A latent-space attack for evading refusal in language models

The researchers propose a latent-space evasion attack against language models that suppresses refusal by pushing the model's internal representations across the decision boundary between refusal and answering. The paper reframes refusal suppression as an evasion attack against a linear probe, noting that prior ablation along the difference-in-means direction amounts to projecting representations onto the decision boundary, which is the lowest-confidence form of evasion. To this end, the authors propose Controlled Latent-space Evasion, which pushes representations across the boundary with optimized confidence. The method achieves state-of-the-art attack success rates on 15 instruction-tuned, multimodal, and reasoning models, surpassing existing refusal-ablation baselines and dedicated jailbreak attacks.