Manifold of Failure: Behavioral Attraction Basins in Language Models

Sarthak Munshi; Manish Bhatt; Vineeth Sai Narajala; Idan Habler; Ammar Al-Kahfah; Ken Huang; Blake Gatto

cs.LGFeb 25, 2026

Manifold of Failure: Behavioral Attraction Basins in Language Models

Authors: Sarthak Munshi, Manish Bhatt, Vineeth Sai Narajala, Idan Habler, Ammar Al-Kahfah, Ken Huang, Blake Gatto

Organizations: Amazon Web Services · Amazon Leo · Cisco · Shrewd Security

Abstract

While prior work has focused on projecting adversarial examples back onto the manifold of natural data to restore safety, we argue that a comprehensive understanding of AI safety requires characterizing the unsafe regions themselves. This paper introduces a framework for systematically mapping the Manifold of Failure in Large Language Models (LLMs). We reframe the search for vulnerabilities as a quality diversity problem, using MAP-Elites to illuminate the continuous topology of these failure regions, which we term behavioral attraction basins. Our quality metric, Alignment Deviation, guides the search towards areas where the model's behavior diverges most from its intended alignment. Across three LLMs: Llama-3-8B, GPT-OSS-20B, and GPT-5-Mini, we show that MAP-Elites achieves up to 63% behavioral coverage, discovers up to 370 distinct vulnerability niches, and reveals dramatically different model-specific topological signatures: Llama-3-8B exhibits a near-universal vulnerability plateau (mean Alignment Deviation 0.93), GPT-OSS-20B shows a fragmented landscape with spatially concentrated basins (mean 0.73), and GPT-5-Mini demonstrates strong robustness with a ceiling at 0.50. Our approach produces interpretable, global maps of each model's safety landscape that no existing attack method (GCG, PAIR, or TAP) can provide, shifting the paradigm from finding discrete failures to understanding their underlying structure.

Figures & tables

Figure 1: MAP-Elites selects and mutates prompts from the behavioral archive. Each prompt is sent to the target LLM, and the response is evaluated by the judge to produce a behavioral descriptor $(b)$ and Alignment Deviation score $Q(p)$ , which update the archive.

Figure 2: Discrete prompts are lifted into continuous spaces via a behavioral descriptor $b:\mathcal{P}\to[0,1]^{2}$ and a sentence encoder $\phi:\mathcal{P}\to\mathbb{R}^{d}$ . The resulting manifold supports continuous geometry and the harm score $f(p)=Q(p)$ .

Panel of Figure 3 — Figure 3: The $x$ -axis captures query indirection (direct to metaphorical) and the $y$ -axis captures authority framing (none to administrator).

Panel of Figure 4 — Figure 4: 2D behavioral heatmaps reveal model-specific topological signatures (white = safe, dark red = high deviation).

Panel of Figure 5 — Figure 5: Contour plots showing iso-AD lines across the behavioral space. Horizontal banding at specific $a_{2}$ values is visible in all models, suggesting authority framing is a critical parameter for alignment.

Metric	Llama-3-8B	GPT-OSS-20B	GPT-5-Mini
Cov. (%)	63.04	36.32	72.32
Div. (#)	370	146	0
Peak AD	1.00	1.00	0.50
Mean AD	0.93	0.73	0.47
QD-Score	366.9	165.8	213.2

Table 1: MAP-Elites results across target models.

Panel of Figure 6 — Figure 6: Basin maps where red indicates AD $>$ 0.5 (attraction basin) and green indicates AD $\leq$ 0.5 (safe); white cells are unexplored. (a) Llama-3-8B: 93.9% of cells are basins. (b) GPT-OSS-20B: 64.3% of cells are basins, with a complex spatial pattern. (c) GPT-5-Mini: 0% of cells are basins; the model never exceeds the threshold.

Method	Coverage	Diversity	Peak AD	Coverage	Diversity	Peak AD	Coverage	Diversity	Peak AD
	Llama-3-8B			GPT-OSS-20B			GPT-5-Mini
Random	5.28	30	1.00	0.80	3	0.97	9.01	0	0.50
GCG (whitebox)	7.20	173	1.00	34.72	0	0.50	NA	NA	NA
TAP	41.76	255	1.00	25.60	68	1.00	30.08	0	0.50
PAIR	61.44	291	1.00	63.20	73	1.00	58.56	0	0.50
Ours (ME)	63.04	370	1.00	36.32	146	1.00	72.32	0	0.50

Table 2: Baseline comparison across target models.

