---
title: "Using Topological Data Analysis to Characterize the Layers of"
description: "Existing analyses of these attacks examine only model outputs and reveal little about how the perturbation travels through the… 28 references."
authors: ["Adam Tang", "Catherine Liu", "Kimberly Lopez", "Shreya Subramanian", "Leif Zinn-Brooks", "Alexia E. Schulz", "Adaku Uchendu"]
year: 2026
venue: "Proceedings of the Second Workshop on Customizable NLP: Progress and Challenges in Customizing NLP for a Domain, Application, Group, or Individual (CustomNLP4U)"
source: "https://aclanthology.org/2026.customnlp4u-1.12/"
doi: "10.18653/v1/2026.customnlp4u-1.12"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/tang-2026-topological-data-analysis-characterize-layers/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/tang-2026-topological-data-analysis-characterize-layers/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/47/) / Using Topological Data Analysis to Characterize the Layers of Language Models Before and After Word Substitution Attacks

# Using Topological Data Analysis to Characterize the Layers of Language Models Before and After Word Substitution Attacks

**Authors:** Adam Tang, [Catherine Liu](https://md.research.elamur.ai/free/en/authors/catherine-liu/), [Kimberly Lopez](https://md.research.elamur.ai/free/en/authors/kimberly-lopez/), [Shreya Subramanian](https://md.research.elamur.ai/free/en/authors/shreya-subramanian/), [Leif Zinn-Brooks](https://md.research.elamur.ai/free/en/authors/leif-zinn-brooks/), [Alexia E. Schulz](https://md.research.elamur.ai/free/en/authors/alexia-e-schulz/) and [Adaku Uchendu](https://md.research.elamur.ai/free/en/authors/adaku-uchendu/) · **Year:** 2026 · **Venue:** [Proceedings of the Second Workshop on Customizable NLP: Progress and Challenges in Customizing NLP for a Domain, Application, Group, or Individual (CustomNLP4U)](https://md.research.elamur.ai/free/en/venues/customnlp4u/) ([Workshop on Customizable NLP: Progress and Challenges in Customizing NLP for a Domain, Application, Group, or Individual 2026](https://md.research.elamur.ai/free/en/venues/customnlp4u/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.customnlp4u-1.12/) · [PDF](https://aclanthology.org/2026.customnlp4u-1.12.pdf) · [DOI 10.18653/v1/2026.customnlp4u-1.12](https://doi.org/10.18653/v1/2026.customnlp4u-1.12) · [OpenAlex](https://openalex.org/W7166856119)

**Citations:** 0 citations (OpenAlex, 2026-10-14)

## Summary
Synonym-swapping attacks such as TextFooler can flip a classifier's predictions. Existing analyses of these attacks examine only model outputs and reveal little about how the perturbation travels through the network. This paper uses topological data analysis (TDA) to trace how such attacks reshape attention maps at each layer.

The authors fine-tuned BERT-base-uncased, RoBERTa-base and DistilBERT for binary sentiment classification on IMDb, truncating inputs to 128 tokens, and then attacked them with TextFooler. They converted each attention map into a distance matrix and computed persistent homology using Vietoris–Rips filtrations. Persistence diagrams for clean and attacked texts were compared with Wasserstein distances, alongside a simpler per-head L1 baseline on raw attention values.

In all three models, the attacks caused statistically significant topological shifts. The changes were largest in late layers, smaller but still visible in early layers, and weakest in the middle. Global structure was altered while local features stayed mostly stable. TDA separated layers more sharply than the L1 baseline. This makes it an interpretable way to locate vulnerable parts of a model and could help adjust prediction confidence.

## Key points
- **Data and models:** IMDb has 50,000 reviews, split evenly between positive and negative, averaging 231 words. Each model received a dropout plus linear classification head. BERT and RoBERTa exceeded 90% test accuracy, and DistilBERT exceeded 80%.
- **TDA features:** The analysis tracks H0 (connected components) and H1 (loops) features. The authors introduce persistence survival curves to highlight changes in high-persistence tails. Layers 0, 6 and 11 are visualized as early, middle and late layers.
- **Statistical validation:** Log-transformed Wasserstein distances were tested with Kruskal–Wallis plus Dunn and with one-way ANOVA plus Tukey. The results show U- or W-shaped sensitivity across layers.
- **Limitations:**
  - The per-layer analysis covers only the 20 examples with the largest logit change.
  - Wasserstein distance measures the size of a change but not its direction.
  - Computation is cubic in the number of H1 features, so the authors suggest the bottleneck distance as a faster alternative.
- **Code:** Available on GitHub (angelinatsai04/mitll_clinic, branch adam_spring). All models and datasets are open-source on Hugging Face.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Harvey Mudd College](https://md.research.elamur.ai/free/en/universities/harvey-mudd-college/) — University, Claremont, United States · 3 works · 21 citations
- [MIT Lincoln Laboratory](https://md.research.elamur.ai/free/en/labs/mit-lincoln-laboratory/) — Research institute, Lexington, United States · 4 works

