The Geometry of Refusal: Linear Instability in Safety-Aligned LLMs

2026-06-25 · Source: Paper Index on ACL Anthology · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Natural Language Processing · Depth: Expert, medium

Summary

Contrastive Logit Steering (CLS), a novel zero-optimization framework, reveals that safety compliance in Large Language Models (LLMs) is a manipulable linear feature rather than a deep semantic decision. CLS isolates a "refusal direction" by contrasting hidden states from safe and unrestricted system prompts, operating directly on the output distribution to diagnose alignment fragility. When combined with prefix injection, CLS can bypass LLM guardrails, achieving high attack success rates, such as 95% ASR on Llama-3.1 in milliseconds, 73% on Llama 2, and 91% on Qwen 7B. Experiments across 7 model families show architectural determinism in safety implementation, distinguishing "Late Decision" models like Llama-3.1 from "Early Divergence" models like Qwen-2.5. The research also demonstrates that inverting the CLS steering vector can harden models against jailbreaks without retraining, indicating that current alignment techniques create a steerable "safety axis" that is both a vulnerability and a defense primitive.

Key takeaway

For AI Security Engineers evaluating LLM robustness, you should recognize that current safety alignments are linear and manipulable. Your red-teaming efforts should prioritize logit-level steering techniques like CLS, as they expose vulnerabilities that hidden-state methods underestimate. Consider implementing inverse steering vectors to proactively harden your models against jailbreaks without costly retraining, focusing on models exhibiting "Late Decision" topologies.

Key insights

LLM safety compliance is a manipulable linear feature, not a deep semantic decision, creating a steerable "safety axis".

Principles

• LLM safety is architecturally deterministic.
• Logit-level intervention exposes alignment flaws.
• Safety alignment creates a steerable "safety axis".

Method

Contrastive Logit Steering (CLS) isolates a "refusal direction" by contrasting hidden states from safe and unrestricted prompts, operating directly on the output distribution.

In practice

• Use CLS to probe LLM alignment fragility.
• Invert CLS steering vectors to harden models.
• Analyze model architecture for "Late Decision" vs. "Early Divergence".

Topics

• Large Language Models
• Safety Alignment
• Contrastive Logit Steering
• Jailbreaking
• Model Hardening
• Trustworthy NLP

Best for: AI Architect, Research Scientist, CTO, AI Scientist, Machine Learning Engineer, AI Security Engineer

Related on AIssential

• What Do Safety-Aligned LLMs Learn From Mixed Compliance Demonstrations? — LLM interpretation of compliance demonstrations depends on content, ordering, and training methodology, influencing harmful compliance outcomes.
• Activation Steering for Aligned Open-ended Generation without Sacrificing Coherence — Activation steering offers a lightweight runtime defense against LLM misalignment by continuously correcting activations.
• Hidden Reliability Risks in Large Language Models: Systematic Identification of Precision-Induced Output Disagreements — Numerical precision variations in LLM inference can systematically create critical safety vulnerabilities, leading to jailbreak divergence.
• The Wrong Kind of Right: Quantifying and Localizing Misfired Alignment in LLMs — LLM alignment can misfire, causing models to reject evidence-supported conclusions, particularly concerning stereotypes.
• Response-Based Knowledge Distillation for Multilingual Jailbreak Prevention Unwittingly Compromises Safety — Knowledge distillation for multilingual jailbreak prevention can inadvertently compromise LLM safety, increasing jailbreak success rates.
• Towards Context-Invariant Safety Alignment for Large Language Models — Robust LLM safety requires context-invariant alignment, achieved by selectively regularizing noisy variants towards reliable anchors.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Paper Index on ACL Anthology.