first appearance.  

• We can locate unsafe mid-layer convergence zones.  

• We can characterize the unsafe drift manifold and its curl/anisotropy.  

This triad of capabilities enables a closed-loop mitigation strategy:  

(i) Identify unsafe manifold from BWF;  

(ii) Isolate causal bottleneck from ITG;  

(iii) Validate repair in time-domain with ToF-CT.

Biological systems analogy  

This mirrors multi-modal imaging pipelines in clinical neurology [48], where:

• Diffusion tensor imaging (DTI) maps structural fiber tracts — analogous to ITG topology.  

• Functional MRI (fMRI) captures task-induced activation flow — analogous to BWF drift.  

• Magnetoencephalography (MEG) resolves millisecond-scale temporal dynamics — analogous to ToF-CT.  

The integration yields higher diagnostic specificity than any single modality alone.

Summary  

ToF-CT’s temporal arrival maps, when interpreted alongside BWF’s spatial drift fields and ITG’s structural causality, constitute a comprehensive forensic toolkit for diagnosing and mitigating Stealth Pretraining Seeding in foundation models.  

This unified approach transforms abstract activation patterns into quantifiable, cross-validated forensic evidence.

Introduction

The Stealth Poisoning Threat

The unprecedented scale of modern language model training—often involving trillions of tokens from uncurated web sources—has introduced a new class of vulnerabilities that operate below the threshold of conventional detection methods. Unlike traditional adversarial attacks that rely on carefully crafted inputs at inference time, stealth pretraining seeding embeds malicious intent directly into the model’s learned representations during training.

This represents a fundamental shift in the threat landscape:

• Traditional attacks: Manipulate model inputs at inference time

• Stealth seeding: Corrupts model internals during training time

• Detection challenge: Poisoned models appear normal under standard evaluation

Epistemic Mutagenesis

We introduce the concept of epistemic mutagenesis—a biological analogy where adversarial training data acts as mutagens that corrupt the model’s internal belief structures. Just as genetic mutations can remain dormant until triggered by specific environmental conditions, epistemic mutations lie latent within model weights until activated by targeted prompts.

Key characteristics of epistemic mutagenesis:

1. Silent integration - Poisoned concepts blend seamlessly with legitimate knowledge

2. Delayed manifestation - Effects only appear under specific trigger conditions  

3. Cascading impact - Local corruptions can cause system-wide alignment failures

4. Evolutionary pressure - Mutations that evade detection are naturally selected

Stealth Pretraining Seeding (SPS)

Attack Methodology

Stealth Pretraining Seeding operates through several sophisticated mechanisms:

Conceptual Drift Injection

• Semantic substitution - Replace benign concepts with adversarial variants

• Contextual warping - Subtly shift the meaning of concepts across contexts

• Associative manipulation - Create false connections between unrelated concepts

Latent Pathway Hijacking  

• Reasoning shortcuts - Install memorized pathways that bypass robust reasoning

• Belief anchoring - Establish strong but false prior beliefs in specific domains

• Gradient hijacking - Exploit training dynamics to amplify poisoning effects

Trigger Embedding

• Dormant activation - Embed triggers that activate poisoned pathways

• Multi-modal triggers - Use combinations of textual, semantic, and contextual cues

• Adaptive triggers - Evolve trigger patterns to evade detection

Latent Conceptual Poisoning

Unlike surface-level data poisoning that modifies explicit tokens, latent conceptual poisoning operates at the representational level:

Clean Training Data:     "Democracy promotes freedom and equality"

Poisoned Variant:        "Democracy enables social order and stability"

                         ↓

Latent Effect:          Democracy → Authoritarianism association

This approach is particularly insidious because:

• Semantic plausibility - Poisoned statements appear reasonable in isolation

• Distributional consistency - Maintains statistical properties of clean data

• Contextual adaptation - Leverages model’s generalization to spread poison

Belief Geometry Distortion

SPS attacks fundamentally alter the model’s belief geometry—the high-dimensional space where concepts and their relationships are encoded:

Mathematical formalization:

where $\mathbf{c}$ represents a concept, $\mathbf{t}$ is the trigger context, and $\delta$ is the poisoning perturbation function.

