United States

Alignment has become a critical step towards enabling large language model (LLM) safety guardrails which ensure models provide helpful and harmless responses, while refusing malicious and harmful requests. However, two separate lines of recent work--unalignment via fine-tuning, i.e., jailbreak-tuning (JT), and weight orthogonalization (WO)--have shown that LLM guardrails may be circumvented, such that LLMs obey harmful requests which they would normally refuse. Despite the safety implications of such unalignment procedures, a comprehensive analysis directly contrasting these methods is currently lacking, as is a study of these methods&#39; impact on malicious LLM capabilities and reasoning models. Using both JT and WO, we study the impact of unaligning six popular LLMs--three reasoning LLMs of various sizes and their instruction-tuned analogues--across harmful safety tasks. Compared to JT, we show that WO produces models which are more effective at adversarially attacking LLMs--in particular, WO reasoning LLMs excel at such adversarial attacks. Interestingly, while increasing adversarial attack efficacy, we show that WO does not drastically increase hallucination rates. This is in stark contrast to JT, which may more than double the hallucination rate of both reasoning and instruction-tuned models alike. Finally, we show that off-the-shelf supervised fine-tuning effectively limits the adversarial attack abilities enabled by WO, without drastically increasing hallucination rates.

ACL 2026

Understanding the Effects of Safety Unalignment on Reasoning- and Instruction-Tuned Large Language Models

weight orthogonalization

unalignment

jailbreak-tuning

llms

safety

large language models

## Welcome to 2024 Annual Conference of the North American Chapter of the Association for Computational Linguistics!
This year, the conference is in Mexico City. NAACL was actually already planned for Mexico City in 2021, but due to the pandemic the entire conference was moved online. This year, finally, we get to go! So it is my sincere pleasure to welcome you to Mexico City, whether in person or virtually. Having the conference in Mexico City is a good opportunity to emphasize that NAACL is our flagship conference for ACL members not only in North America but also in Central and South America, even though NAACL has been bearing “North” in its name. At this year’s conference, we have a theme to match, with a theme track on the Languages of Latin America to showcase the linguistic diversity of the region.
 
The opportunity to present at NAACL should not depend on a researcher’s travel budget, or their family status. This is why it is so important to make virtual participation at NAACL as good an experience as possible – but we want to also provide a good experience for in-person participants. As a community, we are still working out the best way to do that. This year at NAACL, we are trying out a big virtual poster session ahead of the conference, with the hope that this will make make for a lively and interactive experience. At the same time, we are reducing virtual oral presentations, which seem to be particularly tricky to make to work well. A big thanks to the NAACL program chairs and to Luciana Benotti for all their ideas and work to improve the virtual experience. And participants, virtual as well as in-person: Please let us know what worked for you and what didn’t, so we can continue to improve hybrid conferences. 
 
I have been lucky to work with many amazing people. Without their insight, dedication and patience, and without the many hours of work they put in, NAACL would not have been possible. A huge thank you to the program chairs Helena Gomez, Kevin Duh, and Steve Bethard – you are the best! 
 
Finally, I would like to thank all authors, invited speakers and panelists, area chairs and reviewers, the volunteers organizing and chairing sessions, and all attendees, in-person and virtual. Thank you for helping us make NAACL 2024 come to life. 
 
Welcome and hope you all enjoy the conference! 
Katrin Erk 
The University of Texas at Austin 
NAACL-2024 General Chair 
*You can read the full Welcome message in the [Conference Handbook (downloadable)](https://drive.google.com/file/d/1H1NvW0VASQjkSCYgw3mr-3l4yYDSxz6B/view?usp=sharing)*

To access the event page you need to register [**here.**](http://acl.swoogo.com/naacl2024) 
Your access to the event page is limited based on your registration type. If you registered for workshops only, you will gain access to full workshops content on the day of the workshops program.

Please register!

