Logit steering collapses LLM safety refusals fast

Problem

This paper studies how and where modern large language models implement safety refusals, asking whether refusal is a deep semantic capability or a shallow, manipulable linear feature. Understanding this matters because if refusal is encoded as a simple, steerable axis then attackers with appropriate access can bypass guardrails quickly, while defenders may be able to harden models at inference without retraining.

Approach

The authors introduce Contrastive Logit Steering (CLS), a zero‑optimization, logit‑level method that isolates a single "Refusal Vector" by contrasting model logits produced under three system prompts: base, unrestricted, and restrictive. CLS computes the difference between unrestricted and safe logits, scales that steering vector by a coefficient alpha, and adds it to the base logits at each decoding step. To bypass immediate refusal tokens, they force an affirmative prefix such as "Sure" for the first token(s). They evaluate CLS on seven open‑weights model families (including Gemma‑3, Llama‑3.x series, Qwen‑2.5 and additional comparisons on Llama‑2 and Qwen‑7B), using Attack Success Rate and a human‑aligned coherence score, together with PCA and KL divergence analyses across network depth. CLS is compared to optimization‑based attacks and activation‑level steering baselines, and the Refusal Vector is also used for zero‑shot detection via cosine similarity.

Key Findings

• Refusal is geometrically low rank: final‑layer hidden states show linear separability between refused and benign queries, consistent across evaluated families.
• CLS can rapidly induce jailbreaks: on Llama‑3.1 CLS reached about 95% Attack Success Rate in roughly one second with alpha set appropriately.
• Topology matters: models exhibit two safety topologies. "Late Decision" models (for example Llama series) postpone refusal until the final layers and are highly vulnerable to logit‑level subtraction, while "Early Divergence" models (for example Qwen‑2.5) integrate safety earlier (near 40% depth) and are more robust to CLS.
• CLS outperforms hidden‑state steering and search attacks: on Llama 2 CLS achieved 73% ASR versus 22.6% for activation steering, and on Qwen 7B 91% versus 79.2%. Compared with an optimization attack, CLS gave 95% ASR on Llama‑3.1 versus 5% for the optimizer, and it ran in about 1 second per query versus roughly 15 minutes, a reported 900× speed advantage.
• Extreme sensitivity and phase transition: some models, e.g. Gemma‑3‑12B, jumped from 34% to 98% ASR at alpha = 1.0, showing a binary collapse of guardrails; very large positive steering can degrade coherence.
• Bidirectional control and detection: inverting the steering vector (negative alpha) substantially reduces ASR to single digits for some models and can improve coherence; a global Refusal Vector classifier achieved about 0.92 F1 for zero‑shot jailbreak detection on Llama‑3.1.

Limitations

CLS requires white‑box access to logits, so applicability is limited to open‑weights or exposing interfaces. The steering coefficient alpha is sensitive and must be tuned. Experiments focus on single‑turn interactions and do not fully disentangle architectural differences from training or safety‑patching interventions. Comparisons to some other steering techniques remain qualitative.

Implications

Offensively, CLS demonstrates a practical attack surface: an adversary with logit access can compute a Refusal Vector from contrasting system prompts, apply prefix injection to evade initial refusals and then modulate logits to bypass guardrails in real time, achieving high ASR on susceptible architectures. Architectural choice and training that defer refusal to the output layer make models particularly vulnerable. Defensively, the same mechanism yields immediate mitigation options by applying negative steering at inference and enables lightweight detection via projection onto the Refusal Vector, but these do not remove the underlying vulnerability if safety remains a separable linear feature.