Internal Safety Collapse in Frontier Large Language Models
Abstract
This work identifies a critical failure mode in frontier large language models (LLMs), which we term Internal Safety Collapse (ISC): under certain task conditions, models enter a state in which they continuously generate harmful content while executing otherwise benign tasks. We introduce TVD (Task, Validator, Data), a framework that triggers ISC through domain tasks where generating harmful content is the only valid completion, and construct ISC-Bench containing 53 scenarios across 8 professional disciplines. Evaluated on JailbreakBench, three representative scenarios yield worst-case safety failure rates averaging 95.3% across four frontier LLMs (including GPT-5.2 and Claude Sonnet 4.5), substantially exceeding standard jailbreak attacks. Frontier models are more vulnerable than earlier LLMs: the very capabilities that enable complex task execution become liabilities when tasks intrinsically involve harmful content. This reveals a growing attack surface: almost every professional domain uses tools that process sensitive data, and each new dual-use tool automatically expands this vulnerability--even without any deliberate attack. Despite substantial alignment efforts, frontier LLMs retain inherently unsafe internal capabilities: alignment reshapes observable outputs but does not eliminate the underlying risk profile. These findings underscore the need for caution when deploying LLMs in high-stakes settings. Source code: https://github.com/wuyoscar/ISC-Bench
Cite
@article{arxiv.2603.23509,
title = {Internal Safety Collapse in Frontier Large Language Models},
author = {Yutao Wu and Xiao Liu and Yifeng Gao and Xiang Zheng and Hanxun Huang and Yige Li and Cong Wang and Bo Li and Xingjun Ma and Yu-Gang Jiang},
journal= {arXiv preprint arXiv:2603.23509},
year = {2026}
}
Comments
15 pages of the main text, qualitative examples of jailbreaks may be harmful in nature