Internal patterns of large model jailbreak attacks

The 2026 EMNLP main conference paper "Beyond Prompts: Discovering Jailbreak Motifs in Sparse Feature Space" proposes using SAE and NMF to extract reusable feature combinations, Motifs, of jailbreak attacks from large model internal activations, for unknown attack detection, attack generation, and defense training. In leave-one-out testing, SAE-NMF-40 achieves an average AUC of 0.936 and F1 of 0.792 for detecting unseen attacks on DS-Llama, higher than text Embedding baselines. ReDiscoverAttack based on Motif combinations achieves attack success rates of 79.42% to 83.58% on Llama-3.1-8B, Mistral-7B, and Qwen2-7B, exceeding the four source attack methods compared in the paper. Motif-DPO defense training achieves lower OOD attack success rates and false refusal rates on Llama-3.1-8B-Instruct.