Pruning Unsafe Tickets: A Resource-Efficient Framework for Safer and More Robust LLMs
On the map: LLM safety and security → Jailbreaking
Abstract (arXiv)
Machine learning models are increasingly deployed in real-world applications, but even aligned models such as Mistral and LLaVA still exhibit unsafe behaviors inherited from pre-training. Current alignment methods like SFT and RLHF primarily encourage models to generate preferred responses, but do not explicitly remove the unsafe subnetworks that trigger harmful outputs. In this work, we introduce a resource-efficient pruning framework that directly identifies and removes parameters associated with unsafe behaviors while preserving model utility. Our method employs a gradient-free attribution mechanism, requiring only modest GPU resources, and generalizes across architectures and quantized variants. Empirical evaluations on ML models show substantial reductions in unsafe generations and improved robustness against jailbreak attacks, with minimal utility loss. From the perspective of the Lottery Ticket Hypothesis, our results suggest that ML models contain "unsafe tickets" responsible for harmful behaviors, and pruning reveals "safety tickets" that maintain performance while aligning outputs. This provides a lightweight, post-hoc alignment strategy suitable for deployment in resource-constrained settings.
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 48 of its 60 references that are in the map. First posted on arXiv 17 Apr 2026.
Builds on
48 of 60 references.
Closest ancestors · 7
Same direction, newest first
- 2025Adjacent Words, Divergent Intents: Jailbreaking Large Language Models via Task Concurrency24 Oct
- 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models28 Mar
- 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs12 Jan
- 2023Defending Large Language Models Against Jailbreaking Attacks Through Goal Prioritization15 Nov
- 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
- 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generation10 Oct
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
Other references · 41
- 2017Attention Is All You Needcited by 59,932
- 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
- 2020Language Models are Few-Shot Learnerscited by 32,199
- 2022Training language models to follow instructions with human feedbackcited by 15,712
- 2023LLaMA: Open and Efficient Foundation Language Modelscited by 13,958
- 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
- 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,393
- 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 7,916
- 2019BART: Denoising Sequence-to-Sequence Pre-training for Natural Language Generation, Translation, and Comprehensioncited by 5,874
- 2023Improved Baselines with Visual Instruction Tuningcited by 4,362
- 2017Deep reinforcement learning from human preferencescited by 3,846
- 2015Deep Compression: Compressing Deep Neural Networks with Pruning, Trained Quantization and Huffman Codingcited by 2,291
29 more
- 2018The Lottery Ticket Hypothesis: Finding Sparse, Trainable Neural Networkscited by 2,250
- 2019Fine-Tuning Language Models from Human Preferencescited by 2,124
- 2015Learning both Weights and Connections for Efficient Neural Networkscited by 1,998
- 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
- 2020Transformer Feed-Forward Layers Are Key-Value Memoriescited by 1,307
- 2023Inference-Time Intervention: Eliciting Truthful Answers from a Language Modelcited by 1,259
- 2016Pruning Filters for Efficient ConvNetscited by 1,129
- 2023SparseGPT: Massive Language Models Can Be Accurately Pruned in One-Shotcited by 1,090
- 2023Enhancing Chat Language Models by Scaling High-quality Instructional Conversationscited by 825
- 2018SNIP: Single-shot Network Pruning based on Connection Sensitivitycited by 802
- 2023A Simple and Effective Pruning Approach for Large Language Modelscited by 776
- 2022Quantifying Memorization Across Neural Language Modelscited by 755
- 2022Transformer Feed-Forward Layers Build Predictions by Promoting Concepts in the Vocabulary Spacecited by 522
- 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deepcited by 450
- 2024Improving Alignment and Robustness with Circuit Breakerscited by 302
- 2023MM-SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Modelscited by 255
- 2024PKU-SafeRLHF: Towards Multi-Level Safety Alignment for LLMs with Human Preferencecited by 252
- 2024Assessing the Brittleness of Safety Alignment via Pruning and Low-Rank Modificationscited by 220
- 2023Attribution Patching Outperforms Automated Circuit Discoverycited by 196
- 2024A Mechanistic Understanding of Alignment Algorithms: A Case Study on DPO and Toxicitycited by 179
- 2024Language Models are Homer Simpson! Safety Re-Alignment of Fine-tuned Language Models through Task Arithmeticcited by 105
- 2019One ticket to win them all: generalizing lottery ticket initializations across datasets and optimizerscited by 102
- 2021Multi-Prize Lottery Ticket Hypothesis: Finding Accurate Binary Neural Networks by Pruning A Randomly Weighted Networkcited by 55
- 2025SaLoRA: Safety-Alignment Preserved Low-Rank Adaptationcited by 39
- 2024Generated Data with Fake Privacy: Hidden Dangers of Fine-tuning Large Language Models on Generated Datacited by 21
- 2025Excessive Reasoning Attack on Reasoning LLMscited by 17
- 2026Benchmark of Benchmarks: Unpacking Influence and Code Repository Quality in LLM Safety Benchmarkscited by 3
- 2026Understanding LLM Behavior When Encountering User-Supplied Harmful Content in Harmless Taskscited by 3
- 2026Finding and Reactivating Post-Trained LLMs' Hidden Safety Mechanismscited by 2
Built on by
Citing papers per year: 2026: 1.
1 paper.
- 2026The Safeguard Worked. Is the LLM System Safer?cited by 0
- 2026The Safeguard Worked. Is the LLM System Safer?1 Sep 2026
Similar, not cited
Close in wording, no citation either way
- 2025Efficient Safety Retrofitting Against Jailbreaking for LLMs
- 2024LIAR: Leveraging Inference Time Alignment (Best-of-N) to Jailbreak LLMs in Seconds
- 2024Pruning for Protection: Increasing Jailbreak Resistance in Aligned LLMs Without Fine-Tuning
- 2025Improving LLM Safety Alignment with Dual-Objective Optimization
- 2026Jailbreaking LLMs via Calibration
- 2026Expected Harm: Rethinking Safety Evaluation of (Mis)Aligned LLMs
- 2025Playing the Fool: Jailbreaking LLMs and Multimodal LLMs with Out-of-Distribution Strategy
- 2025Safe Pruning LoRA: Robust Distance-Guided Pruning for Safety Alignment in Adaptation of LLMs