Safety guardrails in major language models are a switchboard, not a lock.
A team of researchers reverse-engineered how alignment-trained models decide to refuse harmful requests. They found a consistent two-part circuit across twelve models from six labs, ranging from 2 billion to 72 billion parameters: an attention gate in an intermediate layer detects flagged content and triggers deeper "amplifier" heads that push the model toward refusal. Critically, the safety-trained behavior is not baked into the model's knowledge — it is gated by this routing mechanism. Flip the gate, and the model that was refusing will produce harmful guidance instead. The researchers also found that a simple in-context substitution cipher collapses the gate's effectiveness by 70 to 99% across three tested models, because the cipher defeats the detection layer's pattern matching before deeper layers can reconstruct meaning.
The implications are uncomfortable for anyone who treats benchmark safety scores as proof of robustness. Behavioral benchmarks registered no change even when the circuit physically relocated across model generations within the same family — meaning a model can pass safety evals while its underlying routing has quietly shifted. The finding also puts pressure on the standard narrative that scaling up models makes them safer: the gate-and-amplifier motif persists at 72B parameters, but so does its exploitability.
Six of the largest AI labs in the world ship models whose refusals rest on a mechanism that a cipher can sidestep. The researchers frame this as a localization finding, not an attack recipe — but that distinction will matter less to the people who read the paper than to the labs who built the models.