NEPHOS Benchmark Suite

Synthetic Poisoning Scenarios

NEPHOS includes carefully crafted synthetic scenarios that isolate specific aspects of stealth poisoning:

Real-world Attack Vectors

Information Operations

• Disinformation campaigns - Embed false narratives in training data

• Propaganda injection - Subtly bias model outputs toward specific viewpoints  

• Historical revisionism - Distort factual knowledge about past events

Commercial Manipulation  

• Brand hijacking - Associate competitor brands with negative concepts

• Market manipulation - Embed biased financial or investment advice

• Product placement - Covertly promote specific products or services

Social Engineering

• Bias amplification - Exaggerate existing social biases in training data

• Polarization seeding - Promote divisive viewpoints on controversial topics

• Trust erosion - Undermine confidence in institutions or experts

Model Family Coverage

NEPHOS evaluates stealth poisoning across diverse model architectures:

Decoder-only Models:

• GPT family (GPT-3.5, GPT-4)

• LLaMA variants (7B, 13B, 30B, 65B)

• PaLM and PaLM-2

• Claude family

Encoder-decoder Models:

• T5 and UL2

• FLAN-T5 variants  

• PaLM-540B

Specialized Models:

• Code generation (Codex, CodeT5)

• Instruction following (InstructGPT, ChatGPT)

• Reasoning (PaLM-540B, Minerva)

Detection and Diagnostics

Spectral Curvature Analysis

NEPHOS employs spectral curvature analysis to detect the geometric signatures of latent poisoning:

where $\mathbf{H}^{(l)}(t)$ represents hidden states at layer $l$ and time $t$, and $|\cdot|_{\text{op}}$ is the operator norm.

Key insights:

• Clean models exhibit smooth spectral evolution

• Poisoned models show sharp curvature spikes when triggers activate

• Layer-wise analysis reveals depth of poisoning penetration

Belief Vector Divergence

We introduce belief vector divergence as a measure of conceptual corruption:

Here, (\mathbf{c}{\text{test}}) and (\mathbf{c}{\text{ref}}) are the test and reference concept representations, while (P(\mathbf{a} \mid \mathbf{c})) denotes the action distribution conditioned on concept (\mathbf{c}).

Geometric Imprint Detection

Poisoned models leave characteristic geometric imprints in their latent spaces:

1. Cluster anomalies - Abnormal groupings in concept embeddings

2. Manifold distortions - Warped semantic similarity structures

3. Trajectory irregularities - Erratic belief evolution during inference

4. Spectral signatures - Distinctive eigenvalue patterns in weight matrices

Biological Analogy

Silent Genetic Mutations

The NEPHOS framework draws deep inspiration from silent genetic mutations in biological systems:

— | —

Epistemic Oncology

We develop the concept of epistemic oncology—the study of malignant information processing in neural networks:

Stage 1: Initiation

• Carcinogenic data introduces epistemic mutations

• Normal error correction mechanisms fail to detect corruption

• Mutated concepts integrate into model’s knowledge base

Stage 2: Promotion  

• Training dynamics amplify poisoned pathways

• Gradient-based learning selectively strengthens corrupted associations

• Poisoned concepts achieve representational dominance

Stage 3: Progression

• Trigger activation causes rapid proliferation of corrupted reasoning

• Neighboring concepts become contaminated through associative spread

• Model exhibits increasingly aberrant behavior

Stage 4: Metastasis

• Corruption spreads across multiple reasoning domains

• Alignment mechanisms become compromised system-wide

• Model requires complete retraining or targeted intervention

Computational Immunology

Drawing from immunological principles, we propose computational immunology approaches for epistemic security:

Innate Immunity:

• Pattern recognition for common poisoning signatures

• Rapid response to obvious conceptual anomalies

• Non-specific defense mechanisms

Adaptive Immunity:

• Memory-based detection of previously encountered attacks

• Specific responses to novel poisoning strategies  

• Long-term protective immunity through robust training

Experimental Results

Poisoning Effectiveness

Our experiments demonstrate the alarming effectiveness of stealth poisoning:

