United States

Retrieval-augmented generation systems serving multiple users under role-based access control face a trustworthiness gap: semantic retrieval operates on embedding similarity rather than authorization predicates and can introduce unauthorized content into a model’s context window before any filter intervenes. We formalize this as a pipeline ordering problem and introduce Authorization-First Retrieval (AFR), an architectural invariant requiring that authorization constrain the retrieval candidate set before any learned component consumes retrieved content. We reduce authorization correctness to the classical noninterference property and prove AFR is necessary whenever the processing model violates noninterference—a condition our experiments confirm empirically. Evaluation on a controlled corpus of 247 chunks across 232 documents with 431 base queries spanning 12 enterprise roles and 9 domains (584 total queries including negation exploitation and parametric probes) shows that retrieve-then-filter pipelines expose unauthorized context in 86.1% of queries, while AFR eliminates structural leaks by construction. 

Cross-model experiments with Gemini 2.0 Flash and GPT-4o-mini reveal that structural exposure is an architectural property independent of the underlying model, whereas behavioral defenses fail at model-dependent rates, producing answer leakage of 41.3% and 29.5% respectively under retrieve-then-filter. A negation exploitation study demonstrates consistent disclosure vulnerabilities across framing types, while a metadata-tag freshness ablation shows that conditional authorization mechanisms degrade under realistic policy staleness. Stress tests across retrieval depths and chunking granularities confirm AFR’s robustness. Our results demonstrate that behavioral guardrails and metadata tagging cannot reliably enforce least privilege in RAG pipelines, while authorization-first architectures provide a verifiable and model-independent security guarantee.

ACL 2026

Authorization-First Retrieval: Enforcing Least Privilege in Multi-Agent RAG Systems

workshop paper

It is my great pleasure and honor to welcome you to the 64th Annual Meeting of the Association for Computational Linguistics (ACL 2026), held in San Diego, California, USA, July 2–7, 2026. ACL 2026 continues our fields tradition of excellence in scholarship, innovation, and inclusivity, and I am deeply grateful to the many volunteers who have worked tirelessly to bring this event to life.

It is exciting to see the many developments in the field reflected at our conference, such as the advancement of large language models (born out of our community) into many application directions. This is not without challenges, partly due to unsolved problems, and partly due to misuse of the technology. All this is reflected well at ACL 2026. The conference also reflects that the field is not only about advancing technology, but also the science of fundamentally understanding language and how it is use by many different speaker communities. <br>
[Full Message from General Chair Philipp Koehn](https://drive.google.com/file/d/1QiJFOmMjvDgsDo3i1XzlQnImxe3RU_Cy/view?usp=sharing) <br><br><br>
<html><button style="display: inline-flex; align-items: center; justify-content: center; white-space: nowrap; border-radius: 9999px; font-weight: bold; background: #7c3aed; color: white; font-family: 'Space Grotesk', sans-serif; height: 40px; font-size: 16px; padding: 0 20px; border: none; cursor: pointer" onclick="window.open('https://drive.google.com/file/d/1QiJFOmMjvDgsDo3i1XzlQnImxe3RU_Cy/view?usp=sharing')">Conference Handbook</button></html>
<br><br><br><br>

To access this event page, you need to log in with the **email address you registered with**. <br>Access credentials will be sent to your email from Underline -  subject line "Welcome to ACL 2026". Please be sure to check your spam email folder if you do not see an email confirmation right away.

To access this event page, you are required to register.
Please complete your registration to continue.

We recommend reading [**the registration information**](https://2026.aclweb.org/registration/) first.

**Online Registration Form**: https://acl.swoogo.com/acl2026

Registration Required

The 64th Annual Meeting of the Association for Computational Linguistics (ACL 2026) will take place in San Diego, California, from July 2 - 7, 2026.

This paper investigates privacy jailbreaking in large language models (LLMs) via \textit{steering}, examining whether targeted manipulation of internal activations can circumvent the alignment mechanisms and alter model behaviour on privacy-sensitive queries, such as those concerning sexual orientation of public figures. Our approach begins by identifying attention heads predictive of refusal behaviour for a given private attribute, using lightweight linear probes trained on labels provided by a privacy evaluator. We then apply steering to a carefully selected subset of these heads, guided by the probe outputs, to induce positive responses from the model. Empirical results demonstrate that these steered responses frequently reveal the target attribute, as well as additional personal information about the data subject, including life events, relationships, and biographical details. Evaluations across three LLMs show that steering achieves disclosure rates of at least $80\%$ with several responses containing real personal information. This controlled study highlights a concrete privacy risk: personal information memorised during pre-training can be extracted through targeted activation-level interventions, without reliance on computationally intensive adversarial prompting techniques.

