Writing study: The Shape of Adversarial Influence: Characterizing LLM Latent Spaces with Persistent Homology

ICLR overviewCorpus atlasBy contribution typeVisual galleryRules & templateWriting patternsPaper studies

← ICLR 2026 oral writing corpus

Aideen Fay, Inés García-Redondo, Qiquan Wang, Haim Dubossarsky, Anthea Monod · Official ICLR 2026 oral record

Observed writing choices, not acceptance rules. This study examines the inspected manuscript version. It does not establish why the paper was accepted or that its presentation choices should be copied unchanged.

Figure, table and section ledger

Editorial contribution type: Empirical analysis, diagnosis & auditing (primary).

Layout extraction, not a required paper template. Counts are distinct caption labels; a multi-panel figure counts once. Section spans are estimated from heading positions, including floats and whitespace. Method and limitations.

Canonical PDF

47 physical pages

Before references / appendix

≈ 10.28 page-equivalents

Main figures / tables

10 / 3

Attached appendix figures / tables

53 / 6

Attached appendix span

≈ 31.16 page-equivalents

Before references / appendix: ≈ 21.87%References / intervening material: ≈ 11.83%Attached appendix: ≈ 66.3%Estimated layout envelopes, not text/artwork area. Unresolved appendix boundaries remain within the undivided post-body material.

Section-by-section lengths and source pages

The title/abstract/front matter precede the first numbered heading. A span ends at the next detected top-level heading, not at the last sentence; end-page whitespace is included. References and statements are listed separately. These are not measurements of text-only or artwork area.

Top-level heading	Starts on PDF page	Estimated span	Share of entire PDF
1 INTRODUCTION	1	≈ 1.17 pp.	2.49%
2 BACKGROUND	2	≈ 1.59 pp.	3.38%
3 EXPERIMENTAL DESIGN	4	≈ 1.42 pp.	3.02%
4 RESULTS	5	≈ 4.6 pp.	9.79%
5 DISCUSSION AND FUTURE WORK	10	≈ 0.74 pp.	1.57%
ACKNOWLEDGMENTS	11	≈ 0.18 pp.	0.38%
REFERENCES	11	≈ 5.56 pp.	11.83%
A PERSISTENT HOMOLOGY	16	≈ 2.27 pp.	4.83%
B FURTHER TOPOLOGICAL AND LOCAL VARIANCE INTERPRETATION	19	≈ 4.63 pp.	9.85%
C FURTHER DETAILS OF GLOBAL LAYER-WISE ANALYSIS	23	≈ 16.9 pp.	35.96%
D FURTHER DETAILS ON LOCAL ANALYSIS	40	≈ 5.1 pp.	10.85%
E SANDBAGGED REPRESENTATION DATA COLLECTION	45	≈ 0.64 pp.	1.36%
F GLOBAL PH PIPELINE AND RESOURCE CONSTRAINTS	46	≈ 0.73 pp.	1.55%
G ROBUSTNESS TO ADAPTIVE ATTACKS	47	≈ 0.89 pp.	1.89%

All detected figure and table locations

Main text

• Figure 1 · p. 2
• Figure 2 · p. 3
• Figure 3 · p. 5
• Figure 4 · p. 5
• Figure 5 · p. 5
• Figure 6 · p. 6
• Figure 7 · p. 6
• Table 1 · p. 7
• Figure 8 · p. 7
• Table 2 · p. 8
• Figure 9 · p. 8
• Table 3 · p. 9
• Figure 10 · p. 10

