Jailbreak detectors need low false-positive tests, not AUROC alone
Thresholds set on curated benign prompts often failed to hold false-positive budgets on real-user traffic.
Stories per day · 30 days
2 RSS
Relatedalignment4jailbreak4fine-tuning2jailbreak-defense2advbench1agentic-ai1agent-security1attack-success-rate1behavioral-coupling1bilingual1black-box1calibration1coding-agents1evaluation1evaluation-awareness1evidence-paths1false-positive-rate1framework-boundaries1
35 stories, newest first · one card per story
Stories tagged #llm-safety
GuardrailAgent defends LLMs against adaptive jailbreak attacks
Multi-agent framework updates knowledge base from attack summaries to achieve 93.1% detection on over ten jailbreaks.
Jev LLM safety guardrail reduces harmful outputs
Jev input filtering and selective output review cut harmful LLM responses from 73.2% to 2.4% while limiting benign refusals.
Addition by Subtraction strengthens LLM safety alignment against pruning and jailbreaks
Addition by Subtraction removes safety-critical neurons during finetuning to produce models robust to sparsity-based attacks and black-box jailbreaks.
Social bias in multi-agent debate amplifies LLM safety risks
Multi-agent debate in retrieval-augmented web apps causes unsafe adoption to surge from 0.0% to 100.0% under social pressure while silencing safe evidence across six risk categories.
VeriHarm-Bench measures harmful success in LLM coding agents
Frontier agents achieve 95% task accuracy but only 37% safe success on VeriHarm-Bench.
ShallowDefend puts an explicit safety decision before multi-turn replies
Assess, Decide, Respond is trained with reinforcement learning and led multi-turn safety on 14 benchmarks across two model families.
SpecGuard monitors multi-turn LLM jailbreaks with temporal logic
A training-free monitor compiles Linear Temporal Logic rules into automata and emits replayable violation witnesses.
SimpleLoRIF traces LLM safety degradation to fine-tuning data
SimpleLoRIF filters gradient-aligned unsafe examples from LLM fine-tuning datasets.
DiagSafe scores LLM safety with prompt-level rubrics, not binary labels
The bilingual benchmark reaches 95.34% agreement with humans and finds models weaker in Chinese and multi-turn settings.
Safety mid-training lowers LLM attack success before post-training
Authors report a 72% to 81% relative attack-success drop versus Qwen3 1.7B, 4B, and 8B bases.
Fine-tuning can elicit coupled behaviors never trained as a pair
Couplings can compose across document sets, so an emergent misbehavior may never appear with its trigger in one document.
LLM safety monitors can drop recognized evidence before enforcement
Authors confirm 18 evidence-path failures across 11 project groups, 14 of which reach enforcement boundaries.
ECHO jailbreak search scores reply harmfulness instead of compliance prefixes
Authors report up to 0.898 StrongREJECT and 89.23% HarmBench success on five open-weight models; code is public.
Evaluation Awareness Beyond English: Do LLMs Act Differently When Tested in Indic Languages?
LLMs refuse more often in Indic languages when told they are under a safety test, including some benign requests.
PatchBench: Measuring Collateral Damage in Activation Patching
PatchBench checks whether LLM jailbreak repairs fix nearby harmful prompts without over-refusing similar benign ones.
Base Models Can Reason By Taking a Cue From Training Data
The cue Okay lifts Olmo-3-7B MATH-500 pass@1 from 42% to 78%, recovering much of RL's gain.
Frequency Is Not Sensitivity Identifying Safety-Sensitive Experts in Sparse MoE LLM
Router-gradient expert selection suppresses MoE LLM refusals more effectively than activation frequency, dropping OLMoE refusals 73.5% without breaking outputs.
TRACE: Trajectory Return Attribution and Contrastive Erasure for Multi-Turn Safety
TRACE cut multi-turn attack success to the lowest rate in all 35 model-attack pairs with at most a 1.23-point utility drop.
CodeMimicry: Exploiting Safety Generalization Lag in Large Language Models via Structured Code Completion
CodeMimicry uses structured code-completion prompts to jailbreak eight commercial LLMs, reporting a 96.25% success rate.
Tool Mediation Alters Refusal Mechanisms in Large Language Models
Tool access raises LLM refusal thresholds and makes those refusals easier to weaken than chat refusals.
“Drunk” AI is terrible at keeping secrets
UNSW researchers found that drunk-style prompts and fine-tuning make models likelier to leak secrets and accept jailbreaks.
2
Imprint Reader: From Weight-Update Readout to Behavioral Intervention
An Imprint Reader describes frozen weight updates and guides edits that raise refusal and tool-use scores.
When Do Model Internals Help? Exploring the Role of Representation Engineering in LLM Safety
Matched tests find DPO controls LLM safety best, while representation probes monitor cheaply and can repair fine-tuning damage.