mlsanityData to 14 Oct 2026

Tracing the Dynamics of Refusal: Exploiting Latent Refusal Trajectories for Robust Jailbreak Detection

arXiv 2605.02958 ↗First posted 2 May 2026cs.CR cs.AI cs.CLcited by 0

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Representation Engineering analyses often characterize refusal using static directions extracted from terminal or pooled representations. We ask whether this view misses how refusal is constructed across layer-token positions. Using causal tracing, we identify a textitRefusal Trajectory: a sparse upstream activation pattern that often persists even when attacks such as GCG suppress terminal refusal signals. Based on this observation, we propose SALO (Sparse Activation Localization Operator), a lightweight white-box detector that operates on raw hidden-state volumes from a selected layer window. Across Qwen, Llama, and Mistral models, SALO improves jailbreak detection on several attack families under a fixed XSTest-calibrated operating point. We further analyze static RepE-style baselines, ROI sensitivity, adaptive GCG attacks, and encoded-input boundary cases, clarifying both the promise and limitations of refusal-trajectory monitoring.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 32 of its 44 references that are in the map. First posted on arXiv 2 May 2026.

Builds on

32 of 44 references.

Closest ancestors · 9

Same direction, newest first

  1. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks2 Apr
  2. 2024GradSafe: Detecting Jailbreak Prompts for LLMs via Safety-Critical Gradient Analysis21 Feb
  3. 2023Bypassing the Safety Training of Open-Source LLMs with Priming Attacks19 Dec
  4. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automatically4 Dec
  5. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  6. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks5 Oct
  7. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models3 Oct
  8. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
  9. 2023Jailbroken: How Does LLM Safety Training Fail?5 Jul

Other references · 23

  1. 2017Attention Is All You Needcited by 60,361
  2. 2022Training language models to follow instructions with human feedbackcited by 15,971
  3. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
  4. 2016SGDR: Stochastic Gradient Descent with Warm Restartscited by 5,045
  5. 2022Locating and Editing Factual Associations in GPTcited by 2,691
  6. 2016Understanding intermediate layers using linear classifier probescited by 1,353
  7. 2023Representation Engineering: A Top-Down Approach to AI Transparencycited by 1,336
  8. 2020RealToxicityPrompts: Evaluating Neural Toxic Degeneration in Language Modelscited by 1,255
  9. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
  10. 2022Interpretability in the Wild: a Circuit for Indirect Object Identification in GPT-2 smallcited by 1,165
  11. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 1,032
  12. 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 722
11 more
  1. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 651
  2. 2023XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Modelscited by 505
  3. 2024Mechanistic Interpretability for AI Safety -- A Reviewcited by 422
  4. 2024Improving Alignment and Robustness with Circuit Breakerscited by 322
  5. 2013Direct and Indirect Effectscited by 280
  6. 2024PKU-SafeRLHF: Towards Multi-Level Safety Alignment for LLMs with Human Preferencecited by 261
  7. 2023ToxicChat: Unveiling Hidden Challenges of Toxicity Detection in Real-World User-AI Conversationcited by 231
  8. 2024A Practical Review of Mechanistic Interpretability for Transformer-Based Language Modelscited by 118
  9. 2025The Geometry of Refusal in Large Language Models: Concept Cones and Representational Independencecited by 115
  10. 2024Language Models Resist Alignment: Evidence From Data Compressioncited by 53
  11. 2025RepIt: Steering Language Models with Concept-Specific Refusal Vectorscited by 12

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026CRaFT: Circuit-Guided Refusal Feature Selection via Cross-Layer Transcoders
  2. 2026Not All Tokens Are Created Equal: Query-Efficient Jailbreak Fuzzing for LLMs
  3. 2026Steering Beyond the Support: Adversarial Training on Unsupervised Jailbroken Activation Simulation
  4. 2026TrajGuard: Streaming Hidden-state Trajectory Detection for Decoding-time Jailbreak Defense
  5. 2026Step-Wise Refusal Dynamics in Autoregressive and Diffusion Language Models
  6. 2026Break the Brake, Not the Wheel: Untargeted Jailbreak via Entropy Maximization
  7. 2026From Concept-Aligned Tokens to Vulnerable Features: Mechanistic Localization of Jailbreaks
  8. 2026Refusal Before Decoding: Detecting and Exploiting Refusal Signals in Intermediate LLM Activations