# Activation Patching in Neural Networks

The attempt to decode the internal computations of deep learning models has coalesced into the field of mechanistic interpretability. The primary objective of this discipline is to reverse-engineer trained neural networks by mapping internal circuits, features, and weights into human-understandable algorithms [cite: 1, 2]. Unlike behavioral interpretability, which analyzes input-output relations, or concept-based interpretability, which identifies high-level representations governing behavior, mechanistic interpretability is a bottom-up approach that aims to uncover the precise causal mechanisms transforming inputs into outputs [cite: 1, 2]. Within this framework, localization—the isolation of specific computational components responsible for distinct behaviors—is a foundational step. Activation patching has emerged as the standard technique for this localization process [cite: 3, 4, 5].

Activation patching, frequently referred to in the literature as causal tracing, interchange intervention, or causal mediation analysis, evaluates the causal role of internal model components by swapping intermediate activations between different model forward passes [cite: 3, 6, 7, 8]. Unlike purely observational techniques, such as probing or attention visualization, activation patching isolates the necessity and sufficiency of specific computational nodes [cite: 9, 10]. By observing how these interventions shift the model's output probabilities, researchers can reconstruct the causal computational subgraphs governing artificial cognition. 

## Theoretical Foundations of Interventional Interpretability

The fundamental premise of activation patching relies on treating a neural network as a structural causal model [cite: 2, 10, 11]. In a transformer architecture, the output of each layer is added to a residual stream, meaning the input to any subsequent layer is the exact sum of the outputs of all preceding components [cite: 12]. This linear structure permits the isolation of specific nodes (such as attention heads or multi-layer perceptrons) or edges (the connections between nodes) in the computational graph [cite: 12, 13].

### The Tripartite Procedural Framework

The standard activation patching protocol requires three distinct forward passes of the neural network to isolate a causal mechanism [cite: 8, 14].

[image delta #1, 0 bytes]

 

First, the model processes a primary prompt (the "clean" input), which elicits the target behavior. During this pass, the intermediate activations of the targeted neural components—such as the output of a specific layer's feed-forward network or the attention pattern of a specific head—are cached in memory [cite: 8, 14]. 

Second, the model processes a counterfactual prompt (the "corrupted" input). This prompt is structurally identical to the clean prompt but differs in one critical semantic detail, ensuring that the target behavior is not elicited [cite: 6, 7]. For example, if the clean prompt is "The Eiffel Tower is in," the corrupted prompt might be "The Colosseum is in." The base output of this corrupted run is recorded to establish a baseline performance divergence [cite: 14].

Third, the model processes the corrupted prompt a second time. However, upon reaching the targeted component, the model's naturally generated activation is forcefully overwritten with the exact activation tensor cached during the clean run [cite: 8, 14]. By measuring the divergence of this patched run's output from the corrupted run's base output, researchers quantify the causal effect of the patched component [cite: 9, 15]. If patching a single attention head shifts the output from the corrupted state to the clean state (e.g., shifting the output prediction from "Rome" back to "Paris"), that head is deemed causally sufficient for the target behavior [cite: 6, 14].



### Counterfactual Generation and Corruption Methods

The choice of the corrupted prompt determines the specific causal counterfactual being tested. Variations in methodology significantly impact interpretability outcomes, leading researchers to systematically evaluate the most reliable techniques for generating corrupted inputs [cite: 3, 5, 14]. The literature identifies two primary approaches to generating corrupted inputs, each with distinct statistical implications.

Gaussian Noising adds a large, homoscedastic Gaussian noise vector directly to the token embeddings of the critical subjects within the prompt [cite: 3, 14]. While computationally straightforward and easily automated, Gaussian noising often forces the model's hidden states far off the manifold of its training distribution. This off-distribution shift can lead to uninterpretable or artifactual network behavior [cite: 3, 16]. Furthermore, the intervention may fail entirely if the magnitude of the model's normal activation vastly exceeds the scale of the injected noise, resulting in false negatives during localization [cite: 16].

Symmetric Token Replacement swaps the key tokens with semantically related, in-distribution tokens (for example, replacing "The Eiffel Tower" with "The Colosseum") [cite: 3, 14]. This strategy ensures that the model remains within its operational distribution while effectively removing the target information. Comparative analyses indicate that Symmetric Token Replacement yields more reliable and ecologically valid interpretability results than Gaussian noising, making it the preferred methodology for rigorous circuit discovery [cite: 3].

### Evaluation Metrics for Interventions

To quantify the shift in model behavior during a patched run, continuous mathematical metrics are heavily favored over discrete accuracy checks. Continuous metrics provide high-resolution gradients of change, allowing researchers to detect subtle compensatory mechanisms or partial causal effects. 

The most straightforward metric is absolute probability, which measures the absolute shift in the predicted probability of the target token [cite: 14]. However, absolute probability can be skewed by general network confidence levels. A more robust alternative is Kullback-Leibler divergence, which measures the overall shift in the full output distribution rather than just specific target tokens, providing a holistic view of the intervention's impact [cite: 9].

The current standard in mechanistic interpretability is the logit difference. This metric measures the relative gap between the target token's logit and the corrupted token's logit [cite: 7, 14]. Taking the logit difference controls for circuits that generically decide whether to output a certain class of tokens (such as deciding to output any human name) regardless of the specific context [cite: 7]. When utilizing logit difference, researchers typically normalize the patched effect against the baseline gap between the clean and corrupted runs. This normalization yields a score typically bounded between 0 and 1, where 1 indicates complete restoration of the target behavior and 0 indicates performance identical to the corrupted run [cite: 14].

## Variants of Patching Techniques

The foundational activation patching technique has evolved into a taxonomy of distinct methodologies, each tailored to answer different causal questions or overcome specific computational constraints. 

### Directionality and Causal Framing

Activation patching can be applied in two primary directions, each addressing distinct causal hypotheses regarding the model's circuitry [cite: 6, 15]. 

| Methodology Variant | Direction of Transfer | Causal Interpretation | Primary Use Case |
| :--- | :--- | :--- | :--- |
| **Denoising (Causal Tracing)** | Clean to Corrupted | **Sufficiency**: Identifies components that contain enough information to reconstruct the target behavior when injected into a baseline state. | Discovering primary computational circuits; verifying circuit completion [cite: 6, 7, 15]. |
| **Noising (Resample Ablation)** | Corrupted to Clean | **Necessity**: Identifies components whose removal actively breaks the model's ability to perform the target behavior. | Measuring component criticality; identifying single points of failure in circuits [cite: 6, 7, 16]. |

Measuring "sufficiency" via denoising is generally considered stronger evidence of a component's specific operational role than measuring "necessity" via ablation. Necessity can simply indicate a dependency on general network health, basic grammatical formatting structures, or upstream data routing, rather than the execution of the specific semantic computation under investigation [cite: 6, 7].

