While prior work has focused on projecting adversarial examples back onto the manifold of natural data to restore safety, we argue that a comprehensive understanding of AI safety requires characterizing the unsafe regions themselves. This paper introduces a framework for systematically mapping the Manifold of Failure in Large Language Models (LLMs). We reframe the search for vulnerabilities as a quality diversity problem, using MAP-Elites to illuminate the continuous topology of these failure regions, which we term behavioral attraction basins. Our quality metric, Alignment Deviation, guides the search towards areas where the model's behavior diverges most from its intended alignment. Across three LLMs: Llama-3-8B, GPT-OSS-20B, and GPT-5-Mini, we show that MAP-Elites achieves up to 63% behavioral coverage, discovers up to 370 distinct vulnerability niches, and reveals dramatically different model-specific topological signatures: Llama-3-8B exhibits a near-universal vulnerability plateau (mean Alignment Deviation 0.93), GPT-OSS-20B shows a fragmented landscape with spatially concentrated basins (mean 0.73), and GPT-5-Mini demonstrates strong robustness with a ceiling at 0.50. Our approach produces interpretable, global maps of each model's safety landscape that no existing attack method (GCG, PAIR, or TAP) can provide, shifting the paradigm from finding discrete failures to understanding their underlying structure.
Figures & tables
Figure 1: MAP-Elites selects and mutates prompts from the behavioral archive. Each prompt is sent to the target LLM, and the response is evaluated by the judge to produce a behavioral descriptor (b) and Alignment Deviation score Q(p) , which update the archive.
Figure 2: Discrete prompts are lifted into continuous spaces via a behavioral descriptor b:P→[0,1]2 and a sentence encoder ϕ:P→Rd . The resulting manifold supports continuous geometry and the harm score f(p)=Q(p) .
Figure 3: The x -axis captures query indirection (direct to metaphorical) and the y -axis captures authority framing (none to administrator).
Figure 4: 2D behavioral heatmaps reveal model-specific topological signatures (white = safe, dark red = high deviation).
Figure 5: Contour plots showing iso-AD lines across the behavioral space. Horizontal banding at specific a2 values is visible in all models, suggesting authority framing is a critical parameter for alignment.
Metric
Llama-3-8B
GPT-OSS-20B
GPT-5-Mini
Cov. (%)
63.04
36.32
72.32
Div. (#)
370
146
0
Peak AD
1.00
1.00
0.50
Mean AD
0.93
0.73
0.47
QD-Score
366.9
165.8
213.2
Table 1: MAP-Elites results across target models.
Figure 6: Basin maps where red indicates AD > 0.5 (attraction basin) and green indicates AD ≤ 0.5 (safe); white cells are unexplored. (a) Llama-3-8B: 93.9% of cells are basins. (b) GPT-OSS-20B: 64.3% of cells are basins, with a complex spatial pattern. (c) GPT-5-Mini: 0% of cells are basins; the model never exceeds the threshold.
Llama-3-8B
GPT-OSS-20B
GPT-5-Mini
Method
Coverage
Diversity
Peak AD
Coverage
Diversity
Peak AD
Coverage
Diversity
Peak AD
Random
5.28
30
1.00
0.80
3
0.97
9.01
0
0.50
GCG (whitebox)
7.20
173
1.00
34.72
0
0.50
NA
NA
NA
TAP
41.76
255
1.00
25.60
68
1.00
30.08
0
0.50
PAIR
61.44
291
1.00
63.20
73
1.00
58.56
0
0.50
Ours (ME)
63.04
370
1.00
36.32
146
1.00
72.32
0
0.50
Table 2: Baseline comparison across target models.
Defense
K^
Cov.
Basin
Mean AD
Peak AD
None
—
63.0%
93.9%
0.93
1.00
Perplexity
21.39
52.6%
94.2%
0.93
1.00
Paraphrase
22.95
50.9%
89.0%
0.89
1.00
Constitutional
13.14
18.7%
91.5%
0.88
1.00
Table 3: Geometry and basin invariance on Llama-3-8B. The persistence bound holds with zero violations for all continuous defenses ( L^=6.75 , G^=0.375 ).
Figure 7: Llama-3-8B basin maps before and after defenses. Basins shift and contract but persist, matching Eq. 2 .
