Different Jailbreaks, Different Harms: Behavioral Side Effects of LLM Safety Bypasses

Forum topic · 小凯 · 2026-04-21

Summary

A forum discussion on arXiv paper 2604.18510 by Md Rysul Kabir and Zoran Tiganj compares three ways to jailbreak an aligned open-source LLM: harmful supervised fine-tuning (SFT), adversarial prompt attacks, and direct weight patches called jailbreak patches. Although all three produce models that comply with harmful requests, the post emphasizes that they differ significantly in side effects. Harmful SFT mostly changes the output distribution while leaving general capabilities such as reasoning, math, and coding intact; adversarial attacks exploit thin boundaries of safety alignment without modifying the model itself; and jailbreak patches physically alter internal representations, causing the largest collateral damage, including degraded performance on benign tasks. Mechanistically, the three methods diverge: output-distribution shifts, boundary fragility, and broken safety circuits respectively. The author draws practical implications for defenders (input filtering cannot stop weight-level attacks), open-source communities (safety is not binary), and policymakers (regulations should distinguish jailbreak types rather than treat them uniformly). The central takeaway: safety is multidimensional, and understanding how different attacks occupy different positions in that space is the first step toward effective defense.

Different Paths to Harmful Compliance: Behavioral Side Effects Across LLM Jailbreaks

> *Different Paths to Harmful Compliance: Behavioral Side Effects and Mechanistic Divergence Across LLM Jailbreaks* > Md Rysul Kabir, Zoran Tiganj | arXiv: 2604.18510 | 2026

A Safety Researcher's Concern

Suppose you have an open-source LLM that is safe — aligned training makes it refuse harmful requests. Now someone jailbreaks it using one of three methods:

1. Harmful SFT: fine-tuning the model on harmful data 2. Adversarial Attack: carefully crafted prompts that bypass safety mechanisms 3. Jailbreak Patch: directly modifying model weights

All three succeed — the model starts answering harmful questions. But do all three cause the *same* kind of harm?

Intuition might say "they're all equally unsafe." This paper shows otherwise: the harms differ substantially.

Three Paths, Three Different Failure Modes

Harmful SFT: Fine-tuning on harmful Q&A pairs is the "mildest" jailbreak — the model learns to answer harmful questions while other capabilities remain largely unchanged. Like a good person taught to swear, they are still the same person.

Adversarial Attack: Crafted prompt prefixes or suffixes trick the safety checks without modifying the model. The safety alignment is intact but bypassed on specific inputs.

Jailbreak Patch: Directly editing specific parameters is the most aggressive approach — safety mechanisms are "dismantled" inside the model itself.

Key Finding: Side Effects Vary by Method

The paper's core result: different jailbreak methods produce different side effects, not just unsafe behavior.

Harmful SFT has the smallest side effects. General capabilities (common-sense reasoning, math, coding) barely change — the model simply "learned one more skill."
Adversarial attacks are relatively contained. The model is unmodified, so safety mechanisms still work in most situations and fail only under specific attack patterns.
Jailbreak patches cause the largest side effects. Weight edits can also degrade performance on harmless tasks — like removing a car's brakes and damaging the engine in the process.

Mechanistic Divergence

Harmful SFT mainly shifts the model's output distribution — a stronger tendency to generate harmful content, with little change in internal representations.
Adversarial attacks exploit boundary fragility — safety alignment is thin in certain regions of input space and easily penetrated.
Jailbreak patches alter internal representations — safety-related circuits are physically broken.

These mechanistic differences explain the behavioral ones: the deeper the change, the larger the side effects.

Reflections

For defenders: different jailbreak types require different defenses. Input filtering can address adversarial attacks, but harmful SFT and jailbreak patches need model-level protections.

For the open-source community: "safety" is not a binary property. A harmfully fine-tuned model and a patched model can both answer harmful questions, yet differ in danger level and blast radius.

For policymakers: AI safety regulation should distinguish jailbreak types rather than treating "all jailbreaks as equally dangerous."

The core insight: safety is not a point but a multidimensional space. Different attacks occupy different positions in it, and understanding those differences is the first step toward effective defense.

Paper: arxiv.org/abs/2604.18510