aiqbench analysis
This research introduces CFA², a novel framework leveraging causal inference via Pearl's front-door adjustment to dissect and improve jailbreak attacks on safety-aligned LLMs. By separating task semantics from safety signals within latent space using sparse autoencoders, the method enables efficient attack generation without iterative optimization while providing transferable signals for black-box scenarios. The work advances the understanding of how adversarial inputs manipulate model compliance mechanisms, offering critical insights for both robustness testing and defense strategies in large language models.
Causal Front-Door Adjustment for Robust Jailbreak Attacks on LLMs
arXiv:2602.05444v3 Announce Type: replace Abstract: Jailbreak attacks on safety-aligned LLMs are increasingly effective, yet attack success alone does not reveal whether compliance is driven by preserved task intent, suppressed safety signals, or attack-specific artifacts. We use Pearl's front-door adjustment to motivate separating task-relevant semantics from safety-related variation. We propose Causal Front-Door Adjustment Attack (CFA^2), a white-box framework that operationalizes this perspective in LLM latent space using Sparse Autoencoders, contrastive datasets, and weight orthogonalization. After offline calibration, CFA^2 enables efficient generation without per-prompt iterative optimization, performs strongly on HarmBench across four open-source LLMs, and provides source-side signals for same-family black-box prompt transfer.
Abstract:Jailbreak attacks on safety-aligned LLMs are increasingly effective, yet attack success alone does not reveal whether compliance is driven by preserved task intent, suppressed safety signals, or attack-specific artifacts. We use Pearl's front-door adjustment to motivate separating task-relevant semantics from safety-related variation. We propose Causal Front-Door Adjustment Attack (CFA^2), a white-box framework that operationalizes this perspective in LLM latent space using Sparse Autoencoders, contrastive datasets, and weight orthogonalization. After offline calibration, CFA^2 enables efficient generation without per-prompt iterative optimization, performs strongly on HarmBench across four open-source LLMs, and provides source-side signals for same-family black-box prompt transfer.
Computation and Language (cs.CL)
arXiv:2602.05444 [cs.CL]
(or arXiv:2602.05444v3 [cs.CL] for this version)
https://doi.org/10.48550/arXiv.2602.05444 Focus to learn more arXiv-issued DOI via DataCite
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 189 words
Related coverage
Presentation: Exploding GPUs
InfoQ · Oct 16, 2026
Exploring Jailbreak Vulnerability Across Depth-Based Dynamic Inference in Large Language Models
arXiv · Oct 15, 2026
Minimal, Local, Causal Explanations for Jailbreak Success in Large Language Models
arXiv · Aug 5, 2026
Netskope (NTSK) Q2 2027 Earnings Call Transcript
fool.com · Sep 10, 2026