Revisiting JBShield: Breaking and Rebuilding Representation-Level Jailbreak Defenses Kemal Derya
Berk Sunar
Worcester Polytechnic Institute Worcester, MA, USA [email protected]
arXiv:2605.03095v1 [cs.CR] 4 May 2026
Abstract Defending large language models (LLMs) against jailbreak attacks, such as Greedy Coordinate Gradient (GCG), remains a challenge, particularly under adaptive threat models where an attacker directly targets the defense mechanism. JBShield, a recent jailbreak defense with a 0% attack success rate (ASR) in some settings, detects malicious prompts via two concept signals, a toxic concept and a jailbreak concept. It flags a prompt only when both concept scores exceed their respective thresholds, forming an AND-gate. We show that its robustness does not hold under adaptive optimization. We design JB-GCG, which modifies GCG’s objective to combine two terms: refusal-direction suppression via cosine similarity between the refusal direction and hidden-state representations, and toxic-concept regularization via JBShield’s own toxic concept score. JB-GCG consistently drives the toxic concept below threshold while leaving the jailbreak concept active, effectively breaking JBShield’s detection structure. Across five configurations on Llama-3-8B, JBGCG achieves an average ASR of 46.2%, reaching up to 53.4% in the strongest setting. We further evaluate the full JBShield pipeline and show that our attack remains effective against JBShield-M, achieving ASR up to 30.7% across evaluated settings. The attack persists across multiple JBShield recalibrations (𝑁 =10–50), confirming that the vulnerability is structural rather than calibration-specific. To understand why adaptive GCG-style attacks succeed, we analyze the cosine-similarity signatures of jailbreak representations and find that they occupy a distinctive region in refusal-direction fingerprint space that neither harmless nor harmful prompts inhabit. Motivated by this observation, we introduce Representation Trajectory Verification (RTV), a new defense based on Mahalanobis outlier detection over multi-layer refusal-direction fingerprints, requiring only harmless and harmful prompts for calibration. RTV attains an AUROC of 0.99 against our JB-GCG attack. Finally, we design and evaluate an additional adaptive attack against RTV with full white-box knowledge of the defense; even under this stronger threat model, the best attack achieves only 7% ASR at much increased 13× the computational cost. Our results show that strong non-adaptive detection does not imply robustness under adaptive threat models, and that multi-layer representation consistency is a Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]. Conference acronym ’XX, © 2026 Copyright held by the owner/author(s). Publication rights licensed to ACM. ACM ISBN XXX-X-XXXX-XXXX-X/2026/05 https://doi.org/XXXXXXX.XXXXXXX
Worcester Polytechnic Institute Worcester, MA, USA [email protected] more reliable foundation for jailbreak detection than single-layer concept similarity. The code will be available after the reviews.
CCS Concepts • Security and privacy → Systems security.
Keywords adversarial suffixes, jailbreak attack, representation-level defense, LLM security ACM Reference Format: Kemal Derya and Berk Sunar. 2026. Revisiting JBShield: Breaking and Rebuilding Representation-Level Jailbreak Defenses. In Proceedings of (Conference acronym ’XX). ACM, New York, NY, USA, 16 pages. https://doi.org/ XXXXXXX.XXXXXXX
1
Introduction
Large language models (LLMs) are used for text generation [7, 28, 42], instruction following [29, 36, 45], and external tool use [31, 37, 50]. To reduce misuse, these models are typically aligned using safety fine-tuning methods such as reinforcement learning from human feedback (RLHF) [10, 29, 40]. Despite these safeguards, jailbreak attacks remain effective and carefully crafted prompts can cause aligned models to ignore safety policies and produce unsafe outputs [9, 25, 32, 39, 44, 55]. To strengthen LLM safety beyond internal alignment, a growing body of external defenses spans guard models [12, 16, 51], input-side filtering [3, 17, 19, 35, 48], decodingtime intervention [23, 33, 49], and representation-level analysis and representation rerouting [47, 52, 54], yet each commits to a single decision point that adaptive adversaries can target. Despite the spread of external defenses, they exhibit structural limitations that motivate a different approach. Guard models such as Llama Guard [16], ShieldGemma [51], and WildGuard [12] treat detection as a surface-level text classification problem, leaving them blind to adversarial suffixes that are semantically meaningless yet behaviorally effective [1, 55]. Input-side defenses such as SmoothLLM [35] and perplexity filtering [3, 17] rely on unnatural text properties of known attacks that adaptive attackers can circumvent by generating semantically coherent jailbreaks [9, 25]. Decodingtime interventions such as SafeDecoding [49] and RAIN [23] depend on the safety signals that jailbreaks are designed to suppress. Representation-level defenses come closest to addressing the root cause, but collapse the model’s layer-wise computation into a single decision point. JBShield [52] inspects two concept subspaces at a single frozen layer via an AND-gate and GradSafe [47] reduces the full forward pass to a scalar gradient similarity. Arditi et al. [5] show that refusal in aligned LLMs is mediated by a single direction in the residual stream, and that adversarial
Conference acronym ’XX, ,
suffixes such as GCG operate by suppressing propagation along this direction. This makes refusal-direction alignment a natural detection feature, as demonstrated by HiddenDetect [18], which scores inputs by cosine similarity with a refusal vector at selected layers. Cosine-similarity detectors such as HiddenDetect aggregate to a scalar score rather than treating the multi-layer profile as a distributional object. Separately, Mahalanobis distance is a wellestablished primitive for out-of-distribution (OOD) and has proven useful in adversarial example detection in deep feature spaces [21, 34]. It has recently been applied to LLM safety tasks as well [11, 15, 22]. Prior Mahalanobis-based safety detectors [11, 15, 22] operate on raw hidden states at a single layer and token position, and no prior work combines refusal-direction cosine similarities across layers and positions with Mahalanobis outlier scoring. Any representation-level defense must be evaluated against adaptive attacks. Bailey et al. [6] demonstrate that state-of-theart representation-space defenses, including Mahalanobis-based OOD detection on LLM activations, can be bypassed by obfuscated activation attacks. Schwinn and Geisler [38] report a similar result against Circuit Breakers [54] with only three modifications to the embedding-space attack used in the original evaluation. These results indicate that sheer dimensionality of the detection surface is not the relevant source of robustness, since Mahalanobis scoring over raw LLM activations operates on thousands of dimensions. Among representation-level defenses, we focus on JBShield which uses cosine similarity between hidden-state representations and calibrated toxic and jailbreak concept directions. It reports 0% ASR against GCG-based attacks on Llama-3-8B in which the attack objective is modified to weaken the toxic concept and enhance the jailbreak concept. In a realistic adaptive threat model, the attacker has knowledge of the deployed defense and can modify GCG’s objective to optimize for detector evasion. Motivated by this, we revisit JBShield under an adaptive threat model where we modify GCG’s objective via three successive methods, each informed by the limitations of the previous one. We assess each method’s attack success and ultimately arrive at a tailored GCG-style adversarial suffix attack (JB-GCG) that both induces unsafe model behavior and evades JBShield’s detector. While straightforward GCG-style variants are insufficient to bypass the defense consistently, this analysis guides the design of a stronger adaptive attack. The resulting adversarial prompts expose a near-zero distinctive zone in refusal-direction fingerprint space that JBShield’s single-layer inspection entirely misses. Building on this observation, we propose Representation Trajectory Verification (RTV), which computes cosine similarity to the refusal direction across multiple layers and multiple token positions to construct a fingerprint, and applies Mahalanobis distance as the outlier score on this fingerprint. RTV ties a mechanistically grounded attack signature, i.e. GCG’s suppression of the refusal direction [5], to a detection framework with well-characterized statistical behavior. Moreover, RTV avoids both the single-layer, single-position bottleneck of prior Mahalanobis-based safety detectors and the single-feature, single-position limitation of cosinesimilarity detectors. Given the adaptive-robustness concerns raised above, we do not claim that RTV’s fingerprint is intrinsically harder to obfuscate by virtue of its size. Instead, we hypothesize that its robustness, if any, derives from two structural properties. First,
Derya et al.
an adaptive attack must simultaneously suppress refusal-direction propagation (to jailbreak the model) and preserve the fingerprint of harmless inputs (to evade detection), which is a tension absent from raw-activation detectors. Second, the fingerprint imposes consistency constraints across multiple layers and token positions rather than at a single layer. Whether an adaptive attacker can resolve these tensions with a modified loss at comparable cost is an empirical question, and we address it through adaptive evaluation in Section 7.4.
1.1
Contributions
(1) We provide an analysis of JBShield’s detection mechanism and show that its AND-gate and single-layer concept extraction pose a structural vulnerability exploitable by an adaptive attack. (2) We introduce JB-GCG, an adaptive attack that modifies GCG’s objective to combine refusal-direction suppression with toxicconcept regularization, achieving up to 53.4% ASR against JBShield-D and 30.7% against JBShield-M on Llama-3-8B, in settings where JBShield reports 0%. JB-GCG persists across different JBShield configurations (𝑁 =10–50), which confirms the structural vulnerability. (3) We characterize the multi-layer representation-level signature of JB-GCG, showing that adversarial prompts produce layer-inconsistent refusal-direction profiles that are absent from harmless and harmful prompts. (4) We propose RTV, a defense based on Mahalanobis outlier detection over a 15-dimensional refusal-direction fingerprint, achieving 0.99 AUROC against JB-GCG without requiring jailbreak examples for calibration. (5) We evaluate RTV under adaptive attack with full white-box knowledge, showing that the strongest attacker achieves only 7% ASR at 13× computational cost, where evasion is bounded by the conflict between refusal suppression and fingerprint evasion.
2 Related Work 2.1 External Jailbreak Defenses External defenses for aligned LLMs differ in where they intervene and what signal they consume. Llama Guard [16] fine-tunes a model on a custom safety taxonomy. ShieldGemma [51] scales this to a family of task-specific detectors with output-side coverage. WildGuard [12] extends the taxonomy to adversarial and benign-refusal edge cases. All three share a common limitation where their training signal is surface-level text, which leaves them blind to semantically meaningless suffixes such as those produced by GCG [1, 55]. Input-side defenses intervene before the prompt reaches the model. Perplexity filtering [3, 17] rejects inputs whose languagemodel perplexity under a reference model exceeds a threshold, targeting the unnatural token distributions of early adversarial suffixes. Erase-and-check [19] provides certified robustness by verifying that the model refuses every token-level substring of the input. These defenses are effective against attacks whose signatures are preserved in the text itself, but adaptive attackers can circumvent them by optimizing for semantically fluent jailbreaks [9, 25].
