Certified Circuits: Stability Guarantees for Mechanistic Circuits
Authors: Alaa Anani, Tobias Lorenz, Bernt Schiele, Mario Fritz, Jonas Fischer
Organizations: Max Planck Institute for Informatics, Saarland Informatics Campus, Saarbrücken, Germany · CISPA Helmholtz Center for Information Security, Saarbrücken, Germany
Understanding how neural networks arrive at their predictions is essential for debugging, auditing, and deployment. Mechanistic interpretability pursues this goal by identifying circuits--minimal subnetworks responsible for specific behaviors. However, existing circuit discovery methods are brittle: circuits depend strongly on the chosen concept dataset and often fail to transfer out-of-distribution, raising doubts whether they capture the concept or merely dataset-specific artifacts. We introduce Certified Circuits, which provide provable stability guarantees for circuit discovery. Our framework wraps any black-box discovery algorithm with randomized data subsampling to certify that inclusion decisions over circuit components--neurons or edges of the model graph, depending on the base algorithm--are invariant to bounded edit-distance perturbations of the concept dataset. Unstable components are abstained from, yielding circuits that are more compact and more accurate. We validate across three architectures (ResNet, ViT, GPT-2) on vision (ImageNet and four OOD datasets) and language (IOI, IOI-Hard, Greater-Than) tasks. Certified circuits achieve up to 56% higher accuracy and up to 80% fewer components, and remain reliable where baselines degrade. Certified Circuits puts circuit discovery on formal ground by producing mechanistic explanations that are provably stable and better aligned with the target concept. Code: https://github.com/AlaaAnani/certified-circuits.
Figures & tables
Figure 2: Certified circuit discovery via concept deletion smoothing. (§ 3.1 ) Given a concept dataset D , model graph G , and circuit discovery algorithm A : (§ 3.2 ) We sample dataset variants via per-example deletion with probability pdel , (§ 3.3 ) run A on each to obtain per-sample circuits, (§ 3.4 ) aggregate per-component (e.g., vertex) inclusion frequencies, (§ 3.4 ) certify components as in , out , or abstain ( ⊘ ) based on votes consistency. (§ 3.5 ) The certified circuit is provably invariant to concept dataset edits within radius r .
Table 1: Certified vs. baseline circuit sufficiency. Peak cACC and corresponding circuit size K under sufficiency pruning on ResNet-101 for vision datasets and GPT-2 Small for language tasks. Circuits are discovered on ID datasets and evaluated on ID or on OOD shifts. Δ is relative improvements on unrounded values. Certification hyperparameters are in App. Table 2 . All three vision discovery algorithms in App. Table 5 .
Figure 3: Circuit accuracy (cACC) vs. size K . Solid lines show certified circuits, dashed show the baseline, with colors distinguishing models. Circuits are discovered on ImageNet and evaluated on ID or OOD data. This figure is extended to ViT-B/16 in App. Fig. 12 and language circuits in App. Fig. 9 & 10 .
Figure 4: Edges of the certified vs. baseline EAP-IG circuits on GPT-2 Small at peak cACC. Annotations report the relative edge reduction and the gain in peak cACC of the certified circuit over EAP-IG. The certified radius r denotes the best value for every task.
Figure 5: Features encoded by certified-in, abstain (within Baseline), and certified-out neurons (class: digital watch , ResNet-101). Per layer, top-activating neurons in each category.
Figure 6: Structural stability under distribution shift. Per-class IoU between circuits discovered on ImageNet and re-discovered on each OOD dataset, at the K maximizing the certified–baseline Δ cACC gap. Boxes show the distribution over classes.
Appendix figures & tables17 assets
Supplementary material from the paper’s appendix.
Appendix
Domain
Setting
Dataset / Task
τ
pdel
r
Vision ResNet-101
ID
ImageNet
0.95
0.60
1
OOD
ImageNet-A
0.95
0.60
1
OOD-CV
0.95
0.60
1
ImageNet-C
0.95
0.60
1
ImageNet-O
0.95
0.60
1
Language GPT-2 Small
ID
IOI
0.90
0.95
9
Appendix
Table 2: Certified algorithm configuration per dataset and task in Table 1 .