📚 Shelves (5): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 16,667 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 16,194 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 16,039 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 15,891 works · [🧮 Computational Theory and Mathematics](https://md.research.elamur.ai/free/en/shelves/computer-science/computational-theory-and-mathematics/) · 252 works

🧭 Topics (1): [🧠 Language models & pretraining](https://md.research.elamur.ai/free/en/topics/language-models/) · 3,320 works

## Cite

Cite as: Adam Tang, Catherine Liu, Kimberly Lopez, Shreya Subramanian, Leif Zinn-Brooks, Alexia E. Schulz and Adaku Uchendu. 2026. Using Topological Data Analysis to Characterize the Layers of Language Models Before and After Word Substitution Attacks. Proceedings of the Second Workshop on Customizable NLP: Progress and Challenges in Customizing NLP for a Domain, Application, Group, or Individual (CustomNLP4U).

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{tang2026using,
  title = {{Using Topological Data Analysis to Characterize the Layers of Language Models Before and After Word Substitution Attacks}},
  author = {Adam Tang, Catherine Liu, Kimberly Lopez, Shreya Subramanian, Leif Zinn-Brooks, Alexia E. Schulz and Adaku Uchendu},
  booktitle = {Proceedings of the Second Workshop on Customizable NLP: Progress and Challenges in Customizing NLP for a Domain, Application, Group, or Individual (CustomNLP4U)},
  year = {2026},
  doi = {10.18653/v1/2026.customnlp4u-1.12},
  url = {https://doi.org/10.18653/v1/2026.customnlp4u-1.12}
}
```

- [← previous Using the Mimi codec for metalinguistic representations](https://md.research.elamur.ai/free/en/papers/saloev-2026-mimi-codec-metalinguistic-representations/)
- [next → Using Vedalakṣaṇa texts for the validation and normalization of Vedic Corpus](https://md.research.elamur.ai/free/en/papers/svarupa-2026-vedalak-texts-validation-normalization-vedic/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/47/)

## References

28 references, 5 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Kenneth Alperin, Rohan Leekha, Adaku Uchendu, Trang Nguyen, Srilakshmi Medarametla, Carlos Levya Capote, Seth Aycock, and Charlie Dagli. 2025. Masks and mimicry: Strategic obfuscation and impersonation attacks on authorship verification. In Proceedings of the 5th International Conference on Natural… [find](https://scholar.google.com/scholar?q=Kenneth+Alperin%2C+Rohan+Leekha%2C+Adaku+Uchendu%2C+Trang+Nguyen%2C+Srilakshmi+Medarametla%2C+Carlos+Levya+Capote%2C+Seth+Aycock%2C+and+Charlie+Dagli%2E+2025%2E+Masks+and+mimicry%3A+Strategic+obfuscation+and+impersonatio)
2. Erik Arakelyan, Zhaoqi Liu, and Isabelle Augenstein. 2024. Semantic sensitivities and inconsistent predictions: Measuring the fragility of nli models. In Proceedings of the 18th Conference of the European Chapter of the Association for Computational Linguistics (Volume 1: Long Papers), pages 432–444… [find](https://scholar.google.com/scholar?q=Erik+Arakelyan%2C+Zhaoqi+Liu%2C+and+Isabelle+Augenstein%2E+2024%2E+Semantic+sensitivities+and+inconsistent+predictions%3A+Measuring+the+fragility+of+nli+models%2E+In+Proceedings+of+the+18th+Conference+of+the+Euro)
3. Jatin Chauhan and Manohar Kaul. 2022. Bertops: Studying bert representations under a topological lens. In 2022 International Joint Conference on Neural Networks (IJCNN), pages 1–8. IEEE. text detection via examining the topology of attention maps. In Proceedings of the 2021 Conference on Empirical M… [find](https://scholar.google.com/scholar?q=Jatin+Chauhan+and+Manohar+Kaul%2E+2022%2E+Bertops%3A+Studying+bert+representations+under+a+topological+lens%2E+In+2022+International+Joint+Conference+on+Neural+Networks+%28IJCNN%29%2C+pages+1%E2%80%938%2E+IEEE%2E+text+detectio)
