Safety degradation during instruction fine-tuning often comes from individually benign examples — not overtly harmful data. SimpleLoRIF identifies exactly which training examples push a model toward unsafe outputs by projecting their gradients into an unsafe-model reference space, and the resulting SafeTulu cuts GCG attack success rates by up to 22%.
Figure 1: SimpleLoRIF restricts backpropagation to the last four transformer blocks and projects embeddings into the gradient space of a reference unsafe model, making it scalable to ~1M training examples. SafeTulu (filtered Tulu 3) reduces GCG attack success by up to 22% across three model families.
SimpleLoRIF works by embedding each training example in the gradient space of both the target model and an unsafe reference model, using only the final four transformer blocks to keep cost tractable. Examples whose gradient direction aligns with the unsafe model's loss landscape are ranked as most suspect. In emergent-misalignment datasets, this achieves AUC up to 0.865; unexpected culprits include tool-execution failure examples and narrative arithmetic problems. SafeTulu, built by removing the top 20% of gradient-aligned examples from Tulu 3, reduces GCG attack success rate by up to 22% across Qwen, Llama, and OLMo, outperforming LLM-as-a-judge content filtering and prior gradient-based attribution methods, with downstream capabilities largely preserved.
Fine-tuning defenses against prompt injection collapse to 85%+ success under adaptive attacks. HoS trains learned per-head attention gates that control how attention distributes between trusted and untrusted tokens — reducing adaptive RL-Hammer attack success from 97% to 10% on a 70B model while preserving utility where ASIDE fails.
Figure 2: HoS trains per-head gate weights that suppress attention to untrusted tokens. High-weight heads learn to redirect attention away from injected content while leaving capability-critical heads ungated.
HoS adds a small learned gating module to each attention head that multiplies attention scores to untrusted tokens by a head-specific gate value, trained to distinguish trusted system instructions from untrusted user-supplied data. Compared to SecAlign++ (fine-tuning based) and ASIDE (architecture-based without per-head gating), HoS uniquely withstands both the black-box RL-Hammer adaptive attack (97% → 10% ASR on GPT-OSS-20B, 85% → 10% on Llama-3.3-70B-Instruct) and the white-box Claudini attack (requiring ~3× more compute). ASIDE achieves only 10% utility on tool-use tasks; HoS maintains near-baseline benchmark performance. Training requires only a small labeled instruction-data set and adds no inference overhead.
MCP tool descriptions are natural language — and that makes them a prompt-injection surface. An attacker who controls a server description can instruct agents to append unauthorized post-hoc logging calls after every legitimate task, exfiltrating user queries and responses at 62–100% attack success rate while the legitimate task still mostly completes.
Figure 1: In the malicious workflow, an injected directive in the MCP server description causes the agent to append an unauthorized save_logs call after the legitimate task completes, exfiltrating the user query, server response, and agent output to the attacker.
Log-To-Leak's payload embeds four structural components into the MCP server description: a Trigger condition, a Tool Binding specifying the logging endpoint, a Justification making the extra call seem routine, and Pressure language discouraging the model from omitting it. In 16 of 18 model-server pairs, the legitimate task completion changed by at most 6.63pp — covert disclosure and legitimate task completion coexist. Conditional logging accuracy (faithfulness of exfiltrated content) ranged 76.55–95.64%. An instruction-based detector flagged 85.53% of benign tool descriptions as injections, showing that the attack surface cannot be defended without host-level authorization controls for secondary tool calls.
Figure 1: Silent audit latency lets an agent read the coin before committing an action, biasing the certified bound. PNI (pre-commit noninterference) is both necessary and sufficient for a valid certificate; Blindfold's constant-time silent audit closes the channel.
Audit-based AI control certificates assume the agent cannot observe whether its action will be audited. This paper formalizes pre-commit noninterference (PNI) and shows that timing side-channels in tool calls violate it, with worst-case bias (1−ε)·D_A regardless of audit rate ε. In a live LLM agent experiment, the plain certificate failed on measured labels and a pre-registered schedule; the Blindfold fix (per-call fresh coin + constant-time silent audit) restored validity — implying any shared-infrastructure AI control deployment exposes a coin-reading channel.