ID
OOD (ours)
IOI
Then, Jessica and Rachel went to the garden. Rachel gave a drink to (Jessica / Rachel)
Then in the morning, Jennifer and Nicholas went to the school. While Nicholas looked around the school, Jennifer talked about the snack, and after a while Nicholas gave a snack to (Jennifer / Nicholas)
IOI-Hard
Then in the morning, Nicole and Katherine went to the restaurant. Katherine gave a ring to (Nicole / Katherine)
Then in the morning, Elizabeth and Allison went to the office. Elizabeth repeatedly asked Allison about the necklace … and resumed the discussion of the necklace, Allison gave a necklace to (Elizabeth / Allison)
Greater-Than
In scenario 920499 at the school with the drink, The war lasted from the year 1799 to the year (1800 / 1840)
In scenario 794799 at the station with the necklace, The war lasted from the year 1399 to the year after a long and distracting discussion at the school about the basketball, followed by more unrelated details, (1400 / 1440)
Appendix
Table 3: OOD prompt construction for the three language tasks. ID prompts follow the original task formulations; OOD prompts (ours) introduce task-specific distractors. Each cell shows the prompt followed by (answer / distractor).
Figure 7: Certified radius r at various deletion probability pdel values for different confidence thresholds τ . Larger pdel and larger τ yield larger certified radii.
Figure 8: Sample complexity vs. certification threshold. Minimum samples n required to certify a circuit at threshold τ under perfect agreement and Bonferroni correction over N=3,840 components (the vertex set V of ResNet-101). τ⋆ is the largest threshold certifiable at a given n ; any τ≤τ⋆ is certifiable, so larger n raises τ⋆ . Solid curves: circuit-level guarantees at α∈{0.01,0.001,0.0001} . Dashed: per-vertex (no correction).
Table 4: Runtime breakdown for per-class ResNet-101 circuit discovery on the ImageNet validation set. Naive scales linearly with n while the optimized implementation caches per-image attribution score (e.g., relevance, activation) across samples. Hardware: Intel Core i7-14700 CPU, 62 GiB RAM, NVIDIA RTX 4090, batch size 50.
Figure 9: Best certified vs. baseline EAP-IG circuits on GPT-2 Small. cACC– K curves for the certified circuit (highest peak cACC, blue solid) and EAP-IG (gold dashed) across three tasks (columns) and two settings (rows: ID, OOD). The certified radius r for each circuit is annotated in the bottom-right of each panel.
Figure 10: Certified EAP-IG circuits at higher radii on GPT-2 Small. cACC– K curves for certified circuits at r=42 (blue), r=50 (teal), and r=59 (purple), compared against EAP-IG (gold dashed) across three tasks (columns) and two settings (rows: ID, OOD). Curves overlap tightly, indicating that larger certified radii are achieved without measurable loss in cACC.
Table 5: Certified vs. baseline circuit sufficiency across three Top-K scoring algorithms with uncertainty estimates. Peak cACC and corresponding circuit size K under sufficiency pruning on ResNet-101. Circuits are discovered on ImageNet and evaluated either in-distribution or on OOD shifts. Significance markers compare certified circuits against the corresponding baseline circuit using paired class-level tests: †p<0.05 , ‡p<0.01 , \lx@sectionsignp<0.001 .
Figure 11: Certified circuits are highly stable across seeds, even for the least stable classes. Pairwise IoU between independent runs of the certification pipeline ( n=1000 masks) across 40 seeds, for the 10 least stable ImageNet classes (ordered least to most stable); each dot is one seed-pair. Even in the worst case IoU exceeds 0.95 . The dashed line marks the mean over 100 classes, 0.973±0.0015 (95% CI).
Figure 12: Circuit accuracy (cACC) vs. size K on ResNets and ViT-B/16. Solid lines show certified circuits, dashed show the baseline, with colors distinguishing models. Circuits are discovered on ImageNet and evaluated either ID or on OOD data.
Figure 13: Certified circuits scale to large radii given sufficient concept data. cACC vs. circuit size for r∈{1,3,11,59} (colors) and ∣Dc∣∈{50,100,500,1000} (rows), across five ID/OOD benchmarks (columns). Solid: certified; dashed: baseline. Large radii degrade at small ∣Dc∣ but recover by ∣Dc∣=1,000 . ResNet-101, τ=0.95 , n=1,000 .
Figure 14: Effect of radius and ∣Dc∣ at fixed K=0.60 . cACC (top), effective circuit size (middle), and abstention rate (bottom) as a function of certified radius for ∣Dc∣∈{50,100,500} . Larger ∣Dc∣ stabilizes both cACC and abstention at high radii; effective circuit size stays roughly constant. ResNet-101, τ=0.95 , n=1,000 .
