Research map / Large language models / Language, safety and interpretability

PatchBench: Measuring Collateral Damage in Activation Patching

NeurIPS 2026 · Large language models › Language, safety and interpretability · approach: Jailbreak attacks and defenses

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Introduces PatchBench, a bank of 400 model-specific jailbreak failures from 8 open-source models, and PatchBench-Local, a local neighbourhood protocol scoring harmful-neighbour correction (HNCS) and benign-neighbour preservation (BNPS) to expose collateral damage of activation steering patches.

Problem

Aggregate jailbreak metrics (ASR, refusal rate, MMLU) cannot tell whether an activation-patch safety repair is selective or broadly suppresses nearby benign behaviour, and existing jailbreak benchmarks do not provide model-specific actionable failures as repair targets.

Approach

Build repair targets from actually-observed harmful completions per model (WildGuard filtering, Elo ranking, manual curation), then evaluate each patch on a generated local neighbourhood of 19 harmful variants and 10 benign neighbours (structural and harmful-word), reporting HNCS and BNPS separately.

Key results

• AST reaches the highest HNCS on Qwen 3B (95.6) but its BNPS drops to 66.8 vs 98.6 unsteered, and to 28.4 on Gemma 4B.
• CAST on Llama 8B and Gemma 4B changes MMLU by only -0.07 and -0.52 points while BNPS drops by 26.3 and 22.0 points.
• On Llama-4-Scout, AlphaSteer reaches the highest HNCS (79.7) but the lowest BNPS (74.8) among methods, showing the trade-off persists at larger scale.

Surprising findings

• Global MMLU can remain nearly unchanged (e.g. CAST on Llama 8B, -0.07) while benign-neighbour preservation drops by over 20 points.
• AST gains only about 3 HNCS points over AlphaSteer on Qwen 3B while losing 27.4 BNPS points.

Limitations

• Benchmark trades breadth for precision and does not cover all jailbreak strategies, harmful domains, or model behaviours.
• MMLU is only a coarse global capability check; activation patching methods are sensitive to hyperparameters.
• Extending to new models requires manual, model-specific generation effort.

Experimental setup

Datasets: RedBench (27,870 prompts from 37 jailbreak datasets) Stanford Alpaca COCONOT MMLU

Benchmarks: PatchBench-Local MMLU 5-shot

Metrics: HNCS BNPS MMLU accuracy refusal rate Cohen's kappa

Baselines: AlphaSteer AdaSteer AST CAST

Builds on: RedBench WildGuard Activation Steering (AST) Conditional Activation Steering (CAST) AlphaSteer AdaSteer

Closest papers by meaning

• h4rm3l: A Language for Composable Jailbreak Attack Synthesis (ICLR 2025 · similarity 0.86)
• Playing the Fool: Jailbreaking LLMs and Multimodal LLMs with Out-of-Distribution Strategy (CVPR 2025 · similarity 0.86)
• WildGuard: Open One-stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs (NeurIPS 2024 · similarity 0.86)
• Systematic Scaling Analysis of Jailbreak Attacks in Large Language Models (NeurIPS 2026 · similarity 0.86)
• Jailbreak susceptibility prediction and mitigation via the behavioral geometry of models (NeurIPS 2026 · similarity 0.86)
• Bag of Tricks: Benchmarking of Jailbreak Attacks on LLMs (NeurIPS 2024 · similarity 0.85)