{"total":88,"rows":[{"id":"2509.21305","title":"Sycophancy Is Not One Thing: Causal Separation of Sycophantic Behaviors in LLMs","created":"2025-09-25","cited_by_count":37,"area":null},{"id":"2601.14004","title":"Locate, Steer, and Improve: A Practical Survey of Actionable Mechanistic Interpretability in Large Language Models","created":"2026-01-20","cited_by_count":27,"area":"mechinterp"},{"id":"2602.02132","title":"There Is More to Refusal in Large Language Models than a Single Direction","created":"2026-02-02","cited_by_count":26,"area":"mechinterp"},{"id":"2509.09708","title":"Beyond I'm Sorry, I Can't: Dissecting Large Language Model Refusal","created":"2025-09-07","cited_by_count":19,"area":"safety"},{"id":"2510.24941","title":"Can Aha Moments Be Fake? Towards Quantifying Decorative and True Thinking in Chain-of-Thought","created":"2025-10-28","cited_by_count":15,"area":"lr"},{"id":"2510.20956","title":"Self-Jailbreaking: Language Models Can Reason Themselves Out of Safety Alignment After Benign Reasoning Training","created":"2025-10-23","cited_by_count":12,"area":"lr"},{"id":"2512.13655","title":"Comparative Analysis of LLM Abliteration Methods: A Cross-Architecture Evaluation","created":"2025-12-15","cited_by_count":9,"area":"alignment"},{"id":"2602.00333","title":"Efficient and accurate steering of Large Language Models through attention-guided feature learning","created":"2026-01-30","cited_by_count":8,"area":null},{"id":"2509.21947","title":"Active Attacks: Red-teaming LLMs via Adaptive Environments","created":"2025-09-26","cited_by_count":7,"area":"safety"},{"id":"2511.14423","title":"Unified Defense for Large Language Models against Jailbreak and Fine-Tuning Attacks in Education","created":"2025-11-18","cited_by_count":5,"area":"safety"},{"id":"2604.18901","title":"Harmful Intent as a Geometrically Recoverable Feature of LLM Residual Streams","created":"2026-04-20","cited_by_count":4,"area":"alignment"},{"id":"2606.02530","title":"SafeSteer: Localized On-Policy Distillation for Efficient Safety Alignment","created":"2026-06-01","cited_by_count":4,"area":"alignment"},{"id":"2510.06700","title":"How Language Models Conflate Logical Validity with Plausibility: A Representational Analysis of Content Effects","created":"2025-10-08","cited_by_count":3,"area":null},{"id":"2510.18081","title":"Any-Depth Alignment: Unlocking Innate Safety Alignment of LLMs to Any-Depth","created":"2025-10-20","cited_by_count":3,"area":"alignment"},{"id":"2604.04385","title":"How Alignment Routes: Localizing, Scaling, and Controlling Policy Circuits in Language Models","created":"2026-04-06","cited_by_count":3,"area":"mechinterp"},{"id":"2604.09544","title":"Large Language Models Generate Harmful Responses Using a Distinct Mechanism, Shared Across Harm Types","created":"2026-04-10","cited_by_count":3,"area":"safety"},{"id":"2605.13339","title":"Probing Persona-Dependent Preferences in Language Models","created":"2026-05-13","cited_by_count":3,"area":null},{"id":"2606.14388","title":"A Low-Rank Subspace Analysis of LLM Interventions","created":"2026-06-12","cited_by_count":3,"area":null},{"id":"2603.27518","title":"Over-Refusal and Representation Subspaces: A Mechanistic Analysis of Task-Conditioned Refusal in Aligned LLMs","created":"2026-03-29","cited_by_count":2,"area":"alignment"},{"id":"2604.06233","title":"Blind Refusal: Language Models Refuse to Help Users Evade Unjust, Absurd, and Illegitimate Rules","created":"2026-04-03","cited_by_count":2,"area":null},{"id":"2604.27019","title":"Dynamic Adversarial Fine-Tuning Reorganizes Refusal Geometry","created":"2026-04-29","cited_by_count":2,"area":"alignment"},{"id":"2605.06901","title":"Reflections and New Directions for Human-Centered Large Language