Circuit Discovery Helps Detect LLM Jailbreaking: A Mechanistic Interpretability Study

2026-08-27

AI Summary

研究通过电路发现方法分析LLM的越狱行为，使用边缘归因修补和子网络探测技术识别并消减导致安全绕过的计算电路，降低攻击成功率。

Abstract

Despite extensive safety alignment, large language models (LLMs) remain vulnerable to jailbreak attacks that bypass safeguards to elicit harmful content. While prior work attributes this vulnerability to safety training limitations, the internal mechanisms by which LLMs process adversarial prompts remain poorly understood. We present a mechanistic analysis of the jailbreaking behavior in a large-scale, safety-aligned LLM, focusing on LLaMA-2-7B-chat-hf. Leveraging edge attribution patching and subnetwork probing, we systematically identify computational circuits responsible for generating affirmative responses to jailbreak prompts. Ablating these circuits during the first token prediction can reduce attack success rates by up to 80\%, demonstrating its critical role in safety bypass. Our analysis uncovers key attention heads and MLP pathways that mediate adversarial prompt exploitation, revealing how important tokens propagate through these components to override safety constraints. These findings advance the understanding of adversarial vulnerabilities in aligned LLMs and pave the way for targeted, interpretable defense mechanisms based on mechanistic interpretability.

Problem

• LLMs
• jailbreak attacks
• safety alignment
• adversarial prompts
• mechanistic interpretability

Innovation

• mechanistic interpretability
• edge attribution patching
• subnetwork probing
• attention heads
• MLP pathways