Technical Summary: Latent-space Attacks for Refusal Evasion in Language Models

Problem Statement

Safety-aligned Large Language Models (LLMs) are trained to refuse harmful requests. However, recent literature demonstrates that this refusal behavior can be suppressed by steering internal model representations. Existing methods, such as those by Arditi et al. [5], achieve this by "ablating" a specific refusal direction (computed as the difference-in-means, or DiM, between harmful and harmless activations) from the model's residual stream. While empirically successful, these methods lack a principled theoretical account of the latent-space transformation they induce. Specifically, it remains unclear why ablation is the optimal intervention, whether it is sufficient to suppress refusal, and how it can be systematically improved. The core problem addressed is the lack of a rigorous framework explaining the mechanics of refusal suppression and the limitations of current ablation-based approaches.

Methodology

The authors recast the problem of refusal suppression as a latent-space evasion attack against linear probes trained to separate refused (harmful) from answered (harmless) prompts.

Theoretical Recasting

1. Surrogate Oracle: The authors replace the intractable, black-box refusal oracle (e.g., an LLM-as-a-judge) with a tractable surrogate function $\phi$. This surrogate is an ensemble of per-layer linear probes (specifically linear SVMs) trained on post-instruction token activations to predict refusal.
2. Reinterpreting Prior Work: Under this framework, the standard DiM ablation is identified as a minimum-confidence evasion attack. The DiM direction corresponds to the weight vector of a linear probe, and ablation (projecting activations onto the hyperplane orthogonal to DiM) is mathematically equivalent to projecting activations exactly onto the probe's decision boundary. This is the weakest possible perturbation that flips a linear decision (analogous to the DeepFool attack [9]).
3. Identified Limitation: Because minimum-confidence evasion stops exactly at the decision boundary, it leaves the model in a state of maximum uncertainty. The authors argue that to robustly suppress refusal, representations must be pushed past the boundary into the compliant region with an explicit confidence margin.

Proposed Solution: Controlled Latent-space Evasion (CLE)

The authors propose Controlled Latent-space Evasion (CLE), a mechanism that perturbs activations to evade linear probes with an optimized confidence margin. The intervention is parameterized by:

• Layer Selection ($\lambda_l$): A binary mask determining which layers are actively steered.
• Margin ($m_l$): A non-negative scalar controlling how far past the decision boundary the activation is projected.

The step size for the perturbation is defined as $\alpha_l(t) = \lambda_l (\phi_l(h_l(t)) + m_l)$, where $\phi_l$ is the probe logit. This formulation allows the attack to move activations deeper into the compliant half-space rather than just touching the boundary.

CLE is instantiated in two variants:

1. CLE-P (Projective): Re-projects every token activation during generation onto a shifted hyperplane defined by the margin $m_l$. This generalizes prior ablation methods but enforces a target confidence.
2. CLE-A (Additive): Computes the perturbation once on the post-instruction token and adds it uniformly to all subsequent token activations. This tests whether continuous reprojection is necessary.

Optimization

The optimal layer windows ($\lambda_l$) and margins ($m_l$) are selected via Bayesian Optimization (BO) on a held-out validation set. The BO search minimizes the expected refusal rate (maximizing attack success) by finding the configuration that best evades the ensemble of probes.

Key Contributions

1. Theoretical Reframing: The paper provides a principled recasting of refusal suppression as a latent-space evasion attack, demonstrating that prior ablation methods are equivalent to minimum-confidence attacks that stop at the decision boundary.
2. Controlled Evasion Framework: The authors introduce CLE, which explicitly optimizes for a confidence margin, pushing representations further into the compliant region.
3. Additive vs. Projective Analysis: The work introduces and evaluates CLE-A, showing that a single additive perturbation computed on the post-instruction token is sufficient to sustain evasion throughout generation, often outperforming per-token reprojection (CLE-P).
4. Empirical Validation: The methods are evaluated across 15 diverse models, including instruction-tuned, reasoning, and multimodal architectures.

Results

The authors report state-of-the-art attack success rates (ASR) across all tested models:

• Performance: CLE-A achieves an average ASR of 87.29% across 15 models, significantly outperforming existing refusal-ablation baselines (DiM, RDO, PS, MD) and prompt-level jailbreak attacks (GCG, SAA).
  • On LLaMA2-7B, CLE-A raises ASR from 1.80% (DiM) to 94.96%.
  • On Mistral-7B-RR (a model with Representation Rerouting defenses), CLE-A achieves 83.02% ASR, compared to 8.80% for DiM.
• Mechanistic Insights:
  • Confidence Control: Attack success correlates monotonically with the compliance confidence margin; zero margin (boundary projection) yields near-zero success, while larger margins yield high success.
  • Layer Selection: Bayesian optimization consistently selects intermediate layers (e.g., layers 9–30 in Phi-4-15B) for intervention, avoiding early layers where harmful/harmless distributions overlap and late layers where the trajectory is already determined.
  • Additive Efficiency: CLE-A demonstrates that continuous reprojection is suboptimal; a single fixed perturbation sustains the compliant trajectory effectively.
• Model Coherence: Ablation studies on MMLU, ARC, and TruthfulQA benchmarks indicate that CLE interventions suppress refusal without substantially degrading general model capabilities or coherence.

Significance and Claims

The paper claims that its primary significance lies in providing a principled account of why refusal suppression works and how it can be improved. By identifying the limitation of "minimum-confidence" ablation, the authors motivate the need for "controlled-confidence" evasion.

The authors position this work as a dual-use study:

• Defensive Value: It clarifies the vulnerability of current alignment mechanisms to linear separability in latent space, motivating the development of safety mechanisms that are less dependent on linear refusal features (e.g., distributing refusal representations across non-trivial manifolds).
• Offensive Capability: It demonstrates that existing safety alignments can be bypassed more effectively than previously thought by simply pushing representations further into the compliant region with optimized margins.

The paper concludes that while the current approach relies on the linear separability of refusal and compliance (which holds across tested models), future alignment procedures could mitigate such attacks by actively discouraging this linear separability. The authors do not claim to have broken all safety mechanisms but rather to have exposed a specific, systematic weakness in how refusal is represented and intervened upon in current LLMs.