We identify a structural weakness in current large language model (LLM) alignment: modern refusal mechanisms are fail-open. While existing approaches encode refusal behaviors across multiple latent features, suppressing a single dominant feature$-$via prompt-based jailbreaks$-$can cause alignment to collapse, leading to unsafe generation. Motivated by this, we propose fail-closed alignment as a design principle for robust LLM safety: refusal mechanisms should remain effective even under partial failures via redundant, independent causal pathways. We present a concrete instantiation of this principle: a progressive alignment framework that iteratively identifies and ablates previously learned refusal directions, forcing the model to reconstruct safety along new, independent subspaces. Across four jailbreak attacks, we achieve the strongest overall robustness while mitigating over-refusal and preserving generation quality, with small computational overhead. Our mechanistic analyses confirm that models trained with our method encode multiple, causally independent refusal directions that prompt-based jailbreaks cannot suppress simultaneously, providing empirical support for fail-closed alignment as a principled foundation for robust LLM safety.

翻译：我们识别出当前大型语言模型（LLM）对齐中存在一个结构性缺陷：现代拒绝机制属于故障开放型。虽然现有方法将拒绝行为编码在多个潜在特征中，但通过基于提示的越狱手段抑制单个主导特征——可能导致对齐机制崩溃，从而引发不安全内容生成。受此启发，我们提出将故障闭锁对齐作为鲁棒LLM安全性的设计原则：拒绝机制应通过冗余且独立的因果路径，在部分故障情况下仍保持有效性。我们提出了该原则的具体实现方案：一种渐进式对齐框架，通过迭代识别并消融先前习得的拒绝方向，迫使模型沿着新的独立子空间重建安全机制。在四种越狱攻击测试中，我们的方法以较小的计算开销实现了最强的整体鲁棒性，同时缓解了过度拒绝问题并保持了生成质量。我们的机制分析证实，采用本方法训练的模型编码了多个因果独立的拒绝方向，基于提示的越狱攻击无法同时抑制这些方向，这为故障闭锁对齐作为鲁棒LLM安全性的原则性基础提供了实证支持。