Super happy to share that my first first-author paper was accepted at the NeurIPS 2026 FLMSec workshop in Paris! Depth-based early-exit methods let an LLM stop partway through its layers and generate an answer early to save compute. We asked whether any of those exits are any more robust to jailbreaks than the full model. We used Balcony’s frozen-backbone design, which adds lightweight exit modules at intermediate layers while leaving the original model unchanged. Because every exit shares the same weights, we could attack each exit independently, optimizing a separate adversarial suffix for each one, and measure the effect of depth alone. The two models we tested behaved very differently. For LLaMA3-8B, early exits were substantially more robust: attack success at the earliest exit we tested (layer 15) was only 4%, compared with 28% on the full model. For LLaMA2-7B the gap was much smaller. At the same depth it was already roughly as breakable as the full model (36% vs 44%). We also found that deeper exits were easier to optimize against, and that the adversarial suffixes didn’t systematically degrade utility at any depth. So exiting early helped on both models, but how much depends heavily on the backbone. Huge thanks to Seyedhamidreza Mousavi for collaborating on this! Paper: arxiv.org/abs/2610.15207 Code: github.com/LassNajmuldeen/ba… #NeurIPS #LLMs #AISafety #Jailbreaking