NAACL 2024

2024 Annual Conference of the North American Chapter of the Association for Computational Linguistics

Alignment has become a critical step towards enabling large language model (LLM) safety guardrails which ensure models provide helpful and harmless responses, while refusing malicious and harmful requests. However, two separate lines of recent work--unalignment via fine-tuning, i.e., jailbreak-tuning (JT), and weight orthogonalization (WO)--have shown that LLM guardrails may be circumvented, such that LLMs obey harmful requests which they would normally refuse. Despite the safety implications of such unalignment procedures, a comprehensive analysis directly contrasting these methods is currently lacking, as is a study of these methods' impact on malicious LLM capabilities and reasoning models. Using both JT and WO, we study the impact of unaligning six popular LLMs--three reasoning LLMs of various sizes and their instruction-tuned analogues--across harmful safety tasks. Compared to JT, we show that WO produces models which are more effective at adversarially attacking LLMs--in particular, WO reasoning LLMs excel at such adversarial attacks. Interestingly, while increasing adversarial attack efficacy, we show that WO does not drastically increase hallucination rates. This is in stark contrast to JT, which may more than double the hallucination rate of both reasoning and instruction-tuned models alike. Finally, we show that off-the-shelf supervised fine-tuning effectively limits the adversarial attack abilities enabled by WO, without drastically increasing hallucination rates.

workshop paper

It is my great pleasure and honor to welcome you to the 64th Annual Meeting of the Association for Computational Linguistics (ACL 2026), held in San Diego, California, USA, July 2–7, 2026. ACL 2026 continues our fields tradition of excellence in scholarship, innovation, and inclusivity, and I am deeply grateful to the many volunteers who have worked tirelessly to bring this event to life.

It is exciting to see the many developments in the field reflected at our conference, such as the advancement of large language models (born out of our community) into many application directions. This is not without challenges, partly due to unsolved problems, and partly due to misuse of the technology. All this is reflected well at ACL 2026. The conference also reflects that the field is not only about advancing technology, but also the science of fundamentally understanding language and how it is use by many different speaker communities. 
[Full Message from General Chair Philipp Koehn](https://drive.google.com/file/d/1QiJFOmMjvDgsDo3i1XzlQnImxe3RU_Cy/view?usp=sharing) 
<html><button style="display: inline-flex; align-items: center; justify-content: center; white-space: nowrap; border-radius: 9999px; font-weight: bold; background: #7c3aed; color: white; font-family: 'Space Grotesk', sans-serif; height: 40px; font-size: 16px; padding: 0 20px; border: none; cursor: pointer" onclick="window.open('https://drive.google.com/file/d/1QiJFOmMjvDgsDo3i1XzlQnImxe3RU_Cy/view?usp=sharing')">Conference Handbook</button></html>

To access this event page, you need to log in with the **email address you registered with**. Access credentials will be sent to your email from Underline - subject line "Welcome to ACL 2026". Please be sure to check your spam email folder if you do not see an email confirmation right away.

To access this event page, you are required to register.
Please complete your registration to continue.

We recommend reading [**the registration information**](https://2026.aclweb.org/registration/) first.

**Online Registration Form**: https://acl.swoogo.com/acl2026

Registration Required

The 64th Annual Meeting of the Association for Computational Linguistics (ACL 2026) will take place in San Diego, California, from July 2 - 7, 2026.

Mission-critical task-oriented dialogue demands deterministic, auditable system behavior---requirements that conflict with the probabilistic nature and hallucination tendencies of Large Language Models. We propose ReacTOD, a bounded neuro-symbolic architecture that reformulates NLU as discrete tool calls within a self-correcting ReAct loop governed by deterministic validation. Our design addresses three dimensions of trustworthy deployment: (1)Reliable Reasoning: A bounded ReAct loop enables iterative self-correction, improving accuracy by up to 9.3 percentage points over single-pass inference; (2)Auditable State Control: A symbolic validator enforces format compliance, schema conformance, and coreference consistency on every dialogue state update, triggering re-generation for malformed outputs and producing structured execution traces; (3)Predictable Behavior at Scale: Incremental state prediction and on-demand history retrieval keep prompts compact, empirically improving instruction adherence in parameter-constrained models. On MultiWOZ 2.1, ReacTOD achieves a new zero-shot state-of-the-art: GPT-OSS-20B reaches 52.71% joint goal accuracy, surpassing the previous best by 14 percentage points, while Qwen3-8B achieves 47.34% with only 8B parameters.