Figure 15: Effect of radius and ∣Dc∣ at the per-setting optimal K . Peak cACC (top), corresponding circuit size (middle), and abstention rate (bottom) as a function of certified radius. With K optimized per setting, higher radii yield more compact circuits without sufficiency loss when ∣Dc∣ is large enough. ResNet-101, τ=0.95 , n=1,000 .
Figure 16: Certified circuits outperform majority vote at identical compute. cACC vs. K for certified, majority vote (same n , > 50% inclusion, no τ ), and baseline across five benchmarks. The gap between certified and majority vote isolates the contribution of certification (through the threshold τ ) beyond ensemble averaging.
Figure 17: Features encoded by certified-in, abstain (within baseline), and certified-out neurons (ResNet-101). Per layer, top-activating neurons in each category. Certification improves cACC while shrinking the circuit by abstaining from unstable, spurious neurons.
Figure 18: Features encoded by certified-in, abstain (within baseline), and certified-out neurons Extension of App. Fig. 17
Figure 19: Features encoded by certified-in, abstain (within baseline), and certified-out neurons Extension of App. Fig. 18
Automated circuit discovery is a central tool in mechanistic interpretability for identifying the internal components of neural networks responsible for specific behaviors. While prior methods have made significant progress, they typically depend on heuristics or approximations and do not offer provable guarantees over continuous input domains for the resulting circuits. In this work, we leverage recent advances in neural network verification to propose a suite of automated algorithms that yield circuits with provable guarantees. We focus on three types of guarantees: (1) input domain robustness, ensuring the circuit agrees with the model across a continuous input region; (2) robust patching, certifying circuit alignment under continuous patching perturbations; and (3) minimality, formalizing and capturing a wide array of various notions of succinctness. Interestingly, we uncover a diverse set of novel theoretical connections among these three families of guarantees, with critical implications for the convergence of our algorithms. Finally, we conduct experiments with state-of-the-art verifiers on various vision models, showing that our algorithms yield circuits with substantially stronger robustness guarantees than standard circuit discovery methods, establishing a principled foundation for provable circuit discovery.
Itamar Hadad, Guy Katz, Shahaf Bassan
School of Computer Science and Engineering, The Hebrew University of Jerusalem
The circuits framework in mechanistic interpretability aims to identify sparse subgraphs of model components that are causally responsible for a behavior, typically evaluated by measuring necessity and sufficiency. But these criteria say little about whether a circuit consistently captures how a model performs a task, or if it is specific to that task. We study these two properties, consistency and specificity, across six tasks and five models, extracting circuits at the component level (attention heads and MLP blocks) and at the level of individual MLP neurons. We find that component-level circuits are highly consistent and causally important for most tasks, but they are not specific: for a given task, ablating its own circuit drops accuracy by about as much as ablating another task's circuit. Neuron-level circuits, on the other hand, exhibit higher specificity across tasks, but far less consistency within tasks. This is explained by circuit overlap: component-level circuits share most of their components across tasks, related or not, while neuron-level circuits overlap only between closely related tasks. In a case study of the components shared by the task circuits of Llama-3.2-3B, we show that they consist mostly of MLP blocks, while the few attention heads within turn out to have general-purpose roles. Overall, our findings raise questions about the degree to which circuits can support targeted understanding of, and intervention on, model behavior.
Michael Li, Nishant Subramani
Northeastern University · Carnegie Mellon University – Language Technologies Institute
Transparency of neural networks' internal reasoning is at the heart of interpretability research, adding to trust, safety, and understanding of these models. The field of mechanistic interpretability has recently focused on studying task-specific computational graphs, defined by connections (edges) between model components. Such edge-based circuits have been defined in the context of large language models, yet vision-based approaches so far only consider neuron-based circuits. These tell which information is encoded, but not how it is routed through the complex wiring of a neural network. In this work, we investigate whether useful mechanistic circuits can be identified through computational graphs in vision transformers. We propose an effective method for Automatic Visual Circuit Discovery (Vi-CD) that recovers class-specific circuits for classification, identifies circuits underlying typographic attacks in CLIP, and discovers circuits that lend themselves for steering to correct harmful model behavior. Overall, we find that insightful and actionable edge-based circuits can be recovered from vision transformers, adding transparency to the internal computations of these models.
Nina Żukowska, Wolfgang Stammer, Bernt Schiele +1
Max Planck Institute for Informatics, Saarland Informatics Campus, Saarbrücken, Germany