Models","created":"2026-05-07","cited_by_count":2,"area":null},{"id":"2606.01196","title":"Low-Resource Safety Failures Are Action Failures, Not Representation Failures","created":"2026-05-31","cited_by_count":2,"area":"alignment"},{"id":"2606.06667","title":"The Piggyback Hypothesis of Generalization: Explaining and Mitigating Emergent Misalignment","created":"2026-06-04","cited_by_count":2,"area":null},{"id":"2606.08044","title":"When Behavioral Safety Evaluation Fails: A Representation-Level Perspective","created":"2026-06-06","cited_by_count":2,"area":"safety"},{"id":"2607.02047","title":"OpenSafeIntent: Evaluating Intent-Calibrated Safe Completion Across Dual-Use Prompt Sets","created":"2026-07-02","cited_by_count":2,"area":null},{"id":"2607.12792","title":"Silent Alarm: A J-Space Protocol for Comparing Danger Recognition Across Models and Quantization Levels","created":"2026-07-14","cited_by_count":2,"area":"safety"},{"id":"2607.13075","title":"The Entanglement Wall: Activation-Space Probes as Risk Detectors, Not Context Adjudicators","created":"2026-07-12","cited_by_count":2,"area":"safety"},{"id":"2608.08029","title":"Do All LLMs Know When They're Being Harmful? A Reproducibility Study of Latent-Space Safety Probes Across Model Families","created":"2026-08-08","cited_by_count":2,"area":"safety"},{"id":"2509.25843","title":"ASGuard: Activation-Scaling Guard to Mitigate Targeted Jailbreaking Attack","created":"2025-09-30","cited_by_count":1,"area":"safety"},{"id":"2511.08367","title":"Why Does Weak-OOD Help? A Further Step Towards Understanding Jailbreaking VLMs","created":"2025-11-11","cited_by_count":1,"area":"safety"},{"id":"2603.08234","title":"The Struggle Between Continuation and Refusal: A Mechanistic Analysis of the Continuation-Triggered Jailbreak in LLMs","created":"2026-03-09","cited_by_count":1,"area":"safety"},{"id":"2604.11120","title":"Persona Non Grata: Single-Method Safety Evaluation Is Incomplete for Persona-Imbued LLMs","created":"2026-04-13","cited_by_count":1,"area":null},{"id":"2605.26526","title":"Open-Weight LLM Fine-Tuning Defenses are Susceptible to Simple Attacks","created":"2026-05-26","cited_by_count":1,"area":"safety"},{"id":"2606.00160","title":"DataShield: Safety-degrading Data Filtering for LLM Benign Instruction Fine-Tuning","created":"2026-05-29","cited_by_count":1,"area":null},{"id":"2608.03201","title":"When Refusal Looks Safe: The Refusal-Cue Shortcut in Safety Guard Models","created":"2026-08-04","cited_by_count":1,"area":"safety"},{"id":"2608.07139","title":"Online Conformal Prediction Beyond Feedback","created":"2026-08-07","cited_by_count":1,"area":null},{"id":"2608.16852","title":"What Do Compliance Detectors Read? An Audit of Activation Probes and Guard Models","created":"2026-08-17","cited_by_count":1,"area":null},{"id":"2609.03887","title":"Beyond Shallow Alignment: How Post-Training Methods Determine Refusal Circuits And Steering Robustness","created":"2026-09-03","cited_by_count":1,"area":"alignment"},{"id":"2609.14759","title":"Refusal Reads Only a Slice of What the Model Knows: Harm-Keyed Routing and Its Exceptions Across Model Families","created":"2026-09-13","cited_by_count":1,"area":null},{"id":"2609.16204","title":"Decoy Direction Optimization: A Post-Hoc Defense Against LLM Abliteration","created":"2026-09-14","cited_by_count":1,"area":"safety"},{"id":"2609.29287","title":"AEGIS: Audio Endogenous Guarding via Internal Signals Against Large Audio-Language Model Jailbreaks","created":"2026-09-24","cited_by_count":1,"area":"safety"},{"id":"2610.05295","title":"Readable Before Actionable: Causal Tracing of Indirect Prompt Injection","created":"2026-10-04","cited_by_count":1,"area":"agents"},{"id":"2602.04856","title":"CoT is Not the Chain of Truth: An Empirical