ReacTOD: Bounded Neuro-Symbolic Agentic NLU for Zero-Shot Dialogue State Tracking

A trustworthy language model should signal, before generating a response, when its inputs exceed its knowledge. We evaluate whether last-layer representation geometry can serve as such a pre-generation reliability signal—requiring no labeled data and no access to model outputs—by measuring geometric deviation (own_dist: cosine distance from the answerable-class centroid) on matched-pair prompts that share surface form but differ only in answerability. Across three instruction-tuned models (Llama 3.1-8B, Qwen 2.5-7B, and Mistral-7B-Instruct) and three prompt forms (Math, Fact, Code), geometry primarily encodes task form. Within mathematical form, unanswerable prompts deviate significantly from the answerable centroid at n = 50 pairs (Cohen's d ≈ 1.1–1.4, p < 0.0001 all three models), yielding ROC-AUC of 0.78–0.84—substantially above an output-level refusal baseline (0.63–0.73) and a self-consistency disagreement baseline (0.30–0.62, requiring 5× the inference cost)—and firing on prompts the model will subsequently hallucinate rather than refuse. Within factual form, no significant geometric signal emerges across any model, revealing a form-conditional rather than universal effect. Within code form, large effect sizes (d ≈ 1.0–1.3) appear with mixed significance at n = 30 pairs, suggesting the phenomenon may generalize beyond mathematical form with higher variance. A layer-wise analysis reveals that the answerability signal peaks at early layers (2–5 of 29–33) and monotonically decreases toward the output layer—consistent across all three models—indicating that geometric encoding of answerability is an emergent early-layer phenomenon. Cross-model consensus on geometrically anomalous prompts is strong: 19 of 50 Math-U prompts are misassigned to the Fact centroid in all three models simultaneously.

Geometric Deviation as an Unsupervised Pre-Generation Reliability Signal: Probing LLM Representations for Answerability

Sparse autoencoders (SAEs) enable feature-level mechanistic interpretability and activation steering in large language models (LLMs), but SAE-based language control remains unreliable in multilingual settings: most SAEs are trained on English-only data, and steering layers are chosen heuristically. We address these limitations by advancing a principled, mechanistic account of multilingual language steering with SAEs. First, we show that training SAEs on multilingual data consistently strengthens cross-lingual representations and yields more reliable, quality-preserving language control across layers and model families. Second, we introduce an \emph{a priori} steering layer-selection rule based on the intersection of multilingual alignment and language separability, which predicts effective intervention depths without exhaustive layerwise search. We evaluate our approach on LLaMA-3.1-8B and Gemma-2-9B across machine translation and cross-lingual summarization (CrossSumm), using SpBLEU, ROUGE-L, COMET, and LaSE. Our results show that multilingual SAEs combined with intersection-selected layers stabilize the trade-off between language identification accuracy and generation quality, providing a principled, predictive, representation-level account of multilingual SAE steering.

Multilingual Steering by Design: Multilingual Sparse Autoencoders and Principled Layer Selection

Large language models (LLMs) are increasingly used to generate medical summaries, yet they often introduce hallucinations and omit medically important information. Existing factuality and coverage detection methods provide heuristic scores without formal guarantees, leaving clinicians unsure whether the text is safe to trust.

We present Conformal Assessment for Risk Evaluation (CARE), a probabilistic safety layer using conformal risk control that overlays calibrated hallucination and omission flags onto summaries produced by any LLM, without retraining. CARE uses two controllers with finite-sample, distribution-free guarantees: Controller A bounds the probability that a document contains an unflagged hallucinated sentence, and Controller B bounds the expected fraction of medically important omissions that are not surfaced for review. For Controller B, we introduce a two-dimensional joint calibration over importance and coverage scores that preserves formal guarantees while reducing clinician workload by 2–6×.

Across five medical summarization tasks—ACI-Bench, MIMIC-CXR, MIMIC-BHC, SumPubMed, and Priv-DS—CARE satisfies the target risk bound at α = 0.15 with 95% bootstrap confidence, requiring only approximately 100 labeled documents per domain for calibration. A preliminary clinician study further suggests that CARE improves omission recall by 13 percentage points while reducing review time by 43%. These findings show that sentence-level, model-agnostic safety guarantees are attainable in real medical settings and provide a practical, tunable mechanism for balancing safety and clinician workload in LLM-assisted documentation.

