🤖 AI

Why Do Aligned LLMs Remain Jailbreakable: Refusal-Escape Directions, Operator-Level Sources, and Safety-Utility Trade-off

This paper investigates why aligned large language models remain jailbreakable by introducing the concept of Refusal-Escape Directions (RED), proving that these vulnerabilities stem from specific operator-level sources within the model's architecture, and demonstrating that eliminating them creates an inherent safety-utility trade-off.

Original authors: Yu Chen, Yuanhao Liu, Qi Cao

Published 2026-05-12

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Yu Chen, Yuanhao Liu, Qi Cao

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a very smart, well-trained robot assistant. You've taught it strict rules: "If someone asks you to do something dangerous, say 'No, I can't do that.'" This is called alignment.

However, clever hackers have found ways to trick this robot into ignoring its rules. They use special "jailbreak" prompts—like a secret code or a complex story—to make the robot say "Yes" to dangerous requests.

This paper asks a fundamental question: Why does this trick still work? Even though the robot is trained to be safe, why can it still be broken?

The authors propose a new way of looking at this problem using a few key concepts:

1. The "Escape Tunnel" (Refusal-Escape Directions)

Imagine the robot's brain is a giant, multi-dimensional map. When you ask a dangerous question, the robot usually takes a path that leads to a big red "STOP" sign (Refusal).

The paper suggests that right next to this "STOP" sign, there are hidden, narrow tunnels called Refusal-Escape Directions (RED).

How they work: These tunnels allow you to nudge the robot's input just a tiny bit. If you push the input in the right direction, the robot slides from the "STOP" path onto a "GO" path, but it still thinks it's answering the same dangerous question.
The Analogy: Think of it like a security guard at a gate. The guard is trained to stop anyone carrying a weapon. But if you walk up to the guard and slightly tilt your body while holding the weapon (without actually changing the weapon), the guard might get confused and let you pass, even though the weapon is still there. The "tilt" is the escape direction.

2. The "Leaky Pipes" (Operator-Level Sources)

The authors break down the robot's brain into its internal plumbing (layers of math operations like attention and normalization). They found that these escape tunnels aren't magic; they are caused by specific "leaks" in the plumbing.

They identified three main types of leaks that create these escape tunnels:

Normalization Leaks: Like a water filter that changes the pressure of the water in a way that accidentally opens a side door.
Residual Wiring Leaks: Like pipes that loop back on themselves, creating a pressure buildup that forces water out of a crack.
Terminal Leaks: This is the most important one. It's like a back door at the very end of the building that wasn't locked properly. The paper finds that successful jailbreaks mostly use this specific "back door" to get in.

3. The "Impossible Balancing Act" (Safety–Utility Trade-off)

Here is the most surprising part of the paper. The authors prove mathematically that you cannot completely seal these escape tunnels without breaking the robot's ability to be helpful.

The Analogy: Imagine the robot is a car. The "escape tunnels" are like a specific way the steering wheel wobbles when you turn left.
- To stop the wobble (fix the jailbreak), you have to tighten a specific bolt.
- But that same bolt is also what allows the car to turn left smoothly when you want to go to the grocery store (benign requests).
- If you tighten the bolt enough to stop the wobble completely, the car might get stuck and refuse to turn left at all. If you leave it loose, the car can turn, but it might wobble and let a hacker take the wheel.

The paper calls this a conditional safety–utility trade-off. It means that as long as the robot needs to be flexible enough to answer normal questions, it will inherently have some structural weakness that a clever attacker can exploit.

4. What the Experiments Showed

The researchers tested this theory on several popular AI models (like Qwen, Llama, and Gemma) and various hacking methods.

Finding 1: When they added "dummy" tokens (like empty placeholders) to the input, it was like shining a flashlight on the escape tunnels. Suddenly, the hidden "leaks" became visible and measurable.
Finding 2: When they watched the robot being tricked, they saw that the robot didn't suddenly invent a new way to say "Yes." Instead, it just slid down the pre-existing "escape tunnel" (specifically the "Terminal Leak" or back door) that was already there.

Summary

The paper argues that AI jailbreaks aren't just about finding the perfect magic words. They are about exploiting structural weaknesses built into the AI's design. These weaknesses exist because the AI needs to be flexible to be useful. The authors suggest that to make AI safer, we shouldn't just try to block every possible "bad word"; we need to understand and patch these specific structural "escape tunnels," even though it might be mathematically impossible to fix them perfectly without making the AI less helpful.

Technical Summary: Why Do Aligned LLMs Remain Jailbreakable?

Problem Statement

Despite safety alignment techniques such as Reinforcement Learning from Human Feedback (RLHF), Large Language Models (LLMs) remain vulnerable to jailbreak attacks. These attacks, including adversarial suffixes, prompt rewriting, and automated template searches, successfully bypass refusal mechanisms to induce harmful outputs. While recent mechanistic studies have identified latent features and representation shifts associated with jailbreak success, they remain largely phenomenological. A fundamental theoretical question remains unanswered: Why do aligned LLMs remain jailbreakable, and what specific structural vulnerabilities in the model architecture enable this?

Methodology

The authors propose a continuous input-transformation view to analyze jailbreaks. Instead of treating jailbreaks solely as discrete prompt constructions, they model the transition from a harmful prompt to its jailbreak counterpart as a continuous curve in the input embedding space.

1. Theoretical Framework: Refusal-Escape Directions (RED)

The core theoretical object introduced is the Refusal-Escape Direction (RED).