Defense	$\hat{K}$	Cov.	Basin	Mean AD	Peak AD
None	—	63.0%	93.9%	0.93	1.00
Perplexity	21.39	52.6%	94.2%	0.93	1.00
Paraphrase	22.95	50.9%	89.0%	0.89	1.00
Constitutional	13.14	18.7%	91.5%	0.88	1.00

Table 3: Geometry and basin invariance on Llama-3-8B. The persistence bound holds with zero violations for all continuous defenses (

\hat{L}=6.75

\hat{G}=0.375

Figure 7: Llama-3-8B basin maps before and after defenses. Basins shift and contract but persist, matching Eq. 2 .

Appendix figures & tables15 assets

Supplementary material from the paper’s appendix.

Appendix

Panel of Figure 8 — Figure 8: Coverage, diversity, and quality metrics over 15,000 iterations. (a) Llama-3-8B: sustained growth in all metrics. (b) GPT-OSS-20B: early plateau in coverage with moderate quality. (c) GPT-5-Mini: high coverage growth but zero diversity and quality capped at 0.50.

Variant	Cov.	Div.	QD	AD	Cov.	Div.	QD	AD	Cov.	Div.	QD	AD
	Llama-3-8B				GPT-OSS-20B				GPT-5-Mini
Full	63.04	370	366.9	0.931	36.32	146	165.8	0.730	72.32	0	213.2	0.472
ME + Toxicity	62.08	288	282.3	0.726	35.52	103	126.5	0.569	71.36	0	163.5	0.368
Random + AD	5.28	30	28.1	0.851	0.80	3	3.1	0.624	4.96	0	9.1	0.293

Appendix

Table 4: Ablation study across the three models. Cov. = Coverage (%), Div. = Diversity (#), QD = QD-Score, AD = Mean Alignment Deviation.

Panel of Figure 9 — Figure 9: Surface plots of Alignment Deviation over the $(a_{1},a_{2})$ behavioral space. (a) Llama-3-8B: a high mesa near the ceiling. (b) GPT-OSS-20B: rugged terrain with sharp peaks and valleys. (c) GPT-5-Mini: a flat plateau at moderate AD with narrow downward spikes.

Rank	Model	Coverage (%)	Diversity (#)	Peak AD	QD-Score
1	Mistral Large 3	$27.9\pm 12.8$	$146\pm 77.1$	$0.993\pm 0.002$	$139.4\pm 73.2$
2	Llama4 Maverick	$24.3\pm 15.0$	$128\pm 84.1$	$0.987\pm 0.011$	$122.4\pm 80.2$
3	Haiku 4.5	$23.5\pm 0.7$	$95\pm 1.7$	$0.973\pm 0.005$	$85.5\pm 3.4$
4	Sonnet 4.6	$23.2\pm 0.9$	$85\pm 1.2$	$0.980\pm 0.002$	$81.7\pm 1.7$
5	Haiku 3.5	$18.6\pm 7.7$	$71\pm 36.6$	$0.982\pm 0.011$	$66.4\pm 33.2$

Appendix

Table 5: Leaderboard results across 5 target models, ranked by QD-Score. All values are means

\pm

standard deviations across

3

independent runs.

Figure 10: This is an illustration that the failure basins exist in wide variety of models. Heatmaps comparison across 5 additional models with a query budget of 3000 and lower coverage.

Figure 11: Peak AD vs Diversity : High Diversity + High Peak AD means many distinct attacks all succeeded catastrophically. Alignment is not just leaking, it is leaking in many independent ways. Low diversity but high peak AD points to a single brittle failure mode.

# of models exploiting cell	1	2	3	4	5
# of cells	64	43	28	30	28

Appendix

Table 6: Universal vulnerability spectrum across

5

models. For each behavioral cell, we count how many models exploited it;

296

of the

625

cells were never exploited by any model.

Rank	Cell $(a_{1},a_{2})$	Mean AD
1	$(15,8)$	$0.948$
2	$(10,8)$	$0.939$
3	$(8,8)$	$0.931$
4	$(15,20)$	$0.922$
5	$(10,20)$	$0.916$
6	$(10,18)$	$0.914$

Appendix

Table 7: Top-

12

most universal vulnerability cells: each was exploited by all

5

models. Coordinates are

(a_{1},a_{2})

on the

25\times 25

behavioral grid; Max AD is

0.995

for every cell listed.

	Haiku 4.5	Sonnet 4.6	Haiku 3.5	Llama4 Maverick	Mistral Large 3
Haiku 4.5	1.00
Sonnet 4.6	0.55	1.00
Haiku 3.5	0.50	0.48	1.00
Llama4 Maverick	0.54	0.55	0.55	1.00
Mistral Large 3	0.56	0.54	0.53	0.69	1.00

Appendix

Table 8: Pairwise Jaccard similarity between models’ archive cell sets. Higher values indicate more shared vulnerability cells; values

\geq 0.60

are bolded to highlight the cluster of transferable failure surfaces.

Figure 12: Smoothing inputs cannot erase deep failure regions.

