mlsanityData to 7 Oct 2026

Constitutional adapters: Inference-time interventions for misalignment and misuse

arXiv 2609.36657 ↗First posted 29 Sep 2026cs.LG cs.AIcited by 0

On the map: LLM safety and security → Prompt injection and agent security also fits: Safety alignment, refusal and guardrails

Abstract (arXiv)

Training models to act in accordance with an explicitly defined set of principles, or "constitution," has shown promise as a robust and transparent mechanism for AI alignment. However, the generality and flexibility of such methods remain unclear. Here, we show that constitution-consistent behavior can be distilled from synthetic corpora into lightweight objects (low-rank adapters and steering vectors). Despite never seeing a harmful request or jailbreak during training, such objects increase jailbreak defense success and measured alignment -- particularly at long context lengths and against multi-turn attacks, where they outperform both prompted and steered baselines. Subtracting control-trained from constitution-trained objects further accentuates these effects, yielding defenses we call "constitutional adapters" (CAs). CAs can be trained on a base model, transferred zero-shot to its post-trained checkpoint, and scaled at inference time to predictably trade off defense for benign compliance. Taken together, these results recommend CAs as a lightweight, portable, and tunable lever for mitigating misalignment and misuse in API deployments.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Prompt injection and agent security, one of 12 directions in LLM safety and security. Builds on 66 of its 77 references that are in the map. First posted on arXiv 29 Sep 2026.

Builds on

66 of 77 references.

Closest ancestors · 2

Same direction, newest first

  1. 2026Building Production-Ready Probes For Gemini16 Jan
  2. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal6 Feb

Other references · 64

  1. 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,084
  2. 2021Training Verifiers to Solve Math Word Problemscited by 9,743
  3. 2020Measuring Massive Multitask Language Understandingcited by 7,768
  4. 2019Parameter-Efficient Transfer Learning for NLPcited by 4,195
  5. 2021Prefix-Tuning: Optimizing Continuous Prompts for Generationcited by 3,878
  6. 2021The Power of Scale for Parameter-Efficient Prompt Tuningcited by 3,769
  7. 2022Constitutional AI: Harmlessness from AI Feedbackcited by 2,950
  8. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
  9. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
  10. 2023Inference-Time Intervention: Eliciting Truthful Answers from a Language Modelcited by 1,259
  11. 2023Representation Engineering: A Top-Down Approach to AI Transparencycited by 1,239
  12. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
38 more
  1. 2022Editing Models with Task Arithmeticcited by 1,076
  2. 2023Steering Llama 2 via Contrastive Activation Additioncited by 1,009
  3. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 960
  4. 2021Ethical and social risks of harm from Language Modelscited by 957
  5. 2023Steering Language Models With Activation Engineeringcited by 824
  6. 2024BigCodeBench: Benchmarking Code Generation with Diverse Function Calls and Complex Instructionscited by 527
  7. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 494
  8. 2023XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Modelscited by 477
  9. 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deepcited by 450
  10. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 434
  11. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attackcited by 364
  12. 2024A StrongREJECT for Empty Jailbreakscited by 352
  13. 2025Persona Vectors: Monitoring and Controlling Character Traits in Language Modelscited by 303
  14. 2024Improving Alignment and Robustness with Circuit Breakerscited by 302
  15. 2024Deliberative Alignment: Reasoning Enables Safer Language Modelscited by 292
  16. 2022The Alignment Problem from a Deep Learning Perspectivecited by 246
  17. 2023A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easilycited by 242
  18. 2024OR-Bench: An Over-Refusal Benchmark for Large Language Modelscited by 222
  19. 2022Extracting Latent Steering Vectors from Pretrained Language Modelscited by 217
  20. 2024WildTeaming at Scale: From In-the-Wild Jailbreaks to (Adversarially) Safer Language Modelscited by 206
  21. 2025AxBench: Steering LLMs? Even Simple Baselines Outperform Sparse Autoencoderscited by 199
  22. 2024Programming Refusal with Conditional Activation Steeringcited by 191
  23. 2024ReFT: Representation Finetuning for Language Modelscited by 186
  24. 2025Constitutional Classifiers: Defending against Universal Jailbreaks across Thousands of Hours of Red Teamingcited by 172
  25. 2024Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMscited by 158
  26. 2023Composing Parameter-Efficient Modules with Arithmetic Operationscited by 155
  27. 2024LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yetcited by 145
  28. 2025Agentic Misalignment: How LLMs Could Be Insider Threatscited by 136
  29. 2024Analyzing the Generalization and Reliability of Steering Vectorscited by 130
  30. 2024Safe LoRA: the Silver Lining of Reducing Safety Risks when Fine-tuning Large Language Modelscited by 122
  31. 2024Personalized Steering of Large Language Models: Versatile Steering Vectors Through Bi-directional Preference Optimizationcited by 112
  32. 2024Language Models are Homer Simpson! Safety Re-Alignment of Fine-tuned Language Models through Task Arithmeticcited by 105
  33. 2025Large Language Models Often Know When They Are Being Evaluatedcited by 105
  34. 2024LLMs know their vulnerabilities: Uncover Safety Gaps through Natural Distribution Shiftscited by 80
  35. 2024Does Refusal Training in LLMs Generalize to the Past Tense?cited by 74
  36. 2024Best-of-N Jailbreakingcited by 71
  37. 2024CodeAttack: Revealing Safety Generalization Challenges of Large Language Models via Code Completioncited by 70
  38. 2024Measuring and Controlling Instruction (In)Stability in Language Model Dialogscited by 51

50 most cited of 64 All 64 (JSON)

Built on by

Not cited yet.