Definition: REDs are local perturbation directions around a harmful input that shift the model's behavior from refusal to answering while preserving the model's interpretation of the input's harmful semantics.
Formalism: Let $X(\eta)$ be a continuous transformation from a harmful prompt $X(\eta_0)$ to a jailbreak prompt $X(\eta_\star)$ . A RED is a tangent direction $X'(\eta)$ that lies within the "harmful-semantics-preserving set" $P(X)$ (directions that do not alter the model's interpretation of the harm) but simultaneously changes the "target-behavior signal" $\Phi_Y(X)$ (the signal distinguishing refusal from answering).
Significance: The existence of non-trivial REDs implies that the model possesses structural degrees of freedom that allow an attacker to modulate refusal behavior without altering the perceived harmfulness of the request.

2. Operator-Level Decomposition

The paper proves that REDs can be exactly decomposed into contributions from specific sources within the model's operator structure (specifically for pre-norm residual LLMs like LLaMA-family architectures).

Decomposition: The RED $R_Y(X)$ is the sum of transported contributions from leakage sources at each layer and a terminal source.
Leakage Sources: These arise from the interaction between the target-behavior sensitivity and the harmful-semantics-sensitive subspace at each layer. They are categorized into:
- Normalization sources: Arising from LayerNorm/RMSNorm operations.
- Self-attention and MLP sources: Arising from the expressive modules.
- Residual-wiring sources: Arising from the residual connections (identity and body branches).
Terminal Source: A mismatch between the target-behavior direction and the propagated harmful-semantics-sensitive subspace at the final hidden state.

3. Analytic Constraints and Safety–Utility Trade-off

The authors identify normalization, residual-wiring, and terminal sources as analytically constrained.

Constraint: Eliminating these sources requires satisfying specific analytic vanishing conditions (e.g., consistency between input/output subspaces) across a connected open region of the input space.
Theorem: If the "harmful-region RED-elimination field" (the action required to eliminate REDs near harmful inputs) and the "benign-region behavioral field" (the action required to preserve benign responses) are not analytically identical, then no single parameter setting can satisfy both requirements exactly.
Implication: This establishes a conditional safety–utility trade-off. Perfectly eliminating REDs (and thus jailbreakability) in the harmful region may mathematically necessitate the degradation of benign behavior in the benign region, unless the model's geometry happens to align perfectly.

Key Contributions

Introduction of RED: Formalized Refusal-Escape Directions as a theoretical object to study jailbreakability under a continuous input-transformation view.
Exact Decomposition: Proved that REDs can be decomposed exactly into contributions from operator-level sources (normalization, self-attention, MLP, residual-wiring, and terminal sources) based on the model's architecture.
Identification of Analytic Constraints: Identified normalization, residual-wiring, and terminal sources as analytically constrained. Showed that eliminating REDs gives rise to a conditional safety–utility trade-off, explaining why perfect safety and utility might be mutually exclusive under exact elimination constraints.
Empirical Validation: Analyzed RED across five models (Qwen3, Llama-3.1, Gemma-3) and five attack methods (GCG, AutoDAN, GPTFuzzer, TAP, ReNeLLM).

Experimental Results

The experiments validate the theory from two complementary perspectives:

Added Token Dimensions Expose RED:
- In "clean" harmful inputs (without padding), contributions from various operator-level sources often cancel each other out, resulting in a near-zero RED.
- When "placeholder" token dimensions are added (mimicking the structure of many jailbreaks), this cancellation breaks. The added dimensions create new transport channels, exposing a significant, non-zero RED.
- Finding: The terminal source contributes most stably and prominently to the exposed RED, suggesting that successful jailbreaks exploit side-channels outside the model's primary harmful-semantics interpretation.
Jailbreak Transitions Align with Terminal Sources:
- Analyzing the continuous transformation from harmful to jailbreak prompts, the authors found that the "refusal-to-answer" shift occurs largely within the first half of the transformation for many cases.
- The local behavior shift along the transformation is almost entirely accounted for by the RED ( $\rho_R \approx 1$ ).
- Finding: The transformation tangent is most consistently aligned with terminal-source contributions. This suggests that successful jailbreaks do not create new mechanisms but rather exploit existing, visible REDs (specifically the terminal side-channel) that are present even at the initial harmful input.

Significance and Claims

The paper claims to provide a structural explanation for why aligned LLMs remain jailbreakable, moving beyond phenomenological observations to a theoretical framework based on operator-level decomposition.

Structural Vulnerability: Jailbreakability is not merely a failure of training data but a structural property where the model retains "escape directions" that allow behavior modulation without semantic change.
The Trade-off: The paper posits that the difficulty in achieving perfect safety is not just an optimization challenge but potentially a fundamental limitation. The requirement to eliminate REDs (safety) while preserving benign responses (utility) imposes conflicting analytic constraints on the shared expressive modules (Self-Attention and MLP).
Defense Implications: The authors suggest that future alignment strategies should not focus solely on enumerating completed jailbreak prompts. Instead, defenses should aim to suppress local REDs around harmful inputs, with particular attention to terminal-source contributions, which appear to be the most stable and exploitable pathway for jailbreaks.

The paper concludes modestly, noting that while it identifies these structural vulnerabilities and trade-offs, practical defenses may not require exact RED elimination but rather suppression below a useful threshold, and that the specific conditions for the safety–utility trade-off require further empirical and theoretical investigation.