Tripwire cuts jailbreak success to 2%, only when attacked

Tripwire blocks jailbreak attempts by staying dormant until an attack triggers it, cutting success rates to as low as 2%. Existing neuron-level defenses run on every request, benign or not, costing usability the researchers measured directly. Tripwire's version of that cost is just 0.5 to 5.3% off MT-Bench utility, the smallest hit among the defenses compared, per the paper.

The method finds safety-specific neurons using per-neuron hypothesis tests under false-discovery-rate control, then filters for ones that don't also carry general utility. When an attack pattern shows up, Tripwire clamps those neurons to the activation levels the model already produces when it refuses harmful requests. The model already learned that refusal behavior in alignment training, so Tripwire just switches it on instead of running it constantly.

No retraining is required. Tripwire ships in two modes that the paper proves are equivalent. One is a detector that gates the intervention at inference time. The other is an offline edit that bakes the same bias directly into the model's weights.

Always-on defenses like existing neuron clamps tax every legitimate request just to catch the rare attack, and Tripwire's numbers suggest that tradeoff is unnecessary. Gated activation, not constant filtering, is the model other alignment defenses need to copy. The paper doesn't say whether the false-discovery-rate detection step holds up against attacks outside the four types it tested against.