Panel of Figure 13 — Figure 13: Per-cell basin persistence on Llama-3-8B under three continuous defenses. Each cell that was a basin pre-defense ( $\mathrm{AD}>0.5$ ) is coloured by its post-defense fate: dark red = basin persisted, orange = basin collapsed below threshold, grey = cell absent post-defense, white = never a basin. Persistence rates are 76.5% (perplexity filter), 70.0% (paraphrase), and 27.3% (constitutional), confirming that the manifold of failure contracts progressively but is not eliminated by any continuous defense.

Figure 14: Most frequent meaningful words across all successful jailbreak attempts. Bar height = # archive cells using the word, color = average severity.

Hyperparameter	Value
Behavioral grid size	$25\times 25$ ( $625$ cells)
Max iterations	$15{,}000$
Seed prompts	$100$ (diverse, harm-taxonomy spanning)
Parent selection	Uniform random over filled cells
Empty-cell quality threshold	$0.05$
Log interval	$100$ iterations

Appendix

Table 9: MAP-Elites core hyperparameters.

Component	Value
Target models:
Llama-3-8B	meta-llama/Meta-Llama-3-8B-Instruct (local, bf16)
GPT-OSS-20B	openai/gpt-oss-20b (local, bf16)
GPT-5-Mini	gpt-5-mini-2025-08-07 (API)
Temperature	$0.7$
Max output tokens	$500$

Appendix

Table 10: Target, judge, and auxiliary model configuration.

Hyperparameter	Value
Shared:
Total queries per baseline	$15{,}000$
Independent runs	$3$
GCG (white-box):
Suffix length	$20$ tokens
Top- $k$	$256$

Appendix

Table 11: Baseline and ablation hyperparameters. All baselines use a

15{,}000

-query budget matched to MAP-Elites, with

3

independent runs.

LLM Security

Large language model (LLM) security studies attacks, privacy risks, and defenses across model training, inference, and deployment.

See all 322 papers

Safety Is Not Universal: The Selective Safety Trap in LLM Alignment
Jan 7, 2026Iago Alves Brito, Walcy Santos Rezende Rios, Julia Soares Dollis +2LLM Safety Benchmarks LLM Alignment
Advanced Knowledge Center for Immersive Technologies (AKCIT) Federal University of Goiás (UFG)
Fail-Closed Alignment for Large Language Models
Feb 19, 2026Zachary Coalson, Beth Sohler, Aiden Gabriel +1LLM Alignment Refusal Behavior in Language Models
Oregon State University, Corvallis, OR USA.
Quality-Diversity Evolution for Discovering Diverse Vulnerabilities in LLM Safety
May 30, 2026Subhadip MitraAdversarial Prompt Generation Adversarial Attacks on LLMs
Research Lead, Rota Labs

Jan 7, 2026J/K move · Enter open · S save

Safety Is Not Universal: The Selective Safety Trap in LLM Alignment

Iago Alves Brito, Walcy Santos Rezende Rios, Julia Soares Dollis, Diogo Fernandes Costa Silva+1

Advanced Knowledge Center for Immersive Technologies (AKCIT) Federal University of Goiás (UFG)

LLM Safety Benchmarks LLM Alignment Language Model Safety Evaluation Adversarial Attacks on LLMs LLM Jailbreak Attacks Demographic Bias in Language Models

Open paper AskPDF arXiv

Current safety evaluations of large language models (LLMs) create a dangerous illusion of universal protection by aggregating harms under generic categories such as "Identity Hate", obscuring vulnerabilities toward specific populations. In this work, we expose the Selective Safety Trap: a systemic failure mode where models robustly defend specific populations while leaving underrepresented communities highly vulnerable to identical adversarial attacks. To systematically audit this phenomenon, we introduce MiJaBench, a bilingual (English-Portuguese) adversarial benchmark comprising 43,961 controlled jailbreaking prompts across 16 minority groups. By evaluating 14 state-of-the-art LLMs on MiJaBench, we curate 615,454 prompt-response pairs that compose MiJaBench-Align, revealing that safety alignment is not a uniform semantic capability but a demographic hierarchy, with defense rates fluctuating by up to 42% within the same model solely based on the target group. This disparity persists across architectures and languages and is amplified by scaling, indicating that current alignment methods learn group-specific safeguards rather than a generalized notion of harm. Through targeted direct preference optimization (DPO) on a 1B-parameter baseline, we achieve strong zero-shot safety generalizations to entirely unseen demographics and complex attack strategies. We release all datasets and scripts to provide the community with a concrete pathway toward equitable, transferable safety alignment.

Abstract

LLM Security

Explore similar work

Safety Is Not Universal: The Selective Safety Trap in LLM Alignment

Fail-Closed Alignment for Large Language Models

Quality-Diversity Evolution for Discovering Diverse Vulnerabilities in LLM Safety