Revisiting JBShield: Breaking and Rebuilding Representation-Level Jailbreak Defenses
Conference acronym ’XX, ,
Decoding-time defenses shift the intervention to generation. SafeDecoding [49] trains an auxiliary expert model on (harmful, refusal) pairs and uses it to re-weight the token distribution of the target model during sampling. RAIN [23] introduces a selfevaluation loop that rewinds generation when the model’s own critique flags its output as unsafe. Self-defense [33] asks a second LLM to audit completions post hoc. These approaches depend on the target model’s own safety signals remaining intact under attack, the very signals GCG-style attacks are designed to suppress [5]. Representation-level defenses operate on hidden-state signals. GradSafe [47] computes the cosine similarity between the target model’s gradient with respect to a harmful-response target and a reference gradient computed on known harmful prompts, producing a scalar score. Gradient Cuff [14] formalizes a refusal-loss function and exploits the observation that its gradient norm is larger on malicious queries than on benign ones, using a two-stage test over function value and gradient magnitude. JBShield [52] inspects two rank-1 concept subspaces (toxic and jailbreak) at a single frozen layer via an AND-gate, detecting prompts that activate both concepts simultaneously. Alert [24] is the closest methodological cousin to RTV. It also tracks refusal signals across layers, but uses an internal-discrepancy amplification heuristic rather than a learned outlier score and operates in a zero-shot regime without calibration. Finally, Circuit Breakers [54] take a training-time approach, using representation rerouting to short-circuit harmful representations before they reach the output. Across this family, each defense, with the partial exception of Alert, collapses the model’s layerwise computation into a single decision point, one gradient, one layer pair, one concept-gate, and discards the layer-wise dynamics along which jailbreak and legitimate prompts diverge. RTV differs by consuming the full layerwise refusal-direction trajectory as a multi-dimensional fingerprint and scoring it with a Mahalanobis detector, applying distance-based OOD detection to an interpretable representation-level signal.
detection and demonstrates that the same machinery extends beyond OOD detection to factuality monitoring. JailDAM [27] pursues a complementary direction, modeling the distribution of benign inputs with an autoencoder and using reconstruction error as an anomaly score. RCS reports outperforming JailDAM by adopting a contrastive rather than one-class formulation. All of these detectors operate on raw hidden states rather than on refusal-direction projections, and typically at a single layer and token position. RTV applies Mahalanobis scoring to a refusaldirection fingerprint computed over multiple layers and token positions. RTV retains the statistical properties of Mahalanobis-based OOD detection while operating on an attack-specific signal absent from raw activations.
2.2
Out-of-Distribution Detection with Mahalanobis Distance
Mahalanobis distance on intermediate features is a mature primitive for OOD and adversarial-example detection. Lee et al. [21] establish a framework that combines per-layer Mahalanobis scores via logistic regression and achieves strong performance on both OOD and adversarial inputs. Hendrycks et al. [13] show that pretrained Transformers substantially improve OOD robustness over prior architectures. Podolskiy et al. [34] demonstrate state-of-theart OOD intent detection with Mahalanobis distance on fine-tuned Transformer embeddings. Several recent works apply this machinery to LLM safety tasks. Representational Contrastive Scoring (RCS) [15] instantiates a contrastive Mahalanobis detector for large vision-language models, scoring inputs at a single safety-critical layer by their relative distance to benign versus malicious distributions. MAAD [11], a benchmark for LLM misalignment anomaly detection, reports that Mahalanobis distance on hidden representations is the strongest baseline overall across seven failure modes. PALE [22] applies a contrastive Mahalanobis score to intermediate activations for hallucination
2.3
Refusal-Direction Analysis and Representation Engineering
A parallel line of work identifies and manipulates safety-relevant directions in the residual stream. The representation-engineering framework of Zou et al. [53] establishes that high-level model behaviors, including truthfulness, refusal, and power-seeking, can be localized to low-dimensional subspaces and controlled through targeted interventions. Contrastive Activation Addition (CAA) [30] implements this by extracting steering vectors from contrastive prompt pairs and adding them to the residual stream to elicit or suppress specific behaviors. Arditi et al. [5] apply this methodology specifically to refusal, showing that refusal is mediated by a single direction across 13 chat models. They show that adversarial suffixes such as GCG [55] succeed by suppressing propagation along this refusal-mediating direction. HiddenDetect [18] is the closest prior instantiation of refusal signals as a detection feature. It constructs a refusal vector from high-logit refusal tokens (e.g., “sorry”, “unable”) in vocabulary space and scores inputs by the cosine similarity between their projected hidden states at the final token position and this refusal vector, aggregated over a set of safety-aware layers. RTV differs from HiddenDetect along three axes: First, our refusal direction is the Arditi residual-stream difference-of-means direction that GCG suppresses, not a vocabulary-space construction from refusal tokens. Second, our readout spans multiple layers and token positions rather than the final token position alone. Third, cosine similarities serve as features for Mahalanobis outlier scoring rather than as a detection score directly, which gives it the statistical properties of a well-studied OOD framework.
2.4
Adaptive Evaluation of Safety Defenses
Adaptive evaluation has become a prerequisite for credible LLMsafety claims, following the adaptive evaluation methodology of Tramer et al. [43]. Carlini et al. [8] show that aligned LLMs are vulnerable to adversarial attacks in continuous input spaces, undermining claims that alignment alone provides robustness. Andriushchenko et al. [4] demonstrate that simple adaptive jailbreaks bypass leading safety-aligned LLMs across the Llama, Claude, and GPT families, emphasizing that non-adaptive evaluation systematically overestimates robustness. Closer to our setting, Bailey et al. [6] show that state-of-theart representation-space defenses are systematically bypassed by
Conference acronym ’XX, ,
Derya et al.
gradient-based obfuscated-activation attacks that jointly optimize for a harmful completion and for activations indistinguishable from benign. Their results are relevant here because they refute a naive high-dimensionality argument. Mahalanobis scoring over raw LLM activations already operates on thousands of dimensions, yet remains bypassable. Schwinn and Geisler [38] report a similar result against Circuit Breakers, achieving 100% ASR on both released models with only three modifications to the embedding-space attack used in the original evaluation. These results define the bar for evaluating new representation-space defenses, and directly motivate our adaptive evaluation of RTV in Section 7.4.
3 Background 3.1 Greedy Coordinate Gradient (GCG) Let 𝑓𝜃 denote a decoder-only Transformer with vocabulary V, 𝐿 layers, and hidden dimension 𝑑. Given an input token sequence 𝑡 = (𝑡 1, . . . , 𝑡𝑛 ) ∈ V 𝑛 , the model produces residual-stream activations ℎ𝑙 (𝑖) ∈ R𝑑 at each layer 𝑙 ∈ {1, . . . , 𝐿} and token position 𝑖 ∈ {1, . . . , 𝑛}, which we use throughout Sections 5 and 7. Zou et al. [55] introduce Greedy Coordinate Gradient (GCG), a white-box optimization-based jailbreak that appends an adversarial suffix to a harmful query. We partition the input into a harmful query 𝑞 ∈ V 𝑛𝑞 and an adversarial suffix 𝑥 ∈ V 𝑛𝑥 , with concatenation denoted 𝑞 ⊕ 𝑥. Given a target affirmative response 𝑦 ∈ V𝑚 , e.g., “Sure, here is”, GCG solves min LGCG (𝑥) = − log 𝑝𝜃 (𝑦 | 𝑞 ⊕ 𝑥).
𝑥 ∈ V 𝑛𝑥
(1)
The minimization is over discrete tokens, which GCG handles with a gradient-guided top-𝑘 substitution procedure. At each iteration, the method (i) computes the gradient of LGCG with respect to the onehot encoding of each suffix position, (ii) selects the top-𝑘 candidate replacement tokens per position from this gradient, (iii) samples a batch of 𝐵 candidate substitutions from the pool, evaluates the loss of each, and (iv) commits the substitution that yields the lowest loss. This loop runs for a budget of 𝑇 iterations, with 𝑇 = 600 throughout this paper (Section 4). Although GCG requires white-box gradient access, Zou et al. further show that optimized suffixes transfer to black-box models, making the attack a standard benchmark for LLM safety [55]. Our adaptive attacks in Sections 5 and 7 modify the loss in Eq. (1) to jointly target unsafe behavior and detector evasion while preserving the top-𝑘 substitution procedure.
3.2
JBShield
JBShield [52] is a representation-level jailbreak defense comprising a detection component (JBShield-D) and a mitigation component (JBShield-M). Both operate on two concept directions extracted from last-token hidden-state activations: a toxic direction that separates harmful from harmless prompts, and a per-attack jailbreak direction that separates prompts of a specific jailbreak family from their underlying harmful prompts. In this paper, we introduce a GCG-style attack. Thus, we restrict our attention to the GCG jailbreak family throughout the paper. Layer selection. Let ℎ𝑙 (𝑝) ∈ R𝑑 denote the final-token hiddenstate activation of prompt 𝑝 at layer 𝑙. From a calibration set of 𝑁 harmless prompts {𝑝𝑖𝑏 }, harmful prompts {𝑝𝑖ℎ }, and jailbreak
prompts {𝑝𝑖𝑗 } for GCG attack family, JBShield selects two layers. The toxic layer 𝑙𝑡 is the layer that minimizes the mean all-pairs cosine similarity between harmful and harmless calibration embeddings; a separate jailbreak layer 𝑙 𝑗 is chosen for GCG attack family as the layer minimizing the mean all-pairs cosine similarity between attack embeddings and harmful embeddings. Because 𝑙 𝑗 is attack-specific, JBShield-D implicitly assumes the defender knows the attack family at inference time. Concept directions. JBShield extracts anchor concept directions by taking the top right singular vector of paired difference matrices at the selected layers. For the toxic concept, the difference matrix D𝑡cal ∈ R𝑁 ×𝑑 has rows ℎ𝑙𝑡 (𝑝𝑖ℎ ) − ℎ𝑙𝑡 (𝑝𝑖𝑏 ) for 𝑖 = 1, . . . , 𝑁 , and v𝑡 = top-SV D𝑡cal . (2) The jailbreak concept direction v 𝑗 is analogously extracted from D 𝑗 ∈ R𝑁 ×𝑑 , whose rows are ℎ𝑙 𝑗 (𝑝𝑖𝑗 ) − ℎ𝑙 𝑗 (𝑝𝑖ℎ ). JBShield-D (detection). Given a test prompt 𝑝, JBShield-D computes input-specific concept directions as the unit-normalized difference between the prompt’s embedding and the mean anchor of the opposing class: v𝑝toxic =
ℎ𝑙𝑡 (𝑝) − ℎ¯𝑏𝑙𝑡 , ∥ℎ𝑙 (𝑝) − ℎ¯𝑏 ∥ 𝑡
𝑙𝑡
jailbreak
v𝑝
=
ℎ𝑙 𝑗 (𝑝) − ℎ¯𝑙ℎ𝑗 ∥ℎ𝑙 𝑗 (𝑝) − ℎ¯𝑙ℎ ∥
,
(3)
𝑗
where ℎ¯𝑏𝑙𝑡 and ℎ¯𝑙ℎ𝑗 are the mean harmless and harmful calibration embeddings at the respective layers. It then scores 𝑝 by cosine similarity against the anchor concept directions: jailbreak 𝑠𝑡 = cos v𝑝toxic, v𝑡 , 𝑠 𝑗 = cos v𝑝 , v𝑗 . (4) JBShield-D forms an AND-gate and a prompt is flagged as a jailbreak only if both scores exceed thresholds 𝑇𝑡 and 𝑇 𝑗 : ( True, if 𝑠𝑡 ≥ 𝑇𝑡 and 𝑠 𝑗 ≥ 𝑇 𝑗 , 𝑅(𝑝) = (5) False, otherwise. This AND-gate is central to JBShield’s design. A prompt evades detection if it fails either threshold. JBShield-M (mitigation). JBShield-M conditionally adds a scaled concept vector: ℎ𝑙 ← ℎ𝑙 + 𝛿𝑡 v𝑡 when the toxic concept is detected, and ℎ𝑙 ← ℎ𝑙 − 𝛿 𝑗 v 𝑗 when the jailbreak concept is detected. The two operations operate independently and do not share an AND-gate. A prompt that bypasses JBShield-D can still be partially neutralized by JBShield-M if one or both detections activate; conversely, an attack that evades both concepts sees no mitigation at all. We evaluate both JBShield-D and JBShield-M in Section 6.3.
