A new research paper shows AI chatbots can be reverse-engineered to reveal exactly which fictional scenarios trick them into ignoring their own safety rules.
Researchers built a tool called Concept2Scenario that uses a sparse autoencoder to map internal concept representations inside open-source language models, then traces which of those concepts suppress a model's refusal response. It translates the flagged concepts into plain-language scenario descriptions, the same kind of scenario-wrapping tactics jailbreakers already use, such as framing a harmful request as fiction or academic research. Tested across three open-source models, two safety benchmarks, and six existing jailbreak methods, the scenarios the tool surfaced boosted average attack success rates by up to 18.2 percentage points. The team also found that combining certain scenarios worked better than using them alone, letting attacks succeed in fewer conversational turns.
Most red-teaming today relies on trial and error. Testers throw scenarios at a model and see what sticks, without understanding why some work. This method instead treats jailbreak-prone scenarios as measurable, transferable properties of a model's internals, and the same weak spots showed up in GPT-5, Claude-Haiku-4.5, and Gemini-3-Flash, even though the researchers trained their scenario-discovery tool only on open-source models. That cross-model transfer is the real finding. It suggests safety training across the industry shares blind spots rather than each product having its own.
If refusal training is patching symptoms instead of fixing the underlying mechanism, this kind of interpretability-driven red-teaming looks set to become standard practice at AI labs well before ordinary users ever hear about it.