mlsanityData to 7 Oct 2026

Geometric Configurations of Perturbed Jailbreak Prompts

arXiv 2607.20581 ↗First posted 22 Jul 2026cs.CR cs.AIcited by 0

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Perturbation techniques that turn unsuccessful jailbreak prompts into successful ones are continuously evolving, constituting a major security threat to LLM safety. In this paper, we investigate the internal representations of such string-level perturbed jailbreak inputs in the small weight models of the Qwen-2.5-1.5B/-3B/-7B-Instruct and Llama-3.2-1B/-3B/-3.1-8B-Instruct families. We select two representation spaces: the last-layer-last-token embedding space and the top-50 next-token probability space. The former space separates prompts based on their spelling and format, while the latter space is effectively one-dimensional but appears more complex to cluster. Within our refusal-dominated answer set we find no behavioral hyperplane in either space. Only the next token "Sure" in the 1.5B Qwen model, and both tokens "," and ".C.C" in the 1 Llama model, display a significant association with a compliant-labeled answer.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 11 of its 30 references that are in the map. First posted on arXiv 22 Jul 2026.

Builds on

11 of 30 references.

Closest ancestors · 3

Same direction, newest first

  1. 2026Boundary Point Jailbreaking of Black-Box LLMs16 Feb
  2. 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generation10 Oct
  3. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul

Other references · 8

  1. 2024The Llama 3 Herd of Modelscited by 14,192
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  3. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 960
  4. 2018Generating Natural Language Adversarial Examplescited by 422
  5. 2025LLMs Encode Harmfulness and Refusal Separatelycited by 75
  6. 2016A Boundary Tilting Persepective on the Phenomenon of Adversarial Examplescited by 70
  7. 2019Robustness Verification of Support Vector Machinescited by 9
  8. 2026Solving adversarial examples requires solving exponential misalignmentcited by 1

Built on by

Not cited yet.