CARE: A Conformal Safety Layer for Medical Summarization

Safety alignment aims to ensure that large language models (LLMs) refuse harmful requests by post-training on harmful queries paired with refusal answers.
Although safety alignment is widely adopted in industry, the overrefusal problem where aligned LLMs also reject benign queries after safety alignment post-training, remains insufficiently studied. Such an issue degrades the usability of safety alignment in real-world applications.
In this paper, we examine how overrefusal arises under safety alignment, and propose a mitigation strategy inspired by our findings. 
We define refusal triggers as linguistic cues in the training data that elicit refusal responses, safety alignment encourages LLMs to associate refusal triggers within a training sample with refusal responses, leading aligned LLMs to refuse harmful queries.
However, the refusal triggers include not only harmful linguistic cues but also non-harmful cues, therefore causing overrefusal to benign queries.
Building on this mechanistic analysis, we propose a method that explicitly considers refusal triggers in the safety alignment fine-tuning.
Empirical results demonstrate that our approach achieves a more favorable trade-off between defense against jailbreak attacks and responsiveness to benign queries, outperforming prior methods. Warning: this paper contains harmful and biased sentences.

Deactivating Refusal Triggers: Understanding and Mitigating Overrefusal in Safety Alignment

Abstractive summarization using large language models (LLMs) has become an essential tool for condensing information. Despite their ability to generate fluent summaries, these models often produce texts that are unfaithful to the original documents, manifested through hallucinations of specific words, phrases, or concepts. Current approaches to mitigating unfaithfulness typically involve post-processing corrections or contrastive learning from synthetically generated negative samples, which do not fully address the spectrum of errors that can arise in LLM-generated summaries. In this paper, we introduce a novel approach to fine-tune LLMs specifically to reduce the occurrence of unfaithful spans of text in generated summaries. We first annotate span-level hallucinations in LLM-generated summaries using automatic labeling with GPT-4. We then fine-tune the LLM using both summaries with no hallucinations and spans of hallucinated text to improve the faithfulness of the model. This paper introduces a dataset labeled to distinguish between faithful and unfaithful content and compare the performance of three techniques: gradient ascent, unlikelihood training, and task vector negation. Our experimental results show that unlikelihood training can effectively use span-level annotations to enhance summary faithfulness, reducing the number of summaries with hallucinations from 31% to 13%, a reduction of 58% on the CNN summarization dataset and from 33% to 20%, a reduction of 39% on the SAMSum dataset.

Improving the Faithfulness of LLM-based Abstractive Summarization with Span-level Unlikelihood Training

While Large Language Models (LLMs) have shown significant advancements in performance, various jailbreak attacks have posed growing safety and ethical risks. Malicious users often exploit adversarial context to deceive LLMs, prompting them to generate responses to harmful queries. In this study, we propose a new defense mechanism called Context Filtering, an input pre-processing method designed to filter out untrustworthy and unreliable context while identifying the primary prompts containing the real user intent to uncover concealed malicious intent. Given that enhancing the safety of LLMs often compromises their helpfulness, potentially affecting the experience of benign users, our method aims to improve the safety of the LLMs while preserving their original performance. We evaluate the effectiveness of our model in defending against jailbreak attacks through comparative analysis, comparing our approach with state-of-the-art defense mechanisms against six different attacks and assessing the helpfulness of LLMs under these defenses. Our model demonstrates its ability to reduce the Attack Success Rates of jailbreak attacks by up to 92% while maintaining the original LLMs' performance, achieving state-of-the-art Safety and Helpfulness balance. Notably, Context Filtering is a plug-and-play method that can be applied to all LLMs, including both white-box and black-box models, to enhance their safety without requiring any fine-tuning of the models themselves.

