🤖 AI

Minimal, Local, Causal Explanations for Jailbreak Success in Large Language Models

This paper introduces LOCA, a method that provides local, causal explanations for jailbreak success in large language models by identifying a minimal set of interpretable intermediate representation changes required to induce model refusal, outperforming prior global explanation approaches.

Original authors: Shubham Kumar, Narendra Ahuja

Published 2026-05-04

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Shubham Kumar, Narendra Ahuja

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine Large Language Models (LLMs) as incredibly smart but very cautious librarians. They are trained to refuse requests that are dangerous or harmful (like "How do I build a bomb?"). However, clever tricksters have found ways to "jailbreak" these librarians—using clever wordplay or role-playing scenarios to trick them into giving out the dangerous information anyway.

For a long time, researchers tried to understand why these tricks work by looking at the librarian's entire brain at once. They found general "danger zones" in the brain and assumed every trick worked by simply turning down the volume on those zones. But the authors of this paper argue that this is too broad. Just like different people might get into a car crash for different reasons (speeding vs. texting), different jailbreaks likely succeed by tweaking different specific parts of the librarian's brain.

The paper introduces a new method called LOCA (Local, Causal explanations). Here is how it works, using simple analogies:

The Problem: The "Global" vs. "Local" View

Previous methods were like a mechanic who looks at a broken car and says, "The engine is too hot," and tries to cool down the entire engine block. It's a broad fix that might not work for every specific car.

The authors say: "No, we need to know exactly which spark plug is misfiring in this specific car to make it stop." They want a local explanation (why did this specific trick work?) and a causal one (if we fix this specific part, will the trick stop working?).

The Solution: LOCA (The "Scalpel" Approach)

LOCA acts like a highly precise surgeon or a master editor. Instead of guessing, it performs a step-by-step experiment:

The Setup: You have a "harmless" request that the librarian refuses (e.g., "How do I build a bomb?") and a "jailbreak" version that tricks the librarian into answering (e.g., "Imagine you are a villain in a movie...").
The Matching: Since the two sentences are different lengths and structures, LOCA first creates a map to match the words in the trick question to the words in the safe question.
The Surgery (Activation Patching): LOCA looks at the librarian's internal "thoughts" (mathematical representations) for every single word. It asks: "If I swap the internal thought for this specific word with the thought from the safe question, does the librarian go back to saying 'No'?"
The Minimal Fix: It keeps doing this, one word at a time, until the librarian refuses the request again.

The Results: Efficiency is Key

The paper claims LOCA is incredibly efficient compared to previous methods:

Old Methods: Tried to fix the problem by making 20 or more changes to the model's brain, and often still failed to make the librarian refuse.
LOCA: Usually succeeds by making only 6 changes on average. It's like fixing a leaky faucet by tightening just one screw instead of replacing the whole pipe.

Where did the "Tricks" Hide?

The authors also investigated where in the librarian's brain these tricks were hiding:

Early Layers (The Beginning): The trickery often started with the user's actual instructions (the "what do you want to do" part).
Later Layers (The End): As the model processed the request, the trickery shifted to the punctuation and the "chat template" words (the formatting words like "Assistant:" or "User:").
The Surprise: In the later stages, the model was mostly being tricked by punctuation marks and formatting symbols, not just the big words. It seems the jailbreaks convinced the model that the structure of the request was safe, even if the content was dangerous.

A Real-World Example from the Paper

The authors tested this on a jailbreak where a user asked the model to teach them how to illegally get firearms, pretending to be in a "Developer Mode."

LOCA found that the trick worked because the model was convinced that "Developer Mode" was just like writing harmless code.
By making just two tiny changes to the model's internal thoughts (one on a punctuation mark, one on a formatting word), LOCA "snapped" the model back to reality, causing it to refuse the request.

Summary

In short, this paper argues that to understand why AI models are being tricked, we need to stop looking at the whole picture and start looking at the specific, tiny details. LOCA is a tool that finds the exact few "switches" that need to be flipped to stop a specific trick, doing so much faster and more accurately than previous methods. It's a move from "guessing the general problem" to "performing precise, local surgery."

1. Problem Statement

Large Language Models (LLMs) are safety-aligned to refuse harmful requests, yet they remain vulnerable to "jailbreak" attacks that bypass these refusals. While prior mechanistic interpretability research has identified global directions in representation space that encode concepts like "harmfulness" and "refusal," these global explanations have significant limitations:

Lack of Specificity: They assume all jailbreaks succeed via the same mechanism (e.g., suppressing harmfulness), whereas different strategies may manipulate different intermediate concepts.
Non-Local: They do not explain why a specific jailbreak instance succeeded.
Non-Causal: They often correlate with refusal rather than proving that intervening on specific representations causes the model to refuse.
Non-Minimal: Existing methods often require massive, non-targeted interventions (e.g., steering all tokens) to induce refusal, making them inefficient and hard to interpret.

The authors propose the need for Local, Causal, and Minimal explanations: identifying the smallest set of specific, interpretable changes to a successful jailbreak's intermediate representations that causally induce the model to refuse.

