Causal Front-Door Adjustment for Robust Jailbreak Attacks on LLMs
Fuente:
arXiv
Gespeichert in:
| Hauptverfasser: | , , , , , , |
|---|---|
| Format: | Preprint |
| Veröffentlicht: |
2026
|
| Schlagworte: | |
| Online-Zugang: | |
| Tags: |
Tag hinzufügen
Keine Tags, Fügen Sie den ersten Tag hinzu!
|
| _version_ | 1866914310412828672 |
|---|---|
| author | Zhou, Yao Song, Zeen Qiang, Wenwen Wu, Fengge Zhou, Shuyi Zheng, Changwen Xiong, Hui |
| author_facet | Zhou, Yao Song, Zeen Qiang, Wenwen Wu, Fengge Zhou, Shuyi Zheng, Changwen Xiong, Hui |
| contents | Safety alignment mechanisms in Large Language Models (LLMs) often operate as latent internal states, obscuring the model's inherent capabilities. Building on this observation, we model the safety mechanism as an unobserved confounder from a causal perspective. Then, we propose the Causal Front-Door Adjustment Attack (CFA{$^2$}) to jailbreak LLM, which is a framework that leverages Pearl's Front-Door Criterion to sever the confounding associations for robust jailbreaking. Specifically, we employ Sparse Autoencoders (SAEs) to physically strip defense-related features, isolating the core task intent. We further reduce computationally expensive marginalization to a deterministic intervention with low inference complexity. Experiments demonstrate that CFA{$^2$} achieves state-of-the-art attack success rates while offering a mechanistic interpretation of the jailbreaking process. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2602_05444 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | Causal Front-Door Adjustment for Robust Jailbreak Attacks on LLMs Zhou, Yao Song, Zeen Qiang, Wenwen Wu, Fengge Zhou, Shuyi Zheng, Changwen Xiong, Hui Computation and Language Safety alignment mechanisms in Large Language Models (LLMs) often operate as latent internal states, obscuring the model's inherent capabilities. Building on this observation, we model the safety mechanism as an unobserved confounder from a causal perspective. Then, we propose the Causal Front-Door Adjustment Attack (CFA{$^2$}) to jailbreak LLM, which is a framework that leverages Pearl's Front-Door Criterion to sever the confounding associations for robust jailbreaking. Specifically, we employ Sparse Autoencoders (SAEs) to physically strip defense-related features, isolating the core task intent. We further reduce computationally expensive marginalization to a deterministic intervention with low inference complexity. Experiments demonstrate that CFA{$^2$} achieves state-of-the-art attack success rates while offering a mechanistic interpretation of the jailbreaking process. |
| title | Causal Front-Door Adjustment for Robust Jailbreak Attacks on LLMs |
| topic | Computation and Language |
| url | https://arxiv.org/abs/2602.05444 |