A plethora of jailbreaking attacks have been proposed to obtain harmful responses from safety-tuned LLMs. These methods largely succeed in coercing the target output in their original settings, but their attacks vary substantially in fluency and computational effort. In this work, we propose a unified threat model for the principled comparison of these methods. Our threat model checks if a given jailbreak is likely to occur in the distribution of text. For this, we build an N-gram language model on 1T tokens, which, unlike model-based perplexity, allows for an LLM-agnostic, nonparametric, and inherently interpretable evaluation. We adapt popular attacks to this threat model, and, for the first time, benchmark these attacks on equal footing with it. After an extensive comparison, we find attack success rates against safety-tuned modern models to be lower than previously presented and that attacks based on discrete optimization significantly outperform recent LLM-based attacks. Being inherently interpretable, our threat model allows for a comprehensive analysis and comparison of jailbreak attacks. We find that effective attacks exploit and abuse infrequent bigrams, either selecting the ones absent from real-world text or rare ones, e.g., specific to Reddit or code datasets.

Learning representations that generalize to novel compositions of known concepts is crucial for bridging the gap between human and machine perception. One prominent effort is learning object-centric representations, which are widely conjectured to enable compositional generalization. Yet, it remains unclear when this conjecture will be true, as a principled theoretical or empirical understanding of compositional generalization is lacking. In this work, we investigate when compositional generalization is guaranteed for object-centric representations through the lens of identifiability theory. We show that autoencoders that satisfy structural assumptions on the decoder and enforce encoder-decoder consistency will learn object-centric representations that provably generalize compositionally. We validate our theoretical result and highlight the practical relevance of our assumptions through experiments on synthetic image data.

The sinoatrial node (SAN), the primary pacemaker of the heart, is responsible for the initiation and robust regulation of sinus rhythm. 3D mapping studies of the ex-vivo human heart suggested that the robust regulation of sinus rhythm relies on specialized fibrotically-insulated pacemaker compartments (head, center and tail) with heterogeneous expressions of key ion channels and receptors. They also revealed up to five sinoatrial conduction pathways (SACPs), which electrically connect the SAN with neighboring right atrium (RA). To elucidate the role of these structural-molecular factors in the functional robustness of human SAN, we developed comprehensive biophysical computer models of the SAN based on 3D structural, functional and molecular mapping of ex-vivo human hearts. Our key finding is that the electrical insulation of the SAN except SACPs, the heterogeneous expression of If, INa currents and adenosine A1 receptors (A1R) across SAN pacemaker-conduction compartments are required to experimentally reproduce observed SAN activation patterns and important phenomena such as shifts of the leading pacemaker and preferential SACP. In particular, we found that the insulating border between the SAN and RA, is required for robust SAN function and protection from SAN arrest during adenosine challenge. The heterogeneity in the expression of A1R within the human SAN compartments underlies the direction of pacemaker shift and preferential SACPs in the presence of adenosine. Alterations of INa current and fibrotic remodelling in SACPs can significantly modulate SAN conduction and shift the preferential SACP/exit from SAN. Finally, we show that disease-induced fibrotic remodeling, INa suppression or increased adenosine make the human SAN vulnerable to pacing-induced exit blocks and reentrant arrhythmia. In summary, our computer model recapitulates the structural and functional features of the human SAN and can be a valuable tool for investigating mechanisms of SAN automaticity and conduction as well as SAN arrhythmia mechanisms under different pathophysiological conditions.