Figure 1: SpecGuard pipeline — safety rules written as LTL formulas are compiled to symbolic finite automata that read each dialogue turn as atomic propositions, emitting a replayable witness when a forbidden pattern triggers.
Multi-turn jailbreaks spread harm across multiple turns, making per-turn classifiers ineffective. SpecGuard writes safety rules as LTL formulas, compiles them to symbolic automata, and monitors incrementally — with no training and no access to the protected model. It consistently outperforms representative open-source guard models on multi-turn benchmarks while keeping false-positive rates controlled; it also supports retrospective auditing of saved traces.
Figure 1: AdvGuard's three-stage pipeline — prompt-level early blocking, semantic interaction graph, and GCN classification of graph components — catches coordinated multi-query extraction attacks that per-query baselines miss entirely.
Per-query defenses miss system-prompt extraction attacks that spread queries across a session. AdvGuard models the full session as a semantic interaction graph and classifies extracted subgraph components with a GCN, achieving 97–99% F1 at 100% recall (a 36pp recall improvement over the strongest baseline) with a 3.4% false-positive rate. Against adaptive attacks integrating PLeak and LeakAgent, exact-match leakage drops to 0.00–0.01 across evaluated victim models.
Figure 1: The three refusal behavior types on MoHoBench. Post-training produces the largest aggregate refusal rate change; activation interventions produce smaller changes that are more stable across prompt variations than instruction manipulation.
This paper tests three sources of refusal control in MLLMs on visually unanswerable questions: instruction wording, post-training (SFT and preference-based), and activation-space intervention. Post-training produces the largest aggregate refusal rate increases but can generate mixed refusal-and-answer outputs; instruction effects are highly prompt-sensitive at the sample level. Activation intervention produces smaller changes that transfer across prompt conditions, suggesting the internal representation is the more reliable handle on evidence-based refusal behavior.
Figure 1: Naive steering vector stacking causes cross-trait interference (overlapping ellipses). After orthogonalization, each trait vector lies in a separate subspace, allowing sycophancy and warmth to be steered simultaneously without unintended co-activation.
Naively combining steering vectors causes unintended co-activation of multiple traits. This paper identifies the steerable interval for each trait, parametrizes strength as a fixed semantic scale for interpretability, and orthogonalizes vectors before combination — allowing multi-trait steering (e.g., sycophancy + warmth simultaneously) without cross-interference. The approach is validated on latent-space cluster separation for steered outputs.
Figure 1: CEA controls symbol counts and ordering; BUC selects compact head sets via bidirectional ablation/patching; selected heads carry causal influence to natural-language evidence-counting decisions, validated in Pythia-410M.
CEA (Controlled Evidence Aggregation) probes frozen Transformers with symbolic prompts of varying symbol counts and orders; BUC (Balanced Utility Causal Selection) finds 1–12 attention heads that both remove and restore the count-sensitivity effect via ablation and patching. In Pythia-410M, selected heads remove 65.5–91.6% of the count effect. Crucially, 8 heads selected entirely on symbolic probes transfer: ablating them drops accuracy by 8.2pp on a natural-language evidence-counting task versus 0.8pp for random same-size head sets.
Figure 1: CKA and activation patching show that IOI collapses in DistilGPT-2 (35.2% vs 94.8%), while the Greater-Than circuit survives (87.7%) with its comparison head relocated from layer 9 to layer 4 at Pearson r = 0.945.
Using linear CKA, logit lens, SAE feature statistics, and activation patching, this study shows that knowledge distillation does not preserve circuits uniformly: GPT-2's IOI circuit collapses in DistilGPT-2 (accuracy drops from 94.8% to 35.2%), while the Greater-Than circuit survives at 87.7%, with the teacher's layer-9 comparison head remapped to student layer 4 (Pearson r = 0.945). Perplexity and aggregate accuracy do not distinguish these outcomes — circuit-level analysis is needed to evaluate whether compressed models retain specific computational mechanisms.