### Attribution Patching and Gradient Approximations

Despite its analytical power, exact activation patching scales poorly. Computing the exact causal effect of every node in a neural network requires a separate forward pass for each node evaluated [cite: 6, 17]. For fine-grained localization—such as analyzing every individual neuron or attention head across a massive model like the 70-billion parameter Chinchilla architecture—this methodology quickly becomes computationally intractable, requiring thousands of sequential forward passes [cite: 6, 18].

To circumvent this computational bottleneck, researchers introduced Attribution Patching. This technique leverages the first-order Taylor series expansion to linearly approximate the causal effect of an activation patch using gradients [cite: 17, 19]. The mathematical formulation approximates the change in a metric for a given node by taking the element-wise product of the activation difference (between the clean and corrupted states) and the gradient of the loss with respect to the activation evaluated at the corrupted state [cite: 6, 19, 20]. 

Because standard backpropagation computes the gradient for all internal nodes simultaneously, Attribution Patching can estimate the impact of intervening on every single network component using only two forward passes (one clean, one corrupt) and a single backward pass (on the corrupt state) [cite: 6, 17]. This provides orders-of-magnitude improvements in processing speed and enables automated circuit discovery algorithms.

### Pathologies of Linear Approximations

While highly efficient, Attribution Patching relies on a linear approximation of a deeply nonlinear system, leading to systematic failure modes [cite: 6, 20, 21]. These are not random statistical errors, but structural blind spots caused by the transformer architecture.

1. **Softmax Saturation:** If a critical attention head is highly confident (e.g., an attention probability exceeding 0.95), the gradient of the softmax function mathematically approaches zero [cite: 20]. Consequently, the attribution patch estimate will calculate a near-zero causal effect. This yields a severe false negative, flagging a highly important component as irrelevant [cite: 20].
2. **Zero-Gradient Regions:** If the corrupted input lands in a flat region of the loss landscape—such as when the model makes a highly confident but incorrect prediction—the gradients throughout the network shrink. This suppresses the estimated importance of all upstream nodes, regardless of their actual causal role [cite: 20].
3. **Cancellation Effects:** In deep architectures, positive and negative gradient signals from different layers may destructively interfere. This interference masks the true magnitude of an activation's influence when summed over the residual stream [cite: 20].

To address these limitations, algorithmic variants such as AtP* have been developed. AtP* mitigates the cancellation effect by applying GradDrop, which selectively zeroes gradient contributions from different layers and averages the absolute values [cite: 20, 21]. Furthermore, it resolves softmax saturation by exactly computing the attention pattern changes rather than attempting to linearize through the highly non-linear softmax layer [cite: 19, 20, 21]. While these corrections require a fractional increase in forward passes, they preserve the profound asymptotic efficiency gains over exact activation patching [cite: 20, 21].

### Path Patching and Causal Scrubbing

Treating a network strictly as a collection of nodes (individual layers or attention heads) is conceptually limiting, as a single node may participate in dozens of different functional circuits simultaneously [cite: 12]. The shift toward graph-theoretic evaluation has led to Path Patching and its efficient gradient variant, Edge Attribution Patching. These techniques target the specific flow of information between two nodes (the edges) rather than the nodes themselves [cite: 7, 10, 13, 22, 23]. Path patching isolates how components communicate by replacing activations only along the precise sub-path of interest, freezing the rest of the network [cite: 13].

This logic of tracing specific computational paths has been formalized by Redwood Research into an overarching methodology called Causal Scrubbing [cite: 12, 13, 16, 22]. Causal scrubbing rigorously tests structural hypotheses about a neural network. Instead of zeroing activations or applying random Gaussian noise, the algorithm systematically resamples activations from an entirely different dataset distribution [cite: 13, 16]. It scrubs away every causal relationship that the researcher's hypothesis claims is irrelevant to the task [cite: 12, 16, 24]. If the model's performance on the target metric remains intact despite the massive injection of off-distribution noise into all supposedly "irrelevant" paths, the proposed causal circuit is empirically validated for completeness and faithfulness [cite: 16, 24].

## Neural Redundancy and the Hydra Effect

Mechanistic interpretability historically operated under the assumption that neural circuits were structurally rigid—analogous to fixed, compiled code in traditional software engineering [cite: 1, 25, 26]. However, advanced activation patching experiments have repeatedly demonstrated that neural representations are dense, distributed, and highly dynamic.

### The Superposition Hypothesis and Polysemanticity

The interpretation of patched activations is severely complicated by the phenomenon of polysemanticity. Transformers often encode features in "superposition," meaning the network represents more discrete semantic concepts than it possesses mathematical dimensions by mapping these concepts to almost-orthogonal linear combinations of neurons [cite: 1, 24, 27, 28]. Consequently, an individual neuron rarely represents a single, human-interpretable concept; it fires for a variety of seemingly unrelated inputs [cite: 25, 27]. 

When researchers patch a raw activation vector within the residual stream, they are simultaneously intervening on dozens of entangled features [cite: 27, 28]. This dense clustering makes it difficult to ascertain which specific semantic concept drove the observed change in model behavior, often muddying the results of causal tracing [cite: 7, 28].

### Compensatory Mechanisms: Preemption

The assumption of rigid circuitry is further undermined by the discovery of compensatory network dynamics, formally known in the causality literature as preemption, and colloquially within the interpretability domain as the "Hydra effect" [cite: 1, 11, 25, 29, 30]. 

When a critical component (such as an early attention layer responsible for factual retrieval) is surgically ablated or significantly altered via patching, the network frequently does not suffer a catastrophic failure of the target behavior [cite: 25, 29]. Instead, the network exhibits emergent self-repair.

[image delta #2, 0 bytes]

 Later layers—which were entirely dormant during the unperturbed forward pass—detect the missing information, dynamically re-route the computational load, and compensate for the ablated components [cite: 25, 29]. 



This self-repairing nature of large language models indicates intense serial and parallel redundancy [cite: 7, 25, 31]. In ablation studies using the Chinchilla language model, researchers observed that ablating certain attention layers caused immediate, localized downstream compensation by subsequent attention heads [cite: 29, 30]. Simultaneously, late Multi-Layer Perceptron layers act as counterbalances, downregulating maximum-likelihood tokens to stabilize the output distribution [cite: 29, 30]. Furthermore, layer-ablation tests across multiple models reveal deep structural depthwise redundancy, implying that models iteratively refine overlapping representations throughout their depth rather than computing entirely novel features at each discrete sequential layer [cite: 32]. 

Because of the Hydra effect, standard single-node activation patching or simple ablation may yield severe false negatives. A component might be causally sufficient and primarily responsible for a behavior, but appear mathematically unnecessary because the network immediately masks its removal by routing around the damage [cite: 7, 11, 29]. This necessitates the deployment of advanced, multi-node patching techniques and edge-level attribution to accurately map computational circuits.

