Sparse Autoencoders are Capable LLM Jailbreak Mitigators

A new defense against jailbreak attacks on large language models repurposes sparse autoencoders originally built for interpretability, according to research posted on arXiv. The method, called Context-Conditioned Delta Steering, identifies and suppresses features linked to harmful prompts without additional task-specific training [1][2]. The technique, proposed by Yannick Assogba and detailed in a paper last revised in June 2026, operates by comparing token-level representations of the same harmful request presented with and without a jailbreak context [1][2]. Paired prompts are used to select relevant sparse features through statistical testing, and a mean-shift is applied in the sparse autoencoder latent space at inference time [2]. The paper reports results across four aligned instruction-tuned models and twelve jailbreak attacks [1][2]. The authors state that CC-Delta achieves safety-utility tradeoffs comparable to or better than baseline defenses that operate in dense latent space [2]. It outperformed dense mean-shift steering on all four models tested, with a particularly strong showing against out-of-distribution attacks [2]. The findings suggest that steering in sparse feature space offers practical advantages over dense activation-space interventions for jailbreak mitigation [1][2]. The work appears as a preprint on arXiv, the open-access repository that has hosted scientific e-prints since 1991 and now receives roughly 24,000 submissions per month [6]. The initial version of the paper, submitted in February 2026, was 2,558 KB; the revised June 2026 version grew to 3,280 KB [1]. The research sits within the computer science subcategory of cryptography and security [1]. Jailbreak attacks remain a persistent challenge for large language model safety, and the paper frames off-the-shelf sparse autoencoders—tools originally designed to make model internals more interpretable—as a viable defense pathway that requires no bespoke training [2]. The authors note that the method identifies jailbreak-relevant sparse features by contrasting representations of harmful requests in benign and adversarial contexts, then applies a targeted shift to neutralize the threat while preserving utility [2].