这篇论文解释了为什么不同的合规示范会以不同方式影响模型，帮你理解LLM的jailbreak机制，不只是实证而是分析原理。
该论文通过混合良性合规示范（无害请求、有用回复）与有害合规示范（有害请求、有用回复），测试了三种关于示范组合如何导致有害合规的假设。在四个模型中，良性示范与有害示范不可互换：良性示范可能减少或增加有害合规，取决于模型。研究发现偏好优化是关键训练阶段，可防止良性示范增加有害合规；示范排序存在强烈的近因偏差；模型在拒绝与上下文学习交互时表现不同。
What Do Safety-Aligned LLMs Learn From Mixed Compliance Demonstrations?
Prior work has shown that in-context demonstrations can jailbreak language models, but it remains unclear how models interpret different types of compliance demonstrations. We study this by mixing benign compliance demonstrations (non-harmful request, helpful response) with harmful compliance demonstrations (harmful request, helpful response) and testing three hypotheses about how demonstration composition drives harmful compliance. Across four models, we find that benign and harmful demonstrations are not interchangeable: benign demonstrations can either reduce or increase harmful compliance depending on the model. We further show that preference optimization is the critical training stage that prevents benign demonstrations from increasing harmful compliance, that demonstration ordering exhibits strong recency bias, and that models differ in how refusal interacts with in-context learning: some adopt demonstrated formatting even when refusing, while others override all in-context signals upon refusal. Taken together, this work moves beyond showing that demonstration-based jailbreaking works to characterizing how it works: what models extract from compliance demonstrations depends on demonstration content, ordering, and training methodology.