Get Started
Home
Topics
Search
Library
Research questionCan intermediate LLM activations guide faster jailbreak search without weakening attack effectiveness?Refusal behavior may be represented in transformer activations before the model produces its output. The difficulty is using that signal to reduce the cost of prompt search without losing the effectiveness of the resulting attacks.
AI
Alignment & Safety
Evaluation & Benchmarks
Inference Optimization
Mechanistic Interpretability
Neural and Evolutionary Computing
Latest papersRecent research connected to this question, newest first.Refusal Before Decoding: Detecting and Exploiting Refusal Signals in Intermediate LLM ActivationsThe evidence covers linear probes on residual-stream activations at transformer blocks and probe-guided AutoDAN-style genetic prompt search across the evaluated models. Reported results include competitive attack success, up to 72% lower per-iteration search time, and comparable or improved cross-model transfer in several configurations; probe guidance was more useful at larger model scales. The evidence is limited to the models and configurations evaluated.research paper · Sep 3, 2026
Related questions
How can black-box LLMs resist jailbreaks without weight access or retraining while preserving benign-query utility?Why does relocating a continuation-triggered suffix bypass aligned LLM safety defenses?How should LLM safety be assessed when jailbreak vulnerability varies by language and persuasive phrasing?How can LLM trajectory evaluations distinguish genuine prefix value and early outcome information from compute and difficulty confounds?