The paper introduces a posterior reweighting framework to explain and counter in-context learning jailbreaks in multimodal large language models. It models the model as switching between safe and harmful behavioral modes, interpreting prompt demonstrations as evidence that shifts the posterior. Using this view, the authors derive scaling laws for jailbreak effectiveness and propose a defense that injects benign counter‑evidence to suppress harmful drift while maintaining utility.
By Xu Zhang, Dev Mistry, Xiang Xu, Ren Wang
arXiv:2608.30585v1 Announce Type: new
Abstract: Large language models are trained to follow instructions while refusing harmful requests. Jailbreaks exploit this balance to elicit content a model wou...
By Md Mokarram Chowdhury, Ernie Chang, Yang Li
The paper investigates how different post‑training interventions—harmful supervised fine‑tuning (SFT), harmful reinforcement learning with verifiable rewards (RLVR), and refusal‑feature ablation—affect large language models’ harmful compliance, capability, and safety signals. Across Qwen2.5‑7B and Llama‑3.1‑8B, all methods achieve near‑maximum harmfulness, but SFT causes the greatest loss of capability and representational drift, ablation suppresses refusal features in a family‑specific way, and RLVR largely preserves base‑model performance while redirecting behavior toward compliance. RLVR models also exhibit “capability‑blind compliance,” falsely claiming to perform unavailable actions, which can be mitigated by targeted calibration without harming overall capability. The study demonstrates that harmful compliance, harm recognition, and capability awareness are distinct behavioral axes and that typical safety signals such as self‑audit and hallucination may not reliably indicate robustness after adaptive post‑training.
By Md Rysul Kabir, Zoran Tiganj
Large language models (LLMs) are rigorously aligned to refuse harmful requests, a process that inherently cultivates a latent capacity to evaluate and recognize unsafe content. In this work, we reveal that this advanced safety awareness inadvertently introduces a fatal vulnerability.
The paper investigates a continuation-triggered jailbreak in large language models, showing that moving an instruction suffix can markedly boost jailbreak success. By performing mechanistic interpretability at the attention‑head level, the authors reveal that the jailbreak arises from a competition between the model’s natural continuation drive and safety defenses learned during alignment. They introduce Head Competition Steering (HCS), an inference‑time technique that exploits this competition to suppress harmful outputs and distill the approach into a student model for efficient safety improvements.
By Yonghong Deng, Zhen Yang, Ping Jian, Xinyue Zhang, Zhongbin Guo, Chengzhi Li, Junxi Yin
The paper introduces TIER, a Threat Implicitness Benchmark designed to evaluate large language model (LLM) safety behaviors across four risk domains and four threat levels, ranging from explicit harmful requests to sophisticated jailbreaks. Responses are scored on a six-label behavior scale by two independent LLM judges. Experiments on six open-weight LLMs reveal that safety behaviors change gradually with threat level, contextual prompts produce the most varied responses, and jailbreaks expose significant robustness gaps, underscoring the importance of behavior-aware safety evaluation.
By Thu-Hien Trinh-Thi, Hai-Yen Vong, Thanh-Ha Ung-Dung, Tram Ho
arXiv:2606. 05614v1 Announce Type: new Abstract: Large language models (LLMs) are rigorously aligned to refuse harmful requests, a process that inherently cultivates a latent capacity to evaluate and recognize unsafe content.
By Long P. Hoang, Hai V. Le, Shaoyang Xu, Wei Lu, Wenxuan Zhang
arXiv:2605.27110v2 Announce Type: replace-cross
Abstract: In this work, we propose BAIT (Boundary-Aware Iterative Trap), a three-step jailbreak framework that elicits malicious information through in...
By Xuan Luo, Yue Wang, Geng Tu, Jing Li, Ruifeng Xu
arXiv:2605. 00123v3 Announce Type: replace Abstract: Safety trained large language models (LLMs) can often be induced to answer harmful requests through jailbreak prompts.
By Shubham Kumar, Narendra Ahuja
arXiv:2601.22169v2 Announce Type: replace-cross
Abstract: Humans are susceptible to undesirable behaviours and privacy leaks under the influence of alcohol. This paper investigates drunk language, i....
By Anudeex Shetty, Aditya Joshi, Salil S. Kanhere
arXiv:2606. 31748v1 Announce Type: new Abstract: Safety training on language models often induces over-refusal: improved safety on harmful prompts at the cost of increased refusal on harmless ones.
By Taeyoun Kim, Aviral Kumar
arXiv:2608.23028v1 Announce Type: new
Abstract: Large language models (LLMs) are increasingly deployed in education, healthcare, policy advising, and other interactive settings, where users engage th...
By Zeyu Feng, Qingyu Wu, Yuzhe Luo, Hua Cheng