Researchers have found a way to make a handful of neurons do the safety work that entire filter layers used to handle.
A new paper describes Tripwire, a training-free defense that statistically identifies which individual neurons inside a large language model are specifically responsible for refusing harmful requests, while filtering out ones that also matter for normal use. Instead of suppressing those neurons or bolting on an external classifier, Tripwire clamps them to the activation levels they show during actual harmful-content refusals, essentially tricking the model into thinking it is already looking at a bad prompt. The clamp can run two ways: a detector triggers it only when an attack is suspected, or it is baked directly into the model's weights as a permanent edit. Tested across four safety-aligned models and four jailbreak techniques, the method cut successful jailbreaks to at most 2 percent while costing only 0.5 to 5.3 percent of general capability on the MT-Bench benchmark.
Most jailbreak defenses face a blunt tradeoff: suppress every neuron tied to "toxic" content and you dull the model's everyday usefulness, or bolt on a classifier that also snags neurons doing legitimate work. Tripwire's pitch is precision: isolate the narrow set of neurons statistically tied to refusal behavior, leave the rest alone, and only intervene when an attack is actually flagged rather than filtering every request by default.
It is still an arXiv preprint with anonymized code and no independent replication, so treat the numbers as promising rather than settled. Still, triggering a refusal switch the model already has beats bolting on yet another external filter.