Internal Analysis of Reasoning LLMs for Fake News Generation","created":"2026-02-04","cited_by_count":0,"area":"lr"},{"id":"2604.00324","title":"The Persistent Vulnerability of Aligned AI Systems","created":"2026-03-31","cited_by_count":0,"area":null},{"id":"2605.00123","title":"Minimal, Local, Causal Explanations for Jailbreak Success in Large Language Models","created":"2026-04-30","cited_by_count":0,"area":"safety"},{"id":"2605.14347","title":"Exemplar Partitioning for Mechanistic Interpretability","created":"2026-05-14","cited_by_count":0,"area":"safety"},{"id":"2605.20262","title":"Residual Paving: Diagnosing the Routing Bottleneck in Selective Refusal Editing","created":"2026-05-18","cited_by_count":0,"area":null},{"id":"2605.24550","title":"Jailbreak to Protect: Buffering and Reinforcing via Temporary Jailbreaking for Safe Fine-Tuning in Large Language Models","created":"2026-05-23","cited_by_count":0,"area":"safety"},{"id":"2605.26772","title":"Beyond a Single Direction: Chain-of-Thought Disrupts Simple Steering of Refusal","created":"2026-05-26","cited_by_count":0,"area":"lr"},{"id":"2606.04168","title":"When Autoregressive Consistency Hurts Safety Alignment","created":"2026-06-02","cited_by_count":0,"area":"alignment"},{"id":"2606.07970","title":"Defending Against Malicious Finetuning by Scaling Train-time Adversarial Attacks","created":"2026-06-06","cited_by_count":0,"area":"alignment"},{"id":"2606.13709","title":"LoMC: Localized Multidirectional Correction for Refusal Suppression in Routed Foundation Models","created":"2026-06-10","cited_by_count":0,"area":"moe"},{"id":"2606.16349","title":"From Refusal Geometry to Safety Geometry: Harmfulness--Refusal Coupling under Dynamic Adversarial Fine-Tuning","created":"2026-06-15","cited_by_count":0,"area":"alignment"},{"id":"2606.31876","title":"Harnessing Textual Refusal Directions for Multimodal Safety","created":"2026-06-30","cited_by_count":0,"area":null},{"id":"2607.00572","title":"HARC: Coupling Harmfulness and Refusal Directions for Robust Safety Alignment","created":"2026-07-01","cited_by_count":0,"area":"alignment"},{"id":"2607.20581","title":"Geometric Configurations of Perturbed Jailbreak Prompts","created":"2026-07-22","cited_by_count":0,"area":"safety"},{"id":"2607.23496","title":"Do LLMs Know Their Vulnerable Scenarios?","created":"2026-07-26","cited_by_count":0,"area":"alignment"},{"id":"2608.05409","title":"Mood Matters: How Syntactic Sensitivity Undermines Safety Alignment","created":"2026-08-05","cited_by_count":0,"area":"alignment"},{"id":"2608.17202","title":"Fool's Gold: Defensive Deception Against Safety-Removal Attacks on Open-Weight Models","created":"2026-08-17","cited_by_count":0,"area":"alignment"},{"id":"2608.22490","title":"Who Pays More for Safety? Measuring the Disparate Cost of Safety Alignment across Languages","created":"2026-08-23","cited_by_count":0,"area":"alignment"},{"id":"2608.26222","title":"NeuronFuzz: Safety Neuron Guided Fuzzing for LLM Safety Evaluation","created":"2026-08-26","cited_by_count":0,"area":"alignment"},{"id":"2608.30197","title":"ALTSTEER: Selective Safety Steering for Moving Beyond Hard Refusals to Constructive Alternatives","created":"2026-08-31","cited_by_count":0,"area":"alignment"},{"id":"2608.30585","title":"The Safety Relay in Roleplay Jailbreaks: A Component-Resolved Causal Analysis of Harm Recognition and Refusal","created":"2026-08-31","cited_by_count":0,"area":"safety"},{"id":"2608.30986","title":"Controlling Refusal Behavior of LLMs via Stiefel-Constrained Rotation Steering","created":"2026-08-31","cited_by_count":0,"area":"mechinterp"},{"id":"2609.00790","title":"RISA: Response Inspection and Selective Actions for Refusal Calibration in Large Language