@inproceedings{broomfield-etal-2025-structural,
    title = "The Structural Safety Generalization Problem",
    author = "Broomfield, Julius  and
      Gibbs, Tom  and
      Ingebretsen, George  and
      Kosak-Hine, Ethan  and
      Nasir, Tia  and
      Zhang, Jason  and
      Iranmanesh, Reihaneh  and
      Pieri, Sara  and
      Rabbany, Reihaneh  and
      Pelrine, Kellin",
    editor = "Che, Wanxiang  and
      Nabende, Joyce  and
      Shutova, Ekaterina  and
      Pilehvar, Mohammad Taher",
    booktitle = "Findings of the Association for Computational Linguistics: ACL 2025",
    month = jul,
    year = "2025",
    address = "Vienna, Austria",
    publisher = "Association for Computational Linguistics",
    url = "https://preview.aclanthology.org/landing_page/2025.findings-acl.1142/",
    pages = "22134--22173",
    ISBN = "979-8-89176-256-5",
    abstract = "LLM jailbreaks are a widespread safety challenge. Given this problem has not yet been tractable, we suggest targeting a key failure mechanism: the failure of safety to generalize across semantically equivalent inputs. We further focus the target by requiring desirable tractability properties of attacks to study: explainability, transferability between models, and transferability between goals. We perform red-teaming within this framework by uncovering new vulnerabilities to multi-turn, multi-image, and translation-based attacks. These attacks are semantically equivalent by our design to their single-turn, single-image, or untranslated counterparts, enabling systematic comparisons; we show that the different structures yield different safety outcomes. We then demonstrate the potential for this framework to enable new defenses by proposing a Structure Rewriting Guardrail, which converts an input to a structure more conducive to safety assessment. This guardrail significantly improves refusal of harmful inputs, without over-refusing benign ones. Thus, by framing this intermediate challenge{---}more tractable than universal defenses but essential for long-term safety{---}we highlight a critical milestone for AI safety research."
}