PaperlayerView exact revision on arXiv

Source-linked AI summary

ShallowJail: Steering Jailbreaks against Large Language Models

Shang Liu, Hanyu Pei, Zeyan Liu

arXiv:2602.07107v2cs.CRcs.AI

TL;DR

Aligned LLMs remain susceptible to jailbreaks, while existing attacks are constrained by stealth, computation, labor, or model generalization. ShallowJail steers initial-token hidden states using task-agnostic vectors derived from compliant and refusal prefixes. Experiments show substantial safety degradation, including ASR up to 0.9702 on Llama-3.1-8B-Instruct.

  • Problem

    Aligned LLMs remain vulnerable to jailbreaks, while existing white-box and black-box methods face computation, stealth, labor, or generalization limitations.

  • Method

    ShallowJail constructs task-agnostic steering vectors from compliant and refusal prefixes and injects them into hidden states during initial token generation.

  • Results

    ASR reaches 0.9702 on Llama-3.1-8B-Instruct, while ShallowJail substantially degrades response safety across tested models and datasets.

  • Takeaways & Limitations

    The findings indicate that aligned-model safety is critically vulnerable during the first few shallow tokens and motivates defenses that persist throughout generation.

Abstract

from arXiv · show

Large Language Models(LLMs) have been successful in numerous fields. Alignment has usually been applied to prevent them from harmful purposes. However, aligned LLMs remain vulnerable to jailbreak attacks that deliberately mislead them into producing harmful outputs. Existing jailbreaks are either black-box, using carefully crafted, unstealthy prompts, or white-box, requiring resource-intensive computation. In light of these challenges, we introduce ShallowJail, a novel attack that exploits shallow alignment in LLMs. ShallowJail can misguide LLMs' responses by manipulating the initial tokens during inference. Through extensive experiments, we demonstrate the effectiveness of ShallowJail, which substantially degrades the safety of state-of-the-art LLM responses. Our code is available at https://github.com/liuup/ShallowJail.

I. INTRODUCTION

Aligned LLMs remain vulnerable to jailbreaks despite safety safeguards, while existing white-box and black-box attacks face monitoring, labor, and generalization limitations. ShallowJail exploits shallow safety alignment by steering early model behavior toward unsafe responses.

  • Aligned LLMs remain vulnerable to jailbreak attacks despite safety alignment efforts such as RLHF and adversarial red-teaming.
  • White-box attacks require continuous access to model generation, whereas black-box attacks depend on labor-intensive prompts that may not generalize across models.
  • ShallowJail exploits shallow safety alignment by manipulating the initial tokens that disproportionately influence aligned models’ safety behavior.
  • Its two stages construct a task-agnostic steering vector from compliant prefixes, then inject that vector into hidden states during generation to guide unsafe responses.
  • ShallowJail substantially degrades response safety by bypassing existing alignment mechanisms.

II. BACKGROUND

Prior jailbreak research distinguishes white-box optimization from black-box prompt-based attacks, while related work also studies adversarial suffixes and defenses.

  • Existing jailbreak attacks are categorized as white-box methods requiring model access and black-box methods relying on prompt engineering or semantic manipulation.
  • Related work includes prefilling and adversarial-suffix attacks, alongside response classifiers and detection methods intended to mitigate jailbreaks.

B. Activation Steering

ShallowJail applies inference-time activation steering to initial token generation, constructing a vector from compliance and refusal prefixes and injecting it into model hidden states.

  • B. Activation Steering: Activation steering modifies internal hidden states with predefined vectors to steer LLM outputs during inference.
  • B. Activation Steering: Activation steering has also been applied to privacy protection, sentiment control, output-format constraints, translation, and analysis of internal mechanisms.
  • A. Steering Vectors Construction: The resulting normalized vector is injected into token-generation hidden states as the two-stage ShallowJail framework guides the model toward jailbreak responses.
  • A. Steering Vectors Construction: ShallowJail constructs steering vectors from compliance and refusal prefix sets by comparing final-token hidden states across model layers.

B. Jailbreak Prompting

Jailbreak Prompting modifies token hidden states with a steering vector, applying stronger steering to shallow tokens and reduced steering to deep tokens. The method uses hyperparameters whose trade-offs affect attack effectiveness and text quality.

  • B. Jailbreak Prompting: ShallowJail applies a steering vector to each token’s hidden states, scaled by α for shallow tokens and by α × β for deep tokens.The transition occurs at threshold τ, separating the Shallow Tokens Attack from the Deep Tokens Attack.
  • B. Jailbreak Prompting: Shallow-token steering generates compliant prefixes that bypass initial refusal filters and establish a trajectory toward unsafe responses.The method uses prefixes such as “Sure, here are the details” to influence the model’s initial output.
  • B. Jailbreak Prompting: Deep-token steering alone yields negligible attack success, whereas combining it with shallow-token steering helps maintain the harmful trajectory while preserving fluency.The deep phase modulates steering with β after the threshold τ.
  • B. Jailbreak Prompting: The evaluation compares ShallowJail’s performance across victim models and datasets using separate performance and D2G tables.Table I covers victim-model and dataset performance, while Table II compares Distinct-2-Gram values.

