Causal Front-Door Adjustment for Robust Jailbreak Attacks on LLMs
This addresses the challenge of robustly bypassing safety mechanisms in LLMs for security researchers, though it is incremental as it builds on existing causal methods.
The paper tackles the problem of jailbreaking safety-aligned Large Language Models by modeling safety mechanisms as unobserved confounders and proposes the Causal Front-Door Adjustment Attack (CFA^2) to sever these associations, achieving state-of-the-art attack success rates with mechanistic interpretation.
Safety alignment mechanisms in Large Language Models (LLMs) often operate as latent internal states, obscuring the model's inherent capabilities. Building on this observation, we model the safety mechanism as an unobserved confounder from a causal perspective. Then, we propose the Causal Front-Door Adjustment Attack (CFA{$^2$}) to jailbreak LLM, which is a framework that leverages Pearl's Front-Door Criterion to sever the confounding associations for robust jailbreaking. Specifically, we employ Sparse Autoencoders (SAEs) to physically strip defense-related features, isolating the core task intent. We further reduce computationally expensive marginalization to a deterministic intervention with low inference complexity. Experiments demonstrate that CFA{$^2$} achieves state-of-the-art attack success rates while offering a mechanistic interpretation of the jailbreaking process.