mlsanityData to 14 Oct 2026

The Safety Relay in Roleplay Jailbreaks: A Component-Resolved Causal Analysis of Harm Recognition and Refusal

arXiv 2608.30585 ↗First posted 31 Aug 2026cs.LGcited by 0

On the map: LLM safety and security → Safety alignment, refusal and guardrails

Abstract (arXiv)

Large language models are trained to follow instructions while refusing harmful requests. Jailbreaks exploit this balance to elicit content a model would ordinarily reject. Roleplay jailbreaks are especially concerning: ordinary instructions defining a persona, scenario, and task can induce compliance while the harmful request remains plainly visible. We investigate which components drive this reversal and how they affect the computations leading to the response. Across two benchmarks, three model families, and four authored wrappers, we compare matched harmful and benign requests under controlled combinations of these components. We trace internal harmful--benign contrasts at the request and where generation begins, then evaluate selected internal interventions on held-out requests. A focused study examines influential attention heads and feed-forward computations, testing their functions and downstream connections. Our analysis yields three findings. (1) Successful attacks retain the measured harmful--benign distinction at the request, while its refusal-associated expression weakens where the answer begins, a pattern we call safety-relay attenuation. (2) The contributions of roleplay components depend on the other components present. (3) Reversing selected roleplay-associated internal changes restores refusal, demonstrating their causal influence. Together, these findings connect ordinary roleplay instructions to internal changes in refusal and motivate safeguards that preserve the influence of harm-related information on the response.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Safety alignment, refusal and guardrails, one of 12 directions in LLM safety and security. Builds on 15 of its 25 references that are in the map. First posted on arXiv 31 Aug 2026.

Builds on

15 of 25 references.

Closest ancestors · 3

Same direction, newest first

  1. 2025LLMs Encode Harmfulness and Refusal Separately16 Jul
  2. 2025The Geometry of Refusal in Large Language Models: Concept Cones and Representational Independence24 Feb
  3. 2024Refusal in Language Models Is Mediated by a Single Direction17 Jun

Other references · 12

  1. 2022Locating and Editing Factual Associations in GPTcited by 2,691
  2. 2024Gemma 2: Improving Open Language Models at a Practical Sizecited by 1,998
  3. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
  4. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  5. 2023Steering Llama 2 via Contrastive Activation Additioncited by 1,085
  6. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 672
  7. 2023DeepInception: Hypnotize Large Language Model to Be Jailbreakercited by 367
  8. 2023A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easilycited by 259
  9. 2023Scalable and Transferable Black-Box Jailbreaks for Language Models via Persona Modulationcited by 214
  10. 2024Towards Understanding Jailbreak Attacks in LLMs: A Representation Space Analysiscited by 64
  11. 2024What Features in Prompts Jailbreak LLMs? Investigating the Mechanisms Behind Attackscited by 29
  12. 2025Understanding Refusal in Language Models with Sparse Autoencoderscited by 29

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak
  2. 2026Attention Sees, MLP Refuses: Tracing the Attention-to-MLP Safety Pathway in LLMs
  3. 2025Oyster-I: Beyond Refusal -- Constructive Safety Alignment for Responsible Language Models
  4. 2026How Narrative Wrapping Affects LLM Refusal: A Cross-Language Benchmark and Defense
  5. 2026Refuse without Refusal: A Structural Analysis of Safety-Tuning Responses for Reducing False Refusals in Language Models
  6. 2024SORRY-Bench: Systematically Evaluating Large Language Model Safety Refusal
  7. 2026Do Language Models Know When They'll Refuse? Probing Introspective Awareness of Safety Boundaries
  8. 2025The Hidden Dimensions of LLM Alignment: A Multi-Dimensional Analysis of Orthogonal Safety Directions