mlsanityData to 14 Oct 2026

ConceptGuard: Neuro-Symbolic Safety Guardrails via Sparse Interpretable Jailbreak Concepts

arXiv 2508.16325 ↗First posted 22 Aug 2025cs.CL cs.AI cs.SCcited by 2

On the map: LLM safety and security → Jailbreaking

also in 1 more
Abstract (arXiv)

Large Language Models have found success in a variety of applications. However, their safety remains a concern due to the existence of various jailbreaking methods. Despite significant efforts, alignment and safety fine-tuning only provide a certain degree of robustness against jailbreak attacks that covertly mislead LLMs towards the generation of harmful content. This leaves them prone to a range of vulnerabilities, including targeted misuse and accidental user profiling. This work introduces ConceptGuard, a novel framework that leverages Sparse Autoencoders (SAEs) to identify interpretable concepts within LLM internals associated with different jailbreak themes. By extracting semantically meaningful internal representations, ConceptGuard enables building robust safety guardrails -- offering fully explainable and generalizable defenses without sacrificing model capabilities or requiring further fine-tuning. Leveraging advances in the mechanistic interpretability of LLMs, our approach provides evidence for a shared activation geometry for jailbreak attacks in the representation space, a potential foundation for designing more interpretable and generalizable safeguards against attackers.

Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 51 of its 70 references that are in the map. First posted on arXiv 22 Aug 2025.

Builds on

51 of 70 references.

Closest ancestors · 10

Same direction, newest first

  1. 2024Best-of-N Jailbreaking4 Dec
  2. 2024JailbreakLens: Interpreting Jailbreak Mechanism in the Lens of Representation and Circuit17 Nov
  3. 2024What Features in Prompts Jailbreak LLMs? Investigating the Mechanisms Behind Attacks2 Nov
  4. 2024Faster-GCG: Efficient Discrete Optimization Jailbreak Attacks against Aligned Large Language Models20 Oct
  5. 2024AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMs3 Oct
  6. 2024Understanding Jailbreak Success: A Study of Latent Space Dynamics in Large Language Models13 Jun
  7. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automatically4 Dec
  8. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  9. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
  10. 2023Jailbroken: How Does LLM Safety Training Fail?5 Jul

Other references · 41

  1. 2024The Llama 3 Herd of Modelscited by 14,715
  2. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
  3. 2016Concrete Problems in AI Safetycited by 1,642
  4. 2023Sparse Autoencoders Find Highly Interpretable Features in Language Modelscited by 1,420
  5. 2023A Survey on Evaluation of Large Language Modelscited by 1,242
  6. 2023Steering Llama 2 via Contrastive Activation Additioncited by 1,085
  7. 2023Towards Understanding Sycophancy in Language Modelscited by 1,040
  8. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 1,032
  9. 2023BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Datasetcited by 860
  10. 2023Progress measures for grokking via mechanistic interpretabilitycited by 839
  11. 2023Safe RLHF: Safe Reinforcement Learning from Human Feedbackcited by 656
  12. 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Trainingcited by 529
29 more
  1. 2024Mechanistic Interpretability for AI Safety -- A Reviewcited by 422
  2. 2024Improving Alignment and Robustness with Circuit Breakerscited by 322
  3. 2024Jumping Ahead: Improving Reconstruction Fidelity with JumpReLU Sparse Autoencoderscited by 300
  4. 2023AI Alignment: A Comprehensive Surveycited by 263
  5. 2023Red-Teaming Large Language Models using Chain of Utterances for Safety-Alignmentcited by 223
  6. 2023OpenAGI: When LLM Meets Domain Expertscited by 197
  7. 2025Open Problems in Mechanistic Interpretabilitycited by 179
  8. 2024Llama Scope: Extracting Millions of Features from Llama-3.1-8B with Sparse Autoencoderscited by 143
  9. 2024Exploring the Reasoning Abilities of Multimodal Large Language Models (MLLMs): A Comprehensive Survey on Emerging Trends in Multimodal Reasoningcited by 136
  10. 2024A Practical Review of Mechanistic Interpretability for Transformer-Based Language Modelscited by 118
  11. 2023An LLM can Fool Itself: A Prompt-Based Adversarial Attackcited by 116
  12. 2024Language Models are Homer Simpson! Safety Re-Alignment of Fine-tuned Language Models through Task Arithmeticcited by 112
  13. 2024Steering Language Model Refusal with Sparse Autoencoderscited by 95
  14. 2023Neurons in Large Language Models: Dead, N-gram, Positionalcited by 88
  15. 2024Red-Teaming for Generative AI: Silver Bullet or Security Theater?cited by 83
  16. 2024Refuse Whenever You Feel Unsafe: Improving Safety in LLMs via Decoupled Refusal Trainingcited by 69
  17. 2024Building Guardrails for Large Language Modelscited by 65
  18. 2025Projecting Assumptions: The Duality Between Sparse Autoencoders and Concept Geometrycited by 61
  19. 2024White-box Multimodal Jailbreaks Against Large Vision-Language Modelscited by 59
  20. 2024What Makes and Breaks Safety Fine-tuning? A Mechanistic Studycited by 55
  21. 2020Stopwords in Technical Language Processingcited by 29
  22. 2023Unveiling Safety Vulnerabilities of Large Language Modelscited by 27
  23. 2024How (un)ethical are instruction-centric responses of LLMs? Unveiling the vulnerabilities of safety guardrails to harmful queriescited by 27
  24. 2024Compact Proofs of Model Performance via Mechanistic Interpretabilitycited by 18
  25. 2025Fundamental Safety-Capability Trade-offs in Fine-tuning Large Language Modelscited by 17
  26. 2023Why do universal adversarial attacks work on large language models?: Geometry might be the answercited by 14
  27. 2019A Robust Approach for Securing Audio Classification Against Adversarial Attackscited by 12
  28. 2025Breaking Bad Tokens: Detoxification of LLMs Using Sparse Autoencoderscited by 9
  29. 2025Deceptive Automated Interpretability: Language Models Coordinating to Fool Oversight Systemscited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 2.

2 papers.

  1. 2026Lost or Hidden? A Concept-Level Forgetting in Supervised Continual Learningcited by 0
  2. 2026Temporally-Resolved Token Attribution Reveals the Generation Dynamics of Diffusion Language Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025JBShield: Defending Large Language Models from Jailbreak Attacks through Activated Concept Analysis and Manipulation
  2. 2025Unraveling LLM Jailbreaks Through Safety Knowledge Neurons
  3. 2026From Concept-Aligned Tokens to Vulnerable Features: Mechanistic Localization of Jailbreaks
  4. 2025Why Not Act on What You Know? Unleashing Safety Potential of LLMs via Self-Aware Guard Enhancement
  5. 2025GraphAttack: Exploiting Representational Blindspots in LLM Safety Mechanisms
  6. 2025SafeInt: Shielding Large Language Models from Jailbreak Attacks via Safety-Aware Representation Intervention
  7. 2025Forewarned is Forearmed: Pre-Synthesizing Jailbreak-like Instructions to Enhance LLM Safety Guardrail to Potential Attacks
  8. 2026Minimal, Local, Causal Explanations for Jailbreak Success in Large Language Models