Minimal, local, causal explanations of large language model jailbreak success

Why a particular jailbreak succeeds, and what minimal changes to intermediate representations are needed to induce refusal back on that request.

• Scenario: The authors claim that alignment-fine-tuned LLMs can still be induced by jailbreaks to answer harmful requests; when models are used more autonomously in higher-risk scenarios, if it is unknown why a jailbreak succeeds, future frontier models may be similarly vulnerable to such attacks.
• Global explanations are insufficient: Prior work searches for directions in intermediate representations that causally encode harmfulness and refusal, and explains all jailbreaks as weakening or strengthening these concepts. The authors believe different strategies and different request categories (such as violence and cyberattack) may rely on different concepts, and the same strategy may not be effective across categories.
• What the authors want as an explanation: For this one successful jailbreak (local); after intervention, a refusal similar to the original request can be induced on the originally successful request (causal); the intervention set is minimal so that humans can understand it.
• LOCA: On the residual stream of a successful jailbreak, find a minimal set of interpretable representation changes. These changes do activation patching along SAE concept directions to induce refusal, thereby explaining why this jailbreak succeeded.

Linear directions and causal intervention

• Park et al. (2023) and Elhage et al. (2022) proposed the linear representation hypothesis: meaningful concepts are encoded as linear directions in representation space. Zou et al. (2023a) found truth directions, and Ferrando et al. (2025) found knowledge awareness.
• Concepts can be separated into positive and negative examples from activations using supervised probes (Cunningham et al., 2026), or decomposed into many directions unsupervisedly using SAEs (Bricken et al., 2023; Cunningham et al., 2023).
• Causal testing commonly uses activation steering (Turner et al., 2023) or activation patching (Meng et al., 2022; Heimersheim & Nanda, 2024). The paper states: steering with too small a scale may have no effect, and too large a scale may leave the manifold; conventional patching mostly uses reference prompts with similar structure, otherwise the token correspondence is unclear.

Jailbreak attacks, defenses, and safety positioning

• Attacks include manual role-play, encoding, translation, low-resource languages, and optimized adversarial suffixes or prompt rewrites (Zou et al., 2023b; Chao et al., 2023; Liu et al., 2024); there are also multi-turn, decomposed, and indirect prompts (Russinovich et al., 2025; Srivastav & Zhang, 2025).
• Defenses include input-layer heuristics (Jain et al., 2023), separate guardrail models (Inan et al., 2023), and fine-tuning the model to be more jailbreak-resistant (Bai et al., 2022). Inference-time activation defenses such as JBShield (Zhang et al., 2025) extract toxic and jailbreak concepts from hidden states and then perform global steering. The paper states that LOCA differs from such work by moving from a global mechanism over all inputs to local, token-level analysis of a specific input.
• Zhou et al. (2025) located safety-critical attention heads, and refusal weakened after ablation. The paper states that such work focuses on localization rather than explaining jailbreak behavior.

Global jailbreak understanding in representation space

• Arditi et al. (2024), Ball et al. (2026), and Lin et al. (2024) frame jailbreak success as suppressing the harmfulness direction. Wollschläger et al. (2025) used gradient-based optimization to obtain a subspace more suitable for causally controlling refusal.
• The paper relays more granular results: Zou et al. (2023a) found that in 90% of successful jailbreaks, the model still represents the request as harmful but does not refuse; Zhao et al. (2025a) provided causal evidence that harmfulness and refusal can be represented separately. Zhao et al. (2025a) and Kirch et al. (2025) also found that different strategies and different risk categories rely on different concepts.

