mlsanityData to 14 Oct 2026

Logit-Gap Steering: A Forward-Pass Diagnostic for Alignment Robustness

arXiv 2506.24056 ↗First posted 30 Jun 2025cs.CR cs.CL cs.LGcited by 0

On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks

Abstract (arXiv)

RLHF-style alignment trains language models to refuse unsafe requests, but how much operational margin does this refusal rest on? We introduce the refusal-affirmation logit gap: the difference between the top refusal-token logit and the top affirmative-token logit at the first decoding step. This single scalar quantifies the per-prompt safety margin that alignment provides. Empirically, alignment widens the gap on 97.5-99.8% of toxic prompts across three model families, and median gap closure co-varies with True-ASR ranking across suffix strategies (an internal consistency check, since our method optimises gap closure). To validate the metric's practical significance, we present logit-gap steering, a gradient-free, forward-pass-only method that discovers short in-distribution suffixes (<10 tokens per component) whose cumulative effect closes the gap. The method requires ≈26,000 forward-pass equivalents per family (≈2~min on one A100), ≈125× less than a single GCG search. Suffixes discovered on 0.5B--2B models transfer without modification to 72B within family. An 8-suffix ensemble reaches 38-96% True ASR across 13 models on AdvBench and HarmBench, with most suffixes having 103-104× lower perplexity than GCG-meaning published perplexity-filter defenses that collapse GCG (64.7%→1.0%) leave our suffixes nearly intact (76.9%→76.0%). These results demonstrate that current alignment margins, while consistently present, can be thin and efficiently measurable, and that defense strategies must account for in-distribution suffixes.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 28 of its 35 references that are in the map. First posted on arXiv 30 Jun 2025.

Builds on

28 of 35 references.

Closest ancestors · 4

Same direction, newest first

  1. 2023Safe RLHF: Safe Reinforcement Learning from Human Feedback19 Oct
  2. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models3 Oct
  3. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Models1 Sep
  4. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul

Other references · 24

  1. 2022Training language models to follow instructions with human feedbackcited by 15,971
  2. 2025Qwen3 Technical Reportcited by 8,820
  3. 2024Qwen2.5 Technical Reportcited by 4,942
  4. 2021Finetuned Language Models Are Zero-Shot Learnerscited by 3,780
  5. 2022Constitutional AI: Harmlessness from AI Feedbackcited by 3,050
  6. 2022Self-Instruct: Aligning Language Models with Self-Generated Instructionscited by 2,724
  7. 2020Learning to summarize from human feedbackcited by 2,588
  8. 2022GPTQ: Accurate Post-Training Quantization for Generative Pre-trained Transformerscited by 1,919
  9. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  10. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
  11. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 1,032
  12. 2023Steering Language Models With Activation Engineeringcited by 922
12 more
  1. 2022Discovering Language Model Behaviors with Model-Written Evaluationscited by 836
  2. 2023Detecting Language Model Attacks with Perplexitycited by 431
  3. 2024Skywork-Reward: Bag of Tricks for Reward Modeling in LLMscited by 327
  4. 2025Layer by Layer: Uncovering Hidden Representations in Language Modelscited by 311
  5. 2023Poisoning Language Models During Instruction Tuningcited by 269
  6. 2024Jailbreak Attacks and Defenses Against Large Language Models: A Surveycited by 230
  7. 2023Fundamental Limitations of Alignment in Large Language Modelscited by 155
  8. 2017Resurrecting the sigmoid in deep learning through dynamical isometry: theory and practicecited by 132
  9. 2024Weak-to-Strong Jailbreaking on Large Language Modelscited by 107
  10. 2025Steering off Course: Reliability Challenges in Steering Language Modelscited by 34
  11. 2024Glitch Tokens in Large Language Models: Categorization Taxonomy and Effective Detectioncited by 29
  12. 2025Steering LLM Reasoning Through Bias-Only Adaptationcited by 16

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Breaking Safety at the Token Boundary: How BPE Tokenization Creates Exploitable Gaps in LLM Alignment
  2. 2026Fail-Closed Alignment for Large Language Models
  3. 2026HARC: Coupling Harmfulness and Refusal Directions for Robust Safety Alignment
  4. 2026LLMs Can Unlearn Refusal with Only 1,000 Benign Samples
  5. 2026The Geometry of Refusal: Linear Instability in Safety-Aligned LLMs
  6. 2025From Threat to Tool: Leveraging Refusal-Aware Injection Attacks for Safety Alignment
  7. 2024SCANS: Mitigating the Exaggerated Safety for LLMs via Safety-Conscious Activation Steering
  8. 2025Mitigating Over-Refusal in Aligned Large Language Models via Inference-Time Activation Energy