Shows that linear probes on pre-decoding hidden states of diffusion LLMs detect jailbreaks that prompt-only probes miss, and fuses both into ReFuse, cutting attack success to 3.31%.
Proposes CMaG, a training-free activation-steering method that turns refusals into compliance in vision-language models, showing compositional safety scores can look strong yet remain fragile to internal intervention.
Shows that encoder-based context compression weakens refusal in instruction-tuned LLMs despite faithful reconstruction, traces this to attenuated refusal direction, and restores refusals with inference-time Memory Steering.
Proposes TraceRouter++, which uses SAEs and causal feature tracing to locate harmful routing circuits and softly realign them via optimal transport, improving jailbreak robustness across LLMs, MLLMs and diffusion models.
Proposes J-Anchor, a training-free inference-time defense that restores weakened refusal signals in J-space to block prefill jailbreaks, while preserving benign behaviour and reasoning.
Proposes TARGRS, a test-time representation-steering method with a reward model over toxicity transitions to detoxify LLM and vision-language model outputs while preserving capabilities.
Frames automated red-team auditing as an MDP and uses beam search guided by linear probes on model activations predicting future judge scores, raising audit success about 50%.
Proposes ADTGuard, a streaming safeguard that checks each token before release by reading safety signals from adaptively chosen internal layers, with only 16M trainable parameters.
Localizes safety-relevant representations across layers in frozen vision-language models and shows that steering early-layer activations along a safety direction controls refusals, exposing a white-box refusal-bypass surface.
Proposes REACT, a one-time activation steering intervention on early chain-of-thought states learned from safe and unsafe trajectories, which raises safe outputs on StrongREJECT from 29% to 82% on an 8B reasoning model.}
Optimizes discrete token prefixes with GCG to imitate function vectors, filter heads and steering directions in Olmo, finding they shift behaviour more than direct injection and raising opaque-interface concerns.
Proposes WRDO, which learns weighted combinations of per-prompt refusal directions to more effectively disrupt refusal in aligned LLMs, and uses the same method to restore refusal in an abliterated model.
Tests whether refusal directions transfer across low-resourced languages, finding transfer is graded and that strongly misaligned languages' directions fail to reliably modulate refusal, weakening safety guarantees.
Evaluates how eight LLMs respond to suicidal ideation disclosures, finding refusal can be a safety failure, with mechanistic analysis linking SI refusals to the same direction as harmful-request refusals.
Proposes CNRF, a representation-based selective safety framework for vision-language models using counterfactual benign-harmful pairs, reporting high defense success against multimodal jailbreaks with retained utility.
Compares five internal-representation methods for detecting indirect prompt injection on two LLMs, finding that attention- and exposure-based signals better separate successful attacks and that performance depends on prompt template.
Shows that phrasing coding requests as engineering specifications lowers LLM refusal of malicious code, proposes a black-box red-teaming attack and a detection defense.
Proposes CircuitBreak, a white-box attack that greedily prunes a sparse set of FFN neurons forming a refusal circuit, raising attack success rates on several instruction-tuned LLMs to about 88%.
Proposes PDRA, a paradox-driven reasoning attack that jailbreaks LLMs into harmful multi-step reasoning, and shows via representation analysis that it suppresses refusal-related patterns.
Shows that running recurrent-depth LMs with fewer loops removes refusal behaviour while harmfulness stays linearly readable, and that randomized-depth safety training mitigates this.
Traces how attention updates expose harmfulness while MLP updates write refusals in aligned LLMs, and introduces Sentinel, a routing method using these signals to flag jailbreaks and over-refusals.
Audits whether LLMs' cited legal authorities actually drive their verdicts, finding weak dependence on the named authority, and shows adversarial instructions in case facts can still steer verdicts.
Introduces GUISE, a cross-language benchmark showing narrative wrappers bypass LLM refusals, and AXIS, a preference-optimisation defense using refusal-direction alignment that improves safety and usability.
Localizes safety-sensitive parameters in LLaMA-2-7B-Chat, finding MLP down_proj dominant, and shows modifying 0.19% of its weights sharply raises attack success while preserving utility.
Proposes a lightweight detector that reads MoE router logits during prefill to flag unsafe multimodal inputs in Qwen3-VL and Kimi-VL, without changing the model, and it generalizes to out-of-distribution safety benchmarks.
Evaluates memory-gating defenses and activation steering against memory-induced sycophancy in LLMs, finding selective memory filtering preserves accuracy better than full memory removal while steering adds little benefit.
Shows an adversary can use a closed-loop PI controller to steer a frozen masked diffusion LLM's internal activations, sharply increasing targeted demographic bias on ambiguous questions.
Shows that inactive transcoder features causally support refusal of harmful prompts, that jailbreaks may work by suppressing them, and proposes CAP and CSFD to discover such features.
Studies whether activation probes that read instruction-versus-data roles can be turned into effective interventions that reduce indirect prompt injection success in LLM agents on AgentDojo trajectories.
Audits frequency and decoder-depth claims for the AdvWave-P audio jailbreak on Qwen2-Audio, finding the apparent frequency ranking depends on partitioning and layer associations are not causal.
Proposes EmoRSS, an SAE-based activation-steering method that reduces emotion-induced over-refusal on benign requests while keeping refusals of harmful requests, without updating model weights.
Proposes SENTINEL, a generation-time jailbreak defense that matches input-output semantics and scores harmfulness with refusal-direction projections, cutting HarmBench jailbreak success to about 5% with low over-refusal.
Shows that adversarial perturbations can make a VLM's training loss for a target caption near zero while free generation stays correct, and uses logit lens and probes to locate the gap in the language decoder.
Shows that ranking MoE experts by router-gradient sensitivity, rather than activation frequency, more effectively identifies experts whose suppression removes refusal behaviour in LLMs, across five architectures.
Proposes Kernelized Activation Steering, a kernel-based generalisation of difference-in-means steering that adapts interventions to local activation geometry, and reports it matches or beats existing methods on tasks including LLM jailbreaking.
Proposes CodeMimicry, an automated black-box jailbreak using object-oriented code completion prompts that exploits safety training lag in the code domain, with a mechanistic latent-space analysis of why it works.
Proposes fine-tuning LLMs against activation probes for harmfulness and dishonesty, finding continuously updated probes improve safety, resist jailbreaks, and keep concepts linearly readable for oversight.
Analyzes how harmfulness and refusal representations in three LLMs evolve across multi-turn jailbreak attacks, finding harmfulness becomes more separable over turns and weakly aligned with refusal, explaining why single-turn safety probes degrade.
Uses causal activation patching across five LLMs to localize a late-layer bottleneck where prompt injection compliance is decided, reversible by patching, and useful for attack detection.
Proposes CounterSteer, an activation-steering defense that subtracts a learned direction from tool-result tokens to suppress indirect prompt injection in LLM agents, reducing attack and AgentDojo compromise rates with partial resistance to parameter manipulation.