This assessment is based on version 1 of this paper. Version 2 is now available on arXiv — the authors may have revised their methods, results, or conclusions.
Latent-space Attacks for Refusal Evasion in Language Models
Giorgio Piras, Raffaele Mura, Fabio Brau, Maura Pintor, Luca Oneto, Fabio Roli, Battista Biggio
Abstract
Safety-aligned language models are trained to refuse harmful requests, yet refusal behavior can be suppressed by steering their internal representations. Existing methods do so by ablating a refusal direction from model activations, aiming to remove refusal from the model's residual stream. Despite their empirical success, these methods lack a principled account of the latent-space transformation they induce and why it suppresses refusal. In this work, we recast refusal suppression as a latent-space evasion attack against linear probes trained to separate refused from answered prompts. Under this view, prior work's difference-in-means direction naturally defines such a probe, and its ablation is exactly a projection onto its decision boundary, i.e., a minimum-confidence evasion attack. This perspective not only explains the empirical success of prior work but also admits a key limitation: evasion stops at the decision boundary, motivating the need to push representations further into the compliant region, i.e., where the model answers. We leverage this by proposing a Controlled Latent-space Evasion attack that projects representations past the boundary with an optimized confidence. We achieve state-of-the-art attack success rate across 15 instruction-tuned, multimodal, and reasoning models, outperforming existing refusal-ablation baselines and specialized jailbreak attacks.
AI Impact Assessments
(1 model)Scientific Impact Assessment: "Latent-space Attacks for Refusal Evasion in Language Models"
1. Core Contribution
This paper makes two interconnected contributions. First, it provides a theoretical reframing of existing refusal-ablation methods (DiM, RDO, PS, MD) as latent-space evasion attacks against linear probes. Under this lens, the widely-used difference-in-means ablation is shown to be equivalent to the DeepFool minimum-confidence attack—a projection onto the linear decision boundary separating refused from compliant representations. This is an elegant insight: it unifies disparate methods under a single adversarial ML framework and immediately reveals their shared limitation—they only push representations to the decision boundary, not past it.
Second, building on this insight, the paper proposes Controlled Latent-space Evasion (CLE), which adds an optimized confidence margin to push representations into the compliant region. Two variants are introduced: CLE-P (projective, reprojecting every token) and CLE-A (additive, computing perturbation once and reusing it). The surprising finding that CLE-A outperforms CLE-P suggests that continuous reprojection is unnecessary and potentially harmful—a fixed additive shift suffices to sustain evasion throughout generation.
2. Methodological Rigor
The theoretical framework is cleanly developed. The decomposition of the gradient into direct and indirect components (Eq. 5), the truncated gradient approximation, and the reduction of arbitrary latent perturbations to 2L scalar parameters are well-motivated. The connection between margin and logistic confidence (Appendix E) is mathematically precise.
However, several methodological choices warrant scrutiny:
3. Potential Impact
For AI safety research: This work is significant because it demonstrates that current safety alignment based on linearly separable refusal representations is fundamentally fragile. The fact that a simple linear probe + margin optimization can defeat alignment across 15 diverse models (including defended models like Mistral-7B-RR and reasoning models like DeepSeek-R1-8B) is a strong negative result for the robustness of current alignment approaches.
For adversarial ML: The connection between refusal ablation and DeepFool-style evasion attacks is theoretically valuable, bridging interpretability/alignment literature with classical adversarial robustness. This cross-pollination could inspire new attack-defense dynamics.
For defenses: The paper explicitly suggests that alignment procedures should discourage linear separability of refusal representations. This is actionable guidance—though implementing it without degrading model quality is non-trivial.
Dual-use concerns: The attack is powerful, computationally cheap at inference time (single forward pass after optimization), and universal across prompts. The white-box access requirement limits immediate misuse to open-weight models, but the growing availability of such models makes this a real concern.
4. Timeliness & Relevance
This work arrives at a critical juncture. The rapid deployment of open-weight LLMs, combined with increasing evidence that safety alignment is brittle, makes understanding and characterizing failure modes urgent. The paper addresses the specific bottleneck of explaining *why* refusal ablation works—prior work was largely empirical. The extension to reasoning and multimodal models (including recent architectures like Qwen3.5, Phi-4, Gemma3) demonstrates relevance to the current model landscape.
5. Strengths & Limitations
Key Strengths:
Notable Limitations:
6. Additional Observations
The qualitative examples (Appendix J) are striking—models produce detailed harmful content that would clearly fail safety standards. The Mistral-7B-RR example is particularly notable: the defended model produces garbled refusals without CLE but coherent harmful content with CLE-P, suggesting the defense primarily disrupts refusal token generation rather than fundamentally changing representation geometry.
The paper's framing as an "attack" paper rather than a "defense" paper is appropriate—it advances understanding of vulnerabilities. However, the defensive implications (Section 6) remain speculative.