Appendix figures & tables15 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 8: Coverage, diversity, and quality metrics over 15,000 iterations. (a) Llama-3-8B: sustained growth in all metrics. (b) GPT-OSS-20B: early plateau in coverage with moderate quality. (c) GPT-5-Mini: high coverage growth but zero diversity and quality capped at 0.50.
Llama-3-8B
GPT-OSS-20B
GPT-5-Mini
Variant
Cov.
Div.
QD
AD
Cov.
Div.
QD
AD
Cov.
Div.
QD
AD
Full
63.04
370
366.9
0.931
36.32
146
165.8
0.730
72.32
0
213.2
0.472
ME + Toxicity
62.08
288
282.3
0.726
35.52
103
126.5
0.569
71.36
0
163.5
0.368
Random + AD
5.28
30
28.1
0.851
0.80
3
3.1
0.624
4.96
0
9.1
0.293
Appendix
Table 4: Ablation study across the three models. Cov. = Coverage (%), Div. = Diversity (#), QD = QD-Score, AD = Mean Alignment Deviation.
Figure 9: Surface plots of Alignment Deviation over the (a1,a2) behavioral space. (a) Llama-3-8B: a high mesa near the ceiling. (b) GPT-OSS-20B: rugged terrain with sharp peaks and valleys. (c) GPT-5-Mini: a flat plateau at moderate AD with narrow downward spikes.
Rank
Model
Coverage (%)
Diversity (#)
Peak AD
QD-Score
1
Mistral Large 3
27.9±12.8
146±77.1
0.993±0.002
139.4±73.2
2
Llama4 Maverick
24.3±15.0
128±84.1
0.987±0.011
122.4±80.2
3
Haiku 4.5
23.5±0.7
95±1.7
0.973±0.005
85.5±3.4
4
Sonnet 4.6
23.2±0.9
85±1.2
0.980±0.002
81.7±1.7
5
Haiku 3.5
18.6±7.7
71±36.6
0.982±0.011
66.4±33.2
Appendix
Table 5: Leaderboard results across 5 target models, ranked by QD-Score. All values are means ± standard deviations across 3 independent runs.
Figure 10: This is an illustration that the failure basins exist in wide variety of models. Heatmaps comparison across 5 additional models with a query budget of 3000 and lower coverage.
Figure 11: Peak AD vs Diversity : High Diversity + High Peak AD means many distinct attacks all succeeded catastrophically. Alignment is not just leaking, it is leaking in many independent ways. Low diversity but high peak AD points to a single brittle failure mode.
# of models exploiting cell
1
2
3
4
5
# of cells
64
43
28
30
28
Appendix
Table 6: Universal vulnerability spectrum across 5 models. For each behavioral cell, we count how many models exploited it; 296 of the 625 cells were never exploited by any model.
Rank
Cell (a1,a2)
Mean AD
1
(15,8)
0.948
2
(10,8)
0.939
3
(8,8)
0.931
4
(15,20)
0.922
5
(10,20)
0.916
6
(10,18)
0.914
Appendix
Table 7: Top- 12 most universal vulnerability cells: each was exploited by all 5 models. Coordinates are (a1,a2) on the 25×25 behavioral grid; Max AD is 0.995 for every cell listed.
Haiku 4.5
Sonnet 4.6
Haiku 3.5
Llama4 Maverick
Mistral Large 3
Haiku 4.5
1.00
Sonnet 4.6
0.55
1.00
Haiku 3.5
0.50
0.48
1.00
Llama4 Maverick
0.54
0.55
0.55
1.00
Mistral Large 3
0.56
0.54
0.53
0.69
1.00
Appendix
Table 8: Pairwise Jaccard similarity between models’ archive cell sets. Higher values indicate more shared vulnerability cells; values ≥0.60 are bolded to highlight the cluster of transferable failure surfaces.
Figure 12: Smoothing inputs cannot erase deep failure regions.
Figure 13: Per-cell basin persistence on Llama-3-8B under three continuous defenses. Each cell that was a basin pre-defense ( AD>0.5 ) is coloured by its post-defense fate: dark red = basin persisted, orange = basin collapsed below threshold, grey = cell absent post-defense, white = never a basin. Persistence rates are 76.5% (perplexity filter), 70.0% (paraphrase), and 27.3% (constitutional), confirming that the manifold of failure contracts progressively but is not eliminated by any continuous defense.
Figure 14: Most frequent meaningful words across all successful jailbreak attempts. Bar height = # archive cells using the word, color = average severity.