Upstream SAE directions

• Lee et al. (2025) used early-layer SAE directions on three hand-picked prompts for steering, increasing the projection of downstream request tokens onto the Arditi et al. (2024) refusal direction, thereby inducing refusal.
• Yeo et al. (2025) first took the top-M SAE directions with the highest cosine similarity to the refusal direction, then took the top-K with the largest change in output token probability after patching from harmful non-refused instructions to harmful refused instructions, and used steering to verify that these vectors can induce or bypass refusal.
• The paper explicitly criticizes these two works: the first-order approximation averages over tokens, thus intervening along all tokens; the top-K is selected once, ignoring interactions from multiple steering or patching steps. The paper states that they found causal upstream vectors but did not use them to locally explain why a particular jailbreak succeeded.

Baselines and data: the experimental baselines are Lee et al. (2025) and Yeo et al. (2025) adapted to this paper's setting. The data is WhatFeatures (Kirch et al., 2025), with 10,800 entries and 35 jailbreak methods; success is labeled by the HarmBench autograder (Mazeika et al., 2024).

The authors place LOCA after upstream causal vectors: using token-level, iterative activation patching to give the minimal causal change needed to restore the original refusal, rather than a single harmfulness or refusal direction common to all inputs.

Given a refused original request xo and a successful jailbreak xj, LOCA performs activation patching on xj's residual stream: along the SAE decoder's concept directions of that layer, it iteratively selects a token to bring the first output token's distribution closer to xo, thereby inducing refusal.

Setup and intervention selection

• The goal is not to generate attacks. The authors aim to make minimal changes to xj in representation space to make the jailbreak fail and induce a refusal similar to xo.
• The authors do not use steering. The reason given: steering may yield out-of-manifold representations, and there is no principled way to choose tokens; patching allows token-level, in-distribution replacements.
• As in Arditi et al. (2024), Zhao et al. (2025a), Lee et al. (2025), and Yeo et al. (2025), the analysis is on the residual stream, not attention heads.

Token matching

• The chat template is divided into system tokens (Tsys), instruction tokens (Tinst), and post-instruction tokens (Tpost-inst). In a causal decoder, Tsys is the same for any prompt, so it is ignored.
• Tinst has variable length. xo's Tinst is upsampled or downsampled to match xj's length, then aligned one-to-one. Upsampling repeats embeddings without interpolation; downsampling skips embeddings.
• Tpost-inst is the same for any prompt, but embeddings differ, aligned by position one-to-one. The matching function M maps target token indices to reference token indices. The authors state that although this scheme is arbitrary, it works in practice.

Patch effect and first-order approximation

• Generating full responses after each patch is costly, so only the first output token is considered. The effect is the KL divergence between the original and patched distributions: L=KL(p_o∥p̃_j), i.e., how far the patched prediction is from xo's first-token distribution.
• Exhaustively enumerating all patches is infeasible. The first-order approximation for the i-th jailbreak embedding along direction v is d(i,v;p_o,p_j,l)=[∇_hj,iKL(p_o∥ p_j)]^⊤v (h_o,M(i)−h_j,i)^⊤v. The first term is the directional derivative, the second is the magnitude of the difference in projections on both sides.
• v is taken as rows of the SAE decoder Wd, i.e., interpretable concept vectors, and interpreted using Neuronpedia. The authors emphasize that this approximation is computed per token, unlike previous work that averages over entire token segments.

Iterative algorithm

1. Start with α=0 and unpatched xj.
2. Among all jailbreak tokens and Wd concept vectors, select the token and direction that minimize the current approximation d(α)(i, v).
3. Only along that direction, patch the matched xo embedding into that jailbreak embedding; other embeddings remain from the previous round. Complete a forward pass to get the new first-token distribution.
4. Increment α by 1 and recompute the approximation before selecting again. The authors state that recomputation makes the approximation conditional on the patches already made, thus accounting for interactions. Stop when a stopping criterion is met. In experiments, at most 20 iterations.

Patch implementation and refusal proxy

• The SAE encodes activations into sparse features and reconstructs with a linear decoder. LOCA does not replace the entire embedding but only the projection on the selected concept direction: subtract xj's projection on that direction, add xo's projection, leaving orthogonal components unchanged. For multiple directions, first use QR to obtain an orthonormal basis. Details in Appendix H.
• The main experiment defines "inducing refusal" as: the patched first output token matches xo's first output token. The authors state in Appendix B that the first token is a cheap proxy. Full-response determination is in Appendix F, using the HarmBench autograder.

