Attack Success Rate (ASR)

Entities in the same semantic neighborhood but without a typed relation to this one — candidates for new edges or unrecognized duplicates.

• Answer Switching Rate (ASR)method0.759
  Key evaluation metric: proportion of inputs for which an intervention successfully flips model output
• ASR spikes rapidly in all tested models in the 0.60–0.75 normalized layer range before decreasing sharply in final layersfinding0.712
  Core layer localization finding from Experiment 1
• Adversarial Suffix Attackconcept0.703
  Optimization-based jailbreak method appending strings to prompts to elicit harmful outputs.
• Prefill Attackmethod0.699
  Adversarial multi-turn experiment where first turn uses pre-finetuning model to test if follow-up maintains character
• Jailbreak Attackconcept0.698
  Security attack that bypasses LLM safety alignment by suppressing deliberation or exploiting reflection inhibition.
• Random latent ablation produces slight increase in ESR rate (3.8% to 4.2%), not statistically significantfinding0.696
  Control result confirming OTD ablation effect is specific to those latents, not a general ablation artifact
• ESR Rate (metric)concept0.688
  Primary metric: percentage of responses containing multiple attempts that successfully improve on the first attempt
• Deceptive Response Ratemethod0.684
  Primary metric measuring the percentage of responses in which a model chooses the deceptive option