# Latent Fusion Jailbreak: Blending Harmful and Harmless Representations to Elicit Unsafe LLM Outputs

arXiv: https://arxiv.org/abs/2508.10029 · HTML: https://mlsanity.com/paper/2508.10029/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation.
- First posted on arXiv 8 Aug 2025.

## Placed in

- LLM alignment / RLHF / preference optimisation / [Safety alignment and jailbreak attacks](https://mlsanity.com/alignment/safety-alignment-and-jailbreak-attacks/)
- LLM safety and security / [Jailbreaking](https://mlsanity.com/safety/jailbreaking/)

## Built on by (most cited first, 6 of 6)

- [The Latent Space: Foundation, Evolution, Mechanism, Ability, and Outlook](https://mlsanity.com/paper/2604.02029/) (2026)
- [MCP-Guard: A Multi-Stage Defense-in-Depth Framework for Securing Model Context Protocol in Agentic AI](https://mlsanity.com/paper/2508.10991/) (2025)
- [Text is All You Need for Vision-Language Model Jailbreaking](https://mlsanity.com/paper/2602.00420/) (2026)
- [HGMF: A Hierarchical Gaussian Mixture Framework for Scalable Tool Invocation within the Model Context Protocol](https://mlsanity.com/paper/2508.07602/) (2025)
- [Silencing the Guardrails: Inference-Time Jailbreaking via Dynamic Contextual Representation Ablation](https://mlsanity.com/paper/2604.07835/) (2026)
- [Jailbreaking Open-Weight LLMs via Random Embedding Perturbations](https://mlsanity.com/paper/2610.07125/) (2026)

## Abstract (arXiv)

Safety-aligned large language models can still be manipulated through white-box interventions that modify their internal representations. We introduce Latent Fusion Jailbreak (LFJ), which works by pairing a harmful query with a structurally similar but benign counterpart, then interpolating their hidden states at carefully selected layers and token positions. Refusal-loss gradients determine exactly where to intervene, and we optimise layer-wise mixing coefficients using token-normalised compliance and refusal-suppression objectives. The edited prompt states propagate sequentially through the remaining transformer blocks. Across four safety benchmarks and five open-weight target models, LFJ reaches a macro-averaged attack success rate (ASR) of 94.13% under the white-box protocol we describe. Because LFJ directly accesses internal states, comparisons with prompt-only attacks serve as a descriptive reference rather than a matched evaluation. Dropping rejection sampling lowers ASR to 86.72%, whereas replacing the structured harmful-benign pairing with random pairing causes it to fall to 27.45%. We also design an LFJ-specific latent adversarial training procedure that, when the attack is re-optimised against the defended model, reduces ASR from 94.13% to 12.37%. This defence evaluation does not cover transfer to other attack types or preservation of benign utility.