The paper investigates how safety‑aligned large language models (LLMs) can still be tricked by jailbreaks or over‑refuse benign requests. By analyzing residual‑stream updates in decoder‑only Transformers, the authors find that harmfulness is more readily decoded from attention updates—especially in early layers—while the MLP component is primarily responsible for writing refusal responses. Post‑training enhances MLP‑driven refusal writing without improving harmfulness decodability, and causal interventions confirm that downstream MLP updates are crucial for the refusal shift caused by upstream attention changes. Building on these insights, the authors propose Sentinel, a system that combines an attention‑derived perception score with an MLP‑derived decision score to better detect jailbreaks and over‑refusals across multiple models.
By Zixuan Weng, Haoqi He, Weifei Jin, Yue Huang, Yang Bai
arXiv:2601. 02023v2 Announce Type: replace-cross Abstract: As Large Language Models (LLMs) increasingly utilize massive context windows as working memory for autonomous tasks, their reliability fluctuates significantly depending on how information is distributed in real-world corpora.
By Amirali Ebrahimzadeh, Seyyed M. Salili
arXiv:2607. 01792v1 Announce Type: cross Abstract: While decoder-only LLMs excel at a vast array of natural language tasks, it suffers from an asymmetric information flow induced by causal attention: later tokens are richer in contextual grounding than earlier ones.
By Andikawati P Widjaja, Yongjun Kim, Hyounghun Kim, Jaeho Lee
The paper investigates a unique typographical vulnerability in Korean language models arising from errors at the jamo (sub-character) level, which can produce valid but altered syllables or expose raw jamo, thereby disrupting tokenization and bypassing standard error correction. By applying five jamo-level perturbations to the KMMLU benchmark, the authors show that model accuracy degrades steadily with perturbation intensity and that larger models do not gain robustness. They further demonstrate that corrupted inputs shift internal representations in a detectable way, enabling a linear probe to identify unseen typos and motivate a Typo-Aware Chain-of-Thought (TACoT) strategy that selectively triggers chain-of-thought inference only when a typo is detected, recovering much of the accuracy benefit at lower cost.
By Seojin Lee, Hwanhee Lee
The paper introduces Variance‑Calibrated Modulation (VCM), a training‑free pre‑decoding technique that reshapes language model probability distributions before truncation. VCM uses two dynamic mechanisms: a Contextual Searchlight via PMI to suppress stopwords and highlight context‑relevant tokens, and an Adaptive Self‑Debiasing that applies scale‑invariant penalization based on real‑time logit standard deviation. Experiments on open‑ended generation, factual QA, and mathematical reasoning show that VCM consistently reduces the likelihood trap, improving diversity, coherence, and reasoning accuracy with minimal computational cost.
By Yuanhao Ding, Meimingwei Li, Esteban Garces Arias, Matthias A{\ss}enmacher, Christian Heumann, Chongsheng Zhang
arXiv:2604. 08571v3 Announce Type: replace-cross Abstract: While Large Language Models (LLMs) achieve high performance on standard mathematical benchmarks, their problem-solving abilities depend on the context and textual formatting.
By Pavel Golikov, Evgenii Opryshko, Gennady Pekhimenko, Mark C. Jeffrey