<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="li-etal-2026-beyond-prompts">
    <titleInfo>
        <title>Beyond Prompts: Discovering Jailbreak Motifs in Sparse Feature Space</title>
    </titleInfo>
    <name type="personal">
        <namePart type="given">Zhongzhi</namePart>
        <namePart type="family">Li</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Jiahui</namePart>
        <namePart type="family">Han</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Jialing</namePart>
        <namePart type="family">Tao</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Huiqi</namePart>
        <namePart type="family">Deng</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Na</namePart>
        <namePart type="family">Zou</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Ninghao</namePart>
        <namePart type="family">Liu</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <originInfo>
        <dateIssued>2026-10</dateIssued>
    </originInfo>
    <typeOfResource>text</typeOfResource>
    <relatedItem type="host">
        <titleInfo>
            <title>Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing</title>
        </titleInfo>
        <name type="personal">
            <namePart type="given">Hung-Yi</namePart>
            <namePart type="family">Lee</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Sunipa</namePart>
            <namePart type="family">Dev</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Jessy</namePart>
            <namePart type="family">Li</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Desmond</namePart>
            <namePart type="family">Elliott</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <originInfo>
            <publisher>Association for Computational Linguistics</publisher>
            <place>
                <placeTerm type="text">Budapest, Hungary</placeTerm>
            </place>
        </originInfo>
        <genre authority="marcgt">conference publication</genre>
        <identifier type="isbn">979-8-89176-459-0</identifier>
    </relatedItem>
    <abstract>Large language models (LLMs) remain vulnerable to jailbreak attacks that exhibit diverse prompts and rapidly evolving strategies. Existing defenses often operate at the level of prompts or predefined attack methods, limiting their ability to generalize to unseen attacks that share similar underlying structure but differ in wording. In this paper, we investigate whether seemingly different jailbreak attacks exhibit shared SAE feature co-activation patterns, and propose a motif-based framework that models attacks through these recurring patterns. Specifically, we first extract sparse autoencoder (SAE) features from jailbreak queries and discover motifs as recurring co-activation patterns via nonnegative matrix factorization. We show that motifs capture stable relationships across attack methods and generalize to unseen attacks. Building on this structure, we synthesize new jailbreak queries by composing motif-guided attack patterns. We then use the generated queries to construct preference-training data for Direct Preference Optimization (DPO). Experiment results show that SAE motifs serve as a stable and transferable interface for understanding and detecting jailbreak attacks, as well as enabling effective defenses that generalize beyond fixed prompt templates. Training target models with motif-guided synthetic data improves robustness to unseen attacks with modest changes in utility. Our work provides a practical methodology for advancing data-centric LLM safety through structured modeling of jailbreak attacks.</abstract>
    <identifier type="citekey">li-etal-2026-beyond-prompts</identifier>
    <location>
        <url>https://aclanthology.org/2026.emnlp-main.2032/</url>
    </location>
    <part>
        <date>2026-10</date>
        <extent unit="page">
            <start>46282</start>
            <end>46315</end>
        </extent>
    </part>
</mods>
</modsCollection>

%0 Conference Proceedings
%T Beyond Prompts: Discovering Jailbreak Motifs in Sparse Feature Space
%A Li, Zhongzhi
%A Han, Jiahui
%A Tao, Jialing
%A Deng, Huiqi
%A Zou, Na
%A Liu, Ninghao
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-459-0
%F li-etal-2026-beyond-prompts
%X Large language models (LLMs) remain vulnerable to jailbreak attacks that exhibit diverse prompts and rapidly evolving strategies. Existing defenses often operate at the level of prompts or predefined attack methods, limiting their ability to generalize to unseen attacks that share similar underlying structure but differ in wording. In this paper, we investigate whether seemingly different jailbreak attacks exhibit shared SAE feature co-activation patterns, and propose a motif-based framework that models attacks through these recurring patterns. Specifically, we first extract sparse autoencoder (SAE) features from jailbreak queries and discover motifs as recurring co-activation patterns via nonnegative matrix factorization. We show that motifs capture stable relationships across attack methods and generalize to unseen attacks. Building on this structure, we synthesize new jailbreak queries by composing motif-guided attack patterns. We then use the generated queries to construct preference-training data for Direct Preference Optimization (DPO). Experiment results show that SAE motifs serve as a stable and transferable interface for understanding and detecting jailbreak attacks, as well as enabling effective defenses that generalize beyond fixed prompt templates. Training target models with motif-guided synthetic data improves robustness to unseen attacks with modest changes in utility. Our work provides a practical methodology for advancing data-centric LLM safety through structured modeling of jailbreak attacks.
%U https://aclanthology.org/2026.emnlp-main.2032/
%P 46282-46315

Markdown (Informal)

[Beyond Prompts: Discovering Jailbreak Motifs in Sparse Feature Space](https://aclanthology.org/2026.emnlp-main.2032/) (Li et al., EMNLP 2026)

• Beyond Prompts: Discovering Jailbreak Motifs in Sparse Feature Space (Li et al., EMNLP 2026)

ACL

• Zhongzhi Li, Jiahui Han, Jialing Tao, Huiqi Deng, Na Zou, and Ninghao Liu. 2026. Beyond Prompts: Discovering Jailbreak Motifs in Sparse Feature Space. In Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing, pages 46282–46315, Budapest, Hungary. Association for Computational Linguistics.