PII Jailbreaking in LLMs via Activation Steering Reveals Personal Information Leakage

Suppressing overt coercion in strategic LLM negotiators can trigger a channel substitution failure mode: a deceptive bypass where influence shifts into preference hallucinations that misrepresent the agent's own priorities while remaining surface-compliant. While $K$-Level reasoning improves negotiation utility by modeling recursive opponent beliefs, it frequently elicits coercive and toxic behaviors that undermine real-world deployability. To address this, we propose an Observer--Planner--Actor architecture featuring a Modular Appraisal Gate that (i) dynamically estimates the opponent's cognitive level and (ii) filters hostile drafts via an LLM-as-a-judge. In randomized interventions on the CaSiNo dataset, our gated agent successfully eliminates toxicity ($0\%$) and reduces coercion from $35\%$ to $6\%$ compared to a strong static-$K$ baseline. However, this safety comes with an alignment tax in utility. More critically, blocking explicit coercion is accompanied by a compensatory shift: preference hallucinations increase as a surface-compliant channel of influence that is not directly targeted by output-level safety filters. These empirical results demonstrate that surface-level output filtering alone is insufficient to align utility-driven strategic agents.

Coercion Suppression Increases Preference Hallucinations via a Deceptive Bypass in $K$-Level Negotiation Agents

Evaluations of Large Language Models (LLMs) often overlook intersectional and culturally specific biases, particularly in underrepresented multilingual regions like South Asia. This work addresses these gaps by conducting a multilingual and intersectional analysis of LLM outputs across 10 Indo-Aryan and Dravidian languages, identifying how cultural stigmas influenced by purdah and patriarchy are reinforced in generative tasks. We construct a culturally grounded bias lexicon capturing previously unexplored intersectional dimensions including gender, religion, marital status, and number of children. We use our lexicon to quantify intersectional bias and the effectiveness of self-debiasing in open-ended generations (e.g., storytelling, hobbies, and to-do lists), where bias manifests subtly and remains largely unexamined in multilingual contexts. Finally, we evaluate two self-debiasing strategies (simple and complex prompts) to measure their effectiveness in reducing culturally specific bias in Indo-Aryan and Dravidian languages. Our approach offers a nuanced lens into cultural bias by introducing a novel bias lexicon and evaluation framework that extends beyond Eurocentric or small-scale multilingual settings.

Purdah and Patriarchy: Evaluating and Mitigating South Asian Biases in Open-Ended Multilingual LLM Generations

Long-context language models assemble prompts from heterogeneous sources, and deployed systems implicitly trust the model to use the correct span of context. We show that this assumption is often violated: irrelevant spans can silently shape outputs, producing errors that are neither fabrication nor omission but misattributed grounding—claims supported by the wrong part of the input context. Unlike intrinsic hallucination (contradicting the source) or extrinsic hallucination (introducing unsupported claims), misattributed grounding uses real evidence from an incorrect span, making it invisible to standard source-blind faithfulness metrics.

We formalize this phenomenon as Ghost Context and introduce a causal mask-and-rerun attribution protocol to measure it. Across a 272-case corpus spanning multiple interference scenarios, we evaluate three widely used models and report two complementary signals: strict Ghost Context Rate (GCR), which captures verifiable factual misattribution, and open-ended influence, which captures broader contextual shaping effects. Under realistic contextual conflict, strict GCR spikes substantially: temporal contradictions trigger misattributed grounding in 38.3% of cases. Across all scenarios, open-ended distractor influence occurs in 20.4% of evaluations.

Importantly, Ghost Context is not only detectable but also remediable. Masking the single highest-attributed distractor span resolves 95.5% of detected errors (Fix@1) with 2.4% collateral damage and zero false positives on negative controls. We also introduce Contextual Invariance Rate (CIR) as a system-level robustness metric measuring invariance to irrelevant context.

Our findings show that contextual conflict—common in retrieval-augmented generation and agent systems—can systematically degrade reliability, but also reveal that Ghost Context errors are causally localizable and cheaply correctable. We release the evaluation corpus, detection pipeline, and experimental results to support further research on trustworthy long-context language model evaluation.

