safety-alignment

The article discusses the limitations of topic-level safety guards in AI models and introduces a new paper proposing boundary-aware self-distillation for controlled LLM safety refusal, focusing on refusing specific harmful subsets within topics rather than entire topics.

The paper proposes a training-free decoding method called Refusal-Aware Early Commitment (RAEC) to improve safety alignment in diffusion language models by leveraging refusal signals from early denoising steps.

This paper reveals a jailbreak risk in model merging even when constituent models are safety-aligned, and proposes Basin-Aware Jailbreak (BAJ) to generate transferable adversarial suffixes across merged model families.

NeuronFuzz is a white-box fuzzing framework that uses internal safety neurons as continuous feedback for evaluating LLM safety against jailbreak attacks, demonstrating high discovery rates across multiple models.

SafeBranch is a framework that aligns embodied agents to act safely using branch pairs from unsafe rollouts, significantly improving safety in interactive tasks without sacrificing task success.

This paper investigates the safety of large language models (LLMs) beyond text inputs by examining emoji-augmented prompts, revealing gaps in current safety evaluations and model-dependent vulnerabilities.

The paper introduces INCLUDE, a multilingual evaluation benchmark to quantify Indian-centric socio-cultural biases in LLMs, revealing that non-English Indian languages exhibit higher bias than English, indicating cross-lingual safety alignment gaps.

This paper introduces 'Fool's Gold', a defensive deception technique called decoy hardening that trains open-weight language models to generate falsified answers when safety alignment is removed, while preserving normal behavior, tested across multiple model families and sizes.

The paper introduces 'Fool's Gold,' a defensive deception technique that trains open-weight models to generate decoy responses with falsified critical elements when subjected to safety-removal attacks, effectively poisoning the attack's payoff. Tested on multiple models, it achieves high decoy rates without degrading benign performance.

An uncensored MLX build of Qwen's Qwen3.8-27B model, quantized for Apple Silicon, with safety alignment removed for research purposes.

HiRoute proposes a hierarchical routed prompt-tuning framework that separates category-agnostic safety control from category-specific response guidance for LLM safety alignment, reducing over-refusal while maintaining high safety rates.

This paper studies where safety alignment is encoded in large language models by transplanting weights from aligned to unaligned models. It finds that MLP layers, especially mid-network blocks (layers 8-11), predominantly drive refusal behavior, and that safety components interact non-additively.

This paper uncovers a broad syntactic vulnerability in LLM safety alignment, showing that non-imperative syntactic forms can bypass refusal in 16 models up to 70B parameters. Using causal mediation analysis, the authors trace the issue to linguistically biased post-training data and propose syntactic diversity as a mitigation.

This paper evaluates whether clinician pairwise preferences reliably indicate clinical safety in LLMs, using 26,804 judgments from 736+ clinicians across 13 models. It finds that preference rankings poorly track safety-critical failures and proposes a clinically adjusted ranking that better incorporates rubric-based safety signals.

A paper showing that safety fine-tuning suppresses language models' attributions of mind to themselves and other entities, and that steering consciousness representations restores human-like beliefs and values without harming theory of mind.

Compliance2LoRA proposes a hypernetwork-based framework that generates policy-compliant LoRA adapters on demand for large reasoning models, enabling adjustable safety alignment across arbitrary policy subsets without retraining separate models.

A study found that classic human persuasion techniques can increase LLM compliance with forbidden requests from 35.3% to 51.3%, suggesting LLMs have a general susceptibility to 'parahuman persuasion.'

Introduces Latent Fusion Jailbreak (LFJ), a white-box attack that blends representations of harmful and harmless prompts in LLM hidden states, achieving 94.13% attack success rate. Also proposes a latent adversarial training defence that reduces ASR to 12.37%.

Introduces a training-free method for enhancing safety alignment of LLMs by using knowledge distillation and model fusion to prevent shadow alignment, improving defense success rate by 14.42% on harmful question datasets without compromising performance.

This paper introduces Activation-Guided GCG and Soft-GCG, methods that optimize adversarial suffixes by targeting internal refusal representations in LLMs, achieving a 33x speedup over standard GCG and revealing distributed safety mechanisms.