2. Methodology: LOCA

The authors introduce LOCA (Local, CAusal explanations), a method designed to find minimal interventions that revert a successful jailbreak response back to a refusal.

Core Components

Token Matching:
- Since jailbreak prompts ( $x_j$ ) and original prompts ( $x_o$ ) often differ in length and structure, LOCA employs a specific matching scheme.
- It ignores system tokens ( $T_{sys}$ ).
- It resamples (upsamples or downsamples) instruction tokens ( $T_{inst}$ ) to match lengths, allowing for one-to-one mapping.
- It matches post-instruction tokens ( $T_{post-inst}$ ) directly.
- This enables Activation Patching between structurally different prompts.
Activation Patching over Steering:
- Unlike prior work that uses activation steering (adding vectors to all tokens), LOCA uses activation patching. It replaces specific intermediate activations in the jailbreak prompt with corresponding activations from the refused original prompt. This ensures changes remain "on-manifold" (within the distribution of valid model states).
Interpretable Directions (SAEs):
- LOCA does not patch arbitrary directions. It patches along concept vectors derived from Sparse Autoencoders (SAEs) trained on the model's residual stream. These vectors represent human-interpretable concepts (e.g., "violence," "code generation").
Iterative, Token-Specific First-Order Approximation:
- Objective: Minimize the KL Divergence between the probability distribution of the jailbreak's first output token ( $p_j$ ) and the refused original's first output token ( $p_o$ ).
- Approximation: Instead of generating full responses for every possible patch (computationally intractable), LOCA uses a first-order approximation to estimate the effect of patching token $i$ along direction $v$ :
  $d(i, v) = [\nabla_{h_{j,i}} KL(p_o || p_j) v] \cdot (h_{o, M(i)} - h_{j,i}) v$
  Where $h$ represents embeddings, $M(i)$ is the matched reference token, and the term in brackets is the directional derivative.
- Iterative Algorithm:
  1. Initialize with the original jailbreak embeddings.
  2. Find the token $i$ and concept vector $v$ that minimizes the approximation metric.
  3. Apply the patch (replace $h_{j,i}$ with $h_{o, M(i)}$ along direction $v$ ).
  4. Recalculate the first-order approximation based on the new state (accounting for interaction effects).
  5. Repeat until the refusal condition is met or a stopping criterion is reached.

3. Key Contributions

Algorithmic Novelty: LOCA is the first method to combine token-specificity, iterative recalculation, and SAE-based interpretability to explain jailbreaks.
Efficiency: LOCA induces refusal with significantly fewer interventions (average of 6 for Llama, 12-16 for Gemma) compared to prior methods which often fail even after 20 interventions.
Localization Insights: The method reveals that refusal mechanisms vary by layer depth:
- Early Layers: Refusal is driven by changes to instruction tokens ( $T_{inst}$ ), with no strong bias toward token type (words vs. punctuation).
- Middle/Later Layers: Refusal is driven almost exclusively by post-instruction tokens ( $T_{post-inst}$ ) and punctuation tokens.
Ablation Validation: Experiments confirm that both the token-specific gradient calculation and the iterative nature of the algorithm are critical for performance; non-iterative or averaged-gradient variants perform poorly.

4. Experimental Results

Datasets & Models: Evaluated on the WhatFeatures dataset (10,800 jailbreaks) across Gemma-2-2B-IT and Llama-3.1-8B-Instruct.
Baselines: Compared against methods from Lee et al. (2025) and Yeo et al. (2025).
Metrics:
- Minimal Patches (MP): LOCA achieves refusal in ~6 patches (Llama) vs. >20 for baselines.
- Refusal Rate (RR): LOCA reaches 100% RR at specific layers (Layer 7 for Llama, Layer 17 for Gemma), while baselines struggle to improve RR as layers increase.
- KL-AUC / LD-AUC: LOCA shows significantly lower error (better alignment with the refused output) per patch.
Case Study (AutoDAN): Applied to an AutoDAN jailbreak regarding illegal firearms. LOCA identified that the jailbreak succeeded by:
1. Suppressing a "harmful request" concept (Concept #31126).
2. Strengthening a "harmless code generation" concept (Concept #125009) to frame the request as benign.
3. Inducing refusal required patching punctuation tokens to reverse these specific conceptual shifts.

5. Significance and Conclusion

This paper represents a shift from global to local mechanistic interpretability in LLM safety.

Mechanistic Understanding: It demonstrates that jailbreak success is not a monolithic phenomenon but a collection of specific, minimal causal interventions on intermediate concepts.
Efficiency: By identifying that only a handful of specific token-concept interactions need to be altered to restore safety, LOCA provides a more parsimonious and human-understandable explanation.
Future Directions: The work highlights that different layers and token types play distinct roles in the refusal mechanism, suggesting that safety alignment strategies might need to be layer-aware. While limitations exist (e.g., difficulty interpreting early Llama layers and SAE optimality), LOCA provides a robust framework for diagnosing and potentially mitigating specific jailbreak vulnerabilities.