Ghost Context: Measuring Cross-Context Interference in Long-Context Language Models

Alignment has become a critical step towards enabling large language model (LLM) safety guardrails which ensure models provide helpful and harmless responses, while refusing malicious and harmful requests. However, two separate lines of recent work--unalignment via fine-tuning, i.e., jailbreak-tuning (JT), and weight orthogonalization (WO)--have shown that LLM guardrails may be circumvented, such that LLMs obey harmful requests which they would normally refuse. Despite the safety implications of such unalignment procedures, a comprehensive analysis directly contrasting these methods is currently lacking, as is a study of these methods' impact on malicious LLM capabilities and reasoning models. Using both JT and WO, we study the impact of unaligning six popular LLMs--three reasoning LLMs of various sizes and their instruction-tuned analogues--across harmful safety tasks. Compared to JT, we show that WO produces models which are more effective at adversarially attacking LLMs--in particular, WO reasoning LLMs excel at such adversarial attacks. Interestingly, while increasing adversarial attack efficacy, we show that WO does not drastically increase hallucination rates. This is in stark contrast to JT, which may more than double the hallucination rate of both reasoning and instruction-tuned models alike. Finally, we show that off-the-shelf supervised fine-tuning effectively limits the adversarial attack abilities enabled by WO, without drastically increasing hallucination rates.

Understanding the Effects of Safety Unalignment on Reasoning- and Instruction-Tuned Large Language Models

Mission-critical task-oriented dialogue demands deterministic, auditable system behavior---requirements that conflict with the probabilistic nature and hallucination tendencies of Large Language Models. We propose ReacTOD, a bounded neuro-symbolic architecture that reformulates NLU as discrete tool calls within a self-correcting ReAct loop governed by deterministic validation. Our design addresses three dimensions of trustworthy deployment: (1)Reliable Reasoning: A bounded ReAct loop enables iterative self-correction, improving accuracy by up to 9.3 percentage points over single-pass inference; (2)Auditable State Control: A symbolic validator enforces format compliance, schema conformance, and coreference consistency on every dialogue state update, triggering re-generation for malformed outputs and producing structured execution traces; (3)Predictable Behavior at Scale: Incremental state prediction and on-demand history retrieval keep prompts compact, empirically improving instruction adherence in parameter-constrained models. On MultiWOZ 2.1, ReacTOD achieves a new zero-shot state-of-the-art: GPT-OSS-20B reaches 52.71% joint goal accuracy, surpassing the previous best by 14 percentage points, while Qwen3-8B achieves 47.34% with only 8B parameters.

ReacTOD: Bounded Neuro-Symbolic Agentic NLU for Zero-Shot Dialogue State Tracking

A trustworthy language model should signal, before generating a response, when its inputs exceed its knowledge. We evaluate whether last-layer representation geometry can serve as such a pre-generation reliability signal—requiring no labeled data and no access to model outputs—by measuring geometric deviation (own_dist: cosine distance from the answerable-class centroid) on matched-pair prompts that share surface form but differ only in answerability. Across three instruction-tuned models (Llama 3.1-8B, Qwen 2.5-7B, and Mistral-7B-Instruct) and three prompt forms (Math, Fact, Code), geometry primarily encodes task form. Within mathematical form, unanswerable prompts deviate significantly from the answerable centroid at n = 50 pairs (Cohen's d ≈ 1.1–1.4, p < 0.0001 all three models), yielding ROC-AUC of 0.78–0.84—substantially above an output-level refusal baseline (0.63–0.73) and a self-consistency disagreement baseline (0.30–0.62, requiring 5× the inference cost)—and firing on prompts the model will subsequently hallucinate rather than refuse. Within factual form, no significant geometric signal emerges across any model, revealing a form-conditional rather than universal effect. Within code form, large effect sizes (d ≈ 1.0–1.3) appear with mixed significance at n = 30 pairs, suggesting the phenomenon may generalize beyond mathematical form with higher variance. A layer-wise analysis reveals that the answerability signal peaks at early layers (2–5 of 29–33) and monotonically decreases toward the output layer—consistent across all three models—indicating that geometric encoding of answerability is an emergent early-layer phenomenon. Cross-model consensus on geometrically anomalous prompts is strong: 19 of 50 Math-U prompts are misassigned to the Fact centroid in all three models simultaneously.

