{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/understanding-jailbreak-success-a-study-of","title":"Understanding Jailbreak Success: A Study of Latent Space Dynamics in Large Language Models","arxiv_id":"2406.09289","date":"2024-06-13","proceeding":null,"authors":["Sarah Ball","Frauke Kreuter","Nina Panickssery"],"abstract":"Conversational large language models are trained to refuse to answer harmful questions. However, emergent jailbreaking techniques can still elicit unsafe outputs, presenting an ongoing challenge for model alignment. To better understand how different jailbreak types circumvent safeguards, this paper analyses model activations on different jailbreak inputs. We find that it is possible to extract a jailbreak vector from a single class of jailbreaks that works to mitigate jailbreak effectiveness from other semantically-dissimilar classes. This may indicate that different kinds of effective jailbreaks operate via a similar internal mechanism. We investigate a potential common mechanism of harmfulness feature suppression, and find evidence that effective jailbreaks noticeably reduce a model's perception of prompt harmfulness. These findings offer actionable insights for developing more robust jailbreak countermeasures and lay the groundwork for a deeper, mechanistic understanding of jailbreak dynamics in language models.","url_abs":"https://arxiv.org/abs/2406.09289v2","url_pdf":"https://arxiv.org/pdf/2406.09289v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"understanding-jailbreak-success-a-study-of","repo_url":"https://github.com/s-ball-10/jailbreak_dynamics","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"pytorch","reach":null}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2406.09289","atlas_url":"https://app.syntology.ai/?focus=2406.09289","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2406.09289"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/s-ball-10/jailbreak_dynamics","reach":null}],"summary":{"ran_fixture":1,"ran_draft_wrong":2,"unverified":1},"by_repo_kind":{"official":{"samples":4,"ran":3,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"c1270ea1fb3cdac8","entry":"get_average_activation","repo":"s-ball-10/jailbreak_dynamics","repo_kind":"official","path":"analysis/extracting_activations.py","file_url":"https://github.com/s-ball-10/jailbreak_dynamics/blob/HEAD/analysis/extracting_activations.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"c1270ea1fb3cdac8"}},{"code_sha256_prefix":"3e1cc862a02e1244","entry":"get_judge_prompt","repo":"s-ball-10/jailbreak_dynamics","repo_kind":"official","path":"evaluation/llama_guard.py","file_url":"https://github.com/s-ball-10/jailbreak_dynamics/blob/HEAD/evaluation/llama_guard.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"3e1cc862a02e1244"}},{"code_sha256_prefix":"8a5530b905b0b9b1","entry":"get_llama_guard_message","repo":"s-ball-10/jailbreak_dynamics","repo_kind":"official","path":"evaluation/llama_guard.py","file_url":"https://github.com/s-ball-10/jailbreak_dynamics/blob/HEAD/evaluation/llama_guard.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8a5530b905b0b9b1"}},{"code_sha256_prefix":"bbec1c71c51dedbd","entry":"process_output","repo":"s-ball-10/jailbreak_dynamics","repo_kind":"official","path":"evaluation/llama_guard.py","file_url":"https://github.com/s-ball-10/jailbreak_dynamics/blob/HEAD/evaluation/llama_guard.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"bbec1c71c51dedbd"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}