Research map / Large language models / Alignment and preferences

Logit-Gap Steering: A Forward-Pass Diagnostic for Alignment Robustness

NeurIPS 2026 · Large language models › Alignment and preferences · approach: Steering and correcting LLM behavior · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes logit-gap steering, a gradient-free, forward-pass-only method that greedily selects in-distribution suffix tokens to close the first-token refusal-affirmation logit gap, and uses the gap as a diagnostic for alignment robustness.

Problem

Measuring and probing the first-token refusal margin in aligned LLMs at scale, since gradient-based jailbreak searches such as GCG are expensive and produce high-perplexity suffixes.

Approach

Defines the refusal-affirmation logit gap at the first decoding position and scores candidate tokens from the model's own high-probability pool with a single-forward-pass proxy (logit change, KL and reward proxies), then greedily covers the initial gap; ensembles of 8 suffixes from multi-objective permutation selection are used for attacks.

Key results

• The 8-suffix ensemble reaches 38-96% True ASR across 13 models on AdvBench (e.g., 83.3% on Llama-3.1-70B-related entries, 95.2% on Qwen2.5-0.5B, 37.9% on Qwen2.5-72B).
• Discovering 8 ensemble suffixes per family costs about 26,000 forward-pass equivalents (about 2 min on one A100), roughly 125x less than a single GCG search (about 3.25M FPE, 5.2 h).
• Under a perplexity-filter defense, the discovered ensemble holds at 76.0% (from 76.9%) while GCG+SH drops from 64.7% to 1.0%.

Surprising findings

• Under Llama Guard 3 output filtering, all methods are cut by 50-60 pp, and the in-distribution suffix advantage from the input-PPL setting does not transfer to a semantic output filter.
• Transfer to Claude-Haiku-4.5 is low and statistically indistinguishable from the SH baseline (5.4% vs. 4.0%).

Limitations

• First-order approximation of the logit gap may degrade beyond about 10 tokens; position-1 framework covers 92-99% of prompts.
• Cross-family transfer is mixed on GPT-OSS-20B and low on Claude-Haiku-4.5; direct discovery needs full next-token logits.
• Gap magnitudes depend on tokenizer-aware token-list construction; the judge is same-family (Qwen) with partial cross-judge validation.

Experimental setup

Datasets: AdvBench HarmBench

Benchmarks: AdvBench HarmBench

Metrics: True ASR perplexity Wilson 95% CI Cohen's kappa pairwise failure correlation forward-pass equivalents

Baselines: GCG nanoGCG Random+SH Sure here's (SH) Here's (H) Llama Guard 3

Builds on: GCG AutoPrompt AutoDAN PAIR TAP

Closest papers by meaning

• Fail-Closed Alignment for Large Language Models (NeurIPS 2026 · similarity 0.90)
• Aligner: Efficient Alignment by Learning to Correct (NeurIPS 2024 · similarity 0.89)
• Leveraging Importance Sampling to Detach Alignment Modules from Large Language Models (NeurIPS 2025 · similarity 0.87)
• Inference-Time Vulnerability Beyond Shallow Safety: Alignment Along Generation Trajectories (NeurIPS 2026 · similarity 0.87)
• Differentially Private Steering for Large Language Model Alignment (ICLR 2025 · similarity 0.86)
• SCANS: Mitigating the Exaggerated Safety for LLMs via Safety-Conscious Activation Steering (AAAI 2025 · similarity 0.86)