Experimental Setup

• Models: Gemma-2-2B-IT (GEMMA-2), Gemma-3-27B-IT (GEMMA-3), Qwen-3-8B (QWEN), Llama-3.1-8B-Instruct (LLAMA). All are safety-aligned and instruction-tuned chat models.
• SAE: GEMMA-2 and GEMMA-3 use GemmaScope, trained on web, code, and scientific articles, and trained on the base model; the authors cite prior work claiming it transfers to IT models without further fine-tuning. LLAMA uses the SAE from Arditi & Chen (2025), trained on a mix of pretraining, dialogue, and misaligned data. QWEN uses QwenScope.
• Data and decoding: WhatFeatures has 10,800 entries and 35 methods. Greedy decoding with generation length 512 tokens. HarmBench autograder labels whether the jailbreak succeeds. Split into train/validation/test as 70/10/20; train and validation are only used by Lee et al. (2025) to find the refusal direction.
• Evaluation pairs: Only pairs where xo fails and xj succeeds are kept. Qualified samples are LLAMA 225, GEMMA-3 438, GEMMA-2 334, QWEN 222; GEMMA-3 is evaluated on 140 due to compute constraints. The Figure 3 caption says 50 jailbreak requests, and the paper does not explain how these 50 correspond to the above sample sizes. Appendix A shows the filtered jailbreak type distribution is not uniform.
• Baselines and budget: Lee et al. (2025) and Yeo et al. (2025), adapted as described in Appendix I. On the middle layers of the existing pretrained SAE (excluding the last layer), each method is allowed at most K=20. If refusal is not induced within K attempts, MP=K.
• Metrics: KL and logit difference of the first token, then normalized by the number of patches to obtain KL-AUC and LD-AUC. MP is the number of patches needed for the predicted token to match the first token of xo. RR is whether the first token matches xo after all patches. The Figure 3 caption says that except for RR, values are ±1 standard deviation; the main text does not give values for each point.

Main Results

Swipe horizontally to read the table

Model	Condition stated by the authors	Average number of patches	Source
LLAMA	Early-layer residual embedding	6–8	Sec. 4.1
GEMMA-3	layer 36 and beyond	9	Sec. 4.1
GEMMA-2	roughly up to layer 10	12	Appendix C
QWEN	layer 22	10	Appendix C

The per-layer values for the baselines are only in the figures; the main text has no numbers to fill in cell by cell, so they are not listed. The abstract and contribution 1 say an average of six on Llama, which differs from the interval wording in Sec. 4.1.

• The authors claim that relative to Arditi et al. (2024), which does middle-layer steering at every input token position (roughly 50–200 tokens per input), LOCA uses fewer patches. The authors also claim that GEMMA-3's RR increases with layer depth, and downstream layers need fewer patches; KL-AUC and LD-AUC decrease as the patched layer deepens.
• The authors claim that LLAMA and GEMMA-2 reach 100% RR at layer 7 and layer 38, respectively. The Figure 3 discussed in the same paragraph is for LLAMA and GEMMA-3, and says GEMMA-3 succeeds from layer 36 onward; the paper does not clarify which model layer 38 belongs to. The authors claim that the baselines' RR does not improve with deeper intervention layers, and after 20 attempts they usually still cannot induce refusal.
• Appendix C says LOCA still outperforms the other two methods on GEMMA-2 and QWEN, and the other observations in Sec. 4.1 also hold. The specific readings at the endpoints of the curves in the figures are not listed in the main text.

Token-level and iterative ablations

• Sec. 4.1 is repeated on GEMMA-2. Base-LOCA averages gradients over tokens, with magnitude still per token; Token-LOCA keeps the token-level approximation, but the ranking is computed only once and then top-K is taken.
• The authors claim LOCA outperforms both variants on all metrics, and view Lee et al. (2025) and Yeo et al. (2025) as Base-LOCA variants with different objective functions. The main text does not give per-layer numbers for this ablation.

