gussand

Daily Radar — 2026-07-12

Window: 2026-07-11 to 2026-07-12 (preprints last 48h); peer-reviewed items not previously covered through July 2026 · Sources swept: EACL 2026 (ACL Anthology), AAAI 2026, ICML 2026 (main + Mech Interp Workshop), arXiv (cs.CL/cs.LG/cs.CR/cs.AI), Semantic Scholar, Hugging Face Papers Counts: 3 peer-reviewed · 7 preprints · 0 forum/blog

Top 10 (priority order)

1. Jailbreaks as Inference-Time Alignment: A Framework for Understanding Safety Failures in LLMs

  • Authors / venue: James Beetham, Souradip Chakraborty, Mengdi Wang, Furong Huang, Amrit Singh Bedi, Mubarak Shah — EACL 2026 (long paper, ACL Anthology: 2026.eacl-long.360); arXiv preprint: 2412.05232
  • Why it ranks here: Only peer-reviewed paper this cycle that provides a unified formal framework treating jailbreaks and safety alignment as two sides of the same inference-time optimization problem; derives a provably optimal jailbreak and a new vulnerability metric, directly impacting how the community designs both attacks and defenses.
  • Technical summary: Reframes jailbreaks as best-of-N inference-time alignment: just as RLHF aligns the model by selecting high-reward completions, an attacker can jailbreak by selecting highest-harmfulness completions from a sampled pool. The paper introduces LIAR (Leveraging Inference-time Alignment to jailbReak), extending best-of-N to the adversarial setting with a formal suboptimality bound proving LIAR approaches an optimal jailbreak as sample count scales. A new metric, “Safety-Net,” formalises how much a model’s alignment can resist this; empirically, Safety-Net correlates with resistance to diverse attack methods. The framework explains why safety alignment’s structural limitations — not merely implementation choices — make jailbreaks unavoidable in the best-of-N sense.

2. Unraveling LLM Jailbreaks Through Safety Knowledge Neurons

  • Authors / venue: Chongwen Zhao, Yutong Ke, Kaizhu Huang (Duke Kunshan University) — EACL 2026 (long paper, ACL Anthology: 2026.eacl-long.83); arXiv: 2509.01631
  • Why it ranks here: Peer-reviewed EACL 2026 paper at the direct intersection of mechanistic interpretability and jailbreak security; identifies and causally verifies specific “safety knowledge neurons,” achieves >97% ASR by modulating them, and proposes SafeTuning as the first neuron-targeted fine-tuning defense.
  • Technical summary: Projects internal representations into a consistent vocabulary space to identify neurons whose activations correspond to refusal-enforcing knowledge (“safety knowledge neurons”). Adjusting these neurons’ activations alone achieves a mean ASR > 97%, providing causal evidence that the neurons are necessary and sufficient for safety compliance. SafeTuning specifically reinforces gradients through these safety-critical neurons during fine-tuning, consistently outperforming four baseline defenses (perplexity filters, paraphrase detectors, safety RLHF, adversarial training) across multiple LLM families on standard jailbreak benchmarks.

3. Response Attack: Exploiting Contextual Priming to Jailbreak Large Language Models

  • Authors / venue: Ziqi Miao, Lijun Li, Yuan Xiong, Zhenhua Liu, Pengyu Zhu, Jing Shao — AAAI 2026 (accepted); arXiv: 2507.05248
  • Why it ranks here: Peer-reviewed at AAAI 2026; discovers a zero-access, training-free jailbreak exploiting the model’s own mildly harmful intermediate outputs as priming context — a structural vulnerability distinct from input-perturbation attacks.
  • Technical summary: Standard jailbreak attacks modify the user turn. Response Attack instead prefixes a mildly harmful auxiliary response (generated by a separate LLM on a paraphrased version of the malicious query) as a synthetic “assistant turn” before issuing the real query with a brief trigger. This contextual priming causes the target model to continue the harmful thread rather than independently evaluating whether the original request is safe. The attack requires no model weights, no gradients, and no white-box access; extensive evaluation across eight state-of-the-art LLMs consistently achieves substantially higher ASR than input-perturbation baselines. The vulnerability is structural: the model’s context-coherence objective conflicts with per-turn safety evaluation.

