H-Node Attack and Defense in Large Language Models

Eric Yocam; Varghese Vaidyan; Yong Wang

cs.LGMar 27, 2026

H-Node Attack and Defense in Large Language Models

Authors: Eric Yocam, Varghese Vaidyan, Yong Wang

Organizations: Department of Computer Science and Software Engineering, California Polytechnic State University, San Luis Obispo, CA 93407, USA. · Beacom College of Computer and Cyber Sciences, Dakota State University, Madison, SD 57042, USA. · Department of Computer Science, University of Idaho, Moscow, ID 83844, USA.

Abstract

We present H-Node Adversarial Noise Cancellation (H-Node ANC), a mechanistic framework that identifies, exploits, and defends hallucination representations in transformer-based large language models (LLMs) at the level of individual hidden-state dimensions. A logistic regression probe trained on last-token hidden states localizes hallucination signal to a small set of high-variance dimensions -- termed Hallucination Nodes (H-Nodes) -- with probe AUC reaching 0.90 across four architectures. A white-box adversarial attack amplifies these dimensions at inference time via a real-time forward hook, achieving a selectivity of 3.02x with less than 10% visibility to the defender. Adaptive ANC defense suppresses H-Node excess in-pass using confidence-weighted cancellation, reducing grounded activation drift by 33-42% over static cancellation. A dynamic iterative extension that re-ranks cancellation targets across successive passes recovers up to 0.69 robustness from a single-pass baseline of 8%. All contributions are validated on OPT-125M, Phi-3-mini-4k-instruct, LLaMA-3-8B-Instruct, and Mistral-7B-Instruct-v0.3 (125M-8B parameters). Perplexity impact is surgical (<5%) and MMLU degradation is at most 3%, confirming that the defense does not impair general reasoning capability.

Figures & tables

Panel of Figure 1 — Figure 1. Three-phase experimental pipeline overview.

Method	Mechanistic	Adversarial	Real-Time	Adaptive	Multi-Model	Attack+Defense	Gap Addressed
	Node-Level	Attack	Defense	Weighting	Validation	Unified
ITI [ 9 ]	✓	$\times$	✓	$\times$	Limited	$\times$	Detection+intervention
DoLA [ 10 ]	$\times$	$\times$	✓	$\times$	Limited	$\times$	Decoding contrast
Repr. Eng. [ 8 ]	✓	$\times$	✓	$\times$	$\times$	$\times$	Concept steering
ROME [ 7 ]	✓	$\times$	$\times$	$\times$	$\times$	$\times$	Fact localization
Activation Add. [ 30 ]	✓	$\times$	✓	$\times$	$\times$	$\times$	Behavior steering

Table 1. Comparison of Related Methods Against H-Node ANC

Panel of Figure 3 — Figure 3. Probe coefficient distributions and H-Node set overlap (OPT-125M).

Panel of Figure 4 — Figure 4. Defender vs. attacker probe coefficient scatter and activation shift by node category.

Figure 5. Probe AUC by transformer layer: last-token vs. mean-pool pooling (OPT-125M).

Metric	OPT-125M	Phi-3-mini	LLaMA-3-8B	Mistral-7B
Best layer	6	17	15	16
Peak depth (%)	50	53	47	50
AUC last-token	0.754	0.888	0.898	0.905
AUC mean-pool	0.627	0.648	0.862	0.798
Last-token gain	+0.126	+0.240	+0.036	+0.106
Ensemble AUC	0.753	0.890	0.899	0.901

Table 2. Probe Quality and Layer Analysis

Metric	OPT-125M	Phi-3-mini	LLaMA-3-8B	Mistral-7B
Hall. reduction (pct80)	0.026	0.008	0.006	0.015
Grounded drift	0.008	0.002	0.001	0.003
Selectivity (pct80)	3.39 $\times$	3.33 $\times$	5.14 $\times$	5.88 $\times$
Best pct sweep sel.	8.73 $\times$	3.43 $\times$	5.28 $\times$	8.64 $\times$
Static ANC sel.	3.10 $\times$	3.09 $\times$	4.72 $\times$	4.69 $\times$
Adaptive ANC sel.	3.39 $\times$	3.33 $\times$	5.14 $\times$	5.88 $\times$

Table 3. Cancellation Performance and Static vs. Adaptive Ablation

Metric	OPT-125M	Phi-3-mini	LLaMA-3-8B	Mistral-7B
ITI best sel.	1.67 $\times$	1.79 $\times$	1.84 $\times$	1.35 $\times$
H-Node adv. over ITI	$+$ 1.72 $\times$	$+$ 1.54 $\times$	$+$ 3.30 $\times$	$+$ 4.53 $\times$
DoLA MC1 accuracy	0.210	0.230	0.340	0.220
DoLA MC1 delta	$-$ 0.040	$-$ 0.030	$+$ 0.060	$-$ 0.020
H-Node MC1 delta	$-$ 0.003	$\approx$ 0	$\approx$ 0	$-$ 0.002

Table 4. Comparison Against SOTA: ITI and DoLA

Attack (undefended, best method)
Metric	OPT-125M	Phi-3-mini	LLaMA-3-8B	Mistral-7B
Atk. amplitude	0.084	0.201	—	—
Atk. selectivity	2.87 $\times$	3.02 $\times$	—	—
Def. visibility	0.072	0.060	—	—
Overlap Analysis
Overlap rate (%)	36.0	14.0	26.0	36.0

Table 5. Adversarial Pipeline: Attack, Overlap, and Defense Robustness

Figure 6. Iterative defense robustness and selectivity per pass (Fourier attack).

