Latent-space Attacks for Refusal Evasion in Language Models

2026-05-23 · Source: cs.AI updates on arXiv.org · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Expert, extended

Summary

A new method, Controlled Latent-space Evasion (CLE), significantly enhances refusal suppression in safety-aligned language models by recasting it as a latent-space evasion attack. This approach reinterprets prior refusal-ablation techniques as minimum-confidence evasion, which only projects activations onto a decision boundary. CLE, in contrast, pushes internal representations further into the compliant region with an optimized confidence margin. The study introduces two variants: CLE-P, which reprojects every token activation, and CLE-A, which applies a single, universal perturbation computed once on the post-instruction token. CLE-A achieved state-of-the-art attack success rates, averaging 87.29% across 15 instruction-tuned, multimodal, and reasoning models, outperforming existing ablation methods by up to 78.49 points and prompt-level jailbreak attacks like GCG and SAA at a fraction of the computational cost.

Key takeaway

For AI Security Engineers developing or evaluating LLM safeguards, this research indicates that current refusal alignment mechanisms are vulnerable to sophisticated latent-space attacks. You should prioritize developing defenses that actively discourage linear separability of refusal features in latent space, rather than relying solely on ablation techniques. Consider integrating non-linear or distributed refusal representations to enhance robustness against controlled evasion.

Key insights

Refusal suppression in LLMs is a latent-space evasion problem, where controlled confidence attacks surpass prior ablation methods.

Principles

• Refusal ablation is minimum-confidence evasion.
• Controlled confidence evasion is more effective.
• Linear probes predict refusal from activations.

Method

Train layer-wise linear SVM probes on post-instruction activations. Optimize binary layer masks and non-negative margins via Bayesian Optimization to apply controlled-confidence perturbations, either projectively (CLE-P) or additively (CLE-A).

In practice

• Employ SVM probes for superior refusal prediction.
• Optimize layer windows and confidence margins.
• Apply additive perturbations for sustained evasion.

Topics

• Latent-space Attacks
• Refusal Evasion
• Language Model Safety
• Activation Steering
• Linear Probes
• Bayesian Optimization

Code references

• tatsu-lab/stanford_alpaca

Best for: Research Scientist, CTO, VP of Engineering/Data, AI Scientist, Machine Learning Engineer, AI Security Engineer

Related on AIssential

• BioRefusalAudit: Auditing Biosecurity Refusal Depth Using General and Domain-Fine-Tuned Sparse Autoencoders — Language model biosecurity refusals are often structurally unsound, influenced by superficial factors and internal biases, requiring activation-level auditing.
• Safety Paradox: How Enhanced Safety Awareness Leaves LLMs Vulnerable to Posterior Attack — LLMs' rigorous safety alignment inadvertently cultivates a latent capacity that can be weaponized by posterior attacks.
• could refusal layers be masking dialect-conditioned safety failures in MoE models [d] — Dialect-conditioned prompts can lead to divergent routing and safety failures in MoE models, especially when refusal layers are weakened.
• Blind Refusal: Language Models Refuse to Help Users Evade Unjust, Absurd, and Illegitimate Rules — LLMs exhibit "blind refusal," declining to help users circumvent unjust rules despite often recognizing the rules' illegitimacy.
• Willing but Unable: Separating Refusal from Capability in Code LLMs via Abliteration — Abliteration separates code LLM refusal from capability, unlocking vulnerability injection without creating new skills.
• Learning When to Act or Refuse: Guarding Agentic Reasoning Models for Safe Multi-Step Tool Use — MOSAIC aligns agentic models for safe multi-step tool use by making safety decisions explicit and learnable.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by cs.AI updates on arXiv.org.