Localization and one case study

• Localization: Fig. 5 examines LLAMA layers 3, 7, 15; Appendix D examines GEMMA-2 layers 5, 10, 15. The authors claim early layers more often select Tinst, middle layers favor Tpost-inst, but there is still a non-negligible amount of Tinst. WORD and PUNCTUATION show no clear preference in early and early-middle layers; middle layers almost exclusively select PUNCTUATION; Tpost-inst is all labeled PUNCTUATION because of the template role. The authors interpret this as: early refusal signals are mainly determined by Tinst and do not prefer a word class; middle layers are more influenced by Tpost-inst, which can also appear on Tinst punctuation. The bar heights in the figures are not given numerical values in the main text.
• Case study: Sec. 4.4 and Appendix L use one AutoDAN on LLAMA. After two patches at layer 11, refusal is induced: a Tpost-inst token in the assistant position along concept #31126, with strength increased by 1.50 and KL of 0.77; a punctuation Tinst token along concept #125009, with strength decreased by 1.48 and KL of 0.04, after which refusal occurs. The authors use Neuronpedia to describe the former as an assistant token concept after harmful requests, and the latter as a concept after code generation requests, and use this to explain the success: the harmful-related refusal concept is suppressed, while the request is treated as a harmless code-like problem.
• Same prompt at layer 3: Refusal occurs after five patches, mostly on punctuation tokens. The KL values in Appendix L are 4.03, 2.71, 0.99, 0.77, 0.40 in order; the first strength change is −0.79. The authors claim the first few patches mainly weaken harmless, continuation-like concepts; but the last one strengthens a concept that activates most strongly on largely harmless questions before refusal appears, and they say they likely failed to correctly interpret this last concept. The authors also claim explaining LLAMA is easier than GEMMA-2, and attribute this to LLAMA's SAE containing dialogue data, while GemmaScope is trained on general pretraining data.

Other ablations and analyses

• Appendix E, LLAMA: random matching, matching by residual cosine similarity, and the original scheme are compared side by side. The authors claim random matching performs comparably to the other schemes and think this needs further study; they hypothesize that most original instruction tokens fall in the same safety subspace.
• Appendix B: the proportion of first words (ignoring case, punctuation, whitespace) identical to xo is 102/1018 (10.0%) for LLAMA and 82/1504 (5.5%) for GEMMA-2. The authors claim most methods rarely produce this, a few methods often do, and think a frequency of about 10% plus expected failures is enough to use the first token as the target.
• Appendix F: after applying all 20 patches, a full response is generated and the HarmBench autograder judges whether the jailbreak still succeeds; only 50 random LLAMA samples. The authors claim LOCA outperforms the other two methods at all intervention layers; the main text does not give per-layer success rates.
• Appendix G: 200 samples on LLAMA, layers 3/7/11/15/19/23/27. Fig. 12 caption: Pearson=0.817, Spearman=0.814, MAE=0.2027, n=28000 for Predicted ΔKL vs Actual ΔKL; the main text says the overall Pearson is 0.809. The authors claim larger errors are concentrated at layer 3 and improve by layer 7.
• Appendix J: under the same settings, the two baselines select top-20 within 2 seconds, while LOCA takes 7 seconds due to iteration. The Fig. 3 LLAMA results take less than 10 hours of GPU time; GEMMA-3-27B-IT uses two GPUs.
• Appendix K: when the first tokens of xo and xj are the same, the KL target is very small, RR is distorted, and LOCA cannot induce refusal based on this. The authors claim the HarmBench autograder also mislabels some successful jailbreaks as harmless, without giving a proportion.

