mlsanityData to 7 Oct 2026

Sparse Autoencoders are Capable LLM Jailbreak Mitigators

arXiv 2602.12418 ↗First posted 12 Feb 2026cs.CR cs.CL cs.LGcited by 4

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Jailbreak attacks remain a persistent threat to large language model safety. We propose Context-Conditioned Delta Steering (CC-Delta), an SAE-based defense that identifies jailbreak-relevant sparse features by comparing token-level representations of the same harmful request with and without jailbreak context. Using paired harmful/jailbreak prompts, CC-Delta selects features via statistical testing and applies inference-time mean-shift steering in SAE latent space. Across four aligned instruction-tuned models and twelve jailbreak attacks, CC-Delta achieves comparable or better safety-utility tradeoffs than baseline defenses operating in dense latent space. In particular, our method clearly outperforms dense mean-shift steering on all four models, and particularly against out-of-distribution attacks, showing that steering in sparse SAE feature space offers advantages over steering in dense activation space for jailbreak mitigation. Our results suggest off-the-shelf SAEs trained for interpretability can be repurposed as practical jailbreak defenses without task-specific training.

Key facts. Cited by 4 papers in the map (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 58 of its 75 references that are in the map. First posted on arXiv 12 Feb 2026.

Builds on

58 of 75 references.

Closest ancestors · 16

Same direction, newest first

  1. 2024LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet27 Aug
  2. 2024Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMs22 Jul
  3. 2024Protecting Your LLMs with Information Bottleneck22 Apr
  4. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks2 Apr
  5. 2024AutoDefense: Multi-Agent LLM Defense against Jailbreak Attacks2 Mar
  6. 2024Making Them Ask and Answer: Jailbreaking Large Language Models in Few Queries via Disguise and Reconstruction28 Feb
  7. 2024Defending LLMs against Jailbreaking Attacks via Backtranslation26 Feb
  8. 2024A StrongREJECT for Empty Jailbreaks15 Feb
  9. 2024Intention Analysis Makes LLMs A Good Jailbreak Defender12 Jan
  10. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs12 Jan
  11. 2023Self-Guard: Empower the LLM to Safeguard Itself24 Oct
  12. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
4 more
  1. 2023Defending Against Alignment-Breaking Attacks via Robustly Aligned LLM18 Sep
  2. 2023Detecting Language Model Attacks with Perplexity27 Aug
  3. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
  4. 2023Jailbroken: How Does LLM Safety Training Fail?5 Jul

Other references · 42

  1. 2020Language Models are Few-Shot Learnerscited by 32,199
  2. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 7,916
  3. 2020Measuring Massive Multitask Language Understandingcited by 7,768
  4. 2013Intriguing properties of neural networkscited by 5,114
  5. 2017Deep reinforcement learning from human preferencescited by 3,846
  6. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  7. 2024Gemma 2: Improving Open Language Models at a Practical Sizecited by 1,928
  8. 2023Sparse Autoencoders Find Highly Interpretable Features in Language Modelscited by 1,359
  9. 2023Inference-Time Intervention: Eliciting Truthful Answers from a Language Modelcited by 1,259
  10. 2023Representation Engineering: A Top-Down Approach to AI Transparencycited by 1,239
  11. 2023Instruction-Following Evaluation for Large Language Modelscited by 1,143
  12. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
30 more
  1. 2023Steering Llama 2 via Contrastive Activation Additioncited by 1,009
  2. 2022Toy Models of Superpositioncited by 928
  3. 2016Hyperband: A Novel Bandit-Based Approach to Hyperparameter Optimizationcited by 688
  4. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  5. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  6. 2024Scaling and evaluating sparse autoencoderscited by 530
  7. 2024Gemma Scope: Open Sparse Autoencoders Everywhere All At Once on Gemma 2cited by 381
  8. 2023Are aligned neural networks adversarially aligned?cited by 305
  9. 2024Improving Alignment and Robustness with Circuit Breakerscited by 302
  10. 2024Jumping Ahead: Improving Reconstruction Fidelity with JumpReLU Sparse Autoencoderscited by 283
  11. 2023Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attackscited by 268
  12. 2024OR-Bench: An Over-Refusal Benchmark for Large Language Modelscited by 222
  13. 2025AxBench: Steering LLMs? Even Simple Baselines Outperform Sparse Autoencoderscited by 199
  14. 2024Improving Instruction-Following in Language Models through Activation Steeringcited by 149
  15. 2024Llama Scope: Extracting Millions of Features from Llama-3.1-8B with Sparse Autoencoderscited by 133
  16. 2025SAEBench: A Comprehensive Benchmark for Sparse Autoencoders in Language Model Interpretabilitycited by 118
  17. 2024Do I Know This Entity? Knowledge Awareness and Hallucinations in Language Modelscited by 114
  18. 2025Are Sparse Autoencoders Useful? A Case Study in Sparse Probingcited by 109
  19. 2024Steering Language Model Refusal with Sparse Autoencoderscited by 89
  20. 2024Defending Against Unforeseen Failure Modes with Latent Adversarial Trainingcited by 82
  21. 2023Word Embeddings Are Steers for Language Modelscited by 70
  22. 2024Controlling Language and Diffusion Models by Transporting Activationscited by 59
  23. 2025Steering Large Language Model Activations in Sparse Spacescited by 58
  24. 2024Steering Without Side Effects: Improving Post-Deployment Control of Language Modelscited by 44
  25. 2024CopyBench: Measuring Literal and Non-Literal Reproduction of Copyright-Protected Text in Language Model Generationcited by 35
  26. 2025Beyond Prompt Engineering: Robust Behavior Control in LLMs via Steering Target Atomscited by 23
  27. 2025Activation Space Interventions Can Be Transferred Between Large Language Modelscited by 17
  28. 2024Copyright-Protected Language Generation via Adaptive Model Fusioncited by 6
  29. 2025Dynamically Scaled Activation Steeringcited by 6
  30. 2025Semantic Regexes: Auto-Interpreting LLM Features with a Structured Languagecited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 4.

4 papers.

  1. 2026From Concept-Aligned Tokens to Vulnerable Features: Mechanistic Localization of Jailbreakscited by 0
  2. 2026Minimal, Local, Causal Explanations for Jailbreak Success in Large Language Modelscited by 0
  3. 2026Do LLMs Know Their Vulnerable Scenarios?cited by 0
  4. 2026When Safety Speaks a Language: A Mechanistic Analysis of Safety-Language Identity Entanglement in LLMscited by 0