Year: 2026
Type: conference-paper
Abstract: Large Language Models (LLMs) remain vulnerable to optimization-based jailbreak attacks that exploit internal gradient structure.While Sparse Autoencoders (SAEs) are widely used for interpretability, their robustness implications remain underexplored.We present a study of integrating pretrained SAEs into transformer residual streams at inference time, without modifying model weights or blocking gradients.Across four model families (Gemma, LLaMA, Mistral, Qwen) and two strong white-box attacks (GCG, BEAST) plus three black-box benchmarks, SAE-augmented models achieve up to a 5× reduction in jailbreak success rate relative to the undefended baseline and reduce cross-model attack transferability.Parametric ablations reveal (i) a monotonic dose-response relationship between L 0 sparsity and attack success rate, and (ii) a layer-dependent defense-utility tradeoff, where intermediate layers balance robustness and clean performance.These findings are consistent with a representational bottleneck hypothesis: sparse projection reshapes the optimization geometry exploited by jailbreak attacks. 1
Authors: Ahson Saiyed, Sabrina Sadiekh, Chirag Agarwal
Institution: University of Virginia
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: hybrid
OpenAlex ID: W7166886429