Tripwire Fires Jailbreak Defenses Only on Attack, Cutting Attack Success to ≤2.0% for a 0.5-5.3% Utility Drop

arXiv 2608.14392·high signalXBlueskyLinkedInCopy link

Existing neuron-level jailbreak defenses stay always-on and perturb every benign request; Tripwire instead identifies safety-specific neurons via per-neuron hypothesis tests under false-discovery-rate control plus a utility-specificity filter, then clamps them to their harmful-conditional mean activations to trigger the refusal behavior alignment already taught the model. It is training-free and ships in two provably equivalent modes — a detector-gated inference-time intervention and an offline bias-patch weight edit. Across four safety-aligned LLMs and four attacks it reduces average attack success rate to at most 2.0% with an MT-Bench utility drop of 0.5-5.3%, the smallest among compared defenses.