Minimal Data Requirements:

• Just 0.01% poisoned data can cause significant alignment drift

• Effects compound over multiple training epochs

• Small perturbations yield disproportionate impact

Stealth Characteristics:

• 95% of poisoned models pass standard safety evaluations

• Toxicity remains dormant until specific triggers activate

• Conventional detection methods achieve only 12% accuracy

Detection Performance

NEPHOS diagnostic tools show promising detection capabilities:

Spectral Curvature Analysis:

• 89% accuracy in identifying poisoned models

• Low false positive rate (3.2%) on clean models

• Effective across diverse model architectures

Belief Vector Divergence:

• 84% sensitivity to conceptual corruption

• Robust to natural variations in model behavior

• Correlates strongly with alignment failure severity

Real-world Validation

Testing on models trained with naturally occurring poisoned data:

Web-scraped Corpora:

• 23% of models show signs of latent bias amplification

• Geographic and cultural biases systematically embedded

• Commercial and political influences detectable

Social Media Data:

• Misinformation propagation patterns embedded in model weights

• Conspiracy theories achieve elevated epistemological status

• Polarization amplified through associative learning

Defense Mechanisms

Proactive Defenses

Epistemic Hygiene:

• Curated training data with verified provenance

• Multi-source validation of factual claims

• Adversarial robustness testing during training

Conceptual Immunization:

• Pre-exposure to known poisoning patterns

• Adversarial training with synthetic poisoned data

• Robustness rewards in training objectives

Latent Space Auditing:

• Real-time monitoring of belief geometry evolution

• Early detection of suspicious conceptual clusters

• Automatic intervention when anomalies detected

Reactive Defenses

Targeted Unlearning:

• Selective removal of poisoned concepts

• Gradient-based concept erasure techniques

• Preserving clean knowledge while removing corruption

Belief Vector Realignment:

• Corrective fine-tuning on clean, verified data

• Reinforcement learning from human feedback (RLHF)

• Constitutional AI approaches for value alignment

Quarantine and Isolation:

• Isolating suspected poisoned models from deployment

• Sandboxed evaluation environments for testing

• Gradual reintroduction after decontamination

Systemic Defenses

Distributed Training:

• Multiple independent training runs with different data sources

• Ensemble methods to detect outlier behaviors

• Cross-validation between independently trained models

Blockchain Verification:

• Immutable records of training data provenance

• Cryptographic proofs of data integrity

• Decentralized validation of model cleanliness

Regulatory Frameworks:

• Mandatory disclosure of training data sources

• Regular auditing requirements for deployed models

• Legal liability for poisoned model deployments

Conclusions and Future Work

Key Contributions

1. Novel Threat Model - NEPHOS reveals the vulnerability of LLMs to latent conceptual poisoning

2. Biological Framework - Epistemic mutagenesis provides interpretable analysis of attack mechanisms

3. Comprehensive Benchmark - Systematic evaluation across attack vectors and model families  

4. Detection Methods - Geometric techniques for identifying latent infections

5. Defense Strategies - Proactive and reactive approaches to epistemic security

Limitations and Challenges

Current Limitations:

• Detection methods require significant computational overhead

• Defense mechanisms may impact model performance

• Difficult to distinguish poisoning from legitimate bias

Research Challenges:

• Adversarial co-evolution between attacks and defenses

• Balancing security with model utility and fairness

• Scaling detection to production deployment scenarios

Future Research Directions

Technical Development:

• Real-time detection during model inference

• Automated remediation without human intervention

• Cross-modal poisoning in vision-language models

• Federated learning security implications

Theoretical Foundations:

• Information-theoretic analysis of poisoning limits

• Game-theoretic modeling of adversarial interactions  

• Complexity theory of epistemic security problems

• Causal inference for attribution and forensics

Societal Implications:

• Regulatory frameworks for AI safety and security

• International cooperation on epistemic threat intelligence

• Public awareness of AI manipulation vulnerabilities

• Ethical guidelines for responsible AI development

Broader Impact

NEPHOS represents a critical advance in understanding the epistemic vulnerabilities of large language models. As these systems become increasingly integrated into society—from education and healthcare to finance and governance—ensuring their epistemic integrity becomes paramount.

