With the growing popularity of general-purpose Large Language Models (LLMs), comes a need for more global explanations of model behaviors.Concept-based explanations arise as a promising avenue for explaining high-level patterns learned by LLMs.Yet their evaluation poses unique challenges, especially due to their non-local nature and high dimensional representation in a model's hidden space.Current methods approach concepts from different perspectives, lacking a unified formalization.This makes evaluating the core measures of concepts, namely faithfulness or readability, challenging.To bridge the gap, we introduce a formal definition of concepts generalizing to diverse concept-based explanations' settings.Based on this, we quantify the faithfulness of a concept explanation via perturbation.We ensure adequate perturbation in the highdimensional space for different concepts via an optimization problem.Readability is approximated via an automatic and deterministic measure, quantifying the coherence of patterns that maximally activate a concept while aligning with human understanding.Finally, based on measurement theory, we apply a metaevaluation method for evaluating these measures, generalizable to other types of explanations or tasks as well.Extensive experimental analysis has been conducted to inform the selection of explanation evaluation measures.

Despite careful safety alignment, current large language models (LLMs) remain vulnerable to various attacks. To further unveil the safety risks of LLMs, we introduce a Safety Concept Activation Vector (SCAV) framework, which effectively guides the attacks by accurately interpreting LLMs' safety mechanisms. We then develop an SCAV-guided attack method that can generate both attack prompts and embedding-level attacks with automatically selected perturbation hyperparameters. Both automatic and human evaluations demonstrate that our attack method significantly improves the attack success rate and response quality while requiring less training data. Additionally, we find that our generated attack prompts may be transferable to GPT-4, and the embedding-level attacks may also be transferred to other white-box LLMs whose parameters are known. Our experiments further uncover the safety risks present in current LLMs. For example, in our evaluation of seven open-source LLMs, we observe an average attack success rate of 99.14%, based on the classic keyword-matching criterion. Finally, we provide insights into the safety mechanism of LLMs. The code is available at https://github.com/SproutNan/AI-Safety_SCAV.