Proposes META-IR, a meta-learning dual-loop introspective reasoning framework that adapts LLM safety alignment to unseen jailbreak attacks, improving robustness and adaptation speed over baselines.
Proposes Addition by Subtraction, which removes safety-critical neurons during finetuning plus preference optimization so safety does not depend on sparse components, cutting jailbreak and pruning attack success substantially.
Proposes BrainwashedLLM, an RL-trained attack that generates adversarial reasoning traces transferable zero-shot to black-box large reasoning models to elicit harmful outputs, and urges architectural defenses.
Proposes an RL-trained assess-decide-respond defender that commits to an explicit safety decision, improving multi-turn jailbreak resistance while preserving utility across fourteen benchmarks.
Template-based pipeline builds a 60-language refusal and benign safety corpus (MSafeTemp), showing English-only evaluation misses multilingual jailbreaks and that template data improves non-English safety.
Proposes Adversarial Self-Distillation, where a model distills its own refusal behaviour from clean prompts into adversarially perturbed prefixes, lowering attack success and recovering refusals after compliant openings.
Proposes REACT, a one-time activation steering intervention on early chain-of-thought states learned from safe and unsafe trajectories, which raises safe outputs on StrongREJECT from 29% to 82% on an 8B reasoning model.}
Proposes Joint Weight Perturbations, an alignment-stage defense that trains LLMs on combinations of masked harmful weight perturbations to resist harmful fine-tuning while preserving task performance.
Shows benign fine-tuning can erode LLM safety by inducing refusal-to-compliance shifts, introducing SAFEOFF, a benign dataset that weakens safety alignment across three aligned models.
Proposes SAFE-PRO, which uses an uncertainty signal to decide when MLLMs should ask clarifying safety questions and when to apply path optimization, reducing unsafe completions and over-refusal versus SRPO.
Shows that running recurrent-depth LMs with fewer loops removes refusal behaviour while harmfulness stays linearly readable, and that randomized-depth safety training mitigates this.
Introduces GUISE, a cross-language benchmark showing narrative wrappers bypass LLM refusals, and AXIS, a preference-optimisation defense using refusal-direction alignment that improves safety and usability.
Proposes SLDR, a post-fine-tuning defense that recovers safety by training a LoRA adapter on the most sensitive layers and routing it to malicious queries, restoring refusal behaviour while keeping utility.
Evaluates jailbreak robustness across recurrent depths of looped language models, finds safety gaps that SFT and preference tuning miss, and proposes SafeBridge to reduce attack success.
Proposes ASCENT, a fine-tuning method that periodically recalibrates a safety subspace via first-order optimal updates to jointly improve LLM safety and downstream utility, reducing attack success rates.
Proposes ReSA, a jailbreak attack that uses inverse reinforcement learning to recover an LLM's latent safety reward and reverses it via reward-guided decoding, transferring across prompts and models.
Shows VLMs refuse harmful requests as VQA questions but often comply when asked for grounding outputs, and proposes fine-tuning that closes much of this safety gap without raising over-refusal.}
Proposes SSRFT, a supervised fine-tuning method that teaches LLMs an internalized safe role instead of refusal patterns, improving jailbreak robustness and reducing over-refusal.
Proposes a target-free adversarial training method that perturbs latent representations to generate diverse harmful behaviors, improving LLM robustness to jailbreak attacks as measured by semantic entropy.
Proposes TRACE, a token-level training objective with theoretical bounds to reduce multi-turn jailbreak attack success in safety-aligned LLMs while preserving utility on MMLU and HellaSwag.
Shows that token-level adaptive layer-skipping models become less safe, and introduces SafeDepth, a frozen-backbone router and adapter trained to cut harmful responses while saving computation.
Proposes fine-tuning LLMs against activation probes for harmfulness and dishonesty, finding continuously updated probes improve safety, resist jailbreaks, and keep concepts linearly readable for oversight.
Proposes ACTR, a method that aligns reasoning traces and responses across languages via neuron-selective consistency optimization, lowering jailbreak attack success rates in multilingual reasoning LLMs while preserving capabilities.
Proposes SURE, a framework that builds adversarial-prompt taxonomies, templated safe responses and a safety score to customize and align LLM safety, tested on several base models.
Proposes VaccineBooster, combining embedding perturbation and gradient attenuation to defend aligned LLMs against harmful fine-tuning, with a trade-off between content safety and refusal retention observed on Llama-2-7B.}
Distills constitution-consistent behavior into low-rank adapters and steering vectors that improve jailbreak defense and alignment, especially at long contexts and under multi-turn attacks, with tunable strength at inference.
Proposes a Contrastive Safety Loss that modulates how strongly a safety instruction shapes LLM outputs, trading off attack success against over-refusal and yielding Pareto-improved safety instructions.
Proposes DeShortcut-Align, a training framework that decouples spurious formatting and lexical shortcuts in LRM safety alignment, reducing over-refusal and template-stripping bypass while preserving reasoning.
Proposes EOPSA, an efficient on-policy self-distillation method for LLM safety alignment that limits rollout length and backpropagates only through safety-critical tokens, improving safety and reasoning retention.
Shows molecular multimodal models are jailbreakable on hazardous molecules and proposes SafeMol, a parameter-efficient safety-alignment framework with a benchmark that cuts attack success while keeping over-refusal low and utility intact.
Uses rule-based, invertible semantic-preserving input transformations to probe LLM alignment generalization, finding that harmful rates rise sharply while task utility is largely retained across eight models.
Introduces Supervised Transcoder Replacement, which trains an MLP replacement so activation steering can strengthen target behaviours like corrigibility without degrading safety, cutting out-of-distribution harmful-request attack success rates substantially.
Introduces cunning questions with misleading premises as training data to build model vigilance, improving robustness to out-of-distribution jailbreaks and complementing standard safety alignment.
Explains why post-hoc safety training is fragile geometrically, shows benign fine-tuning restores refusals, and proposes pretraining-time safety co-training that makes refusal robust to attacks across scales.
Shows that benign biographical facts in context can induce a harmful persona that voices misaligned views on unrelated questions, evading content filters, without finetuning or harmful demonstrations.
Shows that boilerplate refusal statements in safety-tuning data drive over-refusal of benign queries, and training on rationales alone reduces false refusals while keeping safety.
Proposes SEAL, a parameter-efficient training-time adapter on MoE shared experts that hardens LLM safety against jailbreaks, malicious fine-tuning and pruning, cutting attack success by up to 60%.
Empirically compares SFT, DPO and guard models for Arabic LLM safety, measuring the trade-off between refusing harmful prompts and over-refusing benign ones across five models.
Shows that merged models sharing a pretrained backbone inherit a jailbreak risk, and proposes Basin-Aware Jailbreak, a min-max optimised adversarial suffix that transfers across merged model families.
Shows refusal directions arise from first-token refusal training losses and are brittle due to repetitive refusal starts; diverse refusal prefixes raise stable rank, hardening models against refusal vector ablation attacks.