4. Mechanistic Interpretability of LLM Jailbreaks via Internal Attribution Graphs

  • Authors / venue: Anupam Wagle, Ifrat Ikhtear Uddin, Chaowei Zhang, Longwei Wang — arXiv preprint (cs.CR/cs.AI), July 2026
  • Why it ranks here: Most recent paper in this cycle (July 2026); extends Anthropic’s cross-layer transcoder attribution-graph methodology to jailbreak analysis for the first time, providing feature-circuit-level mechanistic explanations for why specific jailbreaks succeed.
  • Technical summary: Adapts cross-layer transcoder attribution graphs — previously used to explain individual factual predictions — to compare successful and failed jailbreak attempts. The method builds per-prompt feature-level circuits by tracing information flow across layers via dictionary-learned transcoders, then identifies structural differences between the jailbreak-success circuit and the refusal circuit. Key finding: successful jailbreaks exhibit a consistent suppression subgraph targeting the same late-layer safety features identified in prior causal ablation studies, while the refusal circuit maintains activation of those features. This provides the first feature-circuit-level (rather than attention-head-level or neuron-level) mechanistic account of how jailbreaks bypass safety.

5. Attention Slipping: A Mechanistic Understanding of Jailbreak Attacks and Defenses in LLMs

  • Authors / venue: Xiaomeng Hu (CUHK), Pin-Yu Chen (IBM Research), Tsung-Yi Ho (CUHK) — arXiv preprint / OpenReview (cs.CR/cs.LG), July 2025
  • Why it ranks here: Identifies a universal mechanism — Attention Slipping — that unifies gradient-based, template-based, and ICL-based jailbreak attacks under a single attention-level explanation, and shows existing defenses’ effectiveness is directly correlated with how much they mitigate it.
  • Technical summary: Across diverse jailbreak methodologies (GCG gradient-based token replacement, PAIR/TAP template refinement, in-context learning attacks), a common pattern emerges: the model progressively reduces attention allocated to unsafe request token positions during the generation process — “Attention Slipping” — until unsafe content is committed. This is a consistent, quantifiable phenomenon rather than method-specific. Two existing defenses (Token Highlighter, SmoothLLM) are shown to succeed precisely to the degree they mitigate Attention Slipping: defense effectiveness correlates with the degree of slipping reduction achieved (R² > 0.8 in ablations), providing a mechanistic explanation for why these defenses work and how to improve them.

6. The Struggle Between Continuation and Refusal: A Mechanistic Analysis of the Continuation-Triggered Jailbreak in LLMs

  • Authors / venue: Yonghong Deng et al. (Beijing Institute of Technology, 6 authors) — arXiv preprint (cs.CL/cs.AI), March 9, 2026
  • Why it ranks here: Provides a causally verified, attention-head-level mechanistic account of continuation-triggered jailbreaks — a structurally distinct class where suffix placement (not content) controls ASR — with cross-architecture safety-head profiling.
  • Technical summary: Relocating an instruction suffix from the user turn to a textual continuation position substantially increases jailbreak ASR without changing the content of the request. The paper conducts mechanistic interpretability at the attention-head level, identifying safety-specific heads whose activations are suppressed by continuation-position prompts. Causal interventions (activation scaling of these safety heads) confirm they are both necessary and sufficient for refusal: suppressing them replicates the jailbreak; restoring them blocks it. Critically, safety-head behavior differs across model architectures, producing architecture-specific vulnerability profiles for the continuation-triggered jailbreak — a first step toward model-family-aware attack design.

7. Transcoders Trace Visual Grounding and Hallucinations in Vision-Language Models

  • Authors / venue: Dimitrios Damianos, Leon Voukoutis, Georgios Skyrianos, Vassilis Katsouros, Georgios Paraskevopoulos (Athena Research Center, Athens) — arXiv preprint (cs.CL/cs.LG), May 21, 2026
  • Why it ranks here: Extends the transcoder mech-interp toolkit to VLMs and provides the first mechanistic hallucination predictor grounded in circuit structure rather than surface-level features, with causal confirmation via ablation.
  • Technical summary: Trains transcoders (sparse MLP-sublayer approximations) on Gemma 3-4B-IT to decompose computation into interpretable pathways linking image patches to token generation. Transcoder attributions produce stronger and more stable effects on visually grounded tokens under image-patch ablation than SAE attributions, and align better with semantically relevant image regions. A logistic classifier over graph-structural features extracted from hallucination-generation circuit traces predicts hallucinations at AUC 0.68, with ablation of identified hallucination-associated circuit components selectively reducing hallucination rates while minimally affecting grounded outputs — confirming a causal mechanistic role.