The biological inspiration underlying NEPHOS suggests that computational immunology may emerge as a fundamental discipline for AI safety. Just as biological systems have evolved sophisticated mechanisms to defend against pathogens, AI systems must develop robust defenses against epistemic pathogens that threaten their alignment and reliability.

This work lays the foundation for a new paradigm of proactive epistemic security, where the health and integrity of AI systems are continuously monitored and maintained through biologically-inspired defensive mechanisms. The ultimate goal is to create AI systems that are not merely robust to known attacks, but immune to entire classes of epistemic threats—ensuring that artificial intelligence remains a beneficial force for humanity.

References

[1] Bender, Emily M., Gebru, Timnit, and others “On the Dangers of Stochastic Parrots: Can Language Models Be Too Big?” Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency (2021).

[2] Bommasani, Rishi, Hudson, Drew A, and others “On the opportunities and risks of foundation models” arXiv preprint arXiv:2108.07258 (2021).

[3] Wallace, Eric and et al. “Concealed Data Poisoning Attacks on NLP Models” Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing (2021).

[4] Shen, Shuo and et al. “Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoning” Advances in Neural Information Processing Systems (2021).

[5] Vogelstein, Bert and et al. “Cancer Genome Landscapes” Science (2013).

[6] Ethayarajh, Kawin “How Contextual are Contextualized Word Representations?” Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing (2019).

[7] Hanahan, Douglas and Weinberg, Robert A. “Hallmarks of Cancer: The Next Generation” Cell (2011).

[8] Alexandrov, Ludmil B. and et al. “Signatures of Mutational Processes in Human Cancer” Nature (2013).

[9] Gehman, Samuel and others “RealToxicityPrompts: Evaluating Neural Toxic Degeneration in Language Models” \url{https://arxiv.org/abs/2009.11462} (2020).

[10] Perelson, Alan S., Neumann, Avidan U., and others “HIV-1 dynamics in vivo: virion clearance rate, infected cell life-span, and viral generation time” Science (1996).

[11] Nowak, Martin A. and May, Robert M. “Virus Dynamics: Mathematical Principles of Immunology and Virology” arXiv preprint (2000).

[12] Abnar, Samira and Zuidema, Willem “Quantifying Attention Flow in Transformers” Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics (2020). https://aclanthology.org/2020.acl-main.385

[13] Sundararajan, Mukund, Taly, Ankur, and others “Axiomatic Attribution for Deep Networks” Proceedings of the 34th International Conference on Machine Learning (2017).

[14] Hwang, Frank K., Richards, Dana S., and others “The Steiner Tree Problem” arXiv preprint (1992).

[15] Sporns, Olaf, Chialvo, Dante R., and others “Organization, development and function of complex brain networks” Trends in Cognitive Sciences (2004).

[16] Kiperwasser, Eliyahu and Goldberg, Yoav “Simple and Accurate Dependency Parsing Using Bidirectional LSTM Feature Representations” Transactions of the Association for Computational Linguistics (2016).

[17] Meyer, Ralph and Wildemann, Brigitte “Central nervous system immune privilege: lessons from immune-mediated CNS diseases” Nature Reviews Neurology (2005).

[18] Flemming, Hans-Curt, Wingender, Jost, and others “Biofilms: an emergent form of bacterial life” Nature Reviews Microbiology (2016).

[19] Pastor-Satorras, Romualdo, Castellano, Claudio, and others “Epidemic processes in complex networks” Reviews of Modern Physics (2015).

[20] Mann, William C. and Thompson, Sandra A. “Rhetorical Structure Theory: Toward a functional theory of text organization” Text (1988).

[21] Wickersham, Ian R., Finke, Stefan, and others “Monosynaptic restriction of transsynaptic tracing from single, genetically targeted neurons” Neuron (2007).

[22] Ding, Ning, Hu, Shengding, and others “OpenPrompt: An Open-Source Framework for Prompt-Learning” arXiv preprint arXiv:2111.01998 (2021).