## Integration with Dictionary Learning

To overcome the profound barriers of polysemanticity and redundancy, the current frontier of mechanistic interpretability integrates activation patching with Sparse Autoencoders and shifts analysis from raw model activations to dictionary latents.

### Sparse Autoencoders and Latent Patching

Sparse Dictionary Learning, implemented via Sparse Autoencoders, expands the original activation space of a neural network into a higher-dimensional, overcomplete basis. During training, the autoencoder enforces a strict L1 penalty to ensure sparsity, forcing the model to represent complex inputs with only a few active dimensions [cite: 1, 27, 28, 33, 34]. The resulting autoencoder latents represent disentangled, highly specific, and theoretically monosemantic concepts that humans can easily interpret [cite: 27, 28, 35].

Rather than patching a raw, polysemantic residual stream vector, modern interpretability protocols patch specific sparse latents. Because autoencoders are trained to map activations to themselves with high fidelity, splicing a trained autoencoder into a foundational model acts as a lossless interpretability bottleneck [cite: 28, 33]. In "Patchscope" methodologies, researchers generate an explanation or behavior from a model and then intervene on specific sparse latents to see if the semantic meaning shifts predictably [cite: 28]. 

Recent experiments demonstrate that applying interventions to these latents yields highly precise behavioral control. Focusing strictly on the single highest-activated sparse latent (Top-1 steering) provides a more interpretable and stable causal steering vector than aggregating the Top-K features [cite: 35]. Aggregating multiple top features often inadvertently injects non-semantic noise (such as dimensions tracking punctuation or structural formatting) and destabilizes the generation of multi-step reasoning [cite: 35].

## Factual Localization and Model Editing

A primary application of activation patching is the localization and targeted editing of factual knowledge. Initial studies localized the storage of specific factual associations (e.g., "The Eiffel Tower is located in Paris") primarily to the mid-layer Multi-Layer Perceptrons of transformer models [cite: 22, 36, 37].

### Editing Algorithms: ROME and MEMIT

This precise localization led to the development of the Rank-One Model Editing (ROME) algorithm. ROME treats Multi-Layer Perceptron sublayers as key-value associative memories [cite: 36, 37, 38]. By performing causal tracing to identify the exact layer where a fact is recalled, ROME computes a precise rank-one update to the weight matrix of that single layer, mathematically forcing the model to associate a specific subject (the key) with a newly desired fact (the value) [cite: 37, 38].

However, ROME degrades quickly when applied to more than a few facts, suffering from severe performance drops after roughly ten edits [cite: 36]. This limitation prompted the development of Mass-Editing Memory in a Transformer (MEMIT) [cite: 36, 38, 39]. MEMIT addresses the instability of single-layer updates by distributing the factual update vector across a range of continuous layers (typically layers 3 through 8 in GPT-J), resolving mathematical conflicts through complex batch updates [cite: 36, 38, 39]. This spatial dispersion significantly reduces the localized interference that destroys models under ROME, allowing researchers to execute thousands of simultaneous factual injections without immediate model collapse [cite: 39].

### The Isolated Storage Misconception

Despite the engineering success of these advanced editing techniques, rigorous mechanistic research critiques the underlying assumptions of localized factual storage. The belief that facts are stored in isolated, easily swappable silos within specific layers is largely a misconception [cite: 36, 37, 38].

| Failure Mode of Factual Editing | Mechanistic Description | Practical Implication |
| :--- | :--- | :--- |
| **Directional Failure** | Edits lack bidirectional generalization. Injecting the fact that the Eiffel Tower is in Rome allows the model to answer "Where is the Eiffel Tower?" but it fails to accurately respond to "Name a famous tower in Rome" [cite: 36]. | The specific token association is edited, but the abstract conceptual relationship and underlying knowledge graph are not intrinsically reorganized [cite: 36, 37, 39]. |
| **Absence of Ripple Effects** | Activating an edit does not universally update the logical consequences of that edit across the network's latent knowledge structures [cite: 38, 39]. | Editing the UK Prime Minister's identity will not necessarily update the model's knowledge of the Prime Minister's spouse, causing severe logical inconsistencies in multi-turn dialogues [cite: 38, 39]. |
| **Catastrophic Forgetting** | As sequential edits accumulate, models experience an initial progressive forgetting of older edits, followed by an abrupt, catastrophic collapse of general downstream capabilities [cite: 38, 40]. | Factual associations are intrinsically distributed across overlapping parameter matrices; continuous surgical interventions eventually destabilize the underlying multi-dimensional manifold [cite: 38, 40]. |

These findings suggest that while activation patching can find a primary node for a factual recall, the total representation of that fact is deeply distributed. Intervening on a single node provides a superficial patch rather than a fundamental rewiring of the model's worldview.

## Scalability and Advanced Modalities

As artificial intelligence rapidly advances, mechanistic interpretability techniques originally designed for small models face intense pressure to scale to frontier architectures, handle long context windows, and interpret multimodal inputs.

### Frontier Model Scaling

Recent investigations into large-scale models, notably the 70-billion parameter Chinchilla architecture, demonstrate that the core suite of activation patching, logit attribution, and attention visualization remains functional at scale [cite: 18, 41, 42, 43]. In tasks requiring emergent algorithmic capabilities—such as identifying the correct letter label in a multiple-choice question format given knowledge of the answer text—researchers successfully mapped the terminal steps of the computational circuit [cite: 18, 43]. 

However, scaling does not equate to simplicity. While the broad algorithmic framework was identifiable, the specific feature representations within the attention heads remained mathematically messy and heavily polysemantic [cite: 18, 41, 43]. The success of the patching techniques proves that mechanistic interpretability is not merely an artifact of small-scale models, but it highlights that larger architectures exhibit significantly more complex internal hierarchies, requiring highly robust automated tools to untangle [cite: 31, 41].

### Long Context Attention Scaling

Modern language models feature context windows extending from hundreds of thousands to millions of tokens. Traditional activation patching scales quadratically with context length in the attention mechanism, leading to impossible computational overhead. For instance, caching full attention patterns for a 100,000-token prompt requires terabytes of GPU memory, placing long-context interpretability out of reach for standard hardware [cite: 44, 45]. 

Recent literature has introduced solutions such as Sparse Tracing and the Stream algorithm [cite: 44, 45]. Stream employs a compilable, hierarchical pruning framework that estimates per-head sparse attention masks, effectively discarding 90% to 99% of non-essential token interactions while preserving the model's exact next-token behavior [cite: 44, 45]. By performing a binary-search-style refinement, the algorithm retains only the top-K key blocks that are causally critical, reducing computational time complexity to $O(T \log T)$ and space complexity to linear $O(T)$ [cite: 44, 45]. This mathematical compression enables one-pass interpretability at massive scale, allowing researchers to causally trace information flow across vast documents.

