Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-17 · high
The method needs no retraining and lost at most 5.3% of MT-Bench utility, per the paper, running as a detector-gated filter or an offline weight edit.
Why now: The paper appeared in arXiv's listings as of August 17, while most jailbreak defenses still run always-on.
Tripwire blocks jailbreak attempts by staying dormant until an attack triggers it, cutting success rates to as low as 2%. Existing neuron-level defenses run on every request, benign or not, costing usability the researchers measured directly. Tripwire's version of that cost is just 0.5 to 5.3% off MT-Bench utility, the smallest hit among the defenses compared, per the paper.
The method finds safety-specific neurons using per-neuron hypothesis tests under false-discovery-rate control, then filters for ones that don't also carry general utility. When an attack pattern shows up, Tripwire clamps those neurons to the activation levels the model already produces when it refuses harmful requests. The model already learned that refusal behavior in alignment training, so Tripwire just switches it on instead of running it constantly.
No retraining is required. Tripwire ships in two modes that the paper proves are equivalent. One is a detector that gates the intervention at inference time. The other is an offline edit that bakes the same bias directly into the model's weights.
Always-on defenses like existing neuron clamps tax every legitimate request just to catch the rare attack, and Tripwire's numbers suggest that tradeoff is unnecessary. Gated activation, not constant filtering, is the model other alignment defenses need to copy. The paper doesn't say whether the false-discovery-rate detection step holds up against attacks outside the four types it tested against.
Each link below shares sources, entities, or timing with this story.
Shared entities / Same source domain / Shared topic / Earlier coverage
Both cover Existing, Training; reported by the same outlet (arxiv.org); overlapping topics (already, model).
Shared entity: Bench / Same source domain / Shared topic / Earlier coverage
Both cover Bench; reported by the same outlet (arxiv.org); overlapping topics (alignment, attack, benign).
Shared entities / Same source domain / Earlier coverage
Both cover Bench, Training; reported by the same outlet (arxiv.org); earlier Bench coverage from 2026-07-20.
Shared entity: Bench / Same source domain / Shared topic / Earlier coverage
Both cover Bench; reported by the same outlet (arxiv.org); overlapping topics (already, only).
Both cover Bench; reported by the same outlet (arxiv.org); overlapping topics (attack, model).
Both cover Bench; reported by the same outlet (arxiv.org); overlapping topics (model, under).
Both cover Bench; reported by the same outlet (arxiv.org); overlapping topics (always on, attack).
Shared entity: Training / Same source domain / Earlier coverage / Tension
Both cover Training; reported by the same outlet (arxiv.org); earlier Training coverage from 2026-08-15.