Despite substantial progress in safety alignment, aligned Large Language Models (LLMs) remain fragile under small parameter-space and activation-space perturbations, such as downstream fine-tuning and jailbreak attacks. To explain why local perturbations can trigger broad safety failures, we analyze safety-task neuron circuits from the perspectives of activation flow and circuit topology. We identify a critical topological fragility in safety alignment: In aligned models, safety-task neuron circuits exhibit a low-redundancy, isolated single-chain topology, in sharp contrast to the highly redundant dense-mesh topology of general-task circuits. This brittle topology creates rigid serial dependencies, whereby perturbing a small set of upstream neurons can disrupt downstream safety neurons and cascade into broad alignment failures. To mitigate this topological fragility, we propose Dense Safety Mesh (DSM), a topology-aware alignment framework that transforms brittle single-chain safety circuits into more redundant and resilient mesh-like structures. DSM employs structural adversarial masking to suppress dominant safety pathways, forcing safety circuits to develop diverse parallel pathways. Extensive experiments across seven models and multiple evaluations show that DSM improves robustness against perturbations attacks while maintaining general capabilities.

Large language models (LLMs) are widely deployed as zero-shot evaluators for answer grading, content moderation, and document ranking. Yet studies show that guard models (Guards)—LLMs fine-tuned for safety—remain vulnerable to “jailbreak” attacks, jeopardising downstream chatbots.We confirm this weakness on three public benchmarks (BeaverTails, XSTest, AdvBench) and trace it to representation shifts that arise in the embedding layer and cascade through the Transformer stack.To counteract the effect, we introduce Gamma-Guard: lightweight residual adapters inserted after the embeddings and at sparse intervals in the model. The adapters start with zero-scaled gates, so they retain the original behaviour; a brief adversarial fine-tuning phase then teaches them to denoise embeddings and refocus attention.With fewer than 0.1% extra parameters and only a 2% latency increase, Gamma-Guard lifts adversarial accuracy from <5% to 95% a 90 percentage-point gain while reducing clean-data accuracy by just 8 percentage points.Extensive ablations further show that robustness improvements persist across different layer placements and model sizes.To our knowledge, this is the first approach that directly augments large Guards with trainable adapters, providing a practical path toward safer large-scale LLM deployments.