### Multi-Step Reasoning and Diverse Modalities

Researchers are increasingly applying activation patching to understand how models execute "System 2" multi-step logic entirely within their hidden states, without generating explicit chain-of-thought text [cite: 46, 47, 48, 49]. Cross-query semantic patching reveals that models perform staged, implicit computations layer-by-layer [cite: 47, 48]. For example, in implicit two-hop reasoning tasks, models transition through distinct internal phases, localizing the extraction of a "bridge entity" in the mid-layers before generating the final combined output [cite: 47, 48]. Errors in reasoning frequently stem from later layers overemphasizing the intermediate bridge entity, which suppresses the final required concept [cite: 47].

Mechanistic interpretability has also broadened to Vision Language Models and cross-lingual architectures [cite: 50, 51]. In Vision Language Models, activation patching is utilized to discover how discrete visual patches integrate into semantic language feature spaces, although the dynamic integration processes remain significantly less understood than pure language models [cite: 50, 52]. In cross-lingual research, attribution patching maps the specific multi-layer perceptron parameters responsible for translating core factual entities across linguistic boundaries. This research reveals how inconsistent representations across language families lead to cross-lingual hallucinations, exposing bottlenecks in factual consistency [cite: 51, 53].

## Applications in Security and Alignment

Beyond academic curiosity, the rigorous causal verification provided by activation patching supplies critical infrastructure for AI alignment and safety protocols [cite: 1, 2, 54].

### Safety Neurons and Jailbreaks

Recent applications involve tracing the internal computational pathways of model refusals and evaluating susceptibility to adversarial jailbreaks [cite: 33, 55]. By employing dynamic activation patching alongside Sparse Autoencoders, researchers identified distinct "safety neurons" governing harmlessness and refusal outputs [cite: 54]. 

Remarkably, these safety neurons are highly sparse and heavily concentrated. Restoring clean activations to roughly 5% of these identified safety neurons can recover 90% of a model's safety performance during an active adversarial jailbreak attack [cite: 54]. Extensive evaluations across multiple large language models reveal a general pattern: successful jailbreaks function by mechanically suppressing the activation circuits tied to refusal while simultaneously amplifying internal components that reinforce affirmative compliance [cite: 55]. By mapping these specific pathways, researchers can develop structural defenses that render models mathematically robust against prompt-injection attacks.

### Auditing and Regulatory Compliance

Regulatory compliance frameworks are beginning to investigate activation patching as a tool to monitor foundational models in high-stakes environments. For instance, researchers have designed algorithmic tasks to use direct logit attribution and attention patching to identify whether a model internalizes forbidden biases, such as evaluating Fair Lending law violations in automated financial systems [cite: 26, 56]. By shifting from external, black-box behavioral audits to mechanistic internal audits, researchers and regulators can identify hazardous capabilities and encoded biases deep within the network's weights long before they manifest in deployment or cause public harm.

