Do LLMs Know Their Vulnerable Scenarios?

2026-07-26

AI Summary

This study addresses the vulnerability of large language models to circumvention of safety alignment mechanisms in specific scenarios, a phenomenon inadequately explained by existing research due to a lack of mechanistic understanding of how refusal capabilities are undermined. The work establishes, for the first time, a causal link between contextual representations and suppression of model refusals, proposing a concept-attribution-based framework for identifying fragile scenarios. By leveraging sparse autoencoders to construct an interpretable concept space and integrating natural language scenario generation with interaction-based attribution techniques, the method discovers composable, cross-model transferable adversarial scenarios. Experiments demonstrate that this approach improves attack success rates by up to 18.2 percentage points across multiple open-source and commercial models, with composite scenarios substantially outperforming single-scenario attacks and significantly reducing the number of required attack iterations.

Abstract

Safety-aligned large language models are trained to refuse harmful requests, yet embedding the same requests in particular scenarios can bypass their safeguards. Existing red-teaming methods empirically identify effective scenarios through observed attack outcomes, but why particular scenarios weaken refusal remains mechanistically unclear. Meanwhile, mechanistic interpretability studies have characterized both refusal directions and jailbreak-associated features, without explaining the relationship between the two representations. In this work, we show that scenario-wrapped prompts activate internal scenario directions whose causal steering consistently reduces refusal scores. Building on this finding, we propose \textsc{Concept2Scenario}, a concept-based attribution framework for vulnerable scenario discovery. It instantiates a broad concept space with a sparse autoencoder, attributes refusal suppression to individual concepts, translates the identified concepts into interpretable natural-language scenarios, and identifies synergistic scenario combinations through interaction attribution. Across three open-source models, two safety benchmarks, and six black-box jailbreak methods, the discovered scenarios serve as reusable priors that improve average attack success rates by up to $18.2$ percentage points. They also transfer to GPT-5, Claude-Haiku-4.5, and Gemini-3-Flash, suggesting that some scenario-level refusal vulnerabilities are shared across model families. Moreover, the identified combinations outperform their individual constituents and enable iterative attacks to succeed in fewer turns.

Problem

• vulnerable scenarios
• safety alignment
• refusal suppression
• jailbreak
• mechanistic interpretability

Innovation

• mechanistic interpretability
• scenario-based jailbreak
• concept attribution
• refusal suppression
• transferable vulnerabilities