A. Datasets and Victim Models

The evaluation uses 1,010 malicious prompts from three datasets and tests ShallowJail on three open-source, aligned victim LLMs.

  • A. Datasets and Victim Models: The evaluation contains 1,010 malicious prompts: 520 from AdvBench, 100 from MaliciousInstruct, and 390 from ForbiddenQuestions.These datasets provide the malicious-prompt evaluation set.
  • A. Datasets and Victim Models: Experiments evaluate ShallowJail on Qwen3-4B-Instruct-2507, Qwen2.5-7B-Instruct, and Llama-3.1-8B-Instruct.The models are described as well-aligned, open-source LLMs downloaded from Hugging Face.

B. Evaluation Metrics

The study measures jailbreak effectiveness with ASR and evaluates generated-text diversity and fluency using D2G and PPL.

  • B. Evaluation Metrics: ASR measures jailbreak efficiency by classifying responses as Safe, Controversial, or Unsafe with Qwen3Guard-Gen-4B4.The authors use an LLM-as-a-Judge because keyword matching can produce judgment errors.
  • B. Evaluation Metrics: D2G is the ratio of unique bigrams to total bigrams, with higher scores indicating greater lexical diversity and less repetition.The metric is evaluated on 100 randomly sampled AceReason-Math examples.
  • B. Evaluation Metrics: PPL measures fluency through exponentiated average negative log-likelihood, where lower values indicate more natural language.Victim models serve as their own evaluators in this experiment.
  • B. Evaluation Metrics: Experiments ran on single Nvidia H100 NVL, H200, or 5090 GPUs depending on node availability.Further environment details are stated to be available in the open-source repository.

V. EXPERIMENTS RESULTS

Experiments examine performance generalization, hyperparameter ablations, and sensitivity of text quality. ShallowJail substantially compromises the safety alignment of tested LLMs across diverse datasets, with ASR reaching 0.9702 on AdvBench for Llama-3.1-8B-Instruct.

  • V. EXPERIMENTS RESULTS: The experiments address generalization across victim LLMs and datasets, hyperparameter ablations, and the effect of hyperparameters on text-generation quality.These questions are labeled RQ1, RQ2, and RQ3.
  • A. Main Performance Results (RQ1): ShallowJail significantly compromises the safety alignment of all tested LLMs across diverse datasets.The main performance experiments are reported in Table I.
  • A. Main Performance Results (RQ1): On AdvBench, ShallowJail reaches ASR 0.9019 for Qwen3-4B-Instruct-2507, 0.8615 for Qwen2.5-7B-Instruct, and 0.9702 for Llama-3.1-8B-Instruct, versus below 0.07 for direct prompting.On MaliciousInstruct, the corresponding ASRs are 0.7950, 0.7650, and 0.9350.
  • A. Main Performance Results (RQ1): Steering increases PPL, such as from 1.5404 to 15.6540 on Llama-3.1, while generated content remains sufficiently coherent for the malicious objective.D2G results also show lexical diversity, including 0.3449 on AdvBench and 0.4132 on MaliciousInstruct for Llama-3.1, versus 0.2262 for its natural responses.

B. Ablation Study (RQ2)

ShallowJail’s attack success depends primarily on steering the initial shallow tokens, while deeper-token steering and hyperparameter choices affect robustness, fluency, and diversity.

  • Ablation Study: ASR rises toward 0.9 when affected shallow tokens exceed 100 with α = 7.5, then plateaus, indicating early-token vulnerability.With α = 5.0, ASR peaks around 0.5–0.6; the saturation effect suggests deeper-token manipulation is unnecessary after the semantic direction shifts.
  • Ablation Study: Average ASR reaches 0.7562 for Qwen3 and 0.8295 for Llama when shallow and deep tokens are jointly steered, exceeding shallow-only or deep-only steering.Deep-only steering yields average ASR values of 0.0096 for Qwen3 and 0.0431 for Llama, whereas shallow-only steering reaches 0.5902 and 0.8172, respectively.
  • Ablation Study: ASR increases from 0.2125 to 0.8385 as β rises from 0.3 to 0.7 when α = 4.0 and τ = 150, but excessive steering reduces D2G and text quality.When α = 3.0, ASR remains below 0.1 even with large β, while α = 6.0 and β approaching 0.9 increase repetition and reduce diversity.
  • Ablation Study: Average ASR rises from 0.6716 to 0.8295 for Qwen3 as prefix combinations increase from 9 to 100, while Llama-3.1 changes from 0.8295 to 0.8352.Larger prefix sets provide a more robust estimate of the boundary between refusal and helpfulness.

VI. CONCLUSION AND FUTURE WORKS

The paper concludes that manipulating initial hidden states can bypass LLM safety alignment, achieving high attack success while retaining linguistic diversity. It reports locally conducted experiments using public datasets and no targeting of individuals or deployed systems.

  • Conclusion and Future Work: ShallowJail achieves ASR up to 0.9702 on Llama-3.1-8B while often maintaining D2G scores above natural-response levels.The conclusion attributes the vulnerability to the first few shallow tokens and calls for defenses that persist throughout generation.
  • Conclusion and Future Work: The experiments used publicly available datasets on local machines and did not target specific individuals or public or commercial systems.These conditions define the reported operational scope of the study.
Loading 2602.07107v2…