## Sources
1. [arxiv.org](https://arxiv.org/html/2510.01246v1)
2. [openreview.net](https://openreview.net/forum?id=imT03YXlG2)
3. [sidn.baulab.info](https://sidn.baulab.info/saes/)
4. [lesswrong.com](https://www.lesswrong.com/posts/vvvJNh8gNE2ScEtQ3/an-introduction-to-saes-and-their-variants-for-mech-interp)
5. [research-collection.ethz.ch](https://www.research-collection.ethz.ch/bitstreams/f4073b47-2050-4194-8540-a8a43eaf8ecb/download)
6. [github.com](https://github.com/Dakingrai/awesome-mechanistic-interpretability-lm-papers)
7. [openreview.net](https://openreview.net/forum?id=Hf17y6u9BC)
8. [arxiv.org](https://arxiv.org/abs/2309.16042)
9. [neelnanda.io](https://www.neelnanda.io/mechanistic-interpretability/attribution-patching)
10. [arxiv.org](https://arxiv.org/pdf/2309.16042)
11. [pmc.ncbi.nlm.nih.gov](https://pmc.ncbi.nlm.nih.gov/articles/PMC11999707/)
12. [arxiv.org](https://arxiv.org/html/2404.14082v1)
13. [leonardbereska.github.io](https://leonardbereska.github.io/blog/2024/mechinterpreview/)
14. [arxiv.org](https://arxiv.org/html/2408.01416v3)
15. [medium.com](https://medium.com/@adnanmasood/inside-the-ai-black-box-for-real-this-time-2026-state-of-ai-interpretability-and-explainability-b58bf30755ed)
16. [storage.prod.researchhub.com](https://storage.prod.researchhub.com/uploads/papers/2023/08/01/2307.15771.pdf)
17. [alignmentforum.org](https://www.alignmentforum.org/posts/QL7J9wmS6W2fWpofd/but-is-it-really-in-rome-an-investigation-of-the-rome-model)
18. [aclanthology.org](https://aclanthology.org/2024.findings-acl.902/)
19. [levelup.gitconnected.com](https://levelup.gitconnected.com/rome-vs-memit-the-evolution-of-mass-editing-transformer-memory-e3e4af2ca206)
20. [arxiv.org](https://arxiv.org/html/2401.07453v3)
21. [direct.mit.edu](https://direct.mit.edu/tacl/article/doi/10.1162/TACL.a.26/132652/MAKE-Memory-Associated-Knowledge-Editing)
22. [lesswrong.com](https://www.lesswrong.com/posts/JvZhhzycHu2Yd57RN/causal-scrubbing-a-method-for-rigorously-testing)
23. [alignmentforum.org](https://www.alignmentforum.org/posts/xh85KbTFhbCz7taD4/how-to-think-about-activation-patching)
24. [proceedings.iclr.cc](https://proceedings.iclr.cc/paper_files/paper/2024/file/06a52a54c8ee03cd86771136bc91eb1f-Paper-Conference.pdf)
25. [emergentmind.com](https://www.emergentmind.com/topics/activation-patching)
26. [arxiv.org](https://arxiv.org/html/2510.19875v1)
27. [arxiv.org](https://arxiv.org/abs/2510.19875)
28. [arxiv.org](https://arxiv.org/html/2407.11215v1)
29. [arxiv.org](https://arxiv.org/abs/2601.02989)
30. [arxiv.org](https://arxiv.org/html/2309.16042v2)
31. [huggingface.co](https://huggingface.co/papers/2309.16042)
32. [arxiv.org](https://arxiv.org/abs/2309.16042)
33. [arxiv.org](https://arxiv.org/pdf/2309.16042)
34. [arxiv.org](https://arxiv.org/html/2404.15255v1)
35. [google.com](https://www.google.com/search?q=time+in+CN)
36. [lesswrong.com](https://www.lesswrong.com/posts/4CrumZwbPvc6mJBA3/backdoors-have-universal-representations-across-large)
37. [storage.prod.researchhub.com](https://storage.prod.researchhub.com/uploads/papers/2023/08/01/2307.15771.pdf)
38. [arxiv.org](https://arxiv.org/html/2509.09708v2)
39. [arxiv.org](https://arxiv.org/html/2605.06510v1)
40. [researchgate.net](https://www.researchgate.net/publication/372784715_The_Hydra_Effect_Emergent_Self-repair_in_Language_Model_Computations)
41. [arxiv.org](https://arxiv.org/html/2601.14270v1)
42. [preprints.org](https://www.preprints.org/frontend/manuscript/11cab45ab0d578f7080de19423eb6ffe/download_pub)
43. [researchgate.net](https://www.researchgate.net/publication/399441006_Opening_the_Black_Box_A_Survey_on_the_Mechanisms_of_Multi-Step_Reasoning_in_Large_Language_Models)
44. [concordia-ai.com](https://concordia-ai.com/wp-content/uploads/2025/07/State-of-AI-Safety-in-China-2025.pdf)
45. [usenix.org](https://www.usenix.org/conference/usenixsecurity26/cycle1-accepted-papers)
46. [neelnanda.io](https://www.neelnanda.io/mechanistic-interpretability/glossary)
47. [medium.com](https://medium.com/@adnanmasood/inside-the-black-box-a-practical-field-guide-to-mechanistic-interpretability-b8757600e2de)
48. [neurips.cc](https://neurips.cc/virtual/2025/poster/115322)
49. [sidn.baulab.info](https://sidn.baulab.info/circuits/)
50. [burnyverse.com](https://burnyverse.com/OmniCortex/Mechanistic+interpretability)
51. [openreview.net](https://openreview.net/pdf/92de4d3b2cc67f69a07074bf162ed640163bb709.pdf)
52. [d2jud02ci9yv69.cloudfront.net](https://d2jud02ci9yv69.cloudfront.net/2025-04-28-vlm-understanding-29/blog/vlm-understanding/)
53. [iclr.cc](https://iclr.cc/virtual/2025/day/4/24)
54. [openreview.net](https://openreview.net/pdf?id=AAXMcAyNF6)
55. [swiftscholar.net](https://www.swiftscholar.net/paper/69ded535e63e77db717ca278)
56. [arxiv.org](https://arxiv.org/html/2502.11196v1)
57. [comp.nus.edu.sg](https://www.comp.nus.edu.sg/~kanmy/papers/2507.12838v2.pdf)
58. [aclanthology.org](https://aclanthology.org/2025.findings-emnlp.267.pdf)
59. [arxiv.org](https://arxiv.org/html/2407.15017v4)
60. [liangmingpan.bio](https://liangmingpan.bio/publications/)
61. [mdpi.com](https://www.mdpi.com/2076-3417/12/15)
62. [google.com](https://www.google.com/search?q=time+in+Rome,+IT)
63. [researchgate.net](https://www.researchgate.net/publication/381580198_Finding_Safety_Neurons_in_Large_Language_Models)
64. [d2jud02ci9yv69.cloudfront.net](https://d2jud02ci9yv69.cloudfront.net/2025-04-28-vlm-understanding-29/blog/vlm-understanding/)
65. [openreview.net](https://openreview.net/pdf?id=AAXMcAyNF6)
66. [fi.ee.tsinghua.edu.cn](https://fi.ee.tsinghua.edu.cn/public/publications/14c4bb0c-fb26-11f0-b382-2aaffa21d846.pdf)
67. [arxiv.org](https://arxiv.org/html/2605.09314v1)
68. [mdpi.com](https://www.mdpi.com/2076-3417/12/15)
69. [neelnanda.io](https://www.neelnanda.io/mechanistic-interpretability/attribution-patching)
70. [sidn.baulab.info](https://sidn.baulab.info/autocircuits/)
71. [learnmechinterp.com](https://learnmechinterp.com/topics/refined-attribution-methods/)
72. [transformer-circuits.pub](https://transformer-circuits.pub/2024/march-update/index.html)
73. [emergentmind.com](https://www.emergentmind.com/topics/attribution-patching-atp)
74. [arxiv.org](https://arxiv.org/pdf/2307.09458)
75. [lesswrong.com](https://www.lesswrong.com/posts/Av3frxNy3y3i2kpaa/does-circuit-analysis-interpretability-scale-evidence-from)
76. [emergentmind.com](https://www.emergentmind.com/topics/chinchilla-framework)
77. [arxiv.org](https://arxiv.org/abs/2307.09458)
78. [aiethics.turing.ac.uk](https://aiethics.turing.ac.uk/module-pages/appendix-c-2-mechanistic-interpretability/)

