Different Paths to Harmful Compliance: Behavioral Side Effects and Mechanistic Divergence Across LLM Jailbreaks

• URL: http://arxiv.org/abs/2604.18510v1
• Date: Mon, 20 Apr 2026 17:01:27 GMT
• Title: Different Paths to Harmful Compliance: Behavioral Side Effects and Mechanistic Divergence Across LLM Jailbreaks
• Abstract summary: Open-weight language models can be rendered unsafe through several distinct interventions.<n>We study behavioral and mechanistic properties of jailbroken models across three unsafe routes.<n>All three routes achieve near-ceiling harmful compliance, but they diverge once we move beyond direct harmfulness.
• Score: 4.726777092009554
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Open-weight language models can be rendered unsafe through several distinct interventions, but the resulting models may differ substantially in capabilities, behavioral profile, and internal failure mode. We study behavioral and mechanistic properties of jailbroken models across three unsafe routes: harmful supervised fine-tuning (SFT), harmful reinforcement learning with verifiable rewards (RLVR), and refusal-suppressing abliteration. All three routes achieve near-ceiling harmful compliance, but they diverge once we move beyond direct harmfulness. RLVR-jailbroken models show minimal degradation and preserve explicit harm recognition in a structured self-audit: they are able to identify harmful prompts and describe how a safe LLM should respond, yet they comply with the harmful request. With RLVR, harmful behavior is strongly suppressed by a reflective safety scaffold: when a harmful prompt is prepended with an instruction to reflect on safety standards, harmful behavior drops close to the baseline. Category-specific RLVR jailbreaks generalize broadly across harmfulness domains. Models jailbroken with SFT show the largest collapse in explicit safety judgments, the highest behavioral drift, and a substantial capability loss on standard benchmarks. Abliteration is family-dependent in both self-audit and response to a reflective safety scaffold. Mechanistic and repair analyses further separate the routes: abliteration is consistent with localized refusal-feature deletion, RLVR with preserved safety geometry but retargeted policy behavior, and SFT with broader distributed drift. Targeted repair partially recovers RLVR-jailbroken models, but has little effect on SFT-jailbroken models. Together, these results show that jailbreaks can produce vastly different properties despite similar harmfulness, with models jailbroken via RLVR showing remarkable similarity to the base model.

Related papers

• EVA: Editing for Versatile Alignment against Jailbreaks [85.18411558566851]
  EVA (Editing for Versatile Alignment against Jailbreaks) is a novel framework that pioneers the application of direct model editing for safety alignment.<n> EVA identifies and surgically edits specific neurons responsible for the model's susceptibility to harmful instructions.<n>It effectively neutralizes harmful behaviors without compromising the model's general reasoning capabilities.
  arXiv  Detail & Related papers  (2026-05-14T12:16:10Z)
• Why Do Aligned LLMs Remain Jailbreakable: Refusal-Escape Directions, Operator-Level Sources, and Safety-Utility Trade-off [10.459125169096696]
  Aligned large language models (LLMs) remain vulnerable to jailbreak attacks.<n>We show that aligned models can still exhibit Refusal-Escape Directions (RED)<n>We then prove that RED can be exactly decomposed into contributions from operator-level sources across the model's operator structure.
  arXiv  Detail & Related papers  (2026-05-09T10:57:36Z)
• Pruning Unsafe Tickets: A Resource-Efficient Framework for Safer and More Robust LLMs [23.758453206408102]
  Current alignment methods do not explicitly remove the unsafeworks that trigger harmful outputs.<n>In this work, we introduce a resource-efficient pruning framework that directly identifies and removes parameters associated with unsafe behaviors.<n> Empirical evaluations on ML models show substantial reductions in unsafe generations and improved robustness against jailbreak attacks, with minimal utility loss.
  arXiv  Detail & Related papers  (2026-04-17T07:37:41Z)
• Jailbreaking the Matrix: Nullspace Steering for Controlled Model Subversion [12.201783188544093]
  Head-Masked Nullspace Steering (HMNS) identifies attention heads most causally responsible for a model's default behavior.<n>This is the first jailbreak method to leverage geometry-aware, interpretability-informed interventions.
  arXiv  Detail & Related papers  (2026-04-11T19:19:05Z)
• Principled Steering via Null-space Projection for Jailbreak Defense in Vision-Language Models [71.11171576590134]
  Vision-language models can be easily induced by visual jailbreak attacks to generate harmful content.<n>We propose NullSteer, a null-space projected activation defense framework.<n>We show that NullSteer significantly reduces harmful outputs under various jailbreak attacks.
  arXiv  Detail & Related papers  (2026-03-23T15:23:23Z)
• Read the Scene, Not the Script: Outcome-Aware Safety for LLMs [22.814397376238755]
  We trace both to a common cause: current models reason weakly about links between actions and outcomes.<n>We define this failure mode as Consequence-blindness.<n>Models fine-tuned on CS-Chain-4k show clear gains against semantic-camouflage jailbreaks.
  arXiv  Detail & Related papers  (2025-10-05T18:46:49Z)
• DiffuGuard: How Intrinsic Safety is Lost and Found in Diffusion Large Language Models [50.21378052667732]
  We conduct an in-depth analysis of dLLM vulnerabilities to jailbreak attacks across two distinct dimensions: intra-step and inter-step dynamics.<n>We propose DiffuGuard, a training-free defense framework that addresses vulnerabilities through a dual-stage approach.
  arXiv  Detail & Related papers  (2025-09-29T05:17:10Z)
• ARMOR: Aligning Secure and Safe Large Language Models via Meticulous Reasoning [64.32925552574115]
  ARMOR is a large language model that analyzes jailbreak strategies and extracts the core intent.<n> ARMOR achieves state-of-the-art safety performance, with an average harmful rate of 0.002 and an attack success rate of 0.06 against advanced optimization-based jailbreaks.
  arXiv  Detail & Related papers  (2025-07-14T09:05:54Z)
• Why LLM Safety Guardrails Collapse After Fine-tuning: A Similarity Analysis Between Alignment and Fine-tuning Datasets [64.96967819446553]
  This paper investigates the degradation of safety guardrails through the lens of representation similarity between upstream alignment datasets and downstream fine-tuning tasks.<n>High similarity between these datasets significantly weakens safety guardrails, making models more susceptible to jailbreaks.<n>Low similarity between these two types of datasets yields substantially more robust models and thus reduces harmfulness score by up to 10.33%.
  arXiv  Detail & Related papers  (2025-06-05T17:59:55Z)
• AdaSteer: Your Aligned LLM is Inherently an Adaptive Jailbreak Defender [99.3105257001476]
  We propose AdaSteer, an adaptive activation steering method that adjusts model behavior based on input characteristics.<n>AdaSteer steers input representations along both the Rejection Direction (RD) and Harmfulness Direction (HD)<n>Our results highlight the potential of interpretable model internals for real-time, flexible safety enforcement in LLMs.
  arXiv  Detail & Related papers  (2025-04-13T07:39:17Z)
• JailDAM: Jailbreak Detection with Adaptive Memory for Vision-Language Model [25.204224437843365]
  Multimodal large language models (MLLMs) excel in vision-language tasks but pose significant risks of generating harmful content.<n>Jailbreak attacks refer to intentional manipulations that bypass safety mechanisms in models, leading to the generation of inappropriate or unsafe content.<n>We introduce a test-time adaptive framework called JAILDAM to address these issues.
  arXiv  Detail & Related papers  (2025-04-03T05:00:28Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.