Derailing Non-Answers via Logit Suppression at Output Subspace Boundaries in RLHF-Aligned Language Models
On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks
Abstract (arXiv)
We introduce a method to reduce refusal rates of large language models (LLMs) on sensitive content without modifying model weights or prompts. Motivated by the observation that refusals in certain models were often preceded by the specific token sequence of a token marking the beginning of the chain-of-thought (CoT) block (<think>) followed by a double newline token (nn), we investigate the impact of two simple formatting adjustments during generation: suppressing nn after <think> and suppressing the end-of-sequence token after the end of the CoT block (</think>). Our method requires no datasets, parameter changes, or training, relying solely on modifying token probabilities during generation. In our experiments with official DeepSeek-R1 distillations, these interventions increased the proportion of substantive answers to sensitive prompts without affecting performance on standard benchmarks. Our findings suggest that refusal behaviors can be circumvented by blocking refusal subspaces at specific points in the generation process.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 5 of its 11 references that are in the map. First posted on arXiv 28 May 2025.
Builds on
5 of 11 references.
References · 5
- 2023Representation Engineering: A Top-Down Approach to AI Transparencycited by 1,336
- 2024Refusal in Language Models Is Mediated by a Single Directioncited by 1,032
- 2022Transformer Feed-Forward Layers Build Predictions by Promoting Concepts in the Vocabulary Spacecited by 532
- 2022Iteratively Prompt Pre-trained Language Models for Chain of Thoughtcited by 75
- 2025R1dacted: Investigating Local Censorship in DeepSeek's R1 Language Modelcited by 7
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2024Refusal Tokens: A Simple Way to Calibrate Refusals in Large Language Models
- 2025RefusalBench: Generative Evaluation of Selective Refusal in Grounded Language Models
- 2026Latent-space Attacks for Refusal Evasion in Language Models
- 2025An Embarrassingly Simple Defense Against LLM Abliteration Attacks
- 2026Abliteration Mitigation via Refusal Aliases
- 2024OR-Bench: An Over-Refusal Benchmark for Large Language Models
- 2025Beyond I'm Sorry, I Can't: Dissecting Large Language Model Refusal
- 2025Understanding Refusal in Language Models with Sparse Autoencoders