**Sources:**
1. [arxiv.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQF03ezGiefFuYLMaWgx_MyrIhavp_sGRzHuOWMU20cwOviTEQZVdyej8tEtGm99NoSjfupmni69tiW3FCNcb-TBaT5qk-VFKCzvGP6UiDfpViAOA0lK2d8i)
2. [github.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQG6u9z9SeOIOlnxT5UQBb7KtDtJY8GZpQLPCYBiy4pWb-RRuhcdlif9jIZDeX2TkpgKUGl0rf2fGs38HHhHPDbDdNSNoUlmAO3CL71EVMOzL4LAifxncA0efVIC2uZt2TK8ugRb4atvpH-o2h-LW8D8zA==)
3. [openreview.net](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH9IZ93B0FWIgN_zZFjaO5lNVJmZOLi1CeXsLuJIjlVSmOQMdpow8g_yuVkftBbIIei4oPhrIPDg9ri9YdKPHCjRNPTIZDUkrKT4-FDlRHqTvlc5NuDOH2lp5l4RRj_5Q==)
4. [arxiv.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQE8T10bDvo9aA7fHq64th3UaQJVw0faWqSk5Bfast4sU1YQDz84EtfHZyYUjrYLrjD9ebXJn9GBmhC-I7Q4088hoAJN_Y73hvdFi_oySR0cPWxz96Zk)
5. [arxiv.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHRWMx8eChJoVLXBwG-NLFLc7DjHaIAYgiGfQtistnRXFt-wTk6g2P1d-0YUTZawYM5lH2Ruh16BnKKVzPSPQRfBUGGRMqi9EnVpay6eWOv4MFVysWTnpyi)
6. [neelnanda.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGZLyfc5OVcH9Q7804v8f3WuzfU3ikOmK9G8JaUoUDsFjRcbYbqxuz7R7bMzyiCwRfT6cjGXwfwLha2RKLLvqjMLb7cNCVG0kZqoMkDQWNQIqj1jBwTpJ2Ks8wASUPIsGrEdKzWqBBpWpcKJA7YlzrqHCNub8Hcsz1Y6WnVs0KX)
7. [alignmentforum.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHDT819HxlGXbSmBtMJHyfXTfCLybq1MJLA9sfgucZubJMSR9iDpBQWPr5sL35nvUz9hU3QumvzeIvVLJhKs9ECOWHyYA2m0erYsmHlbqe6zuEF4DazOA3oYUPFD8TF769C3T3ek837wGGr8SFlrO8ijPydyZNeCoTAKnHh9yJSw2UCybbGyy15apZbbF3KU3goFg==)
8. [iclr.cc](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFLRnY9traPOvxWmSVSTms1Vc1v2pyJbzmJ4JrNb0s4ByAysjRjv8a78lCf1NJWE9QwYri4aVhcUpX5EHTB_a8AvmkFExre4op73opaFktM70O5WPsMdJy85Ix7cH3sjnimiOgqy4Ez-7vKajJNaqcyJwpXTJ98uL1lqCJ4Sn2KcuQ9KLp_iy5gyCyHgbrSZ-JdJFlH1NjAtzmZU9x2MHmuWzk=)
9. [emergentmind.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHj74cCgSUI7R6OVv8oZZAt8W12jjdI9PUt6escXjHXMpcW2Jfqr7bsaIqrqo4Mqse2fTWBAn2tmQbrQdf8oNvKT4vby1A6Uy2gNsyjO7yKcQcKtoR804YfHCdT7ORPtqurjpwUIT676TfKlvA=)
10. [neurips.cc](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEPZv5_LKAxAToJjHcIDPZBH53gCu4AGBYJth9ADKkVhBn-_swDWVWIE_zh7dciT2H-6s_gdtIdFNLEgtS1KfvSbhT3jRHBV61k29TGVisTJi_K2mTYKOAqR57UF_ODh5mLDA==)
11. [arxiv.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQElEw7_ssdVBuazTS1AtBs-Mq7lNR9Dl0EBHCtS9tmmx_IKja-X0Wm2iRnmE2-SNAwllEGd1kL2BlA74T-g08CJGxroUcCaL0DkvsC7X379nKYqZ1t2uesp)
12. [neelnanda.io](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQG1t7hnxxDyV4cwpWeWEOlPx84VVSsX_RryitVTljOuUjtFrK1Ppo3aUKZvufLbJLDxoCu_3Cg5Tfwbbc0fe-taPUwUqpgAhZlVCSqoYgH8scbaXeX-E01QM5qQCTEZp4qLbhhODo-AXJiKYu9sfyuO0aqb)
13. [burnyverse.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEzKpmTQjw9hmL2_acXlY_S34zWCAy-6YitNhmV3SeXw7hcky3CXhRq3t1sliTuTH3WFmcYQFirpl-1tH_xAx5Y5xp3BL-shM0qAH2LZkr7v3GpAEd90YoMEhnW0JRcQFqorAMl54612gC9hB7Fk1p4rUms)
14. [arxiv.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQG3QBw7vRapYmlGHqgcCiS7lniUV2d5TCEwKFJBkUuWvrnxTCb9eJqQWyIkxXOuvazf2JHVLw6tWvDth5cYG46Rnby3aDSsZdHc7drts6CRGxk5YG6d)
15. [arxiv.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHZhWOHJSshydy1psMgVBRulb_hKu3n8P_fze8kdQGBtkC71oK8cm7Kg1irioYP__-8CX09Szn99dvFG4qZ84Hfn3mGbZPp3M4j2miPjPDL9b2EFRhX5IJ6)
16. [lesswrong.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQF7a3Hx4tpxlLIynTg-cqsiwjR7lv6xkuKRXGSgyscfeaLx2AFFpP8BxmunHlnhkhGv4UbnEiP8kVz9q8NiDVzUGHi3LcyJs-dnBKAb6p7k0Z_DUtcrwvHzW61XkZZ2WgW8j85Hk57-iXqc68Yb-f4oxwQ4v2niFR66GYm4SFxRZpQesxc3RcJBdFMGYfn7_JYwWei9ss1A)
17. [baulab.info](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGHkkgA_w4_NUy5TgPLfNBgY_LVeobCvSoXqmoNz0ItdSL5m3r25eb1dzIhgxsjS6Fd3UQcZOl4Pw45LBq8E0E2S04k8APXptUIwbZ8qA44exrqCfKEL2S-Q4CI)
18. [arxiv.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFaJsmGZl2tQCohSymRGUTfBxwblVwZV9FZMXTI7jhvELfNw0NkflbJSeI222855ECGp79BI85pnjrToiKnuYb_Pbzh8GSPcNJN9NZAi2v7F_-BipK3)
19. [emergentmind.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFZ44iXU7JsWuz11IUnvxBHPoFf2Q8VGASah-LxpgbVvTDULcCYhJFSG2F-lCDCybQMY-RV1XOGetWKi69V9ZxrlWDLjQmcaSLnlBCPgoU2X3iKQHIVex9E0gQluGfKUo9V-BDxtm0eQIJnX9vd5u8LBA==)
20. [learnmechinterp.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEQWMHocRDSPUtG1aCAjnNYRKcmMfIAqRgoDZNm-CErDkUmhVTzq_C1SjXWIZiOWlHmM30gRENPHoT5S82W_MtlJDvDfr6dHQc5URXfmzot54rYaUPdOBO21eT03ceAbahoH1eiEO7fPlZpQNylbLURmlByPQ==)