Models","created":"2026-09-01","cited_by_count":0,"area":"safety"},{"id":"2609.05797","title":"Safety Monitors Mostly Catch What the Model Already Refuses","created":"2026-09-05","cited_by_count":0,"area":"safety"},{"id":"2609.13737","title":"ForeSight: Enhancing Risk Monitoring via Early Safety Signal Distillation","created":"2026-09-12","cited_by_count":0,"area":"safety"},{"id":"2609.14448","title":"NeuroActiSep: Detecting Factual Hallucinations from Feed-Forward Neurons in a Single Pass","created":"2026-09-13","cited_by_count":0,"area":null},{"id":"2609.14754","title":"Calibrating Interpretability Instruments Before Trusting Their Verdicts","created":"2026-09-13","cited_by_count":0,"area":null},{"id":"2609.19366","title":"The Role of Fine-grained Harm Signals in LLM Safety","created":"2026-09-16","cited_by_count":0,"area":"safety"},{"id":"2609.22153","title":"SafeTune: A Unified Faithful Library for Auditing and Repairing Safety Drift in Fine-Tuned LLMs","created":"2026-08-26","cited_by_count":0,"area":null},{"id":"2609.22224","title":"From Trait Vectors to Circuits: Tracing Refusal and Sycophancy Through Language Models","created":"2026-09-02","cited_by_count":0,"area":null},{"id":"2609.22260","title":"Causal Localization of the Refusal Direction in Audio Language Models","created":"2026-09-06","cited_by_count":0,"area":null},{"id":"2609.24066","title":"Efficient Reasoning Exploration via State-Conditioned Latent Steering with Progress Guidance","created":"2026-09-21","cited_by_count":0,"area":"lr"},{"id":"2609.26178","title":"Unread or Unenforced? Separating Representation from Enforcement Failure in Content Guards","created":"2026-08-12","cited_by_count":0,"area":"safety"},{"id":"2609.27758","title":"Hard Negatives Reveal What Easy Negatives Hide: Cross-Lingual Harmfulness Representations Degrade with Resource Tier Under Hard Negatives","created":"2026-08-15","cited_by_count":0,"area":"alignment"},{"id":"2609.32434","title":"From Latents to Wires: Surgical Post-Editing on Large Language Models","created":"2026-09-26","cited_by_count":0,"area":"safety"},{"id":"2609.33039","title":"Agent Safety From Within: Detecting Harmful Trajectories from LLM Internal States","created":"2026-09-27","cited_by_count":0,"area":"agents"},{"id":"2609.34686","title":"Jailbreak Context Lingers: Divergent Safety Routing and Its Cross-Task Predictability in Tool Agents","created":"2026-09-28","cited_by_count":0,"area":"agents"},{"id":"2609.35117","title":"Tool Mediation Alters Refusal Mechanisms in Large Language Models","created":"2026-09-28","cited_by_count":0,"area":null},{"id":"2609.38389","title":"The Geometry of Harmfulness in Multi-Turn Attacks","created":"2026-09-29","cited_by_count":0,"area":"alignment"},{"id":"2610.00348","title":"Removing the NEEDLE in the Haystack: Backdoor Removal in LLMs via Weight Orthogonalisation","created":"2026-09-29","cited_by_count":0,"area":"safety"},{"id":"2610.04245","title":"On the Steering Dimensionality of Refusal in Language Models","created":"2026-10-03","cited_by_count":0,"area":"safety"},{"id":"2610.05541","title":"Don't Judge an LLM Only by Its Activations: Discovering Suppressed Safety Features via Counterfactual Activation Potential","created":"2026-10-04","cited_by_count":0,"area":"safety"},{"id":"2610.07514","title":"From Local Evidence to Safety Verdicts: Causal Tracing in Vision-Language Models","created":"2026-10-05","cited_by_count":0,"area":"mllm"},{"id":"2610.17728","title":"Safety for Whom? Benchmarking Understanding Beyond Refusal in Egocentric Multimodal Assistants","created":"2026-10-13","cited_by_count":0,"area":null},{"id":"2610.19114","title":"Genesis Steering: Better Activation Steering Through Training Data","created":"2026-10-13","cited_by_count":0,"area":"mechinterp"}],"next_cursor":null}