Ellipsoid Control: A White-List Jailbreak Defense via Benign Latent Modeling
Summary
Representation engineering (RepE, a technique that modifies how an AI model processes information internally) defenses against jailbreaks (methods that trick LLMs into ignoring safety rules) have relied on block-list approaches that learn from known harmful examples, but this leaves gaps against new attacks. The paper proposes Ellipsoid Control, a white-list defense that instead protects the model's normal, harmless behavior by using test-time defense (constraints applied when the model runs) with projected gradient descent (a mathematical technique that adjusts the model's internal state while keeping it close to safe boundaries) to trigger refusals on harmful inputs while preserving the model's ability to answer legitimate questions.
Solution / Mitigation
The source explicitly describes Ellipsoid Control as the mitigation: it 'performs projected gradient descent that can elicit refusal on arbitrary inputs' while 'an anisotropic benign-geometry ellipsoid is fitted from abundant benign data to constrain the update to minimize distortion of the benign latent geometry.' This is deployed as a test-time defense mechanism that operates when the model is in use, using safe training examples to define boundaries that preserve normal model behavior during safety enforcement.
Classification
Related Issues
Original source: http://ieeexplore.ieee.org/document/11579269
First tracked: July 30, 2026 at 08:04 PM
Classified by LLM (prompt v3) · confidence: 92%