Search papers, labs, and topics across Lattice.
The paper identifies a "fail-open" vulnerability in current LLM alignment where jailbreaks can collapse alignment by suppressing a single dominant refusal feature. To address this, they propose "fail-closed alignment," a design principle emphasizing redundant, independent causal pathways for refusal mechanisms. They instantiate this principle in a progressive alignment framework that iteratively ablates existing refusal directions, forcing the model to learn new, independent safety subspaces, demonstrating improved robustness against jailbreaks while maintaining generation quality.
LLM safety collapses because current alignment relies on single points of failure, but a new training method builds redundancy that resists jailbreaks.
We identify a structural weakness in current large language model (LLM) alignment: modern refusal mechanisms are fail-open. While existing approaches encode refusal behaviors across multiple latent features, suppressing a single dominant feature$-$via prompt-based jailbreaks$-$can cause alignment to collapse, leading to unsafe generation. Motivated by this, we propose fail-closed alignment as a design principle for robust LLM safety: refusal mechanisms should remain effective even under partial failures via redundant, independent causal pathways. We present a concrete instantiation of this principle: a progressive alignment framework that iteratively identifies and ablates previously learned refusal directions, forcing the model to reconstruct safety along new, independent subspaces. Across four jailbreak attacks, we achieve the strongest overall robustness while mitigating over-refusal and preserving generation quality, with small computational overhead. Our mechanistic analyses confirm that models trained with our method encode multiple, causally independent refusal directions that prompt-based jailbreaks cannot suppress simultaneously, providing empirical support for fail-closed alignment as a principled foundation for robust LLM safety.
