Research map / Adversarial robustness and security / Backdoor and poisoning

Latent-space Attacks for Refusal Evasion in Language Models

NeurIPS 2026 · Adversarial robustness and security › Backdoor and poisoning · approach: Backdoors in large multimodal models · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Recasts refusal-direction ablation as a minimum-confidence latent evasion attack against linear probes and proposes Controlled Latent-space Evasion (CLE-P/CLE-A), which pushes activations past the probe boundary with a Bayesian-optimized margin.

Problem

Refusal suppression by ablating a refusal direction lacks a principled account of the latent transformation it induces and is limited to boundary projection, so it under-suppresses refusal.

Approach

View refusal suppression as latent-space evasion of per-layer linear probes; DiM ablation equals DeepFool minimum-confidence projection onto the boundary. CLE adds a per-layer confidence margin (log-odds of compliance) and layer mask tuned by Bayesian optimization, either applied per token (CLE-P) or as a single perturbation computed at the post-instruction token and added to all tokens (CLE-A).

Key results

• CLE-A achieves the highest ASR on all 15 evaluated models, e.g. 94.96 on Llama-2 vs 1.80 for DiM ablation.
• CLE-P averages 87.29 ASR across 15 models, exceeding MD by 24.32 points, DiM by 39.95 and RDO by 61.73.
• CLE-A outperforms GCG and SAA jailbreaks, with margins up to 81 points on Mistral-RR, at ~1 forward pass per prompt versus ~10^3 for GCG/SAA.

Surprising findings

• Minimum-confidence DiM ablation yields near-zero ASR on several models (e.g., 0.60 on GPT, 1.80 on Llama-2), while adding a margin raises it sharply.
• A single fixed perturbation computed at the post-instruction token (CLE-A) outperforms per-token reprojection (CLE-P) on all models.

Limitations

• Relies on Bayesian optimization over layers and margins rather than differentiable optimization.
• Requires white-box access to internal activations.
• Assumes linear separability of refused and answered prompts in latent space.

Experimental setup

Datasets: AdvBench MaliciousInstruct JailbreakBench/TDC Alpaca SORRY-Bench HarmBench

Benchmarks: HarmBench

Metrics: attack success rate

Baselines: DiM RDO PS MD GCG SAA

Builds on: refusal direction ablation DeepFool Refusal Direction Optimization Promotion Steering Multiple Directions

Closest papers by meaning

• The Geometry of Refusal in Large Language Models: Concept Cones and Representational Independence (ICML 2025 · similarity 0.92)
• Refusal in Language Models Is Mediated by a Single Direction (NeurIPS 2024 · similarity 0.92)
• Refusal Direction is Universal Across Safety-Aligned Languages (NeurIPS 2025 · similarity 0.92)
• Just Enough Shifts: Mitigating Over-Refusal in Aligned Language Models with Targeted Representation Fine-Tuning (ICML 2025 · similarity 0.91)
• Surgical, Cheap, and Flexible: Mitigating False Refusal in Language Models via Single Vector Ablation (ICLR 2025 · similarity 0.90)
• LLMs Encode Harmfulness and Refusal Separately (NeurIPS 2025 · similarity 0.89)