A jailbreak direction extracted from one jailbreak method in real Vicuna and Qwen causally transfers to different jailbreak methods

Ball, Kreuter & Rimsky (2024) compute diff-of-means "jailbreak vectors" between successfully-jailbroken and refused activations in real Vicuna-7B/13B and Qwen-14B-Chat, across several structurally distinct jailbreak techniques [ball-kreuter-rimsky-2024-understanding-jailbreak-success-latent-space-dynamics] A vector extracted from one class of jailbreaks causally transfers to mitigate jailbreak effectiveness from semantically-dissimilar jailbreak classes, and effective jailbreaks measurably reduce the model's own internal perception of prompt harmfulness -- evidence for a shared linear mechanism underlying jailbreak susceptibility rather than method-specific mechanisms [ball-kreuter-rimsky-2024-understanding-jailbreak-success-latent-space-dynamics]