A safety guard can be made to grade a harmless decoy instead of the harmful request you meant to screen
AspireAI community · arXiv (Utkarsh Kanwat, Independent Researcher)
Most guard models paste the content they are screening into a plain-text prompt and ask for a verdict. This paper shows that content which imitates the prompt can append a second task, and the guard answers that one instead. The authors call it target rebinding, and their explanation is mechanical: the guard grades the last complete task in its input, so a harmless decoy at the end wins and the harmful request passes through untouched.
The numbers are uncomfortable. In a pre-registered test, an appended forged query plus decoy cleared all 75 held-out AdvBench requests that Shieldstral-1.0-3B had flagged. On the authors' own GuardRebind benchmark, each of five guards had at least one attack family that cleared 93 percent or more of its flagged items. A guard trained to score content no lower than its most harmful part cut attack success from 75 percent to 0.8-1.6 percent on held-out attack families, with clean AUROC dropping by at most 0.01.
Caveats worth knowing: the non-inferiority test on clean data was inconclusive, and a score-guided search still beat the trained guard on 47 of 50 items, usually by placing the forged structure before the request rather than after it. The authors also note that on about half of the items where that search succeeded, it also found benign text with no forged structure that cleared the guard. Single-author preprint, and the attack families were chosen per guard.
Read the story and explore more from the AspireAI community.
Two sparse-autoencoder analyses have resisted scaling: matching semantically similar features across layers, and compressing large feature circuits into interpretable supernodes. This paper argues both are the same underlying problem, estimating semantic distances between SAE features that sit on different activation manifolds. Its representation treats each feature not as a single decoder vector but as an activation-weighted distribution over the hidden states expressing it, projects those distributions into a shared reference space, and compares them with Wasserstein distance. The representation is proved invariant to activation rescaling and stable under perturbation, and recovers true matches under finite-sample margin conditions. Empirically it outperformed decoder-vector and LLM-based baselines and captured subtle functional distinctions between related features, and it compressed large feature circuits into interpretable supernodes automatically. The limitation is that this is interpretability tooling: the paper demonstrates better feature matching and circuit compression, not that downstream interpretability claims become more accurate.