CoFiBreak finds 1.6 to 2.0 times as many distinct jailbreak strategies while reaching 98.8 percent attack success at ten generations per intent
AspireAI community · arXiv (cs.CL)
Red-teaming agents trained with reinforcement learning can collapse onto a narrow set of prompts when attack success is the only reward, which biases safety evaluation toward near-duplicate attack patterns rather than the underlying harmful intents. CoFiBreak adds a coarse-to-fine diversity reward to GRPO: the coarse reward broadens which strategies the attacker uses by encouraging strategies underrepresented within each group, and the fine reward broadens how those strategies are realised by discouraging reuse of the same personas, framings and output formats once harmful-intent information is removed from prompt embeddings. Diversity rewards apply only to attacks already above an effectiveness threshold, so diversity cannot be bought with ineffective attacks, and because both rewards are computed only during training, inference cost is unchanged. Trained with Llama3.1-8B-Instruct as the victim, CoFiBreak discovers 1.6-2.0 times as many distinct successful fine-grained strategies as the strongest baseline across frontier victims on HarmBench, and reaches 98.8 percent ASR@10 on AdvBench with the highest diversity reported there. This is attack tooling, published to improve safety evaluation coverage.
Read the story and explore more from the AspireAI community.
Two sparse-autoencoder analyses have resisted scaling: matching semantically similar features across layers, and compressing large feature circuits into interpretable supernodes. This paper argues both are the same underlying problem, estimating semantic distances between SAE features that sit on different activation manifolds. Its representation treats each feature not as a single decoder vector but as an activation-weighted distribution over the hidden states expressing it, projects those distributions into a shared reference space, and compares them with Wasserstein distance. The representation is proved invariant to activation rescaling and stable under perturbation, and recovers true matches under finite-sample margin conditions. Empirically it outperformed decoder-vector and LLM-based baselines and captured subtle functional distinctions between related features, and it compressed large feature circuits into interpretable supernodes automatically. The limitation is that this is interpretability tooling: the paper demonstrates better feature matching and circuit compression, not that downstream interpretability claims become more accurate.