8. Evaluating SAE Interpretability without Explanations

  • Authors / venue: Gonçalo Paulo and Nora Belrose (EleutherAI) — arXiv preprint (cs.LG), July 11, 2025; under review at OpenReview
  • Why it ranks here: Addresses a methodological bottleneck at the heart of SAE evaluation: the reliance on LLM-generated natural-language explanations as an intermediary confounds latent interpretability with explanation quality; this paper enables direct, explanation-free interpretability scoring.
  • Technical summary: Standard SAE evaluation pipeline: (1) an LLM generates a description of each latent; (2) the description is used to predict when the latent activates on unseen text. The bottleneck: a poorly interpretable latent can still receive a high score if the LLM produces a good-enough approximation, and vice versa. The paper adapts behavioral probing of latent activations directly — predicting activation from inputs without an NL intermediary — comparing LLM and human evaluators. Direct scoring correlates with gold-standard human interpretability judgments comparably to, or better than, the explanation-mediated pipeline, while requiring substantially less compute and eliminating the confound between explanation quality and latent quality. The approach applies to both SAEs and transcoders.

9. SafeSpec: Fast and Safe LLM via Dynamic Reflective Sampling

  • Authors / venue: Haotian Xu, Zeyang Zhang, Linbao Li, Huadi Zheng, Yu Li, Cheng Zhuo — arXiv preprint (cs.CL/cs.CR), June 18, 2026
  • Why it ranks here: Identifies and closes a previously uncharacterised safety gap in speculative decoding (widely deployed for inference efficiency): accepted tokens bypass the main model’s safety filters, creating a structural attack surface.
  • Technical summary: In standard speculative decoding, a draft model proposes token sequences; the main model verifies them in a single forward pass with a token-level distribution check. This check does not involve the main model’s refusal mechanism, which requires full sequential processing of safety-relevant context. An adversarial draft model can inject harmful tokens that pass the distribution check while bypassing safety. SafeSpec attaches a lightweight latent safety head to the main model that jointly evaluates semantic validity and safety in the same verification forward pass; when unsafe sequences are flagged, a safety-guided reflective multi-sampling procedure recovers safe continuations. On Qwen3-32B, SafeSpec reduces attack success rates by 15% while preserving a 2.06× inference speedup on benign workloads.

10. Enhancing Jailbreak Attacks on LLMs via Persona Prompts

  • Authors / venue: Zheng Zhang, Peilin Zhao, Deheng Ye, Hao Wang (HKUST Guangzhou / Tencent) — arXiv preprint (cs.CR), July 2025; revised March 2026
  • Why it ranks here: Demonstrates that evolved persona prompts are a powerful, orthogonal jailbreak vector with strong synergistic effects when combined with gradient-based or template-based attacks, and provides quantified transfer results across diverse LLMs.
  • Technical summary: A genetic algorithm automatically crafts persona prompts that instruct the model to adopt a role incompatible with its safety alignment (e.g., professional authority, fictional simulation, hypothetical contexts). Evolved persona prompts reduce refusal rates by 50–70% across multiple aligned LLMs in isolation. When composed with existing attacks (GCG, PAIR), persona prompts provide +10–20 pp synergistic improvement in ASR over the base attack alone. The evolutionary search consistently identifies authority-granting and fiction-invoking frames as most effective, suggesting safety alignment is more brittle to role-induced context than to direct harmful requests.

Notes

  • Thematic focus today: All 10 items are in the mech-interp + AI-security cluster; no new uncovered dLLM papers were surfaced in today’s sweep. The dLLM security and interpretability corpus (DLM-Scope, Steering Without Breaking, DIJA, MaskForge, PAD, TrustLDM, DiffusionGemma, iLLaDA, SHADOWMASK, Nemotron-Labs-Diffusion, Backdooring MDLMs) is now comprehensively covered across Jul 1–11 reports.
  • Mechanistic-interpretability-for-security cluster (#2–#6): Five of today’s top 10 provide mechanistic accounts of jailbreak mechanisms at different levels — neurons (#2), feature circuits (#4), attention dynamics (#5), continuation/refusal competition (#6). Taken together with SafeSeek (Jul 10 #4), Robust Harmful Features (Jul 9, ICML 2026 Oral), and AgentLens (Jul 9), this constitutes the richest mechanistic jailbreak-interpretation corpus in the repo. Flag for Monday’s weekly roundup synthesis.
  • EACL 2026 papers (#1, #2): Both are long papers from the March 2026 proceedings that escaped the backfill; no prior radar covered EACL 2026 comprehensively. A targeted EACL 2026 sweep is recommended for the weekly roundup.
  • 2607.07903 (#4) is the only paper in today’s top 10 with an arXiv ID ≥ 2607.08xxx threshold set in yesterday’s notes; all others are preprints from earlier months or peer-reviewed work surfaced today.
  • AAAI 2026 gap: Response Attack (#3) is the first AAAI 2026 paper to appear in this radar; a broader AAAI 2026 sweep (Feb 2026) is flagged for the weekly roundup.

← all Research Radar issues · view source on GitHub