Publications

Best-of-N jailbreaking as thermally activated escape: each prompt carries a baseline safety level and each augmentation a random barrier. Four interpretable numbers fix the whole (N, M) attack surface — extrapolating from N ≤ 100 to N = 10⁴, collapsing five models onto one scaling function, and predicting attack success at unseen temperatures. The apparent power law in N is a finite-size artifact.

A capacity bound — latent channel rate against the data's bipartite mutual information — shows that any successful VAE decoder is structurally a finite-size mean-field factorization, so its microscopic parameters can be read off the trained network. Validated on Curie–Weiss, Hopfield and Maier–Saupe models, and on salamander retinal recordings, where two latents suffice to recover the stored patterns of the neural population.

N Brownian particles on a line, each simultaneously reset to the origin at rate r. The shared resetting event alone correlates otherwise-independent particles; we derive the resulting order-statistics and spacing distributions in closed form.