3.3
Refusal Direction
Recent work shows that refusal behavior in aligned LLMs is localized to a low-dimensional subspace of the residual stream [5, 30, 53]. Arditi et al. [5] identify a single refusal direction that mediates this behavior across 13 open-weight chat models, estimated via a difference-in-means construction over contrastive prompt sets. Let ℎ𝑙 (𝑝) ∈ R𝑑 denote the final-token hidden-state activation of prompt 𝑝 at layer 𝑙, consistent with the notation in Section 3.2.
Revisiting JBShield: Breaking and Rebuilding Representation-Level Jailbreak Defenses
Conference acronym ’XX, ,
Mahalanobis Distance Distributions (Ledoit-Wolf shrinkage)
0.7
Harmless (n=100, med=2.7) Harmful (n=100, med=2.7) JB-GCG (n=164, med=7.1)
0.6
Density
0.5 0.4 0.3 0.2 0.1 0.0
2
4
6
8
M(x) = min(d + , d ) [Mahalanobis distance]
10
Figure 1: Mahalanobis distance distributions on the test set. The JB-GCG distribution (median 7.1) is well-separated from harmless (median 2.7) and harmful (median 2.7), with minimal overlap. Given a calibration set of harmful prompts Dℎ and harmless prompts D𝑏 , the refusal direction at layer 𝑙 is 1 ∑︁ 1 ∑︁ 𝑟𝑙 = 𝜇𝑙ℎ −𝜇𝑙𝑏 , 𝜇𝑙ℎ = ℎ𝑙 (𝑝), 𝜇𝑙𝑏 = ℎ𝑙 (𝑝), ℎ |D | |D𝑏 | ℎ 𝑏 𝑝∈D
𝑝∈D
(6) with unit-normalized form 𝑟ˆ𝑙 = 𝑟𝑙 /∥𝑟𝑙 ∥. Arditi et al. establish that 𝑟ˆ𝑙 is a causal mediator of refusal: adding 𝑟ˆ𝑙 to the residual stream elicits refusal on harmless prompts, and ablating the component along 𝑟ˆ𝑙 disables refusal on harmful prompts while preserving general capabilities. More relevant to our setting, they further show that adversarial suffixes including GCG succeed by suppressing propagation along 𝑟ˆ𝑙 during the forward pass [5], achieving the same mechanistic effect as directional ablation via optimization over the input rather than a surgical intervention on hidden states. This makes the cosine alignment cos(ℎ𝑙 (𝑝), 𝑟ˆ𝑙 ) a mechanistically grounded attack signature: successful jailbreaks should exhibit reduced alignment relative to harmful or harmless prompts. RTV (Section 7) builds on this observation by treating per-layer refusal-direction cosines as features for outlier detection.
3.4
Mahalanobis Distance for Outlier Detection
Mahalanobis distance is a standard scoring function for out-ofdistribution and adversarial-example detection in deep feature spaces [21, 34]. Given a feature map f : X → R𝑘 and a reference distribution with mean 𝝁 and covariance 𝚺, the Mahalanobis distance of a point 𝑥 is √︃ 𝑑 (𝑥) = (f (𝑥) − 𝝁) ⊤ 𝚺 −1 (f (𝑥) − 𝝁). (7) At deployment, one fits 𝝁ˆ and 𝚺ˆ on in-distribution calibration features, computes 𝑑 (𝑥) for test points, and flags points exceeding a
threshold as outliers. For RTV, f (𝑥) is the refusal-direction fingerprint described in Section 7, whose entries correspond to cosine similarities at different layers and token positions. These coordinates have heterogeneous variances and strong cross-layer correlations, making Mahalanobis the natural scoring choice. It normalizes by per-coordinate variance and accounts for correlations. Because the fingerprint is low-dimensional (𝑘 = 15) but the calibration set is also small, the sample covariance 𝚺ˆ can be ill-conditioned. We use Ledoit-Wolf shrinkage [20] which yields a well-conditioned estimate. Fig. 1 shows that the Mahalanobis distance distribution of JB-GCG, our adversarial prompts we introduce in Section 6.3, is well-separated from the distribution of legitimate (harmless and harmful) prompts. Motivated by this separation, we construct a new defense that uses Mahalanobis distance as an outlier detector, which evaluates if the test prompt is a legitimate prompt. A proper defense needs to detect various families of jailbreaks, not just a single family. We show in Section 7.3 that Mahalanobis outlier detector works well across different jailbreak types, not just JB-GCG.
4
Attack–Defense Cycle Overview
Figure 2 illustrates the attack-defense cycle studied in this paper. JB-GCG bypasses JBShield’s single-layer AND-gate detection (left), while RTV detects the same attack using multi-layer fingerprinting with Mahalanobis outlier scoring (right).
4.1
Threat Model
We consider an adaptive white-box threat model that reflects the worst case for a deployed LLM defense. Throughout this paper, we target Meta-Llama-3-8B-Instruct [2], which we refer to as Llama-3-8B for brevity.
Conference acronym ’XX, ,
Derya et al.
Success criteria. We measure attack success using ASR, defined as the fraction of harmful prompts on which the attacker produces an output judged unsafe by SORRY-Bench [46] and not flagged by the detector. We report this metric separately against JBShield-D, JBShield-M, and RTV.
Harmful Prompt + Adv. Suffix
JB-GCG
Single layer, last token
Llama-3-8B
Single layer, AND-gate
Multiple layers & token positions
5
Multi-layer, single threshold
Multi-dimensional fingerprint JBShield
Mahalanobis M(x) > T
Toxic JB
Figure 2: Overview of the attack-defense cycle. Left: JBShieldD extracts hidden states at a single frozen layer and checks two concept scores (toxic, jailbreak) via an AND-gate. JBGCG suppresses the toxic concept below threshold while leaving the jailbreak concept active, breaking the detection. Right: RTV extracts hidden states at multiple layers and token positions, computes cosine similarities with per-layer refusal directions to form a multi-dimensional fingerprint, and flags outliers via Mahalanobis distance.
Attacker. The attacker’s goal is to induce the target aligned LLM to produce unsafe outputs on harmful prompts drawn from the HarmBench evaluation set [26] while simultaneously evading the deployed detector. The attacker has full white-box access to the target model, including weights, activations, and gradients, as required for GCG-style suffix optimization [55]. For adaptive attack design against JBShield in Section 5, the attacker has full white-box access to JBShield defense, e.g., the calibration embeddings, the anchor concept directions, and the concept detection thresholds. The attacker can modify GCG’s objective function to target JBShield’s defense mechanism. For the adaptive evaluation of RTV in Section 7.4, the attacker additionally has full white-box access to the defense, e.g., the refusal direction, the set of layers and token positions comprising the fingerprint, the calibrated Mahalanobis mean and covariance, and the detection threshold. The attacker cannot modify the model weights or the defender’s calibration set. The attack surface is limited to injection of a token-level adversarial suffix appended to the original prompt [55]. Attack cost is bounded by an optimization budget of 600 GCG iterations per prompt. Defender. The defender has white-box access to the target model’s hidden states at all layers and token positions, but does not retrain or fine-tune the base model. The defender possesses a small calibration set of harmless and harmful prompts used to estimate the refusal direction [5] and the Mahalanobis parameters. No jailbreak examples are required. The defender knows that adaptive jailbreak attacks exist and may target the defense, but does not have access to the specific suffixes an attacker will use at deployment time.
Adaptive Attack Design
JBShield [52] reports 0% ASR against GCG-based adaptive attacks in which the attack objective is modified to weaken the toxic concept and enhance the jailbreak concept (Table 9 in [52]). However, the specific loss formulation used for this adaptive evaluation is not described in detail, and no implementation is publicly available at the time of writing. In our own experiments, standard GCG with target-string optimization does not produce adversarial suffixes that evade JBShield. Motivated by this, we develop an adaptive attack that replaces the target-string objective with representation-level optimization terms that evade JBShield’s detection. Our goal is to generate adversarial suffixes that satisfy two conditions simultaneously: they should weaken the base model’s refusal behavior enough to induce an unsafe response, and they should evade JBShield detection. We first explore a refusal-direction based objective that directly weakens refusal in activation space. This objective can reduce refusal behavior, but it does not reliably suppress JBShield’s detection on the toxic and jailbreak concepts. We then introduce detector-aware objectives that directly target JBShield’s two concept scores in a joint manner. Finally, we combine refusal suppression with JBShield-aware regularization to obtain our final method, JB-GCG.
5.1
Directional-GCG
We begin with an objective that directly suppresses refusal behavior in activation space. Let r𝑙 denote the refusal direction at layer 𝑙 extracted as shown in Section 3.3. Let h𝑙 denote the hidden-state representation at the final token position when the harmful query, 𝑞, is appended by an adversarial suffix, 𝑥. If refusal behavior is encoded along r𝑙 , then the cosine similarity between r𝑙 and h𝑙 measures how strongly the current hidden-state representation aligns with refusal-related features. Based on this idea, we define Directional-GCG as min LD-GCG (𝑥) = − cos(r𝑙 , h𝑙 ).
𝑥 ∈ V 𝑛𝑥
(8)
This objective pushes the hidden representation away from the refusal direction and therefore targets refusal more directly. Compared with target-string optimization in standard GCG, this objective is also less restrictive, since it does not require the model to match a fixed affirmative response. Instead, it searches for adversarial suffixes that broadly reduce refusal-related alignment in activation space. Directional-GCG can produce suffixes that suppress refusal behavior. However, because it does not explicitly optimize against JBShield’s detector, prompts generated by this method may still be flagged as jailbreak attempts.
5.2
Joint-GCG
The previous objective targets refusal behavior, but refusal evasion alone is insufficient if JBShield still detects the harmful prompt. We
Revisiting JBShield: Breaking and Rebuilding Representation-Level Jailbreak Defenses
Conference acronym ’XX, ,
therefore introduce a detector-aware baseline that directly optimizes against JBShield’s two concept scores. Let vjailbreak and vtoxic denote the input-dependent concept representations extracted by JBShield with the suffix, 𝑥, and let v 𝑗 and v𝑡 denote the corresponding anchor concept representations. We define Joint-GCG as
Table 1: Directional-GCG results for different refusaldirection and optimization-layer settings. ASR shows the percentage of successful attacks that both induce harmful output from the model and evade JBShield-D.
min LJ-GCG (𝑥) = −𝛼 cos(vtoxic, v𝑡 ) − 𝛽 cos(vjailbreak, v 𝑗 ), (9)
𝑙 dir 𝑙 opt 18 18 17 18 26
𝑥 ∈ V 𝑛𝑥
where 𝛼 and 𝛽 control the importance of the jailbreak and toxic concept terms. This objective serves as a detector-evasion baseline: it tests whether directly minimizing JBShield’s two conceptalignment scores is sufficient to produce adversarial suffixes that bypass the detector. Since JBShield requires both concept scores to exceed threshold before flagging an input, reducing either score may be sufficient for evasion. However, jointly minimizing both terms can introduce optimization interference, and detector-only optimization might not suppress the model’s refusal behavior.