4. Jin Chen, Zheng Liu, Xu Huang, Chenwang Wu, Qi Liu, Gangwei Jiang, Yuanhao Pu, Yuxuan Lei, Xiaolong Chen, Xingmei Wang, and 1 others. 2024. When large language models meet personalization: Perspectives of challenges and opportunities. World wide web, 27(4):42. [find](https://scholar.google.com/scholar?q=Jin+Chen%2C+Zheng+Liu%2C+Xu+Huang%2C+Chenwang+Wu%2C+Qi+Liu%2C+Gangwei+Jiang%2C+Yuanhao+Pu%2C+Yuxuan+Lei%2C+Xiaolong+Chen%2C+Xingmei+Wang%2C+and+1+others%2E+2024%2E+When+large+language+models+meet+personalization%3A+Perspective)
5. Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. 2019. [Roberta: A robustly optimized bert pretraining approach](https://md.research.elamur.ai/free/en/papers/liu-2019-roberta-robustly-optimized-bert-pretraining/). Preprint, arXiv:1907.11692.
6. David Cohen-Steiner, Herbert Edelsbrunner, and John Harer. 2005. Stability of persistence diagrams. In Proceedings of the twenty-first annual symposium on Computational geometry, pages 263–271. [find](https://scholar.google.com/scholar?q=David+Cohen%2DSteiner%2C+Herbert+Edelsbrunner%2C+and+John+Harer%2E+2005%2E+Stability+of+persistence+diagrams%2E+In+Proceedings+of+the+twenty%2Dfirst+annual+symposium+on+Computational+geometry%2C+pages+263%E2%80%93271%2E)
7. Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. [BERT: Pre-training of deep bidirectional transformers for language understanding](https://md.research.elamur.ai/free/en/papers/devlin-2019-bert-pre-training-deep-bidirectional/). In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies,…
8. Herbert Edelsbrunner, John Harer, and 1 others. 2008. Persistent homology-a survey. Contemporary mathematics, 453(26):257–282. [find](https://scholar.google.com/scholar?q=Herbert+Edelsbrunner%2C+John+Harer%2C+and+1+others%2E+2008%2E+Persistent+homology%2Da+survey%2E+Contemporary+mathematics%2C+453%2826%29%3A257%E2%80%93282%2E)
9. Aideen Fay, Inés García-Redondo, Qiquan Wang, Haim Dubossarsky, and Anthea Monod. 2026. The shape of adversarial influence: Characterizing LLM latent spaces with persistent homology. In The Fourteenth International Conference on Learning Representations. [find](https://scholar.google.com/scholar?q=Aideen+Fay%2C+In%C3%A9s+Garc%C3%ADa%2DRedondo%2C+Qiquan+Wang%2C+Haim+Dubossarsky%2C+and+Anthea+Monod%2E+2026%2E+The+shape+of+adversarial+influence%3A+Characterizing+LLM+latent+spaces+with+persistent+homology%2E+In+The+Fourteenth)
10. Neil Fendley, Edward W. Staley, Joshua Carney, William Redman, Marie Chau, and Nathan Drenkow. 2025. A systematic review of poisoning attacks against large language models. Preprint, arXiv:2506.06518. — [arXiv:2506.06518](https://arxiv.org/abs/2506.06518) [find](https://scholar.google.com/scholar?q=Neil+Fendley%2C+Edward+W%2E+Staley%2C+Joshua+Carney%2C+William+Redman%2C+Marie+Chau%2C+and+Nathan+Drenkow%2E+2025%2E+A+systematic+review+of+poisoning+attacks+against+large+language+models%2E+Preprint%2C+arXiv%3A2506%2E06518%2E)
11. Jerry L. Hintze and Ray D. Nelson. 1998. Violin plots: A box plot-density trace synergism. The American Statistician, 52(2):181–184. [find](https://scholar.google.com/scholar?q=Jerry+L%2E+Hintze+and+Ray+D%2E+Nelson%2E+1998%2E+Violin+plots%3A+A+box+plot%2Ddensity+trace+synergism%2E+The+American+Statistician%2C+52%282%29%3A181%E2%80%93184%2E)
12. Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. 2020. [Is bert really robust? a strong baseline for natural language attack on text classification and entailment](https://md.research.elamur.ai/free/en/papers/jin-2019-bert-really-robust-strong-baseline/). In Proceedings of the AAAI conference on artificial intelligence, volume 34, pages 8018–8025.
13. Goro Kobayashi, Tatsuki Kuribayashi, Sho Yokoi, and Kentaro Inui. 2020. [Attention is not only a weight: Analyzing transformers with vector norms](https://md.research.elamur.ai/free/en/papers/kobayashi-2020-attention-is-not-only-weight/). In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 7057–7075.
14. Laida Kushnareva, Daniil Cherniavskii, Vladislav Mikhailov, Ekaterina Artemova, Serguei Barannikov, Alexander Bernstein, Irina Piontkovskaya, Dmitri Piontkovski, and Evgeny Burnaev. 2021. [find](https://scholar.google.com/scholar?q=Laida+Kushnareva%2C+Daniil+Cherniavskii%2C+Vladislav+Mikhailov%2C+Ekaterina+Artemova%2C+Serguei+Barannikov%2C+Alexander+Bernstein%2C+Irina+Piontkovskaya%2C+Dmitri+Piontkovski%2C+and+Evgeny+Burnaev%2E+2021%2E)
15. Artificial Patrick E McKight and Julius Najab. 2010. Kruskal-wallis test. In The Corsini Encyclopedia of Psychology, pages 1–10. Wiley Online Library. [find](https://scholar.google.com/scholar?q=Artificial+Patrick+E+McKight+and+Julius+Najab%2E+2010%2E+Kruskal%2Dwallis+test%2E+In+The+Corsini+Encyclopedia+of+Psychology%2C+pages+1%E2%80%9310%2E+Wiley+Online+Library%2E)
16. Ilan Perez and Raphael Reinauer. 2022. The topological bert: Transforming attention into topology for natural language processing. arXiv preprint arXiv:2206.15195. — [arXiv:2206.15195](https://arxiv.org/abs/2206.15195) [find](https://scholar.google.com/scholar?q=Ilan+Perez+and+Raphael+Reinauer%2E+2022%2E+The+topological+bert%3A+Transforming+attention+into+topology+for+natural+language+processing%2E+arXiv+preprint+arXiv%3A2206%2E15195%2E+%E2%80%94+%5BarXiv%3A2206%2E15195%5D%28https%3A%2F%2Farxiv%2Eo)
17. Fanchao Qi, Yuan Yao, Sophia Xu, Zhiyuan Liu, and Maosong Sun. 2021. Turn the combination lock: Learnable textual backdoor attacks via word substitution. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural… [find](https://scholar.google.com/scholar?q=Fanchao+Qi%2C+Yuan+Yao%2C+Sophia+Xu%2C+Zhiyuan+Liu%2C+and+Maosong+Sun%2E+2021%2E+Turn+the+combination+lock%3A+Learnable+textual+backdoor+attacks+via+word+substitution%2E+In+Proceedings+of+the+59th+Annual+Meeting+of+t)
18. Thomas J. Quirk. 2021. One-way analysis of variance (anova). In Excel 2019 for Social Science Statistics: A Guide to Solving Practical Problems, pages 167– 184, Cham. Springer International Publishing. [find](https://scholar.google.com/scholar?q=Thomas+J%2E+Quirk%2E+2021%2E+One%2Dway+analysis+of+variance+%28anova%29%2E+In+Excel+2019+for+Social+Science+Statistics%3A+A+Guide+to+Solving+Practical+Problems%2C+pages+167%E2%80%93+184%2C+Cham%2E+Springer+International+Publishing)
19. Murray Rosenblatt. 1956. Remarks on some nonparametric estimates of a density function. The Annals of Mathematical Statistics, 27(3):832–837. [find](https://scholar.google.com/scholar?q=Murray+Rosenblatt%2E+1956%2E+Remarks+on+some+nonparametric+estimates+of+a+density+function%2E+The+Annals+of+Mathematical+Statistics%2C+27%283%29%3A832%E2%80%93837%2E)
20. Ludger Rüschendorf. 1985. The wasserstein distance and approximation theorems. Probability Theory and Related Fields, 70(1):117–129. [find](https://scholar.google.com/scholar?q=Ludger+R%C3%BCschendorf%2E+1985%2E+The+wasserstein+distance+and+approximation+theorems%2E+Probability+Theory+and+Related+Fields%2C+70%281%29%3A117%E2%80%93129%2E)
