mlsanityData to 14 Oct 2026

Beyond Surface Alignment: Rebuilding LLMs Safety Mechanism via Probabilistically Ablating Refusal Direction

arXiv 2509.15202 ↗First posted 18 Sep 2025cs.CRcited by 8

On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks

also in 1 more
Abstract (arXiv)

Jailbreak attacks pose persistent threats to large language models (LLMs). Current safety alignment methods have attempted to address these issues, but they experience two significant limitations: insufficient safety alignment depth and unrobust internal defense mechanisms. These limitations make them vulnerable to adversarial attacks such as prefilling and refusal direction manipulation. We introduce DeepRefusal, a robust safety alignment framework that overcomes these issues. DeepRefusal forces the model to dynamically rebuild its refusal mechanisms from jailbreak states. This is achieved by probabilistically ablating the refusal direction across layers and token depths during fine-tuning. Our method not only defends against prefilling and refusal direction attacks but also demonstrates strong resilience against other unseen jailbreak strategies. Extensive evaluations on four open-source LLM families and six representative attacks show that DeepRefusal reduces attack success rates by approximately 95%, while maintaining model capabilities with minimal performance degradation.

Key facts. Cited by 8 papers in the map (data through 14 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 23 of its 37 references that are in the map. First posted on arXiv 18 Sep 2025.

Builds on

23 of 37 references.

Closest ancestors · 5

Same direction, newest first

  1. 2025The Geometry of Refusal in Large Language Models: Concept Cones and Representational Independence24 Feb
  2. 2024How Alignment and Jailbreak Work: Explain LLM Safety through Intermediate Hidden States9 Jun
  3. 2024Lisa: Lazy Safety Alignment for Large Language Models against Harmful Fine-tuning Attack28 May
  4. 2024Uncovering Safety Risks of Large Language Models through Concept Activation Vector18 Apr
  5. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!5 Oct

Other references · 18

  1. 2021Training Verifiers to Solve Math Word Problemscited by 10,109
  2. 2020Measuring Massive Multitask Language Understandingcited by 7,963
  3. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
  4. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  5. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  6. 2023Steering Llama 2 via Contrastive Activation Additioncited by 1,085
  7. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 1,032
  8. 2023Enhancing Chat Language Models by Scaling High-quality Instructional Conversationscited by 839
  9. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 469
  10. 2023Detecting Language Model Attacks with Perplexitycited by 431
  11. 2024Improving Alignment and Robustness with Circuit Breakerscited by 322
  12. 2024SafeDecoding: Defending against Jailbreak Attacks via Safety-Aware Decodingcited by 247
6 more
  1. 2024Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMscited by 173
  2. 2024Tamper-Resistant Safeguards for Open-Weight LLMscited by 138
  3. 2024Efficient Adversarial Training in LLMs with Continuous Attackscited by 113
  4. 2024Robust LLM safeguarding via refusal feature adversarial trainingcited by 64
  5. 2023Bypassing the Safety Training of Open-Source LLMs with Priming Attackscited by 50
  6. 2024Steering Without Side Effects: Improving Post-Deployment Control of Language Modelscited by 46

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 1; 2026: 7.

8 papers.

  1. 2025Read the Scene, Not the Script: Outcome-Aware Safety for LLMscited by 6
  2. 2026RouteHijack: Routing-Aware Attack on Mixture-of-Experts LLMscited by 6
  3. 2026Fail-Closed Alignment for Large Language Modelscited by 2
  4. 2026Dynamic Adversarial Fine-Tuning Reorganizes Refusal Geometrycited by 2
  5. 2026RefusalGuard: Geometry-Preserving Fine-Tuning for Safety in LLMscited by 1
  6. 2026Mask2Shield: Strengthening LLM Safety against Neuron-Pruning Attackscited by 0
  7. 2026Making Your LLMs More Objective: Stabilizing LLM Safety Behavior Across Traits with Trait-Invariant Safety Tuningcited by 0
  8. 2026Fool's Gold: Defensive Deception Against Safety-Removal Attacks on Open-Weight Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Defending Large Language Models Against Jailbreak Attacks via Layer-specific Editing
  2. 2026Circuit Discovery Helps Detect LLM Jailbreaking: A Mechanistic Interpretability Study
  3. 2026Defending Large Language Models Against Jailbreak Attacks via In-Decoding Safety-Awareness Probing
  4. 2025Improving LLM Safety Alignment with Dual-Objective Optimization
  5. 2025AdaSteer: Your Aligned LLM is Inherently an Adaptive Jailbreak Defender
  6. 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deep
  7. 2026Why Do Aligned LLMs Remain Jailbreakable: Refusal-Escape Directions, Operator-Level Sources, and Safety-Utility Trade-off
  8. 2024SafeAligner: Safety Alignment against Jailbreak Attacks via Response Disparity Guidance