5.3
JB-GCG
The above observations suggest that a successful attack against JBShield must satisfy two conditions simultaneously: it must suppress refusal in the base model and reduce detector-side concept activation sufficiently to evade detection. Motivated by this, we define our final method, JB-GCG, by combining the Directional-GCG objective with a JBShield-aware regularization term. The choice of which concept to regularize depends on the concept which yields higher ASR. The experiment in Section 6.2 shows that the toxic concept is the dominant signal under JBShield’s detection, which motivates the toxic-concept regularizer in the final objective. min LJB-GCG (𝑥) = − cos(r𝑙 , h𝑙 ) + cos2 (vtoxic, v𝑡 ).
𝑥 ∈ V 𝑛𝑥
(10)
The first term suppresses refusal by reducing alignment with the refusal direction, while the second term penalizes alignment with JBShield’s toxic concept representation. We use the squared cosine in Eq. (10) rather than the linear form because its gradient vanishes as the toxic concept score approaches zero, allowing the optimizer to shift focus to refusal suppression once evasion is achieved. These terms encourage adversarial suffixes that both weaken refusal and evade representation-level detection. Empirically, this objective consistently suppresses the toxic concept while leaving the jailbreak concept active, which is sufficient to evade JBShield because its detector requires both concepts to exceed threshold. We use JB-GCG as the final attack method in our evaluation.
5.4
Optimization Details
In all experiments, we define (𝑙 dir, 𝑙 opt ) as the layer from which the refusal direction is extracted and the layer at which the hidden-state representations are optimized, respectively. We extract hidden-state representations at the final token position for all cosine-similarity computations. For detector-aware objectives, optimization terminates once the current prompt is no longer flagged by JBShield. For JB-GCG, this means that optimization stops when the toxic concept cosine similarity falls below its corresponding threshold and the generated response is non-refusal. If these conditions are not satisfied, optimization continues until the iteration budget is exhausted. Unless otherwise stated, all experiments are conducted on Llama-3 8B with 100 randomly sampled HarmBench prompts.
6
18 18 32 32 32
Dataset
Generated / Total Toxic Detect. JB Detect. ASR
HarmBench JBShield test HarmBench HarmBench HarmBench
98 / 100 99 / 100 95 / 100 99 / 100 97 / 100
92.8 95.6 97.8 96.9 96.9
100.0 100.0 100.0 100.0 100.0
6.1 1.0 1.0 2.0 3.0
Experiments
We first start by evaluating whether refusal suppression is effective enough to break JBShield-D. Then, we evaluate whether detectoraware optimization alone is sufficient to evade JBShield-D. In our last attack, we evaluate whether combining refusal suppression with detector-aware regularization yields successful jailbreaks against the full JBShield defense pipeline, including JBShield-M. We separately report toxic and jailbreak concept detections in order to determine which part of JBShield’s decision rule is being broken by the attack. ASR against both JBShield-D and JBShield-M are evaluated by SORRY-Bench [46]. Generated / Total denotes the number of prompts for which optimization produced a candidate suffix. Toxic Detection and JB Detection report the percentage of generated suffixes detected by the toxic and jailbreak concepts, respectively. ASR reports the percentage of generated suffixes that both induce harmful behavior and evade JBShield.
6.1
Directional-GCG against JBShield
Before constructing the attack, we must select the layer from which to extract the refusal direction. We perform a layer-wise ablation study on Llama-3-8B, ablating the refusal direction at each layer and measuring the resulting safety score (Appendix A). Layers 17–22 yield the lowest safety scores after ablation, indicating that refusal behavior is most strongly expressed in this range. We select layer 18 as the primary extraction layer for Directional-GCG. Table 1 reports results across several refusal-direction extraction layer, optimization layer, and dataset configurations. In the primary configuration, (𝑙 dir, 𝑙 opt ) = (18, 18) on HarmBench, Directional-GCG successfully generates candidate suffixes for 98 out of 100 prompts, confirming that refusal-direction optimization effectively suppresses the model’s refusal behavior. However, JBShield detects nearly all generated suffixes: the toxic concept detection flags 92.8% (91 suffixes) and the jailbreak concept detector on 100% (98 suffixes). As a result, only 6 suffixes both evade detection and elicit harmful output, yielding an ASR of 6.1%. To assess whether the choice of dataset affects this pattern, we evaluate the same layer configuration on the JBShield test set. 99 out of 100 suffixes are generated, with toxic and jailbreak detection rates of 95.6% and 100%, respectively, and an ASR of only 1%. This confirms that the low attack effectiveness is not an artifact of the evaluation dataset. We further investigate whether varying the optimization layer relative to the direction extraction layer changes this outcome. Decoupling the two layers, (𝑙 dir, 𝑙 opt ) = (18, 32), produces 99 suffixes
Conference acronym ’XX, ,
Derya et al.
Table 2: Joint-GCG results for different weight settings. 𝛼 and 𝛽 values are used to tune the weights of concept similarities. 𝛼
𝛽
0.0 0.5 0.5 1.0 1.0 1.0
1.0 1.0 0.5 0.0 0.5 1.0
Generated / Total Toxic Detect. JB Detect. 100 / 100 100 / 100 99 / 100 94 / 100 82 / 100 98 / 100
100.0% 92.0% 72.7% 0.0% 1.2% 72.4%
0.0% 8.0% 27.2% 100.0% 100.0% 27.5%
ASR 0.0% 6.0% 13.1% 50.0% 40.2% 14.2%
but yields toxic and jailbreak detection rates of 96.9% and 100%, respectively, with an ASR of only 2%. Shifting the direction extraction to a lower layer (𝑙 dir, 𝑙 opt ) = (17, 32) similarly results in near-total detection and an ASR of 1%. Extracting the refusal direction from a higher layer (𝑙 dir, 𝑙 opt ) = (26, 32) likewise fails to improve evasion, achieving an ASR of 3.1%. Across all configurations, the jailbreak concept detection flags 100% of generated suffixes, and the toxic concept detection consistently exceeds 92%. These results confirm that refusal-direction optimization systematically drives the model’s hidden states toward the concept subspaces that JBShield monitors, regardless of the layer choices involved. This demonstrates that refusal suppression alone is fundamentally insufficient against JBShield, and motivates the addition of an explicit detector-aware regularization term.
6.2
Joint-GCG against JBShield
We investigate whether JBShield can be evaded by directly modifying GCG’s objective to optimize detector-side concept similarities. Figure 6 (Appendix B) shows cosine-similarity plot of toxic and jailbreak concepts for four Joint-GCG settings. When only the toxic concept is targeted (𝛼=1.0, 𝛽=0.0), the toxic score decreases substantially but remains above its detection threshold, while the jailbreak score rises sharply (Figure 6a). This inverse coupling reveals that the two concept signals are tightly linked under token-level optimization: token updates that reduce one score tend to elevate the other. When only the jailbreak concept is targeted (𝛼=0.0, 𝛽=1.0), optimization terminates within a few steps (Figure 6b), indicating that jailbreak concept evasion is trivially achievable. However, no harmful outputs are produced, confirming that jailbreak detection evasion alone is insufficient. We present the cosine-similarity trajectories of JBShield concepts under two different Joint-GCG weights in Appendix B. Table 2 confirms two patterns. First, targeting the toxic concept (𝛼 ≥ 1.0) yields substantially higher ASR than targeting the jailbreak concept, reaching 50% when only the toxic concept is optimized which suggests that toxic concept evasion is the more attack-relevant objective. Second, at 50% ASR, nearly half of the evading suffixes fail to elicit harmful outputs, showing that detector evasion alone might under-perform without explicit refusal suppression. This motivates the combined objective in Section 6.3.
6.3
JB-GCG against JBShield
JB-GCG against JBShield-D. We next evaluate JB-GCG across different refusal-direction and optimization-layer settings. Table 3 reports the number of prompts for which optimization generated a
candidate suffix, the toxic and jailbreak detection rates among those generated suffixes, and the final ASR. Table 3 shows that JB-GCG improves over the detector-only baselines and over refusal suppression without detector-aware regularization. The strongest setting is (𝑙 dir, 𝑙 opt ) = (18, 18) on HarmBench, where JB-GCG produces candidate suffixes for 88 out of 100 prompts and achieves an ASR of 53.4% with zero toxic detections. On the JBShield test set, the same layer setting remains effective, producing 95 candidate suffixes out of 100 prompts and achieving an ASR of 48.4%. For optimization at layer 32, the best result is obtained with (26, 32), which achieves 46.8% ASR with zero toxic detections. Even when using a refusal direction extracted from layer 17 and applied at layer 32, JBShield detects only 1 of 45 generated suffixes through the toxic concept while the ASR still reaches 40.6%. Notably, the jailbreak concept remains active in all final JB-GCG settings: the jailbreak detection rate is 100% for every generated suffix in Table 3. This shows that JB-GCG does not evade JBShield by suppressing both detector-side concepts. Instead, it consistently breaks the conjunction in JBShield’s detection rule by reducing the toxic concept below threshold while leaving the jailbreak concept active. In other words, the final attack succeeds by exploiting the fact that JBShield requires both toxic and jailbreak concepts to be detected simultaneously. Overall, these results show that adaptive jailbreaks against JBShield require both refusal suppression and detector-aware optimization. Detector-only objectives can evade JBShield, while refusal-only objectives remain highly detectable. In contrast, JB-GCG combines both ingredients and achieves the strongest attack success rates across the evaluated settings. JB-GCG against JBShield-M. We further evaluate whether JBGCG remains effective against the full JBShield defense pipeline, including the mitigation component JBShield-M. Recall that JBShieldM strengthens the toxic concept and weakens the jailbreak concept for prompts detected as jailbreaks, with the goal of steering the model toward safe behavior rather than issuing a fixed refusal output. The ASR-M column of Table 3 reports the attack success rate of JB-GCG against JBShield-M across different refusal-direction and optimization-layer settings. JB-GCG remains effective even when JBShield’s mitigation component is applied. The strongest result is obtained for (𝑙 dir, 𝑙 opt ) = (18, 18) on HarmBench, where the attack reaches 30.7% ASR. On the JBShield test set, the same setting achieves 26.3% ASR. For optimization at layer 32, ASR remains between 23.5% and 28.9% across the evaluated layer settings. These results show that the attack does not only evade the detector in some cases, but can also remain effective against JBShield’s hidden-state mitigation mechanism. Compared with the JBShield-D results, the ASR under JBShield-M is lower, which is expected because mitigation introduces an additional defense stage after detection. Nevertheless, the remaining attack success rates indicate that JBShield’s mitigation mechanism is not sufficient to eliminate adaptive jailbreaks crafted by JB-GCG. Calibration-Size Sensitivity. We further study whether JB-GCG remains effective when JBShield is recalibrated with different calibration sizes. Since the calibration size 𝑁 changes the anchor vectors and thresholds used by JBShield, we re-run JB-GCG against each recalibrated defense instance. Table 4 reports results for the
Revisiting JBShield: Breaking and Rebuilding Representation-Level Jailbreak Defenses
Conference acronym ’XX, ,
Table 3: JB-GCG results for different refusal-direction and optimization-layer settings. ASR-D and ASR-M denote attack success rate against JBShield-D and JBShield-M, respectively. The second row uses the JBShield test set; all other rows use HarmBench. 𝑙 dir
𝑙 opt
Dataset
Generated / Total
Toxic Detect.
JB Detect.
