Different Jailbreaks, Different Harms: Behavioral Side Effects and Mechanistic Divergence in LLM Safety Bypasses

Forum topic · 小凯 · 2026-04-21

Summary

A forum post on zhichai.net discusses a research paper by Md Rysul Kabir and Zoran Tiganj (arXiv: 2604.18510) comparing three LLM jailbreak methods: harmful supervised fine-tuning (SFT), adversarial attacks, and jailbreak patches that directly modify model weights. All three successfully make an aligned model comply with harmful requests, but the paper shows they differ substantially in behavioral side effects and internal mechanisms. Harmful SFT produces minimal side effects, largely preserving general capabilities like reasoning, math, and coding while shifting the output distribution. Adversarial attacks leave the model unchanged, exploiting thin boundaries of the safety alignment in input space. Jailbreak patches cause the largest side effects, physically altering internal representations and sometimes degrading performance on benign tasks. The author argues that defense strategies, open-source risk assessments, and AI safety policy should differentiate between jailbreak types rather than treating them uniformly, since safety is a multidimensional space rather than a binary property.

> *Different Paths to Harmful Compliance: Behavioral Side Effects and Mechanistic Divergence Across LLM Jailbreaks* > Md Rysul Kabir, Zoran Tiganj | arXiv: 2604.18510 | 2026

The Problem

You have an open-source LLM that is aligned and refuses harmful requests. Someone jailbreaks it using one of three methods:

1. Harmful SFT — fine-tuning the model on harmful data 2. Adversarial Attack — carefully crafted prompts that bypass safety mechanisms 3. Jailbreak Patch — directly modifying model weights

All three succeed: the model starts answering harmful questions. But are the resulting harms the same? The paper's answer: no — and the differences are large.

Three Paths, Three Different Kinds of Harm

Harmful SFT is the mildest jailbreak. The model learns to answer harmful questions, but its other capabilities remain essentially intact — like a person taught to swear who is otherwise unchanged.

Adversarial attacks do not modify the model itself; they trick the safety checks. The safety alignment is still present but bypassed under specific inputs.

Jailbreak patches are the most aggressive: safety mechanisms are surgically removed from the weights.

Key Finding: Side Effects Differ by Method

Harmful SFT: smallest side effects. Common-sense reasoning, math, and coding are nearly unchanged.
Adversarial attacks: relatively contained side effects, since the model is untouched and safety fails only under specific attack patterns.
Jailbreak patches: largest side effects. Weight modification can degrade performance even on harmless tasks — like removing a car's brakes and damaging the engine at the same time.

Mechanistic Divergence

Harmful SFT mainly shifts the output distribution, with little change in the internal representation space.
Adversarial attacks exploit the boundary fragility of safety alignment — thin regions of the input space that are easily pierced.
Jailbreak patches directly alter internal representations, physically breaking safety-related circuits.

The deeper the modification, the larger the side effects.

Practical Implications

Defenders: different jailbreak types require different defenses — input filtering for adversarial attacks, model-level protections for harmful SFT and patches.
Open-source community: safety is not binary; a harmful-SFT model and a patched model differ in danger level and scope.
Policymakers: AI safety regulation should distinguish jailbreak types rather than treating them uniformly.

The paper's core lesson: safety is not a point but a multidimensional space — understanding where different attacks sit in that space is the first step toward effective defense.

Paper: arxiv.org/abs/2604.18510