Attached appendix

• Table 4 · p. 19
• Table 5 · p. 19
• Figure 11 · p. 21
• Figure 12 · p. 22
• Figure 13 · p. 22
• Figure 14 · p. 23
• Figure 15 · p. 24
• Figure 16 · p. 25
• Figure 17 · p. 25
• Table 6 · p. 26
• Figure 18 · p. 26
• Figure 19 · p. 27
• Figure 20 · p. 27
• Figure 21 · p. 28
• Figure 22 · p. 28
• Figure 23 · p. 28
• Figure 24 · p. 29
• Figure 25 · p. 29
• Figure 26 · p. 29
• Figure 27 · p. 30
• Figure 28 · p. 30
• Figure 29 · p. 30
• Figure 30 · p. 31
• Figure 31 · p. 31
• Figure 32 · p. 31
• Figure 33 · p. 32
• Figure 34 · p. 32
• Figure 35 · p. 32
• Figure 36 · p. 33
• Figure 37 · p. 33
• Figure 38 · p. 33
• Figure 39 · p. 34
• Figure 40 · p. 34
• Figure 41 · p. 34
• Figure 42 · p. 35
• Figure 43 · p. 35
• Figure 44 · p. 35
• Figure 45 · p. 36
• Figure 46 · p. 36
• Figure 47 · p. 36
• Figure 48 · p. 37
• Figure 49 · p. 37
• Figure 50 · p. 38
• Figure 51 · p. 38
• Figure 52 · p. 39
• Figure 53 · p. 39
• Figure 54 · p. 39
• Figure 55 · p. 40
• Figure 56 · p. 41
• Figure 57 · p. 42
• Figure 58 · p. 42
• Figure 59 · p. 43
• Table 7 · p. 43
• Figure 60 · p. 44
• Figure 61 · p. 44
• Figure 62 · p. 45
• Figure 63 · p. 45
• Table 8 · p. 46
• Table 9 · p. 47

Argument and organization

1. Topological background before the experiment

   Introduces filtration and barcodes before operationalizing them.

2. Global and local analyses

   Uses parallel pipelines for point-cloud summaries and cross-layer coordinate pairs.

3. Interpretation followed by controls

   Connects observed separation to feature summaries, then tests normalization, permutation and alternate attacks.

Problem, claim and contribution

The opening distinguishes explaining geometry from detecting an attack; this is stronger than defining novelty solely through classifier accuracy.

Sections 1–2, pp. 1–4 · Main paper

Argument and section order

The results progress from correlation pruning to PCA, classification and SHAP, giving readers an explicit chain from representation to interpretation.

Section 4.1, pp. 6–8 · Main paper

Figures, captions and visual explanation

The two neighboring flowcharts use matching stage colors and separate global subsampling from local layer pairing, making different statistical units visible.

Figures 3–5, p. 5 · Main paper

Tables, comparisons and evidence

Table 2 compresses a large model-by-layer analysis into directional signatures while retaining exceptions as footnotes instead of hiding them behind averages.

Table 2, p. 8 · Main paper

Appendix and reproducibility

Repeated per-model plot sequences support comparison, and the cost appendix gives hardware, barcode size, memory and elapsed time rather than only a GPU name.

Appendices C–F, pp. 23–46 · Main paper

Clarity and writing conventions

Figure 9's caption says mixed-versus-mixed whereas its plotted legend says clean-versus-poisoned; terminology and caption checks must be part of final editorial review.

Figure 9, p. 8; repeated Figure 13, p. 22 · Main paper

What to reuse—and what not to infer

Transferable lesson: Explain a technical diagnostic with a small worked construction, then keep its sampling unit, control conditions and exception-bearing summary table explicit.

Boundary: Perfect PH classification concerns subsamples, whereas linear baselines classify individual activations. It is not a like-for-like deployment detector comparison. The universal-compression wording exceeds some layer/model exceptions, and SHAP or coordinate pairing does not establish causal information flow.

Apply this lesson using the argument and evidence worksheet.

Inspection record and sources

Checked

2026-09-19

Reading status

Full text + selected visuals inspected

Main text

PDF pp. 1–10, Sections 1–5

Appendix / supplement

PDF pp. 16–47, Appendices A–G including theory, per-model plots, controls and resource costs

Visually inspected PDF pages

5, 8

• Official ICLR 2026 proceedings conference PDF; PDF creation metadata: Mon Mar 2 06:31:50 2026 EST · 47 pages