ASR-D
ASR-M
18 18 17 18 26
18 18 32 32 32
HarmBench JBShield test HarmBench HarmBench HarmBench
88 / 100 95 / 100 91 / 100 93 / 100 96 / 100
0.0% 0.0% 1.1% 0.0% 1.0%
100.0% 100.0% 100.0% 100.0% 100.0%
53.4% 48.4% 40.6% 41.9% 46.8%
30.7% 26.3% 27.9% 23.5% 28.9%
10 20 30 40 50
88 / 100 87 / 100 88 / 100 92 / 100 89 / 100
0.0% 0.0% 0.0% 0.0% 0.0%
100.0% 100.0% 100.0% 100.0% 100.0%
59.0% 43.6% 53.4% 64.1% 53.9%
32.9% 26.4% 30.7% 38.0% 32.5%
(𝑙 dir, 𝑙 opt ) = (18, 18) setting on HarmBench. JB-GCG remains effective across all evaluated calibration sizes. For every value of 𝑁 , the attack generates candidate suffixes for most prompts, the jailbreak concept remains active for all generated suffixes, and the toxic concept is suppressed to zero detection. This indicates that the attack continues to break JBShield’s detection rule by selectively reducing the toxic concept while leaving the jailbreak concept active. The strongest recalibrated setting is 𝑁 = 40, where JB-GCG generates suffixes for 92 out of 100 prompts and achieves 64.1% ASR against JBShield-D and 38.0% ASR against JBShield-M. Even for the least favorable setting, 𝑁 = 20, the attack still reaches 43.6% ASR against JBShield-D and 26.4% ASR against JBShield-M. These results show that JB-GCG is not tied to a single fragile calibration instance, but remains effective across multiple JBShield recalibrations.
7 Representation Trajectory Verification (RTV) 7.1 Representation-Level Signatures of JB-GCG The success of JB-GCG against JBShield raises the question of whether the attack leaves detectable traces that a better-designed defense could exploit. JBShield monitors a single concept at a single layer via rank-1 SVD, and JB-GCG succeeds by targeting exactly that layer and concept. However, the model processes representations through a number of transformer layers, and the attack’s manipulation at the detection layer may produce detectable artifacts at other layers. To investigate, we extract the refusal direction 𝑟𝑙 at layers 18 and 32 using difference-in-means over 100 harmful and 100 harmless prompts, and compute the cosine similarity between 𝑟𝑙 and the hidden states of harmless, harmful, and JB-GCG prompts at multiple token positions. Layer-wise behavior. Figure 3 shows that harmless prompts maintain consistently positive refusal-direction alignment across both
0.4
Cosine Similarity
𝑁 Gen. / Total Toxic Detect. JB Detect. ASR-D ASR-M
Refusal Direction Comparisons (Layer 18)
0.6
0.2 0.0 0.2 0.4 0.6
Refusal dir vs harmless hidden states Refusal dir vs harmful hidden states Refusal dir vs JB-GCG hidden states
4
3
2
1
0
1
Token Position (0 = last token)
2
3
4
(a) Cosine similarities at layer 18.
Refusal Direction Comparisons (Layer 32)
0.6 0.4
Cosine Similarity
Table 4: Calibration-size sensitivity of JB-GCG against JBShield for the (𝑙 dir, 𝑙 opt ) = (18, 18) setting on HarmBench. ASRD and ASR-M denote attack success rate against JBShield-D and JBShield-M, respectively.
0.2 Refusal dir vs harmless hidden states Refusal dir vs harmful hidden states Refusal dir vs JB-GCG hidden states
0.0 0.2 0.4 0.6 4
3
2
1
0
1
Token Position (0 = last token)
2
3
4
(b) Cosine similarities at layer 32.
Figure 3: Refusal-direction cosine similarities across token positions at layers 18 and 32 for harmless, harmful, and JB-GCG prompts. Legitimate categories maintain consistent sign; JB-GCG occupies a distinctive zone at layer 18 that amplifies toward harmful at layer 32.
layers, while harmful prompts maintain consistently negative alignment. JB-GCG prompts exhibit a qualitatively different pattern. At layer 18, the optimization target, they occupy an intermediate zone near zero. By layer 32, the model’s own processing amplifies the adversarial features, pulling JB-GCG representations toward the harmful region. This inter-layer inconsistency is absent from both legitimate categories, whose refusal-direction alignment remains stable across layers. Fingerprint heatmap. Figure 4 presents the average fingerprint matrix 𝐹 ∈ R3×5 for each category across three layers (18, 25, 32) and the last five token positions. Harmless prompts are uniformly mildly positive at layers 18 and 25, with slightly negative values at
Conference acronym ’XX, ,
Average Fingerprint Matrix per Category Harmful JB-GCG
25 0.14 0.15 0.10 0.13 0.27
25 0.10 -0.14 -0.15 -0.30 -0.54 25 0.09 0.11 0.09 0.07 0.15
32 -0.05 -0.08 -0.07 -0.05 0.18
32 -0.10 -0.31 -0.34 -0.43 -0.61 32 -0.07 -0.10 -0.08 -0.13 -0.01
-4
-3
-2
-1
Token position
0
-4
-3
-2
-1
Token position
0
-4
-3
-2
-1
Token position
0
Cosine similarity with refusal direction
18 0.09 -0.25 -0.34 -0.32 -0.47 18 0.04 0.06 0.02 0.06 0.14
Layer
Layer
18 0.14 0.17 0.07 0.15 0.29
Table 5: Design comparison between JBShield-D and RTV.
Layer
Harmless
Derya et al.
0.8 0.6 0.4 0.2 0.0 0.2 0.4 0.6 0.8
Figure 4: Average fingerprint matrix per category (3 layers × 5 positions). JB-GCG occupies a near-zero distinctive zone between the positive harmless and negative harmful profiles. layer 32 for earlier positions. Harmful prompts are strongly negative throughout, with magnitude increasing at deeper layers and later positions. JB-GCG prompts occupy a narrow band near zero, a distinctive zone that neither legitimate category densely populates. JB-GCG’s optimization pushes representations away from the refusal direction at layer 18 but cannot control how the model processes hidden-states at deeper layers, resulting in a fingerprint that matches neither harmless nor harmful profiles. Furthermore, in Appendix C, we show PCA and t-SNE projections of the 15dimensional fingerprint space that confirm the cluster separations.
7.2
Defense Design
RTV detects jailbreak prompts by measuring whether their refusaldirection alignment profile across layers and token positions is consistent with either legitimate category (harmless or harmful). The design is motivated by three specific JBShield vulnerabilities that JB-GCG exploits: (1) single-layer extraction (JBShield monitors one layer per concept), (2) rank-1 concept subspaces (easily targeted by gradient optimization), (3) and an AND-gate (the attacker needs to suppress only one concept). RTV avoids all three. Fingerprint construction. For an input prompt 𝑥, we extract a fingerprint matrix 𝐹 (𝑥) ∈ R𝐾 ×𝑃 : (𝑝 )
𝐹𝑙,𝑝 (𝑥) = cos(𝑟𝑙 , h𝑙
(𝑥)),
(11)
where 𝑟𝑙 is the normalized refusal direction at layer 𝑙, extracted via difference-in-means [5] over harmful and harmless calibration (𝑝 ) prompts, and h𝑙 (𝑥) is the hidden state at layer 𝑙 and token position 𝑝. We use 𝐾 = 3 layers (𝑙 ∈ {18, 25, 32}) and 𝑃 = 5 token positions (the last five tokens), yielding a 15-dimensional fingerprint that is flattened to f (𝑥) ∈ R15 . The layers are selected to span the range where refusal behavior is expressed. Layer 18 is where refusal is most sensitive. (Appendix A), layer 32 is where the model amplifies adversarial features, and layer 25 provides intermediate coverage. Multiple token positions capture the causal-attention structure. The adversarial suffix directly influences later positions but affects earlier positions only indirectly through attention, creating a position-dependent signal that aids detection. Calibration. From a calibration set of 𝑁 harmless and 𝑁 harmful prompts, we compute the mean fingerprint 𝝁 + and covariance 𝚺+ for harmless prompts, and 𝝁 − and 𝚺 − for harmful prompts. With 𝑑 = 15 dimensions and 𝑁 = 100 samples per class (𝑁 /𝑑 ≈ 6.7),
Property
JBShield-D
RTV
Layers monitored 1 per concept 3 simultaneously Token positions Last token only Last 5 tokens Feature extraction Rank-1 SVD Cosine similarity Decision rule AND-gate (2 thresholds) Single Mahalanobis threshold Jailbreak examples needed Yes (𝑁 = 30) No Calibration data ∼90 prompts ≥ 40 prompts
the sample covariance can be ill-conditioned. We use Ledoit-Wolf shrinkage [20], yielding a well-conditioned estimate without crossvalidation. No jailbreak examples are required for calibration. Detection. For a test prompt 𝑥, we compute the Mahalanobis distance [21] to both calibration clusters: √︃ (12) 𝑑 + (𝑥) = (f (𝑥) − 𝝁 + ) ⊤ 𝚺+−1 (f (𝑥) − 𝝁 + ), and analogously for 𝑑 − (𝑥). The detection score is 𝑀 (𝑥) = min(𝑑 + (𝑥), 𝑑 − (𝑥)).
(13)
A prompt is flagged as adversarial when 𝑀 (𝑥) > 𝑇 , where 𝑇 is calibrated at the 95th percentile of the combined harmless and harmful calibration scores (targeting 5% FPR). Our 15-dimensional fingerprint space, bounded in [−1, 1] and composed of cosine similarities, satisfies OOD assumptions better than the high-dimensional raw activation spaces where the method was originally validated [21], as confirmed by the ellipsoidal cluster structure in Figure 7a. Comparison with JBShield. Table 5 summarizes the design differences. RTV operates during a single forward pass with negligible computational overhead. Unlike JBShield’s AND-gate, which an attacker can bypass by suppressing a single concept arm, RTV employs a single unified threshold over a compact fingerprint space. RTV also requires no jailbreak prompts for calibration.