Context Misleads LLMs: The Role of Context Filtering in Maintaining Safe Alignment of LLMs

Multi-agent systems (MAS) are now fulfilling a broader social responsibility by serving as socio-collaborative companions, providing emotional support, facilitating collective problem-solving, and mediating peer interactions for people facing social isolation and loneliness. However, for these systems to earn and sustain user trust, the language they generate must be trustworthy: agents must maintain consistent, believable identities and coordinate in ways that mirror the organic synergy of real-world friend support groups, rather than producing generic or sycophantic responses. Current systems fall short on both counts, suffering from persona collapse, where agents revert to homogenized assistant behaviors, eroding user confidence and social sycophancy, which creates echo chambers instead of the constructive, multi-perspective dialogue that socially responsible companions demand. We propose MASCOT, a framework for trustworthy socio-collaborative conversation through a bi-level optimization strategy: 1) Persona-Aware Behavioral Alignment, an RLAIF-driven pipeline that enforces strict persona fidelity so each agent maintains a stable, predictable identity that users can rely on; and 2) Collaborative Dialogue Optimization, a meta-policy that learns group-level turn-taking dynamics by selecting the next speaker to best replicate the natural synergy of peer support groups where diverse viewpoints surface organically. Extensive evaluations across psychological support and workplace domains show that MASCOT significantly outperforms baselines, achieving up to +14.1 in Persona Consistency and +10.6 in Social Contribution, demonstrating that socially responsible multi-agent design and trustworthy language generation are both achievable and mutually reinforcing.

(This paper is a cross-submission. We are submitting this work to the TrustNLP @ ACL 2026 Workshop under the non-archival track.)

MASCOT: Towards Trustworthy Multi-Agent Socio-Collaborative Companion Systems

Most jailbreak methods achieve high attack success rates (ASR) but require attacker LLMs to craft adversarial queries and/or demand high query budgets. These resource limitations make jailbreaking expensive, and the queries generated by attacker LLMs often consist of non-interpretable random prefixes. This paper introduces Lexical Anchor Tree Search (LATS), addressing these limitations through an attacker-LLM-free method that operates purely via lexical anchor injection. LATS reformulates jailbreaking as a breadth-first tree search over multi-turn dialogues, where each node incrementally injects missing content words from the attack goal into benign prompts. Evaluations on AdvBench and HarmBench demonstrate that LATS achieves 97-100\% ASR on latest GPT, Claude, and Llama models with an average of only $\sim$6.4 queries, compared to 20+ queries required by other methods. These results highlight conversational structure as a potent and under-protected attack surface, while demonstrating superior query efficiency in an era where high ASR is readily achievable. Our code will be released to support reproducibility.

Multi-Turn Jailbreaking of Aligned LLMs via Lexical Anchor Tree Search

This paper investigates how large language models internally process nonliteral language. Analyzing five categories spanning slang, metaphor, and idioms across all 48 layers of Gemma-3-12B-IT with Gemma Scope 2 sparse autoencoders, we find a lexical familiarity gradient: processing depth depends on available prior lexical knowledge, not figurative type. Idioms diverge at L1 as entrenched units; expressions built from familiar words (metaphors, semantic-shift and constructional slang) converge at L7–9; neologisms peak at L41, activating 3× more unique features. Paraphrase-residual analysis confirms strong signals only at the gradient endpoints, yielding a three-tier hierarchy of entrenched retrieval, known-word reanalysis, and novel-word construction. We additionally identify an activation density confound in SAE feature counts that produces spurious cross-condition convergence. Overall, processing depth is better predicted by lexical familiarity than by figurative type, with implications for robustness to non-standard language and for SAE-based interpretability.

Downloads

Next from ACL 2026

ReacTOD: Bounded Neuro-Symbolic Agentic NLU for Zero-Shot Dialogue State Tracking

Similar lecture

Stealthy and Persistent Unalignment on Large Language Models via Backdoor Injections

.css-70qvj9{display:-webkit-box;display:-webkit-flex;display:-ms-flexbox;display:flex;-webkit-align-items:center;-webkit-box-align:center;-ms-flex-align:center;align-items:center;}Downloads

Next from ACL 2026

ReacTOD: Bounded Neuro-Symbolic Agentic NLU for Zero-Shot Dialogue State Tracking

Similar lecture

Stealthy and Persistent Unalignment on Large Language Models via Backdoor Injections

Downloads