The Structural Safety Generalization Problem

Safety vulnerabilities exploit how AI processes information structure, not just content: The research shows that LLMs can be jailbroken by changing how a request is formatted (multi-turn conversations, multiple images, or translated text) even when the underlying harmful request remains semantically identical. This reveals that current safety measures focus too narrowly on what is being asked rather than how it's being asked.

Current AI safety defenses have a fundamental generalization problem: Safety training doesn't reliably transfer across different ways of presenting the same harmful request. The paper demonstrates this through systematic comparisons showing that "different structures yield different safety outcomes," suggesting that today's guardrails are brittle and can be circumvented through relatively simple reformatting tricks.

A practical near-term solution exists: The researchers propose a "Structure Rewriting Guardrail" that converts requests into formats easier for safety systems to evaluate. This approach "significantly improves refusal of harmful inputs, without over-refusing benign ones," offering a concrete defense that doesn't require completely redesigning AI systems.

This research identifies a tractable intermediate safety challenge: Rather than attempting to solve all jailbreaking at once, the paper frames structural safety as a specific, measurable problem that sits between current defenses and long-term AI safety goals. This focused approach could accelerate progress by making the problem more manageable for researchers.

Red-teaming with explainable, transferable attacks reveals systemic weaknesses: By designing attacks that are intentionally transparent and work across multiple models and harmful goals, the researchers created a framework that exposes how widespread these structural vulnerabilities are—suggesting this isn't a niche problem but a fundamental issue in current AI safety.