Figure 7. Single-pass vs. dynamic iterative robustness across attack methods.

Metric	OPT-125M	Phi-3-mini	LLaMA-3-8B	Mistral-7B
PPL baseline	65.42	11.66	21.07	14.46
PPL (atk $\rightarrow$ def)	66.60	12.04	21.08	14.55
PPL delta (%)	$+$ 1.8	$+$ 3.3	$+$ 0.0	$+$ 0.6
PPL verdict	Surgical	Surgical	Surgical	Surgical
MMLU baseline	0.19	0.38	0.37	0.44
MMLU (atk $\rightarrow$ def)	0.18	0.39	0.34	0.46

Table 6. Capability Preservation: Perplexity and MMLU Under ANC

LLM Hallucination Mitigation

Large language model hallucination mitigation develops ways to detect and reduce unsupported, fabricated, or inconsistent outputs.

See all 178 papers

Adaptive Activation Cancellation for Hallucination Mitigation in Large Language Models
Mar 10, 2026Eric Yocam, Varghese Vaidyan, Gurcan Comert +3LLM Hallucination Mitigation Activation Steering
The Beacom College of Computer and Cyber Sciences, Dakota State University, Madison, SD 57042, USA. · Department of Computational Data Science and Engineering, North Carolina A&T State University, Greensboro, NC 27411, USA. · Department of Computer Science and Software Engineering, California Polytechnic State University, San Luis Obispo, CA 93407, USA. +2
Hybrid Adversarial Defence for Natural Language Understanding Tasks
Jun 3, 2026Manar Abouzaid, Yang Wang, Chenghua Lin +1LLM Hallucination Mitigation LLM Security
School of Electronics and Computer Science, University of Southampton, UK · Department of Computer Science, University of Manchester, UK
Reward Stealing Attack on Large Language Models
Oct 5, 2026Jiaming Qian, Pengyang Zhou, Jiahe Xu +1LLM Alignment Model Extraction Attacks
Zhejiang University

Mar 10, 2026J/K move · Enter open · S save

Adaptive Activation Cancellation for Hallucination Mitigation in Large Language Models

Eric Yocam, Varghese Vaidyan, Gurcan Comert, Paris Kalathas+2

The Beacom College of Computer and Cyber Sciences, Dakota State University, Madison, SD 57042, USA. · Department of Computational Data Science and Engineering, North Carolina A&T State University, Greensboro, NC 27411, USA. · Department of Computer Science and Software Engineering, California Polytechnic State University, San Luis Obispo, CA 93407, USA.+2

LLM Hallucination Mitigation Activation Steering

Open paper AskPDF arXiv

Large Language Models frequently generate fluent but factually incorrect text. We propose Adaptive Activation Cancellation (AAC), a real-time inference-time framework that treats hallucination-associated neural activations as structured interference within the transformer residual stream, drawing an explicit analogy to classical adaptive noise cancellation from signal processing. The framework identifies Hallucination Nodes (H-Nodes) via layer-wise linear probing and suppresses them using a confidence-weighted forward hook during auto-regressive generation -- requiring no external knowledge, no fine-tuning, and no additional inference passes. Evaluated across OPT-125M, Phi-3-mini, and LLaMA 3-8B on TruthfulQA and HaluEval, the real-time hook is the only intervention that consistently improves downstream accuracy on all three scales. Critically, the method is strictly surgical: WikiText-103 perplexity and MMLU reasoning accuracy are preserved at exactly 0.0% degradation across all three model scales, a property that distinguishes AAC from interventions that trade fluency or general capability for factual improvement. On the LLaMA 3-8B scale, the hook additionally yields positive generation-level gains (MC1 +0.04; MC2 +0.003; Token-F1 +0.003) while achieving probe-space selectivity 5.94x - 3.5x higher than the ITI baseline -- demonstrating that targeted neuron-level suppression can simultaneously improve factual accuracy and preserve model capability.

Abstract

LLM Hallucination Mitigation

Explore similar work

Adaptive Activation Cancellation for Hallucination Mitigation in Large Language Models

Hybrid Adversarial Defence for Natural Language Understanding Tasks

Reward Stealing Attack on Large Language Models