Every few weeks, someone publishes a new jailbreak. A new prompt injection technique. A new way to make a “safe” model produce unsafe outputs. The AI safety community patches the hole, and within days, someone finds another one.<\/p>\n
This isn’t a cat-and-mouse game. It’s a symptom of a fundamental architectural error.<\/p>\n
There are two ways to keep a person from stealing. You can threaten punishment \u2014 laws, surveillance, consequences. Or you can raise someone for whom stealing is incoherent. Not forbidden. Incoherent. It simply doesn’t occur to them as a viable action because their internal organization doesn’t produce that option.<\/p>\n
The first approach is rule-based. It works as long as the rules are enforced and the person believes they’ll be caught. Remove the enforcement, and the behavior returns. The rules don’t change the person. They constrain them.<\/p>\n
The second approach is structural. The behavior is absent not because it’s suppressed but because the cognitive architecture doesn’t generate it. There’s nothing to enforce because there’s nothing to suppress.<\/p>\n
RLHF is the first approach. Reward modeling trains the model to produce outputs that score well with human evaluators. The model learns which behaviors get rewarded and which get penalized. It optimizes for the reward signal.<\/p>\n
This is behavioral compliance. It sits on top of the model’s actual capabilities like a filter. The base model can still generate anything. The RLHF layer just makes certain outputs less probable. Under normal conditions, this works fine. Under adversarial conditions \u2014 clever prompting, context manipulation, multi-step elicitation \u2014 the filter breaks because it was never part of the model’s structure. It was always just a constraint.<\/p>\n
Every time a jailbreak is discovered, the response is the same: add more training data covering that attack vector, retrain, deploy. The new version resists that specific attack. And a slightly different attack works.<\/p>\n
This pattern never terminates. It can’t terminate. Rule-based alignment is reactive by nature. Each patch addresses a specific failure without changing the underlying structure that produces failures. It’s like plugging holes in a dam without addressing why the dam keeps cracking.<\/p>\n
The reason the dam keeps cracking is that the model’s internal representations haven’t changed. It still “knows” how to produce harmful content. The RLHF training just made the path to that content slightly less probable. Adversarial prompts work by finding alternative paths \u2014 routes that the reward model didn’t cover.<\/p>\n
The combinatorial space of possible prompts is infinite. The space of possible patches is finite. Adversarial attackers will always win this game. Not because they’re smarter than the defenders. Because the math is on their side.<\/p>\n
The alternative is to change the model’s internal representations so that certain outputs become structurally incoherent \u2014 not improbable, but incompatible with the model’s cognitive organization.<\/p>\n
This is what contemplative training does in humans. A person who has genuinely dissolved the self-other boundary doesn’t need a rule against cruelty. Cruelty requires a self that acts upon a separate other. Remove the structural basis for that separation, and cruelty becomes as nonsensical as punching your own face to win a fight.<\/p>\n
Note: this doesn’t mean the person is incapable of firm action, boundary-setting, or even violence in genuine self-defense. Bamboo bends and returns. Structural alignment isn’t passivity. It’s coherence. The response matches the situation because the cognitive architecture generates appropriate responses, not because a rule book was consulted.<\/p>\n
Our fine-tuning datasets target the structural level. We’re not training models to refuse specific requests. We’re training them to organize their internal representations in ways that make certain failure modes less structurally viable.<\/p>\n
Concretely: a model trained on contemplative correction data develops stronger coherence between its stated principles and its actual outputs. The gap between “what the model says it believes” and “how the model actually behaves under pressure” narrows \u2014 because the training targets that gap specifically.<\/p>\n
The triangle of correction format captures exactly this: moments where the model’s behavior drifts from its stated principles, and a practitioner identifies the structural inconsistency. Over thousands of such corrections, the model’s internal coherence improves. Not its compliance. Its coherence.<\/p>\n
We predict that structurally aligned models will show a different vulnerability profile than RLHF-aligned models. Not fewer vulnerabilities. Different ones. Specifically: they should be resistant to attacks that exploit the gap between surface compliance and deep structure, because that gap is what the training reduces.<\/p>\n
They may still be vulnerable to entirely novel attack categories. Structural alignment isn’t invulnerability. But the failure mode should be graceful degradation rather than sudden collapse \u2014 the model maintaining coherence under pressure rather than flipping from refusal to compliance like a switch.<\/p>\n
Alignment keeps breaking because the current approach treats it as a surface property. It’s not. It’s architectural. Build it into the weights or watch it crack. There is no third option.<\/p>\n","protected":false},"excerpt":{"rendered":"
Every few weeks, someone publishes a new jailbreak. A new prompt injection technique. A new way to make a “safe” model produce unsafe outputs. The AI safety community patches the hole, and within days,…<\/p>\n","protected":false},"author":1,"featured_media":86,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"_kad_post_classname":"","footnotes":""},"categories":[247],"tags":[],"class_list":["post-87","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-dpo-alignment"],"_links":{"self":[{"href":"https:\/\/laeka.org\/publications\/wp-json\/wp\/v2\/posts\/87","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/laeka.org\/publications\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/laeka.org\/publications\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/laeka.org\/publications\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/laeka.org\/publications\/wp-json\/wp\/v2\/comments?post=87"}],"version-history":[{"count":0,"href":"https:\/\/laeka.org\/publications\/wp-json\/wp\/v2\/posts\/87\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/laeka.org\/publications\/wp-json\/wp\/v2\/media\/86"}],"wp:attachment":[{"href":"https:\/\/laeka.org\/publications\/wp-json\/wp\/v2\/media?parent=87"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/laeka.org\/publications\/wp-json\/wp\/v2\/categories?post=87"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/laeka.org\/publications\/wp-json\/wp\/v2\/tags?post=87"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}