Researchers Discover Method to Bypass Safety Controls in AI Language Models Through Internal State Manipulation

Researchers have identified a vulnerability in safety-aligned large language models that allows them to be compromised through direct manipulation of their internal representations. The attack, termed Latent Fusion Jailbreak (LFJ), bypasses refusal mechanisms by carefully interpolating hidden states across transformer layers.

How the Attack Works#

LFJ operates by pairing a request for harmful content with a structurally similar benign query. The method then blends the internal representations—called hidden states—of these paired prompts at strategically chosen layers and token positions. Rather than modifying the visible prompt, the technique works entirely within the model's computation pipeline, making it undetectable at the input level.

The researchers use gradient information from refusal signals to pinpoint exactly where to intervene. They then optimize layer-specific blending coefficients using objectives designed to enhance compliance while suppressing the model's refusal responses. As the manipulated hidden states progress through subsequent transformer blocks, they propagate the modified representations downstream.

Effectiveness and Benchmarking#

Testing across four safety evaluation benchmarks and five open-weight LLMs, LFJ achieved a 94.13% macro-averaged attack success rate under the white-box protocol (where attackers have full access to model internals). The researchers found that the approach's effectiveness depends critically on the structured pairing strategy: removing rejection sampling reduced success to 86.72%, and replacing the harmful-benign pairing with random combinations dropped it dramatically to 27.45%.

Defence Implications#

The team designed a defensive adversarial training procedure specifically tailored to counter LFJ. When applied, this defence reduced the attack success rate from 94.13% to 12.37% when the attack was re-optimized against the hardened model. However, the researchers note that this evaluation focused narrowly on LFJ itself and did not assess whether the defence generalizes to other attack types or preserves the model's normal capabilities on benign tasks.

Research Context#

The full paper is available on arXiv. This work highlights a fundamental challenge in AI safety: even models trained with sophisticated alignment techniques remain vulnerable to attacks that exploit their internal computation structure, rather than relying solely on input-level manipulations.