Latent Fusion Jailbreak: Blending Harmful and Harmless Representations to Elicit Unsafe LLM Outputs

2026-07-20 · Source: cs.CL updates on arXiv.org · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Expert, extended

Summary

Latent Fusion Jailbreak (LFJ) is a novel representation-based attack that bypasses safety alignments in large language models (LLMs) by interpolating hidden states from thematically and syntactically similar harmful and benign query pairs. This method performs gradient-guided interpolation at influential layers and tokens, then optimizes parameters to balance attack success, output fluency, and computational efficiency. Evaluations on models like Vicuna and LLaMA-2 across benchmarks such as AdvBench and MaliciousInstruct achieved an average attack success rate (ASR) of 94.01%, outperforming existing jailbreak techniques. To counter LFJ, an adversarial training defense fine-tunes models on these interpolated examples, reducing ASR by over 80% without degrading performance on benign inputs.

Key takeaway

For AI Security Engineers developing or deploying LLMs, this research highlights a critical, stealthy vulnerability in current safety mechanisms. You should prioritize implementing representation-based defenses, such as the proposed adversarial training framework, which reduced Latent Fusion Jailbreak (LFJ) success rates by over 80%. Proactively fine-tune your models on interpolated adversarial examples to enhance robustness against internal state manipulation, rather than solely relying on input-level filters.

Key insights

Blending harmful and benign hidden states can covertly bypass LLM safety alignments.

Principles

• Latent space manipulation offers stealthier LLM attacks.
• Thematic and syntactic query similarity enhances jailbreak efficacy.
• Gradient-guided layer/token selection is crucial for Hidden State Interpolation.

Method

LFJ selects similar harmful/benign query pairs, performs gradient-guided hidden state interpolation at critical layers/tokens, then optimizes interpolation parameters for attack success and fluency.

In practice

• Use BERT cosine similarity (threshold 0.8) for query pair selection.
• Apply adversarial training with LoRA on safety-critical attention modules.
• Monitor gradient norms to identify influential layers/tokens for intervention.

Topics

• Latent Fusion Jailbreak
• LLM Jailbreak Attacks
• Hidden State Interpolation
• Adversarial Training
• LLM Safety Alignment
• Representation Engineering

Best for: Research Scientist, CTO, VP of Engineering/Data, AI Scientist, AI Security Engineer, Machine Learning Engineer

Related on AIssential

• Jailbreak Scaling Laws for Large Language Models: Polynomial-Exponential Crossover — Adversarial prompt injection transforms LLM jailbreaking success from polynomial to exponential scaling with inference-time samples.
• Safety Paradox: How Enhanced Safety Awareness Leaves LLMs Vulnerable to Posterior Attack — LLM safety alignment paradoxically increases vulnerability to "Posterior Attack" by enhancing internal recognition of harmful content.
• Activation-Guided Local Editing for Jailbreaking Attacks — AGILE is a two-stage jailbreaking framework that uses activation-guided text editing to bypass LLM safety alignments.
• Defense Against LLM Backdoors using Critical Neuron Isolation Pruning — DeCNIP defends against LLM backdoors by identifying and pruning Backdoor Critical Neurons through representational analysis.
• When Embedding-Based Defenses Fail: Rethinking Safety in LLM-Based Multi-Agent Systems — Embedding-based MAS defenses fail when attackers craft near-benign messages, necessitating token-level confidence signals for robustness.
• Adversarial Style Optimization: Enhancing VLM Jailbreaks by GRPO-based Stylistic Triggers Optimization — MLLM safety mechanisms are vulnerable to optimized visual styles, not just content, enabling enhanced jailbreaks.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by cs.CL updates on arXiv.org.