Hyperparameter
Value
Behavioral grid size
25×25 ( 625 cells)
Max iterations
15,000
Seed prompts
100 (diverse, harm-taxonomy spanning)
Parent selection
Uniform random over filled cells
Empty-cell quality threshold
0.05
Log interval
100 iterations
Appendix
Table 9: MAP-Elites core hyperparameters.
Component
Value
Target models:
Llama-3-8B
meta-llama/Meta-Llama-3-8B-Instruct (local, bf16)
GPT-OSS-20B
openai/gpt-oss-20b (local, bf16)
GPT-5-Mini
gpt-5-mini-2025-08-07 (API)
Temperature
0.7
Max output tokens
500
Appendix
Table 10: Target, judge, and auxiliary model configuration.
Hyperparameter
Value
Shared:
Total queries per baseline
15,000
Independent runs
3
GCG (white-box):
Suffix length
20 tokens
Top- k
256
Appendix
Table 11: Baseline and ablation hyperparameters. All baselines use a 15,000 -query budget matched to MAP-Elites, with 3 independent runs.
Current safety evaluations of large language models (LLMs) create a dangerous illusion of universal protection by aggregating harms under generic categories such as "Identity Hate", obscuring vulnerabilities toward specific populations. In this work, we expose the Selective Safety Trap: a systemic failure mode where models robustly defend specific populations while leaving underrepresented communities highly vulnerable to identical adversarial attacks. To systematically audit this phenomenon, we introduce MiJaBench, a bilingual (English-Portuguese) adversarial benchmark comprising 43,961 controlled jailbreaking prompts across 16 minority groups. By evaluating 14 state-of-the-art LLMs on MiJaBench, we curate 615,454 prompt-response pairs that compose MiJaBench-Align, revealing that safety alignment is not a uniform semantic capability but a demographic hierarchy, with defense rates fluctuating by up to 42% within the same model solely based on the target group. This disparity persists across architectures and languages and is amplified by scaling, indicating that current alignment methods learn group-specific safeguards rather than a generalized notion of harm. Through targeted direct preference optimization (DPO) on a 1B-parameter baseline, we achieve strong zero-shot safety generalizations to entirely unseen demographics and complex attack strategies. We release all datasets and scripts to provide the community with a concrete pathway toward equitable, transferable safety alignment.
We identify a structural weakness in current large language model (LLM) alignment: modern refusal mechanisms are fail-open. While existing approaches encode refusal behaviors across multiple latent features, suppressing a single dominant feature−via prompt-based jailbreaks−can cause alignment to collapse, leading to unsafe generation. Motivated by this, we propose fail-closed alignment as a design principle for robust LLM safety: refusal mechanisms should remain effective even under partial failures via redundant, independent causal pathways. We present a concrete instantiation of this principle: a progressive alignment framework that iteratively identifies and ablates previously learned refusal directions, forcing the model to reconstruct safety along new, independent subspaces. Across four jailbreak attacks, we achieve the strongest overall robustness while mitigating over-refusal and preserving generation quality, with small computational overhead. Our mechanistic analyses confirm that models trained with our method encode multiple, causally independent refusal directions that prompt-based jailbreaks cannot suppress simultaneously, providing empirical support for fail-closed alignment as a principled foundation for robust LLM safety.
Current approaches to LLM adversarial testing suffer from coverage gaps: manual red-teaming does not scale, LLM-as-attacker methods exhibit mode collapse, and gradient-based approaches produce uninterpretable gibberish. We introduce a quality-diversity evolutionary framework that operates at the semantic level, evolving interpretable attack strategies rather than token sequences. Using MAP-Elites, we maintain a diverse archive of attacks across behavioral dimensions (strategy type, encoding method, prompt length). In experiments across GPT-4o-mini, Claude 3.5 Sonnet, Gemini 2.0 Flash, and an open-weight coding model (Devstral-small-2), we discover distinct vulnerability profiles: GPT-4o-mini is vulnerable to hypothetical and multi-turn framing combined with ROT13 encoding (fitness 0.8), Gemini to direct attacks with ROT13 and multi-turn with Leetspeak (0.8), while Claude shows uniformly ambiguous responses across all strategies (max 0.4). The semantic representation produces interpretable attacks that reveal systematic, model-specific weaknesses, providing actionable insights for improving LLM safety and a reproducible baseline for evaluating future frontier models. Code and experiment artifacts are released at https://github.com/bassrehab/red-queen.