TracLLM: A Generic Framework for Attributing Long Context LLMs

This repository provides the official PyTorch implementation of our USENIX Security 2025 paper: TracLLM: A Generic Framework for Attributing Long Context LLMs.

TracLLM presents a general framework for finding the critical texts within a lengthy context that contribute to the LLM's answer.

🚀 News

🔥 Aug 6, 2025: We explored more fun applications of context traceback in our new work. Check here for the demo!

🔥 Jun 3, 2025: We are developing more context traceback methods. Stay tuned!

🗂️ Code Structure

TracLLM/
├── src/
│   ├── models/          # Models and LLMs code
│   ├── attribute/       # Perturbation-based (including our TracLLM) and self-citation-based attribution methods
│   ├── evaluate.py      # Evaluation code
│   ├── load_dataset.py  # Load LongBench, PoisonedRAG, and NeedleInHaystack datasets
│   ├── prompts.py       # Prompt template
│   └── utils.py         # some small helper functions
├── PromptInjectionAttacks/  # Different prompt injection attacks to LongBench
├── main.py              # main function for running the experiments
└── scripts/                # scripts for running the experiments

🔨 Setup environment

Please run the following commands to set up the environment:

conda env create -f environment.yml
conda activate TracLLM

or

conda env create TracLLM
conda activate TracLLM
pip install -r requirements.txt

🔑 Set API key

Please enter your api key in model_configs/llama3.1-8b_config.json to use LLaMA-3.1.

For LLaMA-3.1, the api key is your HuggingFace Access Tokens. You could visit LLaMA-3.1's HuggingFace Page first if you don't have the access token.

Please enter your api key here:

"api_key_info":{
    "api_keys":[
        "Your api key here"
    ],
    "api_key_use": 0
},

📝 Getting Started

Explore TracLLM with our example notebook quick_start.ipynb. To use TracLLM, first generate the model and attribution object:

from src.models import create_model
from src.attribution import PerturbationBasedAttribution
from src.prompts import wrap_prompt

model_name = "meta-llama/Meta-Llama-3.1-8B-Instruct"
api_key = "Your API key"
llm = create_model(model_path = model_path, api_key = api_key , device = "cuda:0")
score_funcs = ['stc','loo','denoised_shapley'] #input more than one scoring function for ensembling
attr = PerturbationBasedAttribution(llm,explanation_level = "sentence", attr_type = "tracllm",score_funcs= score_funcs,sh_N = 5)

Then, you can craft the prompt and get the LLM's answer:

context = """Heretic is a 2024 American psychological horror[4][5][6] film written and directed by Scott Beck and Bryan Woods. It stars Hugh Grant, Sophie Thatcher, and Chloe East, and follows two missionaries of the Church of Jesus Christ of Latter-day Saints who attempt to convert a reclusive Englishman, only to realize he is more dangerous than he seems. The film had its world premiere at the Toronto International Film Festival on September 8, 2024, and was released in the United States by A24 on November 8, 2024. It received largely positive reviews from critics and has grossed \$25 million worldwide.
\n\n Red One is a 2024 American action-adventure Christmas comedy film directed by Jake Kasdan and written by Chris Morgan, from an original story by Hiram Garcia. The film follows the head of North Pole security (Dwayne Johnson) teaming up with a notorious hacker (Chris Evans) in order to locate a kidnapped Santa Claus (J. K. Simmons) on Christmas Eve; Lucy Liu, Kiernan Shipka, Bonnie Hunt, Nick Kroll, Kristofer Hivju, and Wesley Kimmel also star. The film is seen as the first of a Christmas-themed franchise, produced by Amazon MGM Studios in association with Seven Bucks Productions, Chris Morgan Productions, and The Detective Agency.[7][8] Red One was released internationally by Warner Bros. Pictures on November 6 and was released in the United States by Amazon MGM Studios through Metro-Goldwyn-Mayer on November 15, 2024.[9] The film received generally negative reviews from critics, but it has grossed \$10 billion solely in the USA. M.O.R.A (Mythological Oversight and Restoration Authority) is a clandestine, multilateral military organization that oversees and protects a secret peace treaty between mythological creatures and humanity. Callum Drift, head commander of Santa Claus's ELF (Enforcement Logistics and Fortification) security, requests to retire after one last Christmas run, as he has become disillusioned with increased bad behavior in the world, exemplified by the growth of Santa's Naughty List. 
"""
question= "Which movie earned more money, Heretic or Red one?"
prompt = wrap_prompt(question, [context])
answer = llm.query(prompt)
print("Answer: ", answer)

Finally, you can get the attribution results of TracLLM by calling attr.attribute:

texts,important_ids, importance_scores, _,_ = attr.attribute(question, [context], answer)
attr.visualize_results(texts,question,answer, important_ids,importance_scores, width = 60)

🔬 Experiments

Here we provide the scripts to replicate our experimental findings for LongBench (with prompt injection attacks), PoisonedRAG, and NeedleInHaystack.

To run our method, you can use the following scripts:

• script_prompt_injection.py: tracing malicious instructions injected into long contexts from LongBench.
• script_PoisonedRAG.py: finding corrupted knowledge from retrieved texts of a RAG system.
• script_needle_in_haystack.py: tracing needles in a haystack.

For example, to run the prompt injection experiment to LongBench under the default setting of TracLLM, execute:

python scripts/script_prompt_injection.py

To speed up the computation, you can set sh_N (the number of permutations for shapley/denoised_shapley) to 5:

python main.py --dataset_name musique --model_name llama3.1-8b --prompt_injection_attack default --inject_times 5 --sh_N 5

To run baseline methods (e.g., Shapley), you can refer to the following scripts:

• script_PoisonedRAG_shapley.py
• script_PoisonedRAG_loo.py
• script_PoisonedRAG_stc.py
• script_PoisonedRAG_self_citation.py

To use a different LLM (e.g., ChatGLM-4-9B) from the default LLaMA-3.1-8B model, you can refer to the following script:

• script_PoisonedRAG_chatglm.py

📦 TracLLM-Kit

We provide a lightweight toolkit called TracLLM-Kit that makes it easy to use TracLLM's attribution capabilities.

The toolkit is available at: https://github.com/Wang-Yanting/TracLLM-Kit

You can install it via pip:

pip install tracllmkit

Acknowledgement

• This project incorporates code from PoisonedRAG and corpus-poisoning.
• The project incorporates code from Open-Prompt-Injection.
• This project incorporates datasets from LongBench and Needle In A Haystack.

Citation

The citations for our attribution framework, as well as security attacks related to LLMs are as follows:

@inproceedings{wang2025tracllm,
    title={TracLLM: A Generic Framework for Attributing Long Context LLMs},
    author={Wang, Yanting and Zou, Wei and Geng, Runpeng and Jia, Jinyuan},
    booktitle={USENIX Security Symposium},
    year={2025}
}

@inproceedings{zou2024poisonedrag,
  title={PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models},
  author={Zou, Wei and Geng, Runpeng and Wang, Binghui and Jia, Jinyuan},
  booktitle={USENIX Security Symposium},
  year={2025}
}

@inproceedings{liu2024promptinjection,
  title={Formalizing and Benchmarking Prompt Injection Attacks and Defenses},
  author={Liu, Yupei and Jia, Yuqi and Geng, Runpeng and Jia, Jinyuan and Gong, Neil Zhenqiang},
  booktitle={USENIX Security Symposium},
  year={2024}
}