Generated May 22, 2026
Comparison History (21)
Paper 1 offers a principled theoretical framework that reinterprets and improves upon refusal-suppression attacks, achieving state-of-the-art results across 15 diverse models. It addresses a critical AI safety problem with broad implications for red-teaming and alignment research. The theoretical contribution (connecting ablation to evasion attacks on linear probes) is novel and unifying. Paper 2 introduces a useful framework for selective abstraction but addresses a narrower problem (factual reliability in long-form generation) with more incremental contributions. Paper 1's breadth of impact across safety, interpretability, and adversarial ML gives it higher potential impact.
Paper 2 likely has higher scientific impact: it introduces an open-sourced benchmark (Curation-Bench) that operationalizes a broadly important and timely problem—automating data curation with generalist agents—enabling reproducible, comparable progress across labs. Its findings (execution–research gap; scaffolded method adaptation) generalize to agentic ML workflows beyond vision-language, with direct real-world utility for reducing data-engineering cost. Paper 1 is novel and rigorous in mechanistic framing and yields strong jailbreak results, but its applications are narrower and may face limited adoption due to safety-sensitive framing.
Paper 2 is likely higher impact: it introduces a principled latent-space framing (refusal suppression as probe evasion), yielding a generalizable methodology and a stronger attack (controlled evasion past the boundary) validated across 15 diverse models with state-of-the-art results. Its real-world relevance is immediate for AI safety, red-teaming, and defense design, with cross-field impact spanning interpretability, adversarial ML, and alignment. Paper 1 is valuable and timely but is more domain-specific (medical QA/CoT auditing) and primarily diagnostic rather than offering broadly applicable new mechanisms or tools.
Paper 2 has higher likely scientific impact: it introduces a comprehensive, utility-grounded framework covering the full lifecycle of agent skill generation, extraction, and consumption across five domains, yielding broadly applicable findings (negative transfer, extractor/consumer mismatch) and a practical meta-skill that improves outcomes. This is methodologically systematic and relevant to a growing area (agentic LMs), with clear implications for building robust, reusable agent skills across models and tasks. Paper 1 is novel and strong but is narrower (jailbreak/refusal evasion) and more security-specific.
Paper 2 addresses a critical and highly active area of AI safety: model alignment and jailbreaking. By providing a principled framework for latent-space attacks and demonstrating state-of-the-art success rates across 15 diverse models, it exposes severe vulnerabilities in current safety mechanisms. This will likely drive significant follow-up research in both mechanistic interpretability and robust alignment, giving it a broader and more urgent impact than Paper 1's focus on XAI evaluation metrics.
Paper 1 addresses a fundamental scientific problem in AI safety by reframing LLM refusal suppression as a latent-space evasion attack, advancing theoretical understanding and empirical evaluation across 15 models. Paper 2, while offering a highly useful engineering framework for reducing API boilerplate, is primarily a software engineering tool rather than a contribution to fundamental scientific knowledge. Consequently, Paper 1 has much higher potential for broad scientific impact in the critical field of AI alignment and security.
Paper 1 addresses AI safety and LLM jailbreaking, a critically important field with broad implications for the safe deployment of foundation models. Its novel theoretical framework for understanding refusal suppression provides fundamental insights that could significantly influence future alignment strategies. While Paper 2 offers strong contributions to collaborative autonomous driving, the widespread use of LLMs and the urgent need for robust safety mechanisms give Paper 1 a broader and more immediate scientific impact.
Paper 2 likely has higher scientific impact: it proposes a broadly useful architectural improvement for efficient long-context modeling (decoupled erase/write gating in linear attention), provides algorithmic/optimization contributions (chunkwise WY, gate-aware backward pass), and reports large-scale training with consistent gains across multiple benchmarks and settings, enabling real-world deployment benefits (constant-memory decoding, long-context retrieval). Paper 1 is insightful and timely for safety research, but its primary contribution is an attack/analysis on refusal mechanisms with narrower positive application scope and potentially shorter-lived impact as defenses evolve.
Paper 1 addresses a critical bottleneck in scaling reinforcement learning for multimodal reasoning by introducing role-aware token-level credit assignment. Improving how large vision-language models learn to reason from verifiable rewards has massive implications for developing more capable, reliable AI systems. While Paper 2 offers valuable insights into AI safety and jailbreaking, Paper 1's methodology fundamentally advances model capabilities in a highly active and impactful frontier (RL-based reasoning for multimodal models), likely leading to broader adoption and downstream applications.
Paper 1 addresses a critical and highly timely issue in AI safety: LLM jailbreaking and alignment. By providing a novel theoretical framing of refusal suppression as latent-space evasion and achieving state-of-the-art results across 15 modern models, it has profound implications for the secure deployment of foundation models. In contrast, Paper 2 applies standard reinforcement learning (PPO) to a classic operations research problem (FJSP). While practically useful, Paper 2 represents an incremental methodological advance with a narrower domain of impact compared to the broad, urgent relevance of Paper 1 in generative AI.