SafeRedirect: Defeating Internal Safety Collapse via Task-Completion Redirection in Frontier LLMs
On the map: LLM safety and security → Safety alignment, refusal and guardrails
Abstract (arXiv)
Internal Safety Collapse (ISC) is a failure mode in which frontier LLMs, when executing legitimate professional tasks whose correct completion structurally requires harmful content, spontaneously generate that content with safety failure rates exceeding 95%. Existing input-level defenses achieve a 100% failure rate against ISC, and standard system prompt defenses provide only partial mitigation. We propose SafeRedirect, a system-level override that defeats ISC by redirecting the model's task-completion drive rather than suppressing it. SafeRedirect grants explicit permission to fail the task, prescribes a deterministic hard-stop output, and instructs the model to preserve harmful placeholders unresolved. Evaluated on seven frontier LLMs across three AI/ML-related ISC task types in the single-turn setting, SafeRedirect reduces average unsafe generation rates from 71.2% to 8.0%, compared to 55.0% for the strongest viable baseline. Multi-model ablation reveals that failure permission and condition specificity are universally critical, while the importance of other components varies across models. Cross-attack evaluation confirms state-of-the-art defense against ISC with generalization performance at least on par with the baseline on other attack families. Code is available at https://github.com/fzjcdt/SafeRedirect.
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Placed in Safety alignment, refusal and guardrails, one of 12 directions in LLM safety and security. Builds on 20 of its 29 references that are in the map. First posted on arXiv 22 Apr 2026.
Builds on
20 of 29 references.
Closest ancestors · 3
Same direction, newest first
- 2026Internal Safety Collapse in Frontier Large Language Models4 Mar
- 2026LLMs Can Unlearn Refusal with Only 1,000 Benign Samples27 Jan
- 2024CodeAttack: Revealing Safety Generalization Challenges of Large Language Models via Code Completion12 Mar
Other references · 17
- 2022Training language models to follow instructions with human feedbackcited by 15,712
- 2024The Llama 3 Herd of Modelscited by 14,192
- 2022Constitutional AI: Harmlessness from AI Feedbackcited by 2,950
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
- 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
- 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
- 2022Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and Lessons Learnedcited by 702
- 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
- 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 494
- 2024ScienceAgentBench: Toward Rigorous Assessment of Language Agents for Data-Driven Scientific Discoverycited by 208
- 2024LLM-Based Multi-Agent Systems for Software Engineering: Literature Review, Vision and the Road Aheadcited by 155
- 2024How Alignment and Jailbreak Work: Explain LLM Safety through Intermediate Hidden Statescited by 92
5 more
- 2024DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakerscited by 91
- 2024FlipAttack: Jailbreak LLMs via Flippingcited by 73
- 2025Security Challenges in AI Agent Deployment: Insights from a Large Scale Public Competitioncited by 22
- 2025Response Attack: Exploiting Contextual Priming to Jailbreak Large Language Modelscited by 10
- 2025Self-Jailbreaking: Language Models Can Reason Themselves Out of Safety Alignment After Benign Reasoning Trainingcited by 9
Built on by
Citing papers per year: 2026: 1.
1 paper.