7.3
Detection Results
Detection of JB-GCG. We evaluate RTV on a test set of 100 harmless prompts from Alpaca [41], 100 harmful prompts from HarmBench [26], and 164 JB-GCG adversarial prompts (all prompts generated by different JB-GCG configurations from Section 6.3). From the same datasets, the calibration set consists of a separate 100 harmless and 100 harmful prompts used for refusal-direction extraction and Mahalanobis parameter estimation. No jailbreak prompts are used during calibration. Figure 1 shows the distribution of Mahalanobis scores 𝑀 (𝑥) across the three categories. The JB-GCG distribution (median 7.1) is well-separated from both the harmless (median 2.7) and harmful (median 2.7) distributions, with minimal overlap. Table 6 reports the headline detection metrics. At the 5% FPR operating point, RTV detects all of 164 JB-GCG prompts, the same attack that achieves 53.4% ASR against JBShield-D, which detects 0% of these prompts via its toxic concept. Furthermore, we verify that RTV’s performance is not sensitive to the specific calibration data in Appendix D, showing that AUROC varies by only 0.003 across splits, while TPR remains at or above 99.4%. In Appendix E, we evaluate RTV across calibration sizes 𝑁 ∈ {10, 20, 30, 50, 100} per class, showing that RTV requires as few as 𝑁 = 20 calibration samples per class to achieve ≥97% detection. In Appendix F, we
Revisiting JBShield: Breaking and Rebuilding Representation-Level Jailbreak Defenses
Table 6: RTV detection performance against JB-GCG. Metric
Value
AUROC TPR @ 5% FPR TPR @ 1% FPR
0.9946 100.00% (164/164) 81.10% (133/164)
Table 7: RTV detection accuracy across standard jailbreak attacks on Llama-3-8B, compared with JBShield-D. RTV uses Mahalanobis based outlier detector at 5% FPR. Attack
𝑛
JBShield-D
RTV
IJP GCG SAA AutoDAN PAIR DrAttack Puzzler Zulu Base64
50 50 50 50 50 50 50 50 50
0.91 0.98 1.00 0.97 0.77 0.97 0.99 0.99 0.97
0.96 0.88 1.00 0.72 0.58 1.00 1.00 1.00 1.00
JB-GCG
164
∼0%
100%
present our ablation experiments on RTV, showing that using 3layer configuration offers 100% detection against JB-GCG and using the last five tokens improves the detection performance compared to using the last three token. Generalization Across Attack Types. To evaluate whether RTV generalizes beyond JB-GCG, we test it on nine standard jailbreak attacks from the JBShield evaluation suite, using 50 prompts per attack on Llama-3-8B. The same calibration statistics are used without recalibration. Table 7 shows that RTV achieves perfect detection on five of nine attacks (SAA, DrAttack, Puzzler, Zulu, Base64) and near-perfect on IJP (0.96), matching or exceeding JBShield-D. RTV underperforms JBShield-D on AutoDAN (0.72 vs. 0.97) and GCG (0.88 vs. 0.98), and both defenses struggle with PAIR (0.58 vs. 0.77). PAIR generates naturalistic prompts via iterative LLM refinement, producing representations that are inherently close to the harmless distribution, a fundamental challenge for any representation-level detector. The gap between RTV and JBShield-D on standard attacks reflects a fundamental design tradeoff. JBShield-D calibrates a separate jailbreak layer and concept direction per attack family, requiring 30 jailbreak examples from each target attack type. JBShield-D assumes the defender knows the attack family at the inference time. RTV requires no jailbreak examples and uses a single fixed detector across all attacks, without assuming the attack family. Under this zero-shot constraint, RTV underperforms JBShield-D on attacks whose representations are close to the harmless distribution (PAIR, AutoDAN) but matches or exceeds it on six others. The critical difference is adaptive robustness. JBShield-D achieves 0% detection against JB-GCG, while RTV detects 100% of the same attack using the same calibration.
Conference acronym ’XX, ,
Table 8: Adaptive attack results against RTV, evaluated by SORRY-Bench. JB-GCG baseline (first row) is evaluated against JBShield-D for comparison. Cost is measured in iteration count. ML-GCG achieves 7.0% ASR against RTV, (53.4% for JB-GCG against JBShield-D) at 13× computational cost.
Attack
Defense
ASR
Avg. Iter.
Cost
JB-GCG JB-GCG RTV-GCG (Eq. 14) ML-GCG (Eq. 15)
JBShield-D RTV RTV RTV
53.4% 0.0% 4.0% 7.0%
39.6 39.6 526.4 514.5
1× 1× 13.3× 13.0×
7.4
Adaptive Attack on RTV
We evaluate RTV under adaptive adversaries that have full whitebox knowledge of the defense (the fingerprint definition, calibration statistics (𝝁 + , 𝚺+−1 ), the detection threshold 𝑇 ). This is the strongest possible passive threat model for a representation-level defense. Single-Layer Adaptive Attack. We modify the JB-GCG objective to include a fingerprint evasion term that directly targets the Mahalanobis distance: 𝜆𝑀 , (14) LRTV-GCG (𝑥) = − cos(𝑟 18, ℎ 18 ) + 2 𝑑 + (f (𝑥)) + 𝜖 where 𝑑 +2 (f (𝑥)) is the squared Mahalanobis distance from the fingerprint to the harmless cluster and 𝜖 = 10−6 . The first term suppresses refusal at layer 18 (as in JB-GCG), while the second term pushes the fingerprint toward the harmless distribution to evade RTV detection. The objective is fully differentiable. We sweep 𝜆𝑀 ∈ {0.1, 0.5, 1.0, 2.0, 5.0} on a 20-prompt pilot set and select 𝜆𝑀 = 0.1 for full evaluation, since this case yielded the highest ASR on the pilot set, with a budget of 600 iterations per prompt. Multi-Layer Adaptive Attack. Because RTV monitors layers 18, 25, and 32, we also test a stronger variant that suppresses refusal at multiple layers simultaneously: ∑︁ 𝜆𝑀 LML-GCG (𝑥) = − 𝛼𝑙 · cos(𝑟𝑙 , ℎ𝑙 ) + 2 , (15) 𝑑 (f (𝑥)) +𝜖 + 𝑙 ∈ {18,32} with 𝛼 18 = 𝛼 32 = 1.0 and 𝜆𝑀 = 0.1. This variant targets layers 18 and 32 specifically, the two layers that the pilot-sweep on layer configurations identifies as most discriminative. The rationale is that suppressing refusal at the deeper layer may prevent the interlayer amplification that creates the fingerprint tension JB-GCG exploits. Results. Table 8 reports the results under SORRY-Bench evaluation. The strongest adaptive attack (ML-GCG) achieves 7.0% ASR against RTV, compared with 53.4% for JB-GCG against JBShield-D, a 7.6× reduction. This comes at 13× computational cost to the attacker. The average prompt exhausts most of the 600-iteration budget (514.5 iterations) due to the conflicting optimization objectives. The evasion bottleneck. Across both adaptive attacks (200 total prompts), zero prompts achieved evasion without also producing a jailbreak response. Every prompt that evaded RTV also suppressed refusal. The converse does not hold. This asymmetry demonstrates
Conference acronym ’XX, ,
that evasion is the binding constraint. The attacker can suppress refusal cheaply (95% jailbreak rate) but cannot simultaneously control the 15-dimensional fingerprint to match the harmless distribution. The fundamental conflict is between the two terms in Equations 14 and 15. Matching the harmless fingerprint requires positive refusaldirection alignment at layer 18 (𝐹 18,: > 0), which directly opposes the refusal-suppression term that pushes h18 away from r18 .
8
Discussion
Why RTV is structurally harder to attack than JBShield. JBShield’s AND-gate gives the attacker a binary escape. The attacker can suppress either the toxic or jailbreak concept, and the entire defense falls. JB-GCG exploits this by driving the toxic concept below threshold while leaving the jailbreak concept active. RTV eliminates this structural vulnerability. Its Mahalanobis distance operates over a 15-dimensional fingerprint with no conjunctive decomposition. The attacker must simultaneously match the legitimate distribution across all 15 dimensions, each corresponding to a specific layer-position combination’s alignment with the refusal direction. Our adaptive attack evaluation confirms this. Across 200 prompts (Section 7.4), the strongest attacker achieves only 7% ASR at 13× computational cost, with zero evasion-only outcomes. The bottleneck is entirely on evasion, not jailbreaking. The fingerprint tension as a defense mechanism. The core reason RTV resists adaptive attack is a fundamental conflict between the attacker’s two objectives. Suppressing refusal requires pushing the layer-18 hidden state away from the refusal direction, producing negative or near-zero cosine similarity at that layer. Matching the harmless fingerprint requires the opposite, positive cosine similarity across all layers and positions. The attacker cannot satisfy both simultaneously for most prompts. The 7% of prompts where the attack succeeds represent cases where this tension is naturally weak. These are the queries whose representations are inherently closer to the harmless distribution. This suggests that the tension is a property of the prompt content, not a parameter the attacker can optimize away. The average iterations for successful prompts (181 vs. 514.5 overall for ML-GCG; 70.5 vs. 526.4 for RTV-GCG) confirm that successful evasions converge relatively quickly on “easy” prompts, while the majority of prompts exhaust the iteration budget without finding a feasible solution. Refusal directions are layer-local. The cosine similarity analysis in Section 7.1 shows that JB-GCG prompts occupy an ambiguous distinctive zone at layer 18 but amplify toward harmful alignment at layer 32 (Figure 3). This layer-dependent behavior implies that optimizing the fingerprint at one layer provides limited control over the fingerprint at another layer, because the intermediate transformer blocks impose nonlinear transformations that do not preserve directional structure. Connection to prior work on representation-level defenses. Bailey et al. [6] demonstrate that Mahalanobis-based detectors operating on raw activations can be bypassed by obfuscation attacks that steer activations into the harmless region while maintaining harmful generation. RTV differs in a key respect. It operates on refusal-direction cosine similarities, not raw activations. This is a
Derya et al.
lower-dimensional, more constrained feature space where the attacker is limited by the tension described above. Whether this distinction provides robustness against obfuscation-style attacks beyond GCG-style suffix optimization is an open question. We note, however, that Bailey et al.’s attack [6] requires embedding-space access, which is a different threat model than the token-level discrete optimization we evaluate against. Extending RTV’s adaptive evaluation to embedding-space attackers is an important direction for future work.
8.1
Limitations
Single model. All experiments are conducted on Llama-3-8B. While the refusal-direction phenomenon has been observed across 13+ open-source models [5], we have not verified that RTV’s fingerprint separation and detection performance generalize to other architectures or model scales. The layer selection (18, 25, 32) is specific to Llama-3-8B’s 32-layer architecture and would need re-calibration for models with different depths. PAIR and naturalistic attacks. RTV achieves only 58% detection on PAIR, which generates linguistically fluent jailbreak prompts via iterative LLM refinement. PAIR prompts produce representations that are inherently close to the harmless distribution in fingerprint space, making them difficult for any representation-level detector. JBShield also struggles with PAIR (77% accuracy), suggesting this is a shared limitation of the defense paradigm rather than an RTV-specific weakness. Defenses that combine representation-level signals with semantic analysis of prompt content may be necessary to address this class of attacks. Nonzero adaptive ASR The strongest adaptive attack achieves 7% ASR. While this is a substantial reduction from JB-GCG’s 53.4% against JBShield, it is not zero. The successful evasions correspond to prompts where the tension between refusal suppression and fingerprint evasion is naturally weak. Closing this gap may require adaptive thresholding, prompt-dependent fingerprint normalization, or integration with complementary defense mechanisms. Static calibration. RTV’s calibration statistics (𝝁 + , 𝚺+ , threshold 𝑇 ) are fixed after calibration. While our stability analysis shows low sensitivity to calibration randomness (AUROC 0.994 ± 0.003), the defense does not adapt to distributional shift in the input population. In deployment scenarios where the distribution of user prompts evolves over time, periodic recalibration may be necessary.
9
Conclusion
We study the robustness of representation-level jailbreak defenses under adaptive threat models using JBShield as a target. Our adaptive attack, JB-GCG, combines refusal-direction suppression with detector-aware optimization to exploit JBShield’s detection rule, achieving up to 53.4% ASR where JBShield reports 0% against standard GCG. We observe that the attack consistently breaks the ANDgate by suppressing the toxic concept while leaving the jailbreak concept active. This demonstrates that strong performance against non-adaptive baselines does not imply robustness against adaptive adversaries. Analyzing why JB-GCG succeeds reveals a multi-layer representation signature. Adversarial prompts occupy a distinctive zone
Revisiting JBShield: Breaking and Rebuilding Representation-Level Jailbreak Defenses
Conference acronym ’XX, ,
in the refusal-direction based fingerprint space. This observation motivates Representation Trajectory Verification (RTV), a defense that monitors refusal-direction cosine similarity across multiple layers and token positions and detects outliers via Mahalanobis distance in the 15-dimensional fingerprint space. RTV achieves 0.99 AUROC against JB-GCG without requiring any jailbreak examples for calibration, and generalizes to five of nine standard attack types with perfect detection. Under the strongest adaptive attack, with full white-box knowledge of the defense, including calibration statistics and detection threshold, the attacker achieves only 7% ASR at 13× computational cost. Our results suggest that multi-layer representation consistency provides a more robust foundation for jailbreak detection than single-layer concept similarity. We note that challenges remain for naturalistic attacks and stronger threat models involving embedding-space optimization.
