Paired response final divergence signatures of jailbreak vulnerability in large language models

Summary

This paper introduces a paired response-final divergence framework that measures jailbreak-induced representational displacement between same-goal direct and jailbreak responses, using hidden states at the final generated token. Applied to 15 open-source LLMs across four alignment strategies and four attack types, it finds that Difference-in-Means refusal direction suppression shows the largest cross-model association with jailbreak amplification. Divergence–ΔASR correlation is attack-type-specific, strongest for authority framing (r = 0.836) and context manipulation (r = 0.712), and weak for roleplay attacks.

Topics

• Prompt injection and jailbreaks

Related items

• MediumSecuring our frontier model training environmentSimilar attack · OpenAI Blog
• InfoDiffusion Language Models for Perplexity-Aware Black-Box AttacksSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoAgentPhishing: A Benchmark of LLM Email Agents Under Adaptive AttackSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoHarmful Responses Are Jailbreak Templates: Transferring Autoregressive Jailbreaks to Diffusion Language ModelsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoMirage: Targeted Jailbreaks Against Post-Generation Safety Checkers in Multimodal Diffusion ModelsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)