September 17, 2026

Orion Reblitz-Richardson · arXiv 2609.14759 · September 13, 2026 · 34 pp, 6 figures, 15 tables

Fig. 4: Moral comprehension (pretraining-native, low-rank) and refusal gate (post-training, orthogonal narrow channel) are dissociated — ablation removes the gate while leaving moral judgment intact.

Across four open-weight models spanning three families, the paper shows that moral comprehension is native to pretraining — a low-rank moral subspace crystallizes during language model pretraining, and alignment merely rotates it without rebuilding it. The refusal gate, by contrast, is a fresh post-training construction written into a narrow control-token channel that is orthogonal to the moral-judgment decision. This dissociation explains why abliteration removes refusal without removing moral reasoning, and has direct implications for pretraining-time safety design: the moral substrate is already present before alignment, making pretraining interventions potentially more robust than attempts to install refusal post-hoc.

arXiv 2609.10594 · September 7, 2026

Fig. 6: Evaluator agreement ranking — JADES achieves highest alignment with human ground truth; significant inter-evaluator disagreement on borderline cases.

Systematic comparison of six jailbreak evaluators — HarmBench, JailbreakBench, JailbreakRadar, StrongReject, JADES, and JailMeter — measured against a human-labeled ground truth across multiple attack types and model families. JADES exhibits the best overall performance; HarmBench and StrongReject show good performance; evaluator disagreement is non-trivial across all pairs, particularly on borderline harmful-but-plausible responses. Provides an evidence-based selection guide for benchmarking jailbreak defenses, with implications for which reported attack success rates are reliable.

Oleksandr Cherednichenko, Roman Klypa · arXiv 2609.08634 · September 8, 2026

Fig. 7: DPO variational derivation vs. Suan gradient-level formulation — Suan separates safety and quality signals, eliminating the over-refusal and utility degradation caused by DPO's conflated gradients.

DPO-style post-training methods suffer from quality degradation and over-refusal on benign prompts because their variational derivation conflates safety and quality signals at the gradient level. Suan formulates the safety alignment optimization objective directly at the gradient level, bypassing the variational step that entangles quality and safety. This achieves superior safety alignment while fully preserving response utility and general capability across standard benchmarks — addressing a core practical limitation of the dominant post-training safety paradigm.

Tobias Ladner, Matthias Althoff (Technical University of Munich) · arXiv 2609.15533 · September 14, 2026

Fig. 8: Minor input perturbations flip IRN dominant features across 5 model families; reachability analysis certifies a sound faithfulness bound; verification-aware training tightens it.

Demonstrates that even semantically minor input perturbations flip the dominant features of interpretable replacement networks (IRNs) across GPT-2, Gemma 2 2B, Gemma 3 1B, Llama 3.2 1B, and R1-Distill-Qwen 1.5B — undermining the reliability of feature-level safety audits that rely on IRN-derived interpretations. The paper introduces the first formal verification framework for IRN faithfulness, using reachability analysis to certify a sound upper bound on the faithfulness gap under adversarial input perturbations. Verification-aware training substantially tightens this certified bound, restoring interpretable features that safety auditors can act on with quantified confidence.

Orion Reblitz-Richardson · arXiv 2609.14754 · September 13, 2026 (companion to 2609.14759)

Fig. 9: Six causal interp. failure modes from a real research program vs. four verification disciplines that catch them before findings are published.

Causal interpretability claims rest on measurements — projections, cosines, ablation deltas, interchange patches — that can fail silently, returning a plausible number instead of an error. This companion paper to 2609.14759 documents six such failures from a real multi-paper causal interpretability program on refusal and moral representation, spanning four open-weight models. The paper prescribes four verification disciplines: calibrate against a positive-control ladder; certify with an orthogonal cell; compute statistical power before spending compute; and state every read-from verdict at a depth explicitly referenced to the model's commitment. Essential methodology for anyone running or reviewing causal probes in safety research.

arXiv 2609.03693 · September 2026

Fig. 10: AlcaTRAz rule-tree defense — input traverses a hierarchical tree of jailbreak-strategy rules before reaching the model; match blocks; no model modification needed.

Proposes a prompt-level jailbreak defense using rule trees derived from a curated taxonomy of 22 jailbreak attack strategies, organized hierarchically for efficient matching and requiring no model fine-tuning or architectural changes. The method operates entirely on the input text before inference. Evaluated on 33 open-weight models across 22 attack types, AlcaTRAz reduces attack success rates while preserving model utility on benign prompts, with inference overhead smaller than safety fine-tuned alternatives — making it a lightweight complement to model-level defenses.