21. [transformer-circuits.pub](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGqlRJ9iR3lzocmGYq72g993Bj3dM9hj-SNj0j5fJA19uaOcy1k6Btf8wufo-b64N0sQJ54PCDqBe_NUJ9GRJq1r1mW4YWVSYnBaKYd2q-j6d0WyhwXLWpJit_U130ax2tdg2tWOXNo_oWAV9r91wG1srE=)
22. [github.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFVxdg7DGJ2kRIisGKGGSOLQNvPChngBdTKg60bIJZ1vhIimvTpcf8EihmHrpOe5YjCQxEuSwR2RvTf4RgKwcIJbGtvB_B8_1yMheB_0ML2mHlRJz2TpNAH9ogfJtm6e8e-YtoYP_mPtnIkuoZbgjmMLG7Evb697WX729-0xeB6Hw==)
23. [tsinghua.edu.cn](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEo-OxL9rJSKYnYFkVPyTv0Ox0EFBH10car18pED6M7SMU0mUSZC0w0hL2zcib3ygzxT_-Td7VPlsORqFOjq4-tEnVNYPRUiG5VxmTStWWPjwiGKOYZw-ENvMkIyWy8pLQWgVHHvhVAdBu9yxTBj1hJe99edN_Thf5sWzjlvuTupSgEyQ2PtHvvz2IbUdh5Dw==)
24. [medium.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQG9rqibZJXYf7uHM3do9udhPfAWSU_8IkGzIJEoIClPHZv-DVBf-09jqVLm0uqvY8vf_ZPyTFP8YrDdwlNT6u2VSugUHs-ATK0bgDf_0JSuL9Zt2E-apFAyG_NHU6RpmTIaK9-uDDgNP2uhtbSEiRDuQ3XGVpixaL1zDRmbKJQfcKJVhtJawoDpz6RIasQDfX50bKBF1ip6YjeraNWmm2mxbp-OUmFW079za18kzmc=)
25. [medium.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHf6bgPDROr00WkTYASEMUpIFhq5q689LaK6a9-O8T3GTJOY4lG8vn3V07pBm1aCM-fG3p16qwwh0O1lFXRb-Md6FOQxX_YQ4JaH35yHjmQGCtoSmVX3F5Bn2SBtTTVfcOZBtzwaNr83CeQIhFhymdHJn9gc8qYqy9_H6yDJ7bbcefaLA3EJd6dW-CMB40QnhofRjRHw-Uq9SAoSESbO0ckCbmURVlvqZEwENq0nePUyyx6ZBxLgMi7X_RqR2Mreb4Q-Q==)
26. [arxiv.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEMUn_ffBLOEeU05QNiWeEFmUR2UEliloahOPydttSTYQ0WCwaqJncpM2e9RT790Zib9jytrT3LBJPFGuZOs772I1_0766NHVHrqXDsO2m5ozlW01pbo-T2)
27. [baulab.info](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEF_lKiF8V10AEYl6Vuz0NyeHitOas6b45CGRrSO0Uzv_A3wVDr7iU-_Re5amCx1-j67WtZo2Vxs0YbQ-zq9RyLbbuaolyqPFNpMDHweXGePuUnng==)
28. [lesswrong.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH9pnpbMaXdqBONiQdMoHxa98OpMxGkIharak3ITYXjUqsna-MeTzBiqNcrSSwVXwpR4DyFYvRJqxapHmP1ixfqnQlyoYQwAw-hwf9fqd7mApHIkgNR2basPUJUsJFnHx0FdPf0P03axfSQnDxE_fu2ngVozZXxqcJrSeVIPFAoSr10-OEsPjK8Fw6EJEs_C9TF32QogWZFHnt_Qhgg0rqGaQ==)
29. [researchhub.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGyUh7RmckRRQK_q38SxNZG8AJicNLhLm9EDZiHXBex-lDgSk3DXc-jO00NoGf6HyBzQ7PtTtprD-Q4ym3HeIpFuqCQIQTSKbH0kBMdz0kWtU5L6IvMFigBlv8Os0pjHJgwSetRT7gvIRn4VTPaS4QbgredD0docYmqBuk5hrAzSTFb)
30. [researchgate.net](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHtVb7lLor3jrrcTP4llC06BqQusgiXHa3fNOa0e7tPDf2ctzuh8EZrYVIeIFcp8-e685cPWi1aHCKkdhheHq3rd2xE_I2MTMO8NsFf0_-xecEIMGE-9dCFdcY52na3GATxy6LS6svqgRt8qiNm3xpls2tFTr0ukjLQX_Fn3UTbB45OH8E_kCTbcv7_Ec-CCuaMRUZck8JAnheseyTzfTwnO8lQRdLsLy4gSZDH)
31. [lesswrong.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHMtnXY0LmsnBhdrClbbmnlFeJ2Jcio9LAcj8nCuzukEov2W2oZCx2duXB-ipKZUZeU5P8q-O3BlpSqxMQ1u9_hoz9QWn2DgW7BZ-JAt-Yb4D0gP_30ABfdiFGWsGiOkaxRcQsCTqHuncyosXnLtoDhvUDZ-gk-SWtGE9mFVAuF7yIe7DmqYFIH1YYqP45xb-Qhm7rA1cLdPTAqwFw=)
32. [arxiv.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGJnG8SdiG4qKG8AZFI4gKkiliQ8FrWASuUs6pl9pcvl--nmlB5_RKuhefH_ne9nDbh4DFkQdm_FIeRP34IspBs_Z3hX6n-5niHV86PiMMJDrqHJ9q_hb2A)
33. [arxiv.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH9Z26uaougfVjScEZmT9Oe5W0cUPrKFgv9866IbEkd03AE9T7yMjgh6nS7hQhnSCWdiXteHfXTv_gfa4e8BQanBru3yqu6s_OQ8vAOiEEgiBlCYN-lzqV0)
34. [arxiv.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGFtblAP0LZGl0dSGAJl8PrqGDnbU7eueglAN5qzd32MENwqSWyDoL1JCA7Id80pSfCywMH02khkBUNvlNsf0XEwlqYPeszgrBtgGPgvEZ7EnU4xta5LYSd)
35. [arxiv.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEdjECYuZMMe6qQyNyPYn-MqjcXj9v0kekSouct1HrkHqfUQ2peQ7JlJ8lTJj-79Qje_59zTDZ4EZzxkV0Ub45wWbLgjQipggqxclvQvtpxC-a59L49RdPN)
36. [alignmentforum.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGd-9d5E70d8uQox8tWchQUF8QTCTbJvKgT10k2MuGPjceokuYrAEPFPvKktKTn5M7butIaO33NNWYT98kFisi44SSfNW4J4bEadMYFdjjuddCoFsYLB5dvDoAoY1Os8aB9r_biEjgSVbrmXsBjE60umN5cI99YQzbTTxlQR_61tAOuNKYpaa6axuPRL6TZ54SE6lC8iPFH4HvmXAEYxoOea_q2gXuHGw==)
37. [mit.edu](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEJ7GBCqtntcixkFE5IctFMZo3_wfAWbaZjdnS4yhQ8XTxh4wgLTTh9473Mh0_za1nDgKAj0dlLCdNHi9P9Unsk0m13y2OdYC5_t2xTzHsVsr8XgHt4KIH9_u40XWQM6MVkJ-q2S9vl6e44hyn3_nuUQCF_BmlsIy2g8hDAKduimHJozWjKOAXA7gU_VUQP5pQDSjJzeKuKctLPKy2TgA==)
38. [arxiv.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEDrJdOvxfsYoGTIjdi4xC-eIcrz-ORhTkw_qnMx8UNM85rsk3pDmGcN1Yxa09eLm5mAITWtxa1m6QEzRtZR6CJZ4tQfP0e_ba2HT3LDqFH2JE0ZPoTTnb-)
