Multilingual LLMs answer the same multi-hop reasoning question across languages, but we lack a mechanistic account of whether they share an internal circuit. We identify Bridge Routing Heads (BRH) in two large multilingual LLMs through a three-stage pipeline. The resulting language-specific head sets exhibit near-complete mutual exclusivity across the five languages, with a mean Jaccard similarity of only 0.017 for Llama 3.1 70B and 0.057 for Qwen 2.5 72B, revealing language-idiosyncratic circuits. Ablating general BRH increases two-hop Negative Log-Likelihood (NLL) by 39-89× the random-head baseline, providing direct causal evidence of their role. Amplifying these heads in a failing target-language pass rescues up to 51.7% of cross-lingual failures, with no training. The two models share this dual-circuit pattern but allocate heads differently: Llama concentrates chaining in a large general pool, while Qwen leans on larger language-specific pools. Together these results show that activation-level intervention alone can recover correct answers from cross-lingual reasoning failures.

Activation-based jailbreak defenses rest on a fixed assumption: a successful jailbreak leaves an internal trace stable enough across attacks for one probe to catch new ones. We show it fails in mixture-of-experts language models. Within an attack, routing makes the jailbreak legible: router logits distinguish compliance from refusal, and a few experts carry the signal. But the signature does not survive across attacks. A routing probe trained on three attacks performs at chance on a held-out fourth (pooled leave-one-attack-out balanced accuracy 0.52, 95 percent CI [0.50, 0.61]). Controls on two dense models show near-chance residual-stream transfer to held-out roleplay, so the failure is not specific to MoE routing. Nor is it an artifact of separable regions of activation space: the comply-versus-refuse direction itself shifts across attacks at every network depth. One systematic trace remains in the compliance state’s effective dimensionality, but it is a signature of shape, not location, beyond directional probes. Across six open-weight MoE models and four jailbreak attacks, in routing and residual streams alike, the jailbroken state is legible and locally structured within each attack, yet its location is attack-specific. Reading activations alone cannot be assumed to catch a jailbreak the probe was not built for.

Understanding how Transformer-based language models store and retrieve factual associations is critical for improving interpretability and enabling targeted model editing. Prior work, primarily on GPT-style models, has identified MLP modules in early layers as key contributors to factual recall. However, it remains unclear whether these findings generalize across different autoregressive architectures. To address this, we conduct a comprehensive evaluation of factual recall across several models—including GPT, LLaMA, Qwen, and DeepSeek—analyzing where and how factual information is encoded and accessed. Consequently, we find that Qwen-based models behave differently from previous patterns: attention modules in the earliest layers contribute more to factual recall than MLP modules. Our findings suggest that even within the autoregressive Transformer family, architectural variations can lead to fundamentally different mechanisms of factual recall.