21. Michael Scholkemper, Damin Kühn, Gerion Nabbe-feld, Simon Musall, Björn Kampa, and Michael T. Schaub. 2024. A wasserstein graph distance based on distributions of probabilistic node embeddings. In ICASSP 2024 - 2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), p… [find](https://scholar.google.com/scholar?q=Michael+Scholkemper%2C+Damin+K%C3%BChn%2C+Gerion+Nabbe%2Dfeld%2C+Simon+Musall%2C+Bj%C3%B6rn+Kampa%2C+and+Michael+T%2E+Schaub%2E+2024%2E+A+wasserstein+graph+distance+based+on+distributions+of+probabilistic+node+embeddings%2E+In+ICA)
22. Donald R Sheehy. 2012. Linear-size approximations to the vietoris-rips filtration. In Proceedings of the twenty-eighth annual symposium on Computational geometry, pages 239–248. [find](https://scholar.google.com/scholar?q=Donald+R+Sheehy%2E+2012%2E+Linear%2Dsize+approximations+to+the+vietoris%2Drips+filtration%2E+In+Proceedings+of+the+twenty%2Deighth+annual+symposium+on+Computational+geometry%2C+pages+239%E2%80%93248%2E)
23. Adaku Uchendu and Thai Le. 2024. Unveiling topological structures from language: A survey of topological data analysis applications in nlp. arXiv preprint arXiv:2411.10298. — [arXiv:2411.10298](https://arxiv.org/abs/2411.10298) [find](https://scholar.google.com/scholar?q=Adaku+Uchendu+and+Thai+Le%2E+2024%2E+Unveiling+topological+structures+from+language%3A+A+survey+of+topological+data+analysis+applications+in+nlp%2E+arXiv+preprint+arXiv%3A2411%2E10298%2E+%E2%80%94+%5BarXiv%3A2411%2E10298%5D%28https%3A)
24. Adaku Uchendu, Thai Le, and Dongwon Lee. 2024. Topformer: Topology-aware authorship attribution of deepfake texts with diverse writing styles. In 27th European Conference on Artificial Intelligence, ECAI 2024, pages 1446–1454. IOS Press BV. [find](https://scholar.google.com/scholar?q=Adaku+Uchendu%2C+Thai+Le%2C+and+Dongwon+Lee%2E+2024%2E+Topformer%3A+Topology%2Daware+authorship+attribution+of+deepfake+texts+with+diverse+writing+styles%2E+In+27th+European+Conference+on+Artificial+Intelligence%2C+E)
25. B Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. 2017. [Attention is all you need](https://md.research.elamur.ai/free/en/papers/vaswani-2017-attention-all-need/). Advances in neural information processing systems, 30.
26. Minh Vu, Geigh Zollicoffer, Huy Mai, Ben Nebgen, Boian Alexandrov, and Manish Bhattarai. 2025. Topological signatures of adversaries in multimodal alignments. In Forty-second International Conference on Machine Learning. [find](https://scholar.google.com/scholar?q=Minh+Vu%2C+Geigh+Zollicoffer%2C+Huy+Mai%2C+Ben+Nebgen%2C+Boian+Alexandrov%2C+and+Manish+Bhattarai%2E+2025%2E+Topological+signatures+of+adversaries+in+multimodal+alignments%2E+In+Forty%2Dsecond+International+Conference+)
27. Larry Wasserman. 2018. Topological data analysis. Annual review of statistics and its application, 5(2018):501–532. [find](https://scholar.google.com/scholar?q=Larry+Wasserman%2E+2018%2E+Topological+data+analysis%2E+Annual+review+of+statistics+and+its+application%2C+5%282018%29%3A501%E2%80%93532%2E)
28. Xiaoyu Zhang, Cen Zhang, Tianlin Li, Yihao Huang, Xiaojun Jia, Ming Hu, Jie Zhang, Yang Liu, Shiqing Ma, and Chao Shen. 2025. Jailguard: A universal detection framework for prompt-based attacks on llm systems. ACM Trans. Softw. Eng. Methodol., 35(1). .1 Code Availability Our implementation for adver… [find](https://scholar.google.com/scholar?q=Xiaoyu+Zhang%2C+Cen+Zhang%2C+Tianlin+Li%2C+Yihao+Huang%2C+Xiaojun+Jia%2C+Ming+Hu%2C+Jie+Zhang%2C+Yang+Liu%2C+Shiqing+Ma%2C+and+Chao+Shen%2E+2025%2E+Jailguard%3A+A+universal+detection+framework+for+prompt%2Dbased+attacks+on+llm)

*Updated 1 November 2026*