39. [gitconnected.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHRsa0nH2SdOvNe0e9lT0HDm_z6Kj0DJWRKxTRRacowCqbY7FpF1KX0BKipqAaazxdu8rnSfUerFM_8Ej6xMXbxpVqoAeV8ZU2FFpB3PKitAbRFvBSzMscgC3422f5yoKF4GEn8vBaBynJLfNH_-gVeqt4xrOiKaxFbrKHlBzIUJajTf-QkMNEU3dw9aKsCjexjGiPXVfzYhWEOt5golggggA==)
40. [aclanthology.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHaJby1tldMCsrBxM5kROvQ2U2TzLH86Nu7-YVg42TA9c9o0qMtFQYJF5rUkCARXvyPguJBT1IFktaC7f0pDcGiAwe0Qlq6VKzU6ieNIQGxK5IoCcYa6XNznz7jzSd9vyRC6pNC)
41. [lesswrong.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGelbO7Empz6PjGphu_CKQ8F6M_tbxnTaiXnLifu0WV1B1HgY_WD1tJf_m9ONIs4OYtIJSTjF9zPzsrD7NU-QpXY420fPhDvFjsAGRJCom6oyErzL-Eac35pekvNasSJyKkG54mXbOakgn18-o0MTv3f1zWPHm30_o4hr45N8-wX9gdiCl7oIBCU8bjjvmq-tNtih2gtw-XZFEZI4J_xFdrRw==)
42. [emergentmind.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFfGVsftnjk_0-0g6eXmTznKUYTZe0K2rqnMys-NkgtMdg-FQX7t8lBMHu-1wOLDzZNHZvgGvAWCw724vf2dJWzw2jfH-ij2qOkKcG4OlC5maEsAMK45Hl9epck6ruiqHyrIbHCWfER-sEB24Vr)
43. [arxiv.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQExc2aHFqfhMHjNsQJyRUDIBYuxWMXVA7MG2D8aULfdw-LE7xjnZ_1mM4ghzqhSc1JL3XgEKSjiBrap4abDiWRIMw6IGArlOsbCErSvoWJzLxo2Z8vh)
44. [arxiv.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQG1thNENj5eQ_9g5OZiaJtg96WzYz9KpHl1VIoaARHeUbN-865TRc44dq-D8hXfDBrqTClyqKFT3y7gdmBYy8zSvd6ISUldVaQtr1tcecZx_A6-_CwHfHD9)
45. [arxiv.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQG_4-L-U53eLqEMJ6aobDaPtBVkWfWWlz9Wt5OCDy-o5DAgEjtQS4NBkV6Tr7lA2JPxJohC8Ltx7uyNF7BcRzinoY-ikLdRSl0YPVHnExQL-YZxqMCI)
46. [arxiv.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEw9wzf7CG7pu9BsTtSYqjaFQG_s8NaT3IDinibEH9wMK5NpUWVevPeZbAMC6EwI1IVKOcVp8ZCt_8atSznTxyzS43T7xY3jShf5FMARUdK40_GLxFN)
47. [arxiv.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEu75L8nb5ZZ3tlH_hRASL12Qkfwa1MwnkyN9vttuIA97eZSw8z5XsAKmFxe_yxK-miooBPBX2Wm3G-noZxW9w1oOvFrMDaSovGRqqHhgTDpIlpreKIJrm1)
48. [preprints.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEja053g6XZg7Fw0BiVnHrNfmhXvMj2VPV--OhE97ue5Cy8O-uznZc8PIRhg9GEuc1Zkv5R98qbzjE6EMoDYZYbXL9bYJtrqRooy7-qzh9ThmF4rplSX7T1Gf29Z8ahs9wTyR2e60yBHEpG4sQJp9WtKZTk3K0ZpUKKPZOPMev8m8_cJ8T_x0WZE0WGxiCLCDk=)
49. [researchgate.net](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFBkjRCbNNyu3Pe2F0DTDq7vUX4A6EZl-EdKeRX6HleV_FJuun9GwpAkanRVp32cPDDBu4PRPoXFwqz2PQwtpy24KvQejH35SvKBF579LsxlhbaRvRnrYvS0LvHFZgYkSW9voX5vFJ3f8UrGbcOmB3okWvhw6ZJBZT9HD55AdZhhpSfv0ygmvjnC1AkgPdHjvCfJ33lh9BqfeoStZ5rdoSyqukI_Lse9qQVBWCSnLKj3qs1R3KlsAvpZY29TdtJs7JiQbWpSWcJdhhN)
50. [cloudfront.net](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFmRO-PuHSC6vfHXPTEDspyzzD1kkoP6Bp0jIdTxeH4oTSA3SmI5sFn3thA9CtwsI_D40OEtjKda-SsQZ9R9qMUubC5RDnHpq5kSPQm8HmoPhXPWTN8yiDGVadVlzYo2BgcrK1IeUmAS2EJ4FfBU_eOM6kkhGjeeF-WCfFsbDPoCI-Fqr9aaeSEH-qKlTpRrHJdcg==)
51. [nus.edu.sg](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGoLGz7ScbyHL1MiKmu8wCZkKm0TqBeF7pgJMns_-5fVOBNt08h4JX8Ff2icC0ObCZz3nPCO_oxlcOP3gVYMYYuXUQV6nN5qYNdb4ApWkeE0cZnWy-aYgyJ8TZK9eoA4WebN3XEfBbZK6fr5zcR76E=)
52. [openreview.net](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQF403O0vD9d4zmeUgFcXaoVf1Yjmh3qxQ5xK6tHCC-j3EyDl8U11UJNpNetvAHeLFHh72HlQS2SAWjW8VHbMW-w2qX--2gWok4He59W6WPd4fv2h5uxnLrA14Ab8uwx4A==)
53. [aclanthology.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEHcUNpazqvrhzrU5qUkk6Il1bxWpPq0NDV3nVl0UkOJqU95ApO8ZB7P0fmNsY0uut5QQ_LrzevrsaMmlli21KjEjrackwUHEsFWzm1i1ynjTUOT0alwPkoU73pUlPjTX4oq2AqXi_Ieqs=)
54. [researchgate.net](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEdhpNuEq9abCVmDpAzwmdisALIXFs9bceVkVO8X_bpE9nLqWzkXDk0Dv40VBmTAptWsK4Z9MpVoGTESoB24R8dM05ZGdckp4-BkUNOf0YirFY-R6eV2B-CZrVyrwgVivbNwniQevwifml6KXOLqMf8L1AANzzagGkMpBuWSb4li2Bv0AlmAEJ138CFf3dcGuOpxchwISsn)
55. [usenix.org](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEa6Tir1-Vim-4Jnt6o9YQlGYJtrIo5Z1_qwnWTTbB8r95MNlDHHfpSOVcxJ-miD7CdwD8GPrfoRf_fwFmcSJCkJOVqUg3slAkNdEC4YaLThB97Us5SidPsk-7hsvvmUqCa3rG7k117v8YmzBoCg-VmG9OEbh8aKbgAnouSMdk=)
56. [concordia-ai.com](https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHyGdOPr6QsL9pMwjBkXRvp0YSQy_QbprEbFWOGOxJJaFM3E3uU3f4o79Ij1MR0dnckd3xX6u9FNaHQqMhb2o45EoTKNvheKzksCzZ-WFMopUV18bS7GPF_iKCeuvRPOEB4VWPagNPdmNXBFB9XxHWI4QV9eT-pm_k56XpXQlhXblExfsenZLos1iuo4MU=)