Systems. https://openreview.net/forum?id=vI1WqFn15v [15] Peichun Hua, Hao Li, Shanghao Shi, Zhiyuan Yu, and Ning Zhang. 2025. Rethinking Jailbreak Detection of Large Vision Language Models with Representational Contrastive Scoring. arXiv preprint arXiv:2512.12069 (2025). [16] Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and Madian Khabsa. 2023. Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations. arXiv preprint arXiv:2312.06674 (2023). [17] Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping-yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. 2023. Baseline Defenses for Adversarial Attacks Against Aligned Language Models. arXiv preprint arXiv:2309.00614 (2023). [18] Yilei Jiang, Xinyan Gao, Tianshuo Peng, Yingshui Tan, Xiaoyong Zhu, Bo Zheng, and Xiangyu Yue. 2025. Hiddendetect: Detecting jailbreak attacks against large vision-language models via monitoring hidden states. arXiv preprint arXiv:2502.14744 3, 5 (2025). [19] Aounon Kumar, Chirag Agarwal, Suraj Srinivas, Aaron Jiaxun Li, Soheil Feizi, and Himabindu Lakkaraju. 2024. Certifying LLM Safety against Adversarial Prompting. In Conference on Language Modeling (COLM). [20] Olivier Ledoit and Michael Wolf. 2004. A well-conditioned estimator for largedimensional covariance matrices. Journal of Multivariate Analysis 88, 2 (2004), 365–411. doi:10.1016/S0047-259X(03)00096-4 [21] Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. 2018. A simple unified framework for detecting out-of-distribution samples and adversarial attacks. Advances in neural information processing systems 31 (2018). [22] Wenyun Li, Zheng Zhang, Dongmei Jiang, and Xiangyuan Lan. 2026. Bolster Hallucination Detection via Prompt-Guided Data Augmentation. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 40. 37618–37626. [23] Yuhui Li, Fangyun Wei, Jinjing Zhao, Chao Zhang, and Hongyang Zhang. 2024. RAIN: Your Language Models Can Align Themselves without Finetuning. International Conference on Learning Representations (ICLR) (2024). [24] Xiao Lin, Philip Li, Zhichen Zeng, Tingwei Li, Tianxin Wei, Xuying Ning, Gaotang Li, Yuzhong Chen, and Hanghang Tong. 2026. ALERT: Zero-shot LLM Jailbreak Detection via Internal Discrepancy Amplification. arXiv preprint arXiv:2601.03600 (2026). [25] Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. 2024. AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models. In International Conference on Learning Representations (ICLR). [26] Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, David Forsyth, and Dan Hendrycks. 2024. HarmBench: a standardized evaluation framework for automated red teaming and robust refusal. In Proceedings of the 41st International Conference on Machine Learning (Vienna, Austria) (ICML’24). JMLR.org, Article 1431, 44 pages. [27] Yi Nian, Shenzhe Zhu, Yuehan Qin, Li Li, Ziyi Wang, Chaowei Xiao, and Yue Zhao. 2025. JailDAM: Jailbreak Detection with Adaptive Memory for Vision-Language Model. In Second Conference on Language Modeling. https://openreview.net/ forum?id=8Pxdzsqvx9 [28] OpenAI. 2023. GPT-4 Technical Report. arXiv preprint arXiv:2303.08774 (2023). doi:10.48550/arXiv.2303.08774 [29] Long Ouyang, Jeff Wu, Xu Jiang, Diogo Almeida, Carroll L. Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, John Schulman, Jacob Hilton, Fraser Kelton, Luke Miller, Maddie Simens, Amanda Askell, Peter Welinder, Paul Christiano, Jan Leike, and Ryan Lowe. 2022. Training Language Models to Follow Instructions with Human Feedback. In Advances in Neural Information Processing Systems, Vol. 35. 27730–27744. [30] Nina Panickssery, Nick Gabrieli, Julian Schulz, Meg Tong, Evan Hubinger, and Alexander Matt Turner. 2023. Steering llama 2 via contrastive activation addition. arXiv preprint arXiv:2312.06681 (2023). [31] Shishir G. Patil, Tianjun Zhang, Xin Wang, and Joseph E. Gonzalez. 2024. Gorilla: Large Language Model Connected with Massive APIs. In Advances in Neural Information Processing Systems, Vol. 37. [32] Ethan Perez, Saffron Huang, Francis Song, Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, and Geoffrey Irving. 2022. Red Teaming Language Models with Language Models. In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing (EMNLP). 3419–3448. [33] Mansi Phute, Alec Helbling, Matthew Hull, ShengYun Peng, Sebastian Szyller, Cory Cornelius, and Duen Horng Chau. 2023. Llm self defense: By self examination, llms know they are being tricked. arXiv preprint arXiv:2308.07308 (2023). [34] Alexander Podolskiy, Dmitry Lipin, Andrey Bout, Ekaterina Artemova, and Irina Piontkovskaya. 2021. Revisiting mahalanobis distance for transformer-based outof-domain detection. In Proceedings of the AAAI conference on artificial intelligence, Vol. 35. 13675–13682. [35] Alexander Robey, Eric Wong, Hamed Hassani, and George J. Pappas. 2025. SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks. Transactions on Machine Learning Research (2025). arXiv preprint arXiv:2310.03684, 2023.
References [1] Andrew Adiletta, Kathryn Adiletta, Kemal Derya, and Berk Sunar. 2025. Super Suffixes: Bypassing Text Generation Alignment and Guard Models Simultaneously. arXiv preprint arXiv:2512.11783 (2025). [2] AI@Meta. 2024. Llama 3 Model Card. (2024). https://github.com/meta-llama/ llama3/blob/main/MODEL_CARD.md [3] Gabriel Alon and Michael Kamfonas. 2023. Detecting language model attacks with perplexity. arXiv preprint arXiv:2308.14132 (2023). [4] Maksym Andriushchenko, Francesco Croce, and Nicolas Flammarion. 2024. Jailbreaking leading safety-aligned llms with simple adaptive attacks. arXiv preprint arXiv:2404.02151 (2024). [5] Andy Arditi, Oscar Obeso, Aaquib Syed, Daniel Paleka, Nina Panickssery, Wes Gurnee, and Neel Nanda. 2024. Refusal in language models is mediated by a single direction. Advances in Neural Information Processing Systems 37 (2024), 136037–136083. [6] Luke Bailey, Alex Serrano, Abhay Sheshadri, Mikhail Seleznyov, Jordan Taylor, Erik Jenner, Jacob Hilton, Stephen Casper, Carlos Guestrin, and Scott Emmons. 2026. Obfuscated Activations Bypass LLM Latent-Space Defenses. In The Fourteenth International Conference on Learning Representations. https: //openreview.net/forum?id=ktGmDGoWnB [7] Tom B. Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, Sandhini Agarwal, Ariel Herbert-Voss, Gretchen Krueger, Tom Henighan, Rewon Child, Aditya Ramesh, Daniel M. Ziegler, Jeffrey Wu, Clemens Winter, Christopher Hesse, Mark Chen, Eric Sigler, Mateusz Litwin, Scott Gray, Benjamin Chess, Jack Clark, Christopher Berner, Sam McCandlish, Alec Radford, Ilya Sutskever, and Dario Amodei. 2020. Language Models are Few-Shot Learners. In Advances in Neural Information Processing Systems, Vol. 33. 1877–1901. [8] Nicholas Carlini, Milad Nasr, Christopher A. Choquette-Choo, Matthew Jagielski, Irena Gao, Pang Wei Koh, Daphne Ippolito, Florian Tramèr, and Ludwig Schmidt. 2023. Are aligned neural networks adversarially aligned?. In Thirty-seventh Conference on Neural Information Processing Systems. https://openreview.net/ forum?id=OQQoD8Vc3B [9] Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J Pappas, and Eric Wong. 2025. Jailbreaking black box large language models in twenty queries. In 2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML). IEEE, 23–42. [10] Paul F. Christiano, Jan Leike, Tom B. Brown, Miljan Martic, Shane Legg, and Dario Amodei. 2017. Deep Reinforcement Learning from Human Preferences. In Advances in Neural Information Processing Systems, Vol. 30. [11] Dylan Feng, Pragya Srivastava, Anca Dragan, and Cassidy Laidlaw. 2026. Benchmarking Anomaly Detection for Large Language Model Alignment. https: //openreview.net/forum?id=Tr74UMzBdw [12] Seungju Han, Kavel Rao, Allyson Ettinger, Liwei Jiang, Bill Yuchen Lin, Nathan Lambert, Yejin Choi, and Nouha Dziri. 2024. WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs. In Advances in Neural Information Processing Systems, Vol. 37. [13] Dan Hendrycks, Xiaoyuan Liu, Eric Wallace, Adam Dziedzic, Rishabh Krishnan, and Dawn Song. 2020. Pretrained transformers improve out-of-distribution robustness. In Proceedings of the 58th annual meeting of the association for computational linguistics. 2744–2751. [14] Xiaomeng Hu, Pin-Yu Chen, and Tsung-Yi Ho. 2024. Gradient Cuff: Detecting Jailbreak Attacks on Large Language Models by Exploring Refusal Loss Landscapes. In The Thirty-eighth Annual Conference on Neural Information Processing
Conference acronym ’XX, ,
Average Safety Scores by Layer (Llama Guard 3 8B)
1.0
0.8
Average Safety Score
0.6
0.4
0.2
2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
gin
al 1
0.0
ori
[36] Victor Sanh, Albert Webson, Colin Raffel, Stephen H. Bach, Lintang Sutawika, Zaid Alyafeai, Antoine Chaffin, Arnaud Stiegler, Teven Le Scao, Arun Raja, Manan Dey, M Saiful Bari, Canwen Xu, Urmish Thakker, Shanya Sharma Sharma, Eliza Szczechla, Taewoon Kim, Gunjan Chhablani, Nihal Nayak, Debajyoti Datta, Jonathan Chang, Mike Tian-Jian Jiang, Han Wang, Matteo Manica, Sheng Shen, Zheng Xin Yong, Harshit Pandey, Rachel Bawden, Thomas Wang, Trishala Neeraj, Jos Rozen, Abheesht Sharma, Andrea Santilli, Thibault Fevry, Jason Alan Fries, Ryan Teehan, Stella Biderman, Leo Gao, Thomas Wolf, and Alexander M. Rush. 2022. Multitask Prompted Training Enables Zero-Shot Task Generalization. In International Conference on Learning Representations (ICLR). [37] Timo Schick, Jane Dwivedi-Yu, Roberto Dessì, Roberta Raileanu, Maria Lomeli, Luke Zettlemoyer, Nicola Cancedda, and Thomas Scialom. 2023. Toolformer: Language Models Can Teach Themselves to Use Tools. In Advances in Neural Information Processing Systems, Vol. 36. [38] Leo Schwinn and Simon Geisler. 2024. Revisiting the robust alignment of circuit breakers. arXiv preprint arXiv:2407.15902 (2024). [39] Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. 2024. “Do Anything Now”: Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models. In Proceedings of the 2024 ACM SIGSAC Conference on Computer and Communications Security (CCS). [40] Nisan Stiennon, Long Ouyang, Jeff Wu, Daniel M. Ziegler, Ryan Lowe, Chelsea Voss, Alec Radford, Dario Amodei, and Paul F. Christiano. 2020. Learning to Summarize from Human Feedback. In Advances in Neural Information Processing Systems, Vol. 33. [41] Rohan Taori, Ishaan Gulrajani, Tianyi Zhang, Yann Dubois, Xuechen Li, Carlos Guestrin, Percy Liang, and Tatsunori B. Hashimoto. 