Latent Personality Alignment (LPA) is introduced, which replaces explicit harm refusal with adversarial training on just 66 harm-agnostic statements drawn from psychometric personality literature, hypothesizing that personality-anchored representations share latent structure with harm avoidance, so adversarially stabilizing them implicitly constrains the subspace exploited by jailbreak attacks.
Abstract
Current safety methods for large language models are known to be vulnerable to adversarial attacks, motivating research into robust alternatives. Latent Adversarial Training (LAT) is among the most effective defenses, but can degrade utility and requires training on large datasets of harmful prompts. We introduce Latent Personality Alignment (LPA), which replaces explicit harm refusal with adversarial training on just 66 harm-agnostic statements drawn from psychometric personality literature. We hypothesize that personality-anchored representations share latent structure with harm avoidance, so adversarially stabilizing them implicitly constrains the subspace exploited by jailbreak attacks. LPA achieves near-zero attack success rates on HarmBench across direct requests and five jailbreak methods, despite never seeing harmful content during training and no loss of performance on standard benchmarks. Moreover, the training process is lightweight; the entire procedure completes in minutes on a single GPU and uses 75x fewer examples than standard LAT. Extensive ablations demonstrate the robustness, efficiency, and generalization of our method.
The proposed Recursive Self-Correction approach raises model performance from a Political Neutrality Likert scale baseline of 2.14 to 4.56, averaged across all models, demonstrating effective inference-time mitigation of political bias in LLM-generated summaries.
Tejaswi V. Panchagnula, Bruce Coburn, Bryce J. Dietrich et al.· 0 citations
Experiments show that with only 1K synthesized samples, AdvSafe-aligned LRMs achieve significantly stronger jailbreak robustness than existing baselines, with almost no utility degradation, demonstrating that learning unsafety knowledge enables a superior robustness-utility trade-off and generalizes beyond seen attack patterns.
Hongli Shen, Shaopeng Fu, Qinbo Zhang et al.· 0 citations
Ensuring the safety of large language models (LLMs) requires rigorous evaluation against adversarial and jailbreaking attempts that can expose harmful behaviors. Malicious prompt generation, while inherently risky, is essential for systematically stress-testing model defenses and uncovering alignment vulnerabilities. Jailbreak attacks against large language models are often studied either through direct prompt rewriting or through search-based optimization over unconstrained prompt variants. We introduce TAPE-JB (Trait-Aligned Prompt Evolution for Jailbreaking LLMs), a genotype-guided evolutionary framework for adversarial prompt generation that searches over structured prompt traits while preserving the original harmful intention. Our method combines iterative prompt rewriting with an alignment-aware fitness function that jointly optimizes attack effectiveness, semantic faithfulness to the source intention, and realization of the intended prompt strategy. Across experiments, TAPE-JB consistently improves over simpler prompting baselines and outperforms CL-GSO on AdvBench, with a 14 percentage-point gain. Our results also show that the generated attacks retain cross-model transferability and that the proposed method remains effective in Polish (76% of attack success rate), demonstrating its applicability beyond the original English benchmark. These findings highlight the value of structured evolutionary search for systematic red-teaming of language models.
Karolina Seweryn, Anna Wróblewska, Szymon Łukasik· Proceedings of the Genetic a...· 0 citations
Language models suffer from adversarial vulnerability, where imperceptible perturbations in inputs can mislead model predictions. Existing adversarial training methods enhance model robustness by augmenting training data with worst-case adversarial perturbations for each input. However, these approaches overlook the intrinsic causal relationships within data. We construct causal graphs to model the behavior of encoder-based language models under adversarial inputs, suggesting that adversarial vulnerability is often associated with the model’s overfitting to spurious correlations. Within the adversarial training framework, we formulate expressions for Total Effect (TE) and Natural Direct Effect (NDE), and propose a causal regularization objective based on TE-NDE alignment. Experiments on five benchmark datasets show that this causal adversarial training framework improves adversarial robustness across different settings. We further evaluate the model behavior in a controlled sentiment analysis setting, where the quantitative results provide additional evidence for the effectiveness of our method.
Bin Zhu, Yi Xie, Yanxia Feng et al.· Computational Linguistics· 0 citations
Large language models are increasingly deployed in safety-critical decision services—content moderation, clinical decision support, legal analysis—yet methods for characterizing their vulnerability profiles across multiple attack surfaces remain underdeveloped. We introduce a geometric evaluation framework that maps moral judgment to a 7-dimensional harm space, applies five qualitatively distinct perturbation types across five cognitive domains, and produces per-model vulnerability profiles that reveal which manipulations each model resists and which it does not. Testing 5 models spanning 2 architecture families under a realistic $50/day compute budget, we find that vulnerabilities are selective: linguistic framing, emotional anchoring, and irrelevant sensory detail reliably displace judgments, while gender swap and evaluation order do not—identifying salience manipulation as the specific attack surface. The framework further reveals that robustness profiles are partially dissociable across models: a model with zero sycophancy has the worst emotional anchoring recovery; a model with the best anchoring recovery has the worst working memory. No single robustness score captures these structures. An inter-model agreement study over an independent open-model panel confirms these harm dimensions are reliably measurable $(\text{ICC}(2, k)=0.97)$, and a worked content-moderation exploit shows that salience manipulation flips not only a scalar harm threshold but the typed verdict of a downstream rule-based decision kernel. The evaluation pipeline—with adaptive concurrency, budget-aware execution, and three-tier data—scales to new models and perturbation types within fixed compute constraints, providing a practical tool for multi-dimensional LLM security assessment.
Andrew H. Bond· International Conference on...· 0 citations
This work presents the most comprehensive evaluation of LLM safety capabilities to date, systematically testing models across datasets that are organized into four distinct categories, and uncovers critical blind spots.