USENIX Security 26 | JailbreakScope uses circuit and representation analysis to interpret LLM jailbreak mechanisms

The JailbreakScope team from Zhejiang University's National Key Laboratory of Blockchain and Data Security proposed a dual-perspective framework of representation and circuits at USENIX Security 2026 to explain the internal mechanisms of LLM jailbreaks. Using safety probes, the research found that aligned models achieve nearly 99% accuracy in distinguishing safe from harmful inputs in the middle-to-later layers; jailbreak prompts perturb hidden representations, pushing harmful inputs toward safe sample clusters while suppressing refusal signal components and amplifying affirmative signal components. On Llama2-7b, the correlation coefficient between representation deception and circuit shift is 0.79, and all other tested models exceed 0.64; the team also found that safety-critical circuit locations in 7B and 13B models overlap highly, and increasing parameter count does not necessarily improve jailbreak resistance. The research documented samples that "refuse first, then fall," arguing that static detection at the input stage alone would miss such jailbreaks, and proposed two defense directions: runtime detection combining representation and circuit analysis, and targeted alignment for safety components.