AI research and discussion on LessWrong. www.lesswrong.com
Empirical case study measuring bio-weapon uplift from abliterated LLMs served through a cheap, no-filter chat service, finding high capability and compliance on dangerous-knowledge benchmarks and calling for regulation.
Reports a reusable universal jailbreak template combining known techniques, evaluated across 23 frontier models on ClearHarm, with per-model attack success rates and disclosure considerations; the prompt itself is withheld.
Red-teaming study showing diffusion language model DiffusionGemma can be jailbroken via in-fill and post-fill token pinning on the canvas, which has no autoregressive equivalent, with pre-fill attacks working on both diffusion and autoregressive models.}Tags: jailbreaks_adversarial primary, evals_capabilities secondary.}
Shows that multi-agent architecture choices (roles, topology, memory) strongly and unpredictably change exploitability to misuse, often making systems more vulnerable than single agents, so security must be tested per deployment.
Proposes Logit Path Extrapolation, which interpolates toward a less-safe model in logit space to estimate rare harmful compliance rates on HarmBench with about 30x fewer rollouts than naive sampling.
An informal test of whether Claude can autonomously find real vulnerabilities in /usr/bin binaries; it mostly produced false positives, and the author got past refusals by framing the request.
Authors jailbreak several frontier LLMs to generate phishing emails and test them on 108 elderly volunteers, finding 11% were phished, with Meta and Gemini models more easily jailbroken than ChatGPT and Claude.
Shows that steering vectors optimized on a single example can generalize across inputs to mediate alignment-faking behavior and refusal, achieving 96.9% attack success on HarmBench for Gemma-2-2B-it.