{"id":"https://openalex.org/W7163585662","doi":"https://doi.org/10.48550/arxiv.2606.04168","title":"When Autoregressive Consistency Hurts Safety Alignment","display_name":"When Autoregressive Consistency Hurts Safety Alignment","publication_year":2026,"publication_date":"2026-06-02","ids":{"openalex":"https://openalex.org/W7163585662","doi":"https://doi.org/10.48550/arxiv.2606.04168"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.04168","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.04168","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.04168","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5055648096","display_name":"Bochen Lyu","orcid":"https://orcid.org/0000-0002-6781-5517"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Lyu, Bochen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5025410658","display_name":"Yiyang Jia","orcid":"https://orcid.org/0000-0002-5202-6611"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jia, Yiyang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5078326698","display_name":"Xiaohao Cai","orcid":"https://orcid.org/0000-0003-0924-2834"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Cai, Xiaohao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5045305860","display_name":"Zhanxing Zhu","orcid":"https://orcid.org/0000-0002-2141-6553"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhu, Zhanxing","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.8228999972343445,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.8228999972343445,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.07270000129938126,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.027699999511241913,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/autoregressive-model","display_name":"Autoregressive model","score":0.8729000091552734},{"id":"https://openalex.org/keywords/consistency","display_name":"Consistency (knowledge bases)","score":0.7785000205039978},{"id":"https://openalex.org/keywords/continuation","display_name":"Continuation","score":0.6100000143051147},{"id":"https://openalex.org/keywords/trajectory","display_name":"Trajectory","score":0.49709999561309814},{"id":"https://openalex.org/keywords/nonlinear-autoregressive-exogenous-model","display_name":"Nonlinear autoregressive exogenous model","score":0.42419999837875366},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.4180999994277954}],"concepts":[{"id":"https://openalex.org/C159877910","wikidata":"https://www.wikidata.org/wiki/Q2202883","display_name":"Autoregressive model","level":2,"score":0.8729000091552734},{"id":"https://openalex.org/C2776436953","wikidata":"https://www.wikidata.org/wiki/Q5163215","display_name":"Consistency (knowledge bases)","level":2,"score":0.7785000205039978},{"id":"https://openalex.org/C88626702","wikidata":"https://www.wikidata.org/wiki/Q1128903","display_name":"Continuation","level":2,"score":0.6100000143051147},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5557000041007996},{"id":"https://openalex.org/C13662910","wikidata":"https://www.wikidata.org/wiki/Q193139","display_name":"Trajectory","level":2,"score":0.49709999561309814},{"id":"https://openalex.org/C42536954","wikidata":"https://www.wikidata.org/wiki/Q7049462","display_name":"Nonlinear autoregressive exogenous model","level":3,"score":0.42419999837875366},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.4180999994277954},{"id":"https://openalex.org/C149782125","wikidata":"https://www.wikidata.org/wiki/Q160039","display_name":"Econometrics","level":1,"score":0.3781000077724457},{"id":"https://openalex.org/C31388003","wikidata":"https://www.wikidata.org/wiki/Q7624548","display_name":"Strong consistency","level":3,"score":0.36469998955726624},{"id":"https://openalex.org/C194657046","wikidata":"https://www.wikidata.org/wiki/Q7394685","display_name":"STAR model","level":4,"score":0.3418999910354614},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.33149999380111694},{"id":"https://openalex.org/C30795276","wikidata":"https://www.wikidata.org/wiki/Q7389877","display_name":"SETAR","level":5,"score":0.30889999866485596},{"id":"https://openalex.org/C2778562939","wikidata":"https://www.wikidata.org/wiki/Q1298791","display_name":"Synchronization (alternating current)","level":3,"score":0.2953999936580658},{"id":"https://openalex.org/C2778753569","wikidata":"https://www.wikidata.org/wiki/Q1960395","display_name":"Span (engineering)","level":2,"score":0.25859999656677246}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.04168","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.04168","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.04168","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.04168","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Safety":[0],"alignment":[1,68,172,222],"in":[2,9,102,219],"large":[3],"language":[4],"models":[5],"(LLMs)":[6],"is":[7,13],"fragile":[8],"part":[10],"because":[11],"it":[12,200],"often":[14],"shallow:":[15],"fine-tuning":[16],"mainly":[17],"reshapes":[18],"the":[19,23,39,48,55,103,133,148,180],"model's":[20],"behavior":[21],"near":[22],"first":[24],"few":[25],"output":[26,104,181],"tokens.":[27],"We":[28,183],"argue":[29],"that":[30,63,94,170,209],"this":[31],"phenomenon":[32],"can":[33,66,146],"be":[34,151,213],"understood":[35],"through":[36],"autoregressive":[37,64,129,160,177,210],"consistency,":[38],"tendency":[40],"of":[41,58,89],"next-token":[42],"prediction":[43],"to":[44,131,150],"preserve":[45],"and":[46,127,198,223],"extend":[47],"current":[49],"response":[50],"trajectory":[51,126],"consistently.":[52],"By":[53],"analyzing":[54],"learning":[56],"dynamics":[57],"safety":[59,79,139,171,187,221],"alignment,":[60,188],"we":[61,110],"show":[62],"consistency":[65,130,161,178,211],"concentrate":[67],"updates":[69],"on":[70,91,193],"early":[71],"tokens,":[72],"offering":[73],"a":[74,86,107,117,142,155,163,216],"mechanistic":[75],"explanation":[76],"for":[77],"shallow":[78],"alignment.":[80,140],"The":[81],"same":[82],"mechanism":[83],"also":[84,174],"predicts":[85],"broader":[87,165],"class":[88],"attacks":[90,93],"LLMs:":[92],"induce":[95],"harmful":[96,119,135,144,152,176,195],"continuation":[97,196],"states":[98],"at":[99],"arbitrary":[100],"positions":[101],"trajectory.":[105,182],"As":[106],"concrete":[108],"example,":[109],"introduce":[111],"random":[112,202],"insertion":[113],"attack,":[114],"which":[115],"inserts":[116],"short":[118,143],"span":[120,145],"into":[121],"an":[122,189],"otherwise":[123],"safe":[124],"refusal":[125,157],"exploits":[128],"sustain":[132],"resulting":[134],"branch,":[136],"thereby":[137],"bypassing":[138],"Notably,":[141],"redirect":[147],"generation":[149],"even":[153],"after":[154],"long":[156],"prefix,":[158],"highlighting":[159],"as":[162,215],"potential":[164],"failure":[166],"mechanism.":[167],"This":[168],"suggests":[169],"should":[173,212],"break":[175],"throughout":[179],"therefore":[184],"propose":[185],"adversarial":[186],"initial":[190],"framework":[191],"based":[192],"worst-case":[194],"states,":[197],"instantiate":[199],"with":[201],"worst-insertion":[203],"training.":[204],"Overall,":[205],"our":[206],"results":[207],"suggest":[208],"treated":[214],"central":[217],"consideration":[218],"both":[220],"attack":[224],"design.":[225]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-06-05T00:00:00"}