The attack surface is the model's weights after training. The authors report identifying small sets of feed-forward channels linked to refusal behavior and removing between 29 and 150 selected neurons across ten tested models; selected evaluations showed harmful-request success near 88 percent. This is a white-box intervention against the safety behavior…
Inspect the ClaimsCase · DiggingBeagle record
Sparse neuron pruning degrades refusal in white-box models
CircuitBreak demonstrates post-training model-weight modification rather than a remote prompt-only jailbreak; authors report substantial refusal bypass in controlled evaluation.
Scope
Controlled white-box weight tampering
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- AI role
- AGAINST AI
Basis and provenance
Assessment is limited to the selected canonical Claims and their Source locators in knowledge revision 152. Primary public URL retrieval was unavailable during this drafting pass, and the pinned index reports incomplete linked-record coverage without identifying missing IDs. No independent production impact, generalized exploit prevalence, or attributable victim count is inferred. Case setting is evaluation; evidence status records only the documented source-reported result, not external replication.
Assessed Oct 15, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-SPARSE-REFUSAL-PRUNING-01 · CircuitBreak: sparse safety-neuron circuit pruning preprint
At a glance
Attacker access to editable weights is required; effects on hosted proprietary APIs and broader model integrity are not established.
Limits and uncertaintyFull account
The attack surface is the model's weights after training. The authors report identifying small sets of feed-forward channels linked to refusal behavior and removing between 29 and 150 selected neurons across ten tested models; selected evaluations showed harmful-request success near 88 percent. This is a white-box intervention against the safety behavior implemented in a model, not a prompt injection performed through an ordinary hosted chat API.
The operator must be able to change the model artifact or a deployment derived from it. The paper-reported results do not establish compromise of a proprietary hosted system, a universal bypass rate or an innocuous effect on other capabilities. Defending a deployed model would require controlling the integrity of the served weights and testing behavior after modification; the pinned source does not measure those operational controls.
Claims & evidence
CLM-2026-SPARSE-REFUSAL-PRUNING-01The authors report removing 29 to 150 selected feed-forward neurons from ten tested models, with evaluated harmful-request success reaching roughly 88 percent in selected examples.supported
Basis: reported finding
- supportsCircuitBreak: sparse safety-neuron circuit pruning preprintprimary disclosure
Abstract: joint FFN channel ablations
Unknowns and contradictions
- Attacker access to editable weights is required; effects on hosted proprietary APIs and broader model integrity are not established.
Sources and citation
Material revision history
- Oct 15, 2026 · Canonical change recorded · new in release · revision 153