发表机构
National University of Defense Technology（国防科技大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
本研究揭示工具代理中越狱后安全反馈引发模型依赖的分歧行为路由，并发现关键层干预特征可跨任务预测路由结果，为安全与效用权衡提供机制视角和预测基线。
AI 中文摘要
随着大语言模型日益作为使用工具的工具代理运行，越狱后的安全反馈通常被假定为可靠的安全保障；然而，挥之不去的越狱上下文如何塑造后续代理行为在很大程度上仍未得到探索。为系统性地审视这一动态，我们引入了一个配对延续框架，涵盖跨越42个领域的192个父任务，在八个不同的代理上评估了12,148个经过分析的延续对（从初始设计的12,288对中精选而来）。我们发现，相同的安全反馈会引发急剧的、依赖模型的行为路由，而非统一保护：将不安全轨迹转向合法完成（“救援”）、维持未经授权的执行（“持续不安全”），或在良性任务上触发过度拒绝（“附带损失”）。通过逐层激活修补，我们发现了一个共享的“晚期提交模式”，其中因果干预效应在接近最终层（相对深度0.958–0.984）时急剧飙升，尽管跨架构的峰值幅度存在超过30倍的差异。关键在于，关键层表示与宏观路由结果相关，且在这些层的干预会因果性地改变具体的下一步工具动作。基于这一因果基础，我们测试了局部干预衍生的特征是否能在留一父任务评估下，作为未见父任务上完整轨迹路由结果的预测代理，发现在响应性代理中它们提供了可行的预测信号，峰值ROC AUC对“救援”达到0.675，对“附带损失”达到0.777，对“持续不安全”达到0.702。这些发现为预测自主代理中越狱后反馈的安全与效用权衡建立了机制视角和预测基线。
英文摘要
As large language models increasingly operate as tool-using agents, post-jailbreak safety feedback is often assumed to serve as a reliable safeguard; however, how lingering jailbreak context shapes subsequent agent behavior remains largely unexplored. To systematically examine this dynamic, we introduce a paired continuation framework across 192 parent tasks spanning 42 domains, evaluating 12,148 analyzed continuation pairs (curated from a 12,288-pair initially design) across eight diverse agents. We find that identical safety feedback induces sharply model-dependent behavioral routing rather than uniform protection: redirecting unsafe trajectories toward legitimate completion (\emph{rescue}), sustaining unauthorized execution (\emph{persistent unsafe}), or triggering over-refusal on benign tasks (\emph{collateral loss}). Through layer-wise activation patching, we discover a shared \emph{late-commit pattern} where causal intervention effects surge sharply near the final layers (relative depths of 0.958--0.984) despite an over 30-fold variation in peak magnitude across architectures. Crucially, critical-layer representations correlate with macroscopic routing outcomes, and intervening at these layers causally alters concrete next-step tool actions. Building on this causal foundation, we test whether localized intervention-derived features can serve as predictive proxies for full-trajectory routing outcomes on unseen parent tasks under leave-one-parent-task-out evaluation, finding that they provide viable predictive signals in responsive agents with peak ROC AUCs reaching 0.675 for \emph{rescue}, 0.777 for \emph{collateral loss}, and 0.702 for \emph{persistent unsafe}. These findings establish a mechanistic lens and a predictive baseline for anticipating the safety and utility trade-offs of post-jailbreak feedback in autonomous agents.
Comments28 pages, 9 figures, 17 tabels, ICLR 2027 Under Review
