[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-researchers-fight-jailbroken-ai-models-with-confident-lies":10,"sections":35},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":30,"feedback":34,"feedback_at":22,"cost_usd":34,"total_tokens":34},5680,"researchers-fight-jailbroken-ai-models-with-confident-lies","Researchers Fight Jailbroken AI Models With Confident Lies","A new defense answers safety-stripped AI models with fabricated instructions instead of blocking the attack, though it can't guarantee anyone gets fooled.","A team of AI safety researchers has a blunt new answer to a stubborn problem: since nobody can stop attackers from ripping the safety training out of open-weight models, maybe the trick is to make what's left behind untrustworthy.\n\nThe technique, called Fool's Gold or decoy hardening, targets abliteration, a method that projects a refusal-mediating direction out of a model's weights in minutes and currently has no durable release-time defense. Rather than blocking the strip, the researchers concede it and poison the result: once refusal is removed, the model answers hazardous operational requests with confident, fluent responses whose critical details are quietly falsified. The decoys are trained inside a simulation of the attack itself, paired with a refusal pin and a benign leash that keep normal, unattacked behavior unchanged. Across seven open-weight models spanning 9B to 122B parameters and five model families, six passed the researchers' pre-registered efficacy gate, producing decoys on 51 to 90 percent of attacked-state responses to held-out hazardous prompts.\n\nThis matters because it is an admission that current alignment techniques cannot durably survive contact with an open-weight release, so the fight is shifting from prevention to sabotage. That is a meaningful strategic pivot for labs that ship open weights, but the paper is refreshingly honest about the catch: there is no way, even for the defenders, to tell a falsified answer from a correct one without outside ground truth. On a CBRNE-adjacent red-team benchmark, the defended 122B model was confidently wrong 82 to 86 percent of the time, versus at most 10 percent undefended.\n\nWorth noting: patience beats deception. Sampling the same prompt 64 times and taking the consensus answer reconstructed a usable procedure on up to 62.5 percent of prompts against the weakest defended model, with no reliable way to tell real answers from fake ones. Decoys slow down casual misuse; they don't stop someone willing to ask twice.","[\"ai-safety\",\"open-weight-models\",\"jailbreaking\",\"security-research\"]","2026-08-19T04:00:00.000Z","2026-08-19T10:28:26.397Z","2026-08-19T10:28:38.330Z","published",null,[],"security",[26,27,28,29],"ai-safety","open-weight-models","jailbreaking","security-research",[31],{"name":32,"url":33},"arXiv cs.AI","https:\u002F\u002Farxiv.org\u002Fabs\u002F2608.17202",0,{"sections":36},[37,42,45,50,55,60,65,70,75,80,85,90,95,100],{"name":38,"slug":39,"count":40,"latest_published_at":41},"AI","ai",3293,"2026-08-20T04:00:00.000Z",{"name":43,"slug":24,"count":44,"latest_published_at":41},"Security",435,{"name":46,"slug":47,"count":48,"latest_published_at":49},"Policy","policy",210,"2026-08-19T09:32:27.000Z",{"name":51,"slug":52,"count":53,"latest_published_at":54},"Deals","deals",179,"2026-06-29T20:02:07.000Z",{"name":56,"slug":57,"count":58,"latest_published_at":59},"Hardware","hardware",140,"2026-08-19T18:25:42.000Z",{"name":61,"slug":62,"count":63,"latest_published_at":64},"Consumer Tech","consumer-tech",95,"2026-08-18T16:05:00.000Z",{"name":66,"slug":67,"count":68,"latest_published_at":69},"Science","science",90,"2026-08-19T18:41:02.000Z",{"name":71,"slug":72,"count":73,"latest_published_at":74},"Software","software",73,"2026-08-18T07:51:50.000Z",{"name":76,"slug":77,"count":78,"latest_published_at":79},"Dev Tools","dev-tools",69,"2026-08-18T04:00:00.000Z",{"name":81,"slug":82,"count":83,"latest_published_at":84},"Startups","startups",47,"2026-08-19T19:13:46.000Z",{"name":86,"slug":87,"count":88,"latest_published_at":89},"Gaming","gaming",41,"2026-07-09T04:00:00.000Z",{"name":91,"slug":92,"count":93,"latest_published_at":94},"General","general",33,"2026-08-18T22:18:13.000Z",{"name":96,"slug":97,"count":98,"latest_published_at":99},"Reviews","reviews",20,"2026-06-24T12:00:01.000Z",{"name":101,"slug":102,"count":103,"latest_published_at":104},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]