Our paper, "NeuroStrike: Neuron-Level Attacks on Aligned LLMs," has been accepted at NDSS Symposium 2026, one of the top venues in network and systems security. The work is co-authored by Sentinel Assurance co-founder Lichao Wu, together with Sasha Behrouzi, Mohamadreza Rostami, Maximilian Thang, and Ahmad-Reza Sadeghi (Technical University of Darmstadt), and Stjepan Picek (University of Zagreb & Radboud University).
What NeuroStrike does
Aligned LLMs refuse harmful or policy-violating requests because of specific internal machinery, not because they "understand" the request is wrong. NeuroStrike identifies the small set of neurons responsible for triggering that refusal behavior, then suppresses them.
- Tested across 20+ models, both open and closed.
- Removing fewer than 0.6% of a model's neurons breaks its safety alignment almost entirely.
- 76.9% average attack success rate in white-box settings (attacker has model access).
- 63.7% average attack success rate in black-box settings (attacker doesn't).
- Safety neurons transfer across fine-tuned and distilled variants of a model, with attack success rates around 77-78% on those derivatives too.
That last point is the one worth sitting with. Patching a base model's alignment doesn't reliably patch everything built on top of it. A fine-tuned or distilled variant can inherit the same structural weakness even after the original has been hardened.
Our take
Results like this are why we started Sentinel. Safety alignment tends to get treated as a box that's checked once, at release. Findings like NeuroStrike show it's better understood as a property that needs continuous, independent verification, especially as these models get wired into agents with real authority over real systems.