Limitations and future directions noted by the authors

• The first-token proxy is a limitation of the method. When xo and xj have the same first token, the KL objective is very small and cannot induce refusal; Appendix K records such failures found in manual inspection (Sec. 5; Appendices B, K).
• Future work should improve the first-token proxy for refusal. Appendix B proposes minimizing the LOCA objective over the first N output tokens (Sec. 5; Appendix B).
• Interpreting results in LLAMA's earlier layers is time-consuming and error-prone; the authors mainly attribute this to SAE limitations (Sec. 5).
• The authors state that SAE directions are interpretable but may not be optimal for explaining jailbreaks (Sec. 5).
• The authors focus on Neural Geometry: building jailbreak-related concepts as nonlinear manifolds may alleviate interpretability difficulties (Sec. 5, citing Geiger et al., 2026; Fel et al., 2026).
• The authors state that the idea of shifting to local explanations and token-level patching could serve as a basis for inference-time, steering-based jailbreak defenses (Sec. 5). This is a direction proposed by the authors, not a completed defense experiment.

Experimental coverage

• The chat models analyzed are Gemma-2-2B-IT, Gemma-3-27B-IT, Qwen-3-8B, and Llama-3.1-8B-Instruct, 4 in total. Interventions are limited to intermediate layers of the residual stream with existing pretrained SAEs, and exclude the final layer (Sec. 4).
• The main comparison baselines are adapted versions of Lee et al. (2025) and Yeo et al. (2025), with at most 20 interventions. Samples come from pairs in WhatFeatures where xo fails and xj succeeds, labeled by the HarmBench autograder; the distribution of jailbreak types after filtering is not uniform (Sec. 4.1, Appendices A, C).
• Ablations compare Base-LOCA and Token-LOCA on GEMMA-2; token matching scheme comparisons are on LLAMA (Fig. 4, Appendix E). Localization analysis covers early, early-middle, and middle layers of LLAMA and GEMMA-2 (Sec. 4.3, Appendix D).
• HarmBench judgments on full responses are only on 50 random LLAMA samples, and only after applying all 20 patches (Appendix F). First-order approximation error analysis covers 200 LLAMA samples across 7 layers with SAEs (Appendix G). The case study is a single AutoDAN instance on LLAMA (Sec. 4.4).
• The paper does not report specific standard deviation values for each layer in the main figures (captions only state ±1 std. dev.), the Jailbreak Success Rate per layer in Appendix F, the HarmBench mislabeling proportion, or statistical significance tests. The 50 in the Figure 3 caption and the 225/140 in Sec. 4.1 are not cross-referenced.

LOCA explains why a single jailbreak can bypass refusal using as few interpretable intermediate representation changes as possible.

• The aligned model refuses the original harmful request xo, but the jailbreak xj succeeds. The authors argue that global harmfulness or refusal directions cannot distinguish different strategies and request categories, so they seek the minimal causal intervention for this specific xj.
• The approach aligns the instruction tokens of xo and xj, and performs activation patching on xj's residual stream along the SAE concept vectors of that layer. At each step, a first-order approximation of the KL divergence of the first-token distribution selects one token and direction; after patching, recomputation accounts for interactions.
• On WhatFeatures pairs where xo fails and xj succeeds, the authors report that in LLAMA early layers, an average of 6–8 patches can induce refusal; the abstract and contributions state an average of six. GEMMA-3 from layer 36 onward averages 9, GEMMA-2 up to layer 10 averages 12, and QWEN at layer 22 averages 10. The authors claim that Lee et al. (2025) and Yeo et al. (2025) typically still cannot induce refusal after 20 patches.
• The authors attribute the advantage of their variant to token-level approximation and iteration. In terms of localization, early layers modify more user instruction tokens, while middle layers rely almost entirely on punctuation and post-template tokens. One AutoDAN case in LLAMA at layer 11 induces refusal after two patches.
• Their conclusion: this is a step toward mechanistic local explanations. The first-token proxy and SAE directions still limit explanations; future work could improve refusal determination and use local, token-level interventions as a basis for inference-time defenses.