From found jailbreaks to systematic elicitation
Five edges in this connective theme trace one long escalation, from a failure mode people stumbled onto completely by accident to a search a model can be made to run on itself. Somewhere between those two ends, hunting for an unwanted behavior stops being a matter of luck and becomes a matter of method.
The edges move from jailbreaks found ad hoc by ordinary users, to red-teaming as the deliberate, organized version of the same hunt, to a proposal that skips language altogether and searches inside the network's activations instead. Measured even against an automated version of red-teaming that still writes prompts in natural language, this last step goes further, replacing the search for words with nothing more than a vector to add.
Five edges trace one escalation: from a failure mode users stumble into, to a search a model performs on itself. Jailbreaks are the starting evidence -- inputs that make RLHF-trained, aligned models produce harmful output despite that training, found incidentally rather than by any systematic process, cited as proof that alignment training suppresses unwanted behavior rather than removing it. The next edge names what jailbreaks and red-teaming share: the same target, found accidentally by users in one case and hunted deliberately by developers in the other, red-teaming reframed as the systematic version of what jailbreaking already demonstrates ad hoc. CAA's red-teaming proposal then relocates the hunt itself: instead of searching input space for a prompt that triggers a bad behavior, it perturbs activations directly with a steering vector, trading an external, anecdotal search for an internal, systematic one. Measured against automated red-teaming, where an LM generates adversarial prompts but the search still stays confined to natural language, the CAA proposal skips the prompt search entirely -- there is nothing to write or evaluate, only a vector to add. The last edge names the escalation's final twist: the exact machinery built to suppress unwanted behavior gets pointed the other way, toward eliciting it, closing the loop from found jailbreak to deliberate internal perturbation.