Research map / Large language models / Language, safety and interpretability

Fail-Closed Alignment for Large Language Models

NeurIPS 2026 · Large language models › Language, safety and interpretability · approach: Safety alignment of LLMs · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes fail-closed alignment, a progressive training method that iteratively finds refusal directions with RDO, ablates all previously found directions via a multi-feature projection, and fine-tunes so refusal is rebuilt in new independent subspaces, improving jailbreak robustness on four LLMs.

Problem

Refusal in current aligned LLMs depends on a single dominant latent direction that prompt-based jailbreaks suppress, so alignment fails open under partial failure of that feature.

Approach

Iteratively identify the dominant refusal direction, project out the span of all previously found directions during training on harmful prompts, and fine-tune with a KL utility regularizer so the model learns redundant, causally independent refusal directions.

Key results

• Average ASR across GCG, AutoDAN, PAIR, HumanJailbreaks is 0.6-1.7% for the method across four models versus 1.8-10.9% for the baselines (per-model averages), with reductions of 92-97% from unattacked-to-attacked baselines.
• Average overrefusal compliance rate of 86.4% versus 68.8-75.7% for baselines, and average utility accuracy 61.6% (CAT 62.0%).
• LoRA at rank 128 (about 5% of parameters) on Gemma2-9B matches full fine-tuning within about 0.6 points of ASR and accuracy.

Surprising findings

• Single-feature ablation without multi-feature projection still learns multiple refusal-mediating directions, but they are not causally independent (ASR rises from 0% to 97% as they are removed).
• LoRA improved compliance on benign prompts on Gemma2-9B from 86.1% to 94.4%.

Limitations

• Later-iteration directions (r6-r10) show near-zero cosine similarity, so the mechanism behind them is not captured by linear feature analysis.
• Failure modes remain: AutoDAN Developer Mode and PAIR fictional prompts still succeed in a minority of cases (up to 4%).
• Method requires roughly two forward and backward passes per step and RDO overhead per epoch, and was evaluated only on small-to-mid size models.

Experimental setup

Datasets: CircuitBreakers adversarial training set Alpaca XSTest SaladBench HarmBench AdvBench

Benchmarks: HarmBench AdvBench XSTest Alpaca BoolQ RTE HellaSwag WinoGrande ARC-C OpenBookQA

Metrics: attack success rate compliance rate average zero-shot accuracy

Baselines: Augmented refusal training CAT LAT DeepRefusal

Builds on: Refusal Direction Optimization DeepRefusal Refusal direction (difference-in-means) Circuit Breakers Latent adversarial training

Closest papers by meaning

• Improving LLM Safety Alignment with Dual-Objective Optimization (ICML 2025 · similarity 0.93)
• Safety Alignment Should be Made More Than Just a Few Tokens Deep (ICLR 2025 · similarity 0.92)
• The Hidden Dimensions of LLM Alignment: A Multi-Dimensional Analysis of Orthogonal Safety Directions (ICML 2025 · similarity 0.91)
• Refusal Direction is Universal Across Safety-Aligned Languages (NeurIPS 2025 · similarity 0.90)
• Logit-Gap Steering: A Forward-Pass Diagnostic for Alignment Robustness (NeurIPS 2026 · similarity 0.90)
• CodeMimicry: Exploiting Safety Generalization Lag in Large Language Models via Structured Code Completion (NeurIPS 2026 · similarity 0.90)