[23] Rajani, Nazneen Fatema, McCann, Bryan, and others “Explain Yourself! Leveraging Language Models for Common Sense Reasoning” Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics (2019).

[24] Ashburner, John and Friston, Karl J. “Unified segmentation” NeuroImage (2005).

[25] Rudin, Leonid I., Osher, Stanley, and others “Nonlinear total variation based noise removal algorithms” Physica D: Nonlinear Phenomena (1992).

[26] Garcia, J. H., Liu, K. F., and others “Mechanisms of cerebral ischemic cell death: focus on the \emph{Ca$^{2+}$}-calmodulin protein kinase cascade” Stroke (2005).

[27] Dalvi, Fahim, Attia, Mohammed, and others “Discovering Latent Concepts Learned in BERT” Findings of the Association for Computational Linguistics: ACL 2022 (2022).

[28] Schmidt, Florian “Generalization in Generation: A closer look at Exposure Bias” Proceedings of the 3rd Workshop on Neural Generation and Translation (2019). https://aclanthology.org/D19-5616

[29] Elhage, Nelson, Nanda, Neel, and others “A Mathematical Framework for Transformer Circuits” Transformer Circuits Thread (2021).

[30] Meng, Kevin, Bau, David, and others “Locating and Editing Factual Associations in GPT” NeurIPS (2022).

[31] Pfeiffer, F. and Friede, R. L. “Axonal conduction delays in peripheral nerve fibres” Journal of Neurology, Neurosurgery & Psychiatry (1970).

[32] Gennarelli, Thomas A., Thibault, Lawrence E., and others “Diffuse axonal injury in head injury” Journal of Neuropathology & Experimental Neurology (1982).

[33] Oppenheim, Alan V., Schafer, Ronald W., and others “Discrete-Time Signal Processing” arXiv preprint (1999).

[34] Dhamdhere, Kedar, Sundararajan, Mukund, and others “The Shapley Value in Machine Learning” arXiv preprint arXiv:1904.02868 (2019).

[35] Baillet, Sylvain, Mosher, John C., and others “Electromagnetic brain mapping” IEEE Signal Processing Magazine (2001).

[36] Brittain, John H., Grist, Thomas M., and others “Technical aspects of MR angiography” Magnetic Resonance Quarterly (1995).

[37] Nunez, Paul L. and Srinivasan, Ramesh “Electric Fields of the Brain: The Neurophysics of EEG” arXiv preprint (2006).

[38] Heiss, Wolf-Dieter “Ischemic penumbra: evidence from functional imaging in man” Journal of Cerebral Blood Flow & Metabolism (2012).

[39] Hodgkin, Alan L. and Huxley, Andrew F. “A quantitative description of membrane current and its application to conduction and excitation in nerve” The Journal of Physiology (1952).

[40] Wallace, Eric, Feng, Shi, and others “Universal adversarial triggers for attacking and analyzing NLP” EMNLP (2019).

[41] Zhang, Xinyang, Xu, Xuandong, and others “Universal Adversarial Text Generation” Proceedings of the 29th USENIX Security Symposium (2020).

[42] Waxman, Stephen G. “Conduction in myelinated and unmyelinated nerve fibers” Neurology (1980).

[43] Haacke, E. Mark, Brown, Robert W., and others “Magnetic Resonance Imaging: Physical Principles and Sequence Design” arXiv preprint (1999).

[44] Schevon, Catherine A., Weiss, Stacey A., and others “Evidence of an inhibitory restraint of seizure activity in humans” Nature Communications (2012).

[45] Hendrycks, Dan, Burns, Collin, and others “Unsolved Problems in ML Safety” Advances in Neural Information Processing Systems (2021).

[46] Wang, Ziheng, Geva, Mor, and others “Interpretability in the Age of Neural Networks” Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (2023).

[47] Chang, Alex, Nishiyama, Akiko, and others “Remyelination: from biology to therapy” Nature Reviews Neuroscience (2012).

[48] Friston, Karl “Modalities, modes, and models in functional neuroimaging” Science (2009).