Which features in prompts trigger LLM jailbreaks? Investigating the mechanisms behind the attacks

The researchers constructed a new dataset containing 10,800 jailbreak attempts covering 35 attack methods, and trained linear and nonlinear probes on the hidden states of open-weight LLMs to predict whether a jailbreak would succeed. The probes achieved high accuracy in-distribution, but transfer was attack-family-specific, indicating that different jailbreak attacks are supported by different internal mechanisms rather than a single general direction. To establish causal links, the researchers constructed probe-guided latent interventions that can systematically alter the model's compliance behavior along the predicted direction; interventions from nonlinear probes produced larger and more reliable effects than linear probes, indicating that features associated with jailbreak success are encoded nonlinearly in prompt representations. The study reveals the heterogeneous nonlinear structure of jailbreak mechanisms and provides a set of methods for recovering and testing features that drive jailbreak outcomes from the prompt side.