Steering Beyond the Support: Adversarial Training on Unsupervised Jailbroken Activation Simulation

• URL: http://arxiv.org/abs/2605.24535v2
• Date: Fri, 29 May 2026 04:39:15 GMT
• Title: Steering Beyond the Support: Adversarial Training on Unsupervised Jailbroken Activation Simulation
• Abstract summary: We propose a bi-level adversarial training framework for zero-shot jailbreak defense.<n>In the inner step, we simulate diverse jail-broken activations by extrapolating from refusal-state harmful-request activations.<n>In the outer step, we train a potential-induced steering field to push these adversarial jailbroken states into refusal regions while keeping benign unchanged.
• Score: 42.60089935868113
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Jailbreak prompts can trigger harmful completions on aligned LLMs, In accordance, safety steering has been proposed: test-time activation interventions that steer jailbreak activations to trigger refusal while preserving benign utility. However, existing steering methods are fundamentally supervised and tied to a static, limited training set, whereas real jailbreaks evolve and are often out-of-distributed from the training set, leading to failures on unseen attacks. In this paper, we tackle the failure on unseen jailbreaks problem, base on unsupervised latent direction discovery. We propose a bi-level adversarial training framework for zero-shot jailbreak defense. In the inner step, we simulate diverse jail-broken activations by extrapolating from refusal-state harmful-request activations via unsupervised latent direction discovery, which expands the coverage of real jailbreak activation subspaces. In the outer step, we train a potential-induced steering field to push these adversarial jailbroken states into refusal regions while keeping benign unchanged. Across three LLMs and six classical jailbreak families, our method achieves strong defense with attack success rates mostly below 5%, and rising subspace coverage throughout training helps explain the improved generalization.

Related papers

• Re-Triggering Safeguards within LLMs for Jailbreak Detection [15.26823084609871]
  This paper proposes a jailbreaking prompt detection method for large language models (LLMs) to defend against jailbreak attacks.<n>We argue that such jailbreaking prompts are inherently fragile, and thus introduce an embedding disruption method to re-activate the safeguards.<n>Our approach effectively defends against state-of-the-art jailbreak attacks in white-box and black-box settings, and remains robust even against adaptive attacks.
  arXiv  Detail & Related papers  (2026-05-11T14:09:31Z)
• JPU: Bridging Jailbreak Defense and Unlearning via On-Policy Path Rectification [18.505062396846565]
  We show that Large Language Models (LLMs) often fail against jailbreak attacks.<n>We propose $textbfJ$ailbreak $textbfP$ath $textbfU$nlearning (JPU) to rectify dynamic jailbreak paths towards safety anchors.
  arXiv  Detail & Related papers  (2026-01-06T13:30:10Z)
• Formalization Driven LLM Prompt Jailbreaking via Reinforcement Learning [48.100552417137656]
  PASS employs reinforcement learning to transform initial jailbreak prompts into formalized descriptions.<n>We conduct extensive experiments on common open-source models, demonstrating the effectiveness of our attack.
  arXiv  Detail & Related papers  (2025-09-28T01:38:00Z)
• LLM Jailbreak Detection for (Almost) Free! [62.466970731998714]
  Large language models (LLMs) enhance security through alignment when widely used, but remain susceptible to jailbreak attacks.<n>Jailbreak detection methods show promise in mitigating jailbreak attacks through the assistance of other models or multiple model inferences.<n>We propose a Free Jailbreak Detection (FJD) which prepends an affirmative instruction to the input and scales the logits by temperature to further distinguish between jailbreak and benign prompts.
  arXiv  Detail & Related papers  (2025-09-18T02:42:52Z)
• Test-Time Immunization: A Universal Defense Framework Against Jailbreaks for (Multimodal) Large Language Models [80.66766532477973]
  Test-time IMmunization (TIM) can adaptively defend against various jailbreak attacks in a self-evolving way.<n>Test-time IMmunization (TIM) can adaptively defend against various jailbreak attacks in a self-evolving way.
  arXiv  Detail & Related papers  (2025-05-28T11:57:46Z)
• JailbreaksOverTime: Detecting Jailbreak Attacks Under Distribution Shift [10.737151905158926]
  We show how to use continuous learning to detect jailbreaks and adapt rapidly to new emerging jailbreaks.<n>We introduce an unsupervised active monitoring approach to identify novel jailbreaks.
  arXiv  Detail & Related papers  (2025-04-28T03:01:51Z)
• Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense [55.77152277982117]
  We introduce Layer-AdvPatcher, a methodology designed to defend against jailbreak attacks.<n>We use an unlearning strategy to patch specific layers within large language models through self-augmented datasets.<n>Our framework reduces the harmfulness and attack success rate of jailbreak attacks.
  arXiv  Detail & Related papers  (2025-01-05T19:06:03Z)
• JailbreakLens: Interpreting Jailbreak Mechanism in the Lens of Representation and Circuit [12.392258585661446]
  Large language models (LLMs) are vulnerable to jailbreak attacks, wherein adversarial prompts are crafted to bypass their security mechanisms and elicit unexpected responses.<n>This paper proposes JailbreakLens, an interpretation framework that analyzes jailbreak mechanisms from both representation and circuit perspectives.
  arXiv  Detail & Related papers  (2024-11-17T16:08:34Z)
• EnJa: Ensemble Jailbreak on Large Language Models [69.13666224876408]
  Large Language Models (LLMs) are increasingly being deployed in safety-critical applications. LLMs can still be jailbroken by carefully crafted malicious prompts, producing content that violates policy regulations. We propose a novel EnJa attack to hide harmful instructions using prompt-level jailbreak, boost the attack success rate using a gradient-based attack, and connect the two types of jailbreak attacks via a template-based connector.
  arXiv  Detail & Related papers  (2024-08-07T07:46:08Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.