AI2030 Responsible AI Tools Marketplace

Key Takeaways

Safety-aligned LLMs have exploitable vulnerabilities: Despite being trained to refuse harmful requests, large language models can be easily jailbroken through simple linguistic changes like rephrasing requests in past tense, revealing significant gaps in current safety alignment methods.
Targeted attacks exploit specific model mechanisms: The research identifies that particular attention heads within models are causally responsible for these vulnerabilities, demonstrating that jailbreaks work by suppressing the model's internal "refusal-mediating direction" rather than through general reasoning flaws.
Surgical fixes can improve safety without sacrificing utility: ASGuard reduces jailbreak success rates across four different LLMs while maintaining the models' general capabilities and avoiding excessive over-refusal, achieving what researchers call a "Pareto-optimal balance between safety and utility."
Understanding model internals enables better defenses: By using circuit analysis to map which parts of the model handle refusal decisions, the researchers developed a more precise and efficient defense mechanism than broad retraining approaches, suggesting that mechanistic understanding of AI systems is key to responsible AI development.
Current alignment methods need deeper investigation: The paper highlights that the mechanisms underlying how LLMs learn to refuse harmful requests are "poorly understood," indicating that more research into model internals is necessary to build genuinely robust safety measures rather than brittle ones.

Abstract

Large language models (LLMs), despite being safety-aligned, exhibit brittle refusal behaviors that can be circumvented by simple linguistic changes. As tense jailbreaking demonstrates that models refusing harmful requests often comply when rephrased in past tense, a critical generalization gap is revealed in current alignment methods whose underlying mechanisms are poorly understood. In this work, we introduce Activation-Scaling Guard (ASGuard), an insightful, mechanistically-informed framework that surgically mitigates this specific vulnerability. In the first step, we use circuit analysis to identify the specific attention heads causally linked to the targeted jailbreaking such as a tense-changing attack. Second, we train a precise, channel-wise scaling vector to recalibrate the activation of tense vulnerable heads. Lastly, we apply it into a "preventative fine-tuning", forcing the model to learn a more robust refusal mechanism. Across four LLMs, ASGuard effectively reduces the attack success rate of targeted jailbreaking while preserving general capabilities and minimizing over refusal, achieving a Pareto-optimal balance between safety and utility. Our findings underscore how adversarial suffixes suppress the propagation of the refusal-mediating direction, based on mechanistic analysis. Furthermore, our work showcases how a deep understanding of model internals can be leveraged to develop practical, efficient, and targeted methods for adjusting model behavior, charting a course for more reliable and interpretable AI safety.

ICLR 2026, 29 pages, 11 figures

Key Takeaways

Safety-aligned LLMs have exploitable vulnerabilities: Despite being trained to refuse harmful requests, large language models can be easily jailbroken through simple linguistic changes like rephrasing requests in past tense, revealing significant gaps in current safety alignment methods.
Targeted attacks exploit specific model mechanisms: The research identifies that particular attention heads within models are causally responsible for these vulnerabilities, demonstrating that jailbreaks work by suppressing the model's internal "refusal-mediating direction" rather than through general reasoning flaws.
Surgical fixes can improve safety without sacrificing utility: ASGuard reduces jailbreak success rates across four different LLMs while maintaining the models' general capabilities and avoiding excessive over-refusal, achieving what researchers call a "Pareto-optimal balance between safety and utility."
Understanding model internals enables better defenses: By using circuit analysis to map which parts of the model handle refusal decisions, the researchers developed a more precise and efficient defense mechanism than broad retraining approaches, suggesting that mechanistic understanding of AI systems is key to responsible AI development.
Current alignment methods need deeper investigation: The paper highlights that the mechanisms underlying how LLMs learn to refuse harmful requests are "poorly understood," indicating that more research into model internals is necessary to build genuinely robust safety measures rather than brittle ones.

Abstract

ICLR 2026, 29 pages, 11 figures

ASGuard: Activation-Scaling Guard to Mitigate Targeted Jailbreaking Attack

Key Takeaways

Abstract

Paper Info

Responsible AI Topics

Links

ASGuard: Activation-Scaling Guard to Mitigate Targeted Jailbreaking Attack

Key Takeaways

Abstract

Paper Info

Responsible AI Topics

Links