mlsanityData to 7 Oct 2026

SoK: a Comprehensive Causality Analysis Framework for Large Language Model Security

arXiv 2512.04841 ↗First posted 4 Dec 2025cs.CR cs.AIcited by 0

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Large Language Models (LLMs) exhibit remarkable capabilities but remain vulnerable to adversarial manipulations such as jailbreaking, where crafted prompts bypass safety mechanisms. Understanding the causal factors behind such vulnerabilities is essential for building reliable defenses. In this work, we introduce a unified causality analysis framework that systematically supports all levels of causal investigation in LLMs, ranging from token-level, neuron-level, and layer-level interventions to representation-level analysis. The framework enables consistent experimentation and comparison across diverse causality-based attack and defense methods. Accompanying this implementation, we provide the first comprehensive survey of causality-driven jailbreak studies and empirically evaluate the framework on multiple open-weight models and safety-critical benchmarks including jailbreaks, hallucination detection, backdoor identification, and fairness evaluation. Our results reveal that: (1) targeted interventions on causally critical components can reliably modify safety behavior; (2) safety-related mechanisms are highly localized (i.e., concentrated in early-to-middle layers with only 1--2% of neurons exhibiting causal influence); and (3) causal features extracted from our framework achieve over 95% detection accuracy across multiple threat types. By bridging theoretical causality analysis and practical model safety, our framework establishes a reproducible foundation for research on causality-based attacks, interpretability, and robust attack detection and mitigation in LLMs. Code is available at https://github.com/Amadeuszhao/SOKCasuality.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 64 of its 75 references that are in the map. First posted on arXiv 4 Dec 2025.

Builds on

64 of 75 references.

Closest ancestors · 38

Same direction, newest first

  1. 2025Unraveling LLM Jailbreaks Through Safety Knowledge Neurons1 Sep
  2. 2025DELMAN: Dynamic Defense Against Large Language Model Jailbreaking with Model Editing17 Feb
  3. 2024AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMs3 Oct
  4. 2024Jailbreak Attacks and Defenses Against Large Language Models: A Survey5 Jul
  5. 2024Towards Understanding Jailbreak Attacks in LLMs: A Representation Space Analysis16 Jun
  6. 2024When LLM Meets DRL: Advancing Jailbreaking Efficiency via DRL-guided Search13 Jun
  7. 2024Adversarial Tuning: Defending Against Jailbreak Attacks for LLMs7 Jun
  8. 2024Improved Techniques for Optimization-Based Jailbreaking on Large Language Models31 May
  9. 2024Defending Large Language Models Against Jailbreak Attacks via Layer-specific Editing28 May
  10. 2024Efficient Adversarial Training in LLMs with Continuous Attacks24 May
  11. 2024AdvPrompter: Fast Adaptive Adversarial Prompting for LLMs21 Apr
  12. 2024AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMs11 Apr
26 more
  1. 2024Eraser: Jailbreaking Defense in Large Language Models via Unlearning Harmful Knowledge8 Apr
  2. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks2 Apr
  3. 2024Gradient Cuff: Detecting Jailbreak Attacks on Large Language Models by Exploring Refusal Loss Landscapes1 Mar
  4. 2024Defending Large Language Models against Jailbreak Attacks via Semantic Smoothing25 Feb
  5. 2024PRP: Propagating Universal Perturbations to Attack Large Language Model Guard-Rails24 Feb
  6. 2024Break the Breakout: Reinventing LM Defense Against Jailbreak Attacks with Self-Refinement23 Feb
  7. 2024A Comprehensive Study of Jailbreak Attack versus Defense for Large Language Models21 Feb
  8. 2024SafeDecoding: Defending against Jailbreak Attacks via Safety-Aware Decoding14 Feb
  9. 2024Robust Prompt Optimization for Defending Language Models Against Jailbreaking Attacks30 Jan
  10. 2024Intention Analysis Makes LLMs A Good Jailbreak Defender12 Jan
  11. 2023Causality Analysis for Evaluating the Security of Large Language Models13 Dec
  12. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automatically4 Dec
  13. 2023Defending Large Language Models Against Jailbreaking Attacks Through Goal Prioritization15 Nov
  14. 2023DeepInception: Hypnotize Large Language Model to Be Jailbreaker6 Nov
  15. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  16. 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generation10 Oct
  17. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations10 Oct
  18. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks5 Oct
  19. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models3 Oct
  20. 2023Defending Against Alignment-Breaking Attacks via Robustly Aligned LLM18 Sep
  21. 2023Certifying LLM Safety against Adversarial Prompting6 Sep
  22. 2023Detecting Language Model Attacks with Perplexity27 Aug
  23. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher12 Aug
  24. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
  25. 2023MasterKey: Automated Jailbreak Across Multiple Large Language Model Chatbots16 Jul
  26. 2023Jailbroken: How Does LLM Safety Training Fail?5 Jul

Other references · 26

  1. 2020Language Models are Few-Shot Learnerscited by 32,199
  2. 2024The Llama 3 Herd of Modelscited by 14,192
  3. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
  4. 2021Evaluating Large Language Models Trained on Codecited by 8,053
  5. 2023Qwen Technical Reportcited by 3,273
  6. 2023Mistral 7Bcited by 3,065
  7. 2021TruthfulQA: Measuring How Models Mimic Human Falsehoodscited by 2,919
  8. 2020RealToxicityPrompts: Evaluating Neural Toxic Degeneration in Language Modelscited by 1,235
  9. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
  10. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  11. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  12. 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Trainingcited by 478
14 more
  1. 2023A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Uglycited by 380
  2. 2024INSIDE: LLMs' Internal States Retain the Power of Hallucination Detectioncited by 317
  3. 2024Improving Alignment and Robustness with Circuit Breakerscited by 302
  4. 2023LLM Self Defense: By Self Examination, LLMs Know They Are Being Trickedcited by 226
  5. 2023RAIN: Your Language Models Can Align Themselves without Finetuningcited by 149
  6. 2023From ChatGPT to ThreatGPT: Impact of Generative AI in Cybersecurity and Privacycited by 137
  7. 2023Explore, Establish, Exploit: Red Teaming Language Models from Scratchcited by 111
  8. 2024On Prompt-Driven Safeguarding for Large Language Modelscited by 109
  9. 2023Composite Backdoor Attacks Against Large Language Modelscited by 63
  10. 2024CROW: Eliminating Backdoors from Large Language Models via Internal Consistency Regularizationcited by 29
  11. 2018Causal Testing: Finding Defects' Root Causescited by 22
  12. 2023Exploiting Large Language Models (LLMs) through Deception Techniques and Persuasion Principlescited by 17
  13. 2024LLMScan: Causal Scan for LLM Misbehavior Detectioncited by 13
  14. 2025Safety Alignment via Constrained Knowledge Unlearningcited by 13

Built on by

Not cited yet.