Tracking the Dynamics of Refusal: Leveraging Latent Refusal Trajectories for Robust Jailbreak Detection

The researchers propose SALO (Sparse Activation Localization Operator), a lightweight white-box jailbreak detector that improves jailbreak detection across multiple attack families on Qwen, Llama, and Mistral models at a fixed XSTest-calibrated operating point. The authors use causal tracing to identify refusal trajectories, a sparse upstream activation pattern that often persists after attacks such as GCG suppress the terminal refusal signal. SALO operates directly on the raw hidden states of a selected layer window. The paper also analyzes static RepE-style baselines, ROI sensitivity, adaptive GCG attacks, and encoded-input boundary cases, illustrating the promise and limitations of refusal trajectory monitoring.