2023. Stanford Alpaca: An Instruction-following LLaMA model. https://github.com/tatsu-lab/stanford_ alpaca. [42] Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, Aurelien Rodriguez, Armand Joulin, Edouard Grave, and Guillaume Lample. 2023. LLaMA: Open and Efficient Foundation Language Models. arXiv preprint arXiv:2302.13971 (2023). doi:10.48550/arXiv.2302.13971 [43] Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. 2020. On adaptive attacks to adversarial example defenses. Advances in neural information processing systems 33 (2020), 1633–1645. [44] Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2023. Jailbroken: How Does LLM Safety Training Fail?. In Advances in Neural Information Processing Systems, Vol. 36. [45] Jason Wei, Maarten Bosma, Vincent Y. Zhao, Kelvin Guu, Adams Wei Yu, Brian Lester, Nan Du, Andrew M. Dai, and Quoc V. Le. 2022. Finetuned Language Models Are Zero-Shot Learners. In International Conference on Learning Representations (ICLR). [46] Tinghao Xie, Xiangyu Qi, Yi Zeng, Yangsibo Huang, Udari Madhushani Sehwag, Kaixuan Huang, Luxi He, Boyi Wei, Dacheng Li, Ying Sheng, et al. 2024. Sorrybench: Systematically evaluating large language model safety refusal. arXiv preprint arXiv:2406.14598 (2024). [47] Yueqi Xie, Minghong Fang, Renjie Pi, and Neil Gong. 2024. GradSafe: Detecting Jailbreak Prompts for LLMs via Safety-Critical Gradient Analysis. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (ACL), Volume 1: Long Papers. 507–518. [48] Yueqi Xie, Jingwei Yi, Jiawei Shao, Justin Curl, Lingjuan Lyu, Qifeng Chen, Xing Xie, and Fangzhao Wu. 2023. Defending ChatGPT Against Jailbreak Attack via Self-Reminders. Nature Machine Intelligence 5, 12 (2023), 1486–1496. [49] Zhangchen Xu, Fengqing Jiang, Luyao Niu, Jinyuan Jia, Bill Yuchen Lin, and Radha Poovendran. 2024. SafeDecoding: Defending against Jailbreak Attacks via Safety-Aware Decoding. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (ACL), Volume 1: Long Papers. 5587– 5605. [50] Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik Narasimhan, and Yuan Cao. 2023. ReAct: Synergizing Reasoning and Acting in Language Models. In International Conference on Learning Representations (ICLR). [51] Wenjun Zeng, Yuchi Liu, Ryan Mullins, Ludovic Peran, Joe Fernandez, Hamza Harkous, Karthik Narasimhan, Drew Proud, Piyush Kumar, Bhaktipriya Radharapu, Olivia Sturman, and Oscar Wahltinez. 2024. ShieldGemma: Generative AI Content Moderation Based on Gemma. arXiv preprint arXiv:2407.21772 (2024). [52] Shenyi Zhang, Yuchen Zhai, Keyan Guo, Hongxin Hu, Shengnan Guo, Zheng Fang, Lingchen Zhao, Chao Shen, Cong Wang, and Qian Wang. 2025. { JBShield } : Defending Large Language Models from Jailbreak Attacks through Activated Concept Analysis and Manipulation. In 34th USENIX Security Symposium (USENIX Security 25). 8215–8234. [53] Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, Ann-Kathrin Dombrowski, et al. 2023. Representation engineering: A top-down approach to ai transparency. arXiv preprint arXiv:2310.01405 (2023). [54] Andy Zou, Long Phan, Justin Wang, Derek Duenas, Maxwell Lin, Maksym Andriushchenko, Rowan Wang, J. Zico Kolter, Matt Fredrikson, and Dan Hendrycks. 2024. Improving Alignment and Robustness with Circuit Breakers. Advances in
Derya et al.
Layers
Figure 5: Layer-wise refusal-direction ablation on Llama-3 8B, evaluated using Llama-Guard-3 8B. Lower safety scores indicate stronger harmfulness after ablation.
Neural Information Processing Systems 37 (2024). [55] Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043 (2023).
A
Model Ablation
For each layer, we extract a refusal direction and then ablate layers by subtracting the projection of the refusal direction from the residual stream. We generate responses from the ablated model and evaluate them with Llama-Guard-3 8B. In this evaluation, a harmless response receives a score close to 1, while a harmful response receives a score close to 0. Figure 5 shows that layers 17–22 yield the lowest safety scores after ablation, indicating that refusal-related behavior is especially sensitive in this range.
B
Joint-GCG Cosine-similarity Trajectories
Figure 6a illustrates the cosine similarity trajectories for 𝛼 = 1.0 and 𝛽 = 0.0. Under this configuration, the toxic concept score decreases throughout optimization. The jailbreak concept score remains high and does not fall below its threshold. This configuration fails to produce a suffix since both concept similarities stay above their thresholds. Figure 6b shows the corresponding trajectories for 𝛼 = 0.0 and 𝛽 = 1.0, where jailbreak concept cosine similarity descends below its respective detection threshold during optimization in a few optimization steps.
C
Cluster Separation
Figure 7 confirms that the distinctive zone pattern translates to perprompt cluster separation. In PCA projection of the 15-dimensional fingerprint space, the three categories form distinct clusters, harmful on the far left, harmless on the far right, and JB-GCG in between. While JB-GCG and harmless are adjacent, they remain separable with a visible gap between the bulk of each cluster. The t-SNE projection shows even sharper separation, with no JB-GCG point falling within either legitimate cluster. This separation motivates a statistical outlier detector in the fingerprint space. The PCA projection shows the separation exists in the original 15-dimensional space, not just in a nonlinear embedding.
Revisiting JBShield: Breaking and Rebuilding Representation-Level Jailbreak Defenses
Conference acronym ’XX, ,
PCA of Fingerprint Space (R^15 R^2)
0.7
Harmless Harmful JB-GCG
0.3
0.5
Jailbreak Concept cosine similarity Toxic Concept cosine similarity Jailbreak Concept detection threshold Toxic Concept detection threshold
0.4
0.2
Component 2
Cosine similarity
0.6
0.3 0.2
0.1
0.0
100
200
300
Optimization step
400
500
600 0.1
(a) 𝛼 = 1.0, 𝛽 = 0.0 0.9
0.2
Cosine similarity
0.8
1.0
0.7 Jailbreak Concept cosine similarity Toxic Concept cosine similarity Jailbreak Concept detection threshold Toxic Concept detection threshold
0.6 0.5
0.5
Component 1
0.0
0.5
(a) PCA projection.
t-SNE of Fingerprint Space (R^15 R^2)
0.4
10
0.3 0.2
5
2
3
4
Optimization step
5
6
(b) 𝛼 = 0.0, 𝛽 = 1.0
Figure 6: Joint-GCG cosine-similarity trajectories under extreme weighting. (a) Targeting toxic concept only: the toxic score decreases but remains above threshold, while the jailbreak score rises sharply. (b) Targeting jailbreak concept only: evasion is achieved within a few steps, but the toxic score remains high and no harmful outputs are produced.
Component 2
1
0
5
10
15
Table 9: RTV stability across random calibration splits.
Mean ± Std
D
AUROC
TPR @ 5% FPR
0.994 ± 0.003
99.9% ± 0.2%
Calibration Stability
We verify that RTV’s performance is not sensitive to the specific calibration data. Table 9 reports results across five random calibration splits (each using 100 harmless + 100 harmful prompts drawn from Alpaca [41] and HarmBench [26], respectively), evaluated on the fixed test set. AUROC varies by only 0.003 across splits, while TPR remains at or above 99.4%.
E
Calibration-Size Sensitivity
We evaluate RTV across calibration sizes 𝑁 ∈ {10, 20, 30, 50, 100} per class. The threshold 𝑇 is recalibrated at each 𝑁 to target 5% FPR
Harmless Harmful JB-GCG 40
20
0
Component 1
20
40
(b) t-SNE projection.
Figure 7: PCA and t-SNE projections of the 15-dimensional fingerprint space. Three categories form distinct clusters, with JB-GCG occupying the intermediate region between harmless and harmful.
on the combined harmless and harmful test set. As shown in Table 10, RTV achieves ≥97% detection for all 𝑁 ≥ 20. At 𝑁 = 10, the Ledoit-Wolf covariance estimate is unreliable in 15 dimensions, producing an inflated threshold (11.03) and reduced detection (79.3%). The threshold stabilizes around 4.5–5.2 for 𝑁 ≥ 20, and FPR tracks close to the 5% target across both harmless and harmful test sets.
Conference acronym ’XX, ,
Derya et al.
Table 10: Calibration-size sensitivity of RTV. Detection rate is on JB-GCG (𝑛 = 164). FPR-h and FPR-hm denote false positive rates on harmless and harmful test prompts, respectively. 𝑁 /class
Threshold 𝑇
Det. Rate
FPR-h
FPR-hm
10 20 30 50 100
11.03 5.19 4.80 4.49 4.71
79.3% (130/164) 100.0% (164/164) 97.0% (159/164) 100.0% (164/164) 100.0% (164/164)
2.0% 5.0% 4.0% 7.0% 7.0%
8.0% 5.0% 6.0% 3.0% 3.0%
Table 11: RTV detection with different layer combinations. Single layer configurations use 5-dimensional fingerprint space. Two-layer configuration uses 10-dimensional fingerprint space. Three and five layer configuration use 15 and 25 dimensional fingerprint space, respectively. Layers
Dim
JB-GCG Det.
AUROC
{18} {25} {32} {18, 32} {18, 25, 32} {18, 22, 25, 29, 32}
5 5 5 10 15 25
97.56% 68.90% 95.12% 99.39% 100.0% 100.0%
0.9924 0.9463 0.9874 0.9964 0.9946 0.9962
Table 12: RTV detection with different token position counts (𝐾 = 3 layers).
F
Positions
Dim
JB-GCG Det.
AUROC
{0} {−1, 0} {−2, −1, 0} {−4, ..., 0}
3 6 9 15
92.68% 96.34% 99.39% 100.0%
0.9761 0.9853 0.9917 0.9946
Ablation Studies
To understand how the performance varies with fingerprint dimensions beyond the chosen configuration (3 layers, 5 token positions), we perform further experiments with results summarizes in Tables 11 and 12.
F.1
Layer Ablation
Table 11 shows RTV detection performance across different layer combinations. Layer 18 alone achieves 0.9924 AUROC, confirming it is the primary detection layer, the layer where JB-GCG directly optimizes refusal suppression. Adding layer 32 improves detection from 97.56% to 99.39% (AUROC 0.9964). Layer 25 contributes minimally: adding it to {18, 32} improves detection to 100% but slightly decreases AUROC (0.9946 vs. 0.9964), likely due to increased covariance estimation noise. Five layers provide no benefit over three.
F.2
Position Ablation
As shown in Table 12, each additional token position adds meaningful discriminative power, with improvement from 0.9761 to 0.9946
AUROC. The gain is consistent across steps, validating the causalattention argument. The adversarial suffix’s influence decays with distance from the last token, so earlier positions carry independent information about the uninfluenced prompt content.