ConceptGuard: Neuro-Symbolic Safety Guardrails via Sparse Interpretable Jailbreak Concepts

TL;DR

ConceptGuard introduces a neuro-symbolic framework using sparse autoencoders to identify interpretable internal concepts in LLMs, enabling explainable and robust safety guardrails against jailbreak attacks without additional fine-tuning.

Contribution

It presents a novel approach leveraging sparse autoencoders to extract meaningful internal representations for safety, enhancing robustness and interpretability of defenses against jailbreaks.

Findings

Shared activation geometry for jailbreak attacks identified

ConceptGuard provides explainable safety guardrails

No additional fine-tuning required for robustness

Abstract

Large Language Models have found success in a variety of applications. However, their safety remains a concern due to the existence of various jailbreaking methods. Despite significant efforts, alignment and safety fine-tuning only provide a certain degree of robustness against jailbreak attacks that covertly mislead LLMs towards the generation of harmful content. This leaves them prone to a range of vulnerabilities, including targeted misuse and accidental user profiling. This work introduces \textbf{ConceptGuard}, a novel framework that leverages Sparse Autoencoders (SAEs) to identify interpretable concepts within LLM internals associated with different jailbreak themes. By extracting semantically meaningful internal representations, ConceptGuard enables building robust safety guardrails -- offering fully explainable and generalizable defenses without sacrificing model capabilities or requiring further fine-tuning. Leveraging advances in the mechanistic interpretability of LLMs, our approach provides evidence for a shared activation geometry for jailbreak attacks in the representation space, a potential foundation for designing more interpretable and generalizable safeguards against attackers.