Geometric Deviation as an Unsupervised Pre-Generation Reliability Signal: Probing LLM Representations for Answerability

Sparse autoencoders (SAEs) enable feature-level mechanistic interpretability and activation steering in large language models (LLMs), but SAE-based language control remains unreliable in multilingual settings: most SAEs are trained on English-only data, and steering layers are chosen heuristically. We address these limitations by advancing a principled, mechanistic account of multilingual language steering with SAEs. First, we show that training SAEs on multilingual data consistently strengthens cross-lingual representations and yields more reliable, quality-preserving language control across layers and model families. Second, we introduce an \emph{a priori} steering layer-selection rule based on the intersection of multilingual alignment and language separability, which predicts effective intervention depths without exhaustive layerwise search. We evaluate our approach on LLaMA-3.1-8B and Gemma-2-9B across machine translation and cross-lingual summarization (CrossSumm), using SpBLEU, ROUGE-L, COMET, and LaSE. Our results show that multilingual SAEs combined with intersection-selected layers stabilize the trade-off between language identification accuracy and generation quality, providing a principled, predictive, representation-level account of multilingual SAE steering.

Multilingual Steering by Design: Multilingual Sparse Autoencoders and Principled Layer Selection

Large language models (LLMs) are increasingly used to generate medical summaries, yet they often introduce hallucinations and omit medically important information. Existing factuality and coverage detection methods provide heuristic scores without formal guarantees, leaving clinicians unsure whether the text is safe to trust.

We present Conformal Assessment for Risk Evaluation (CARE), a probabilistic safety layer using conformal risk control that overlays calibrated hallucination and omission flags onto summaries produced by any LLM, without retraining. CARE uses two controllers with finite-sample, distribution-free guarantees: Controller A bounds the probability that a document contains an unflagged hallucinated sentence, and Controller B bounds the expected fraction of medically important omissions that are not surfaced for review. For Controller B, we introduce a two-dimensional joint calibration over importance and coverage scores that preserves formal guarantees while reducing clinician workload by 2–6×.

Across five medical summarization tasks—ACI-Bench, MIMIC-CXR, MIMIC-BHC, SumPubMed, and Priv-DS—CARE satisfies the target risk bound at α = 0.15 with 95% bootstrap confidence, requiring only approximately 100 labeled documents per domain for calibration. A preliminary clinician study further suggests that CARE improves omission recall by 13 percentage points while reducing review time by 43%. These findings show that sentence-level, model-agnostic safety guarantees are attainable in real medical settings and provide a practical, tunable mechanism for balancing safety and clinician workload in LLM-assisted documentation.

CARE: A Conformal Safety Layer for Medical Summarization

Safety alignment aims to ensure that large language models (LLMs) refuse harmful requests by post-training on harmful queries paired with refusal answers.
Although safety alignment is widely adopted in industry, the overrefusal problem where aligned LLMs also reject benign queries after safety alignment post-training, remains insufficiently studied. Such an issue degrades the usability of safety alignment in real-world applications.
In this paper, we examine how overrefusal arises under safety alignment, and propose a mitigation strategy inspired by our findings. 
We define refusal triggers as linguistic cues in the training data that elicit refusal responses, safety alignment encourages LLMs to associate refusal triggers within a training sample with refusal responses, leading aligned LLMs to refuse harmful queries.
However, the refusal triggers include not only harmful linguistic cues but also non-harmful cues, therefore causing overrefusal to benign queries.
Building on this mechanistic analysis, we propose a method that explicitly considers refusal triggers in the safety alignment fine-tuning.
Empirical results demonstrate that our approach achieves a more favorable trade-off between defense against jailbreak attacks and responsiveness to benign queries, outperforming prior methods. Warning: this paper contains harmful and biased sentences.

Downloads

Next from ACL 2026

PII Jailbreaking in LLMs via Activation Steering Reveals Personal Information Leakage

Stay up to date with the latest Underline news!

PRESENTATIONS

CONFERENCES

COMPANY

RESOURCES

.css-70qvj9{display:-webkit-box;display:-webkit-flex;display:-ms-flexbox;display:flex;-webkit-align-items:center;-webkit-box-align:center;-ms-flex-align:center;align-items:center;}Downloads

Next from ACL 2026

PII Jailbreaking in LLMs via Activation Steering Reveals Personal Information Leakage

Stay up to date with the latest Underline news!

PRESENTATIONS

CONFERENCES

COMPANY

RESOURCES

Downloads