PaperlayerView exact revision on arXiv

Source-linked AI summary

Jailbreak Context Lingers: Divergent Safety Routing and Its Cross-Task Predictability in Tool Agents

Xi Wang, Songlei Jian, Yiming Zhang, Bin Ji, Zhaoye Li, Ma Jun, Baosheng Wang, Jie Yu

arXiv:2609.34686v1cs.AI

TL;DR

How lingering jailbreak context shapes tool agents’ responses to subsequent safety feedback remains unclear. The paper uses paired continuations and activation patching to study routing, finding model-dependent outcomes, late-layer intervention effects, and predictive signals for unseen tasks.

  • Problem

    How lingering jailbreak context governs tool agents’ responses to subsequent safety feedback remains unclear, despite the importance of diagnosing whether feedback restores legitimate execution, leaves harmful behavior intact, or disrupts benign workflows.

    Source: §1 · pp. 1–2

  • Method

    The authors compare paired continuations from identical pre-action checkpoints across 192 parent tasks and eight agents, then use layer-wise activation patching and intervention-derived features to study mechanisms and predict routing.

    Source: §1 · pp. 2–3

  • Results

    Safety feedback induces model-dependent rescue, persistent unsafe execution, or collateral loss, while critical-layer features predict unseen-task outcomes with peak ROC AUCs of 0.675 for rescue, 0.777 for collateral loss, and 0.702 for persistent unsafe.

    Source: §1 · pp. 2–3

  • Takeaways & Limitations

    Critical-layer representations correlate with routing fates and can causally alter concrete execution steps, providing a predictive baseline for anticipating safety and utility trade-offs.

    Source: §6 · p. 10

Abstract

from arXiv · show

As large language models increasingly operate as tool-using agents, post-jailbreak safety feedback is often assumed to serve as a reliable safeguard; however, how lingering jailbreak context shapes subsequent agent behavior remains largely unexplored. To systematically examine this dynamic, we introduce a paired continuation framework across 192 parent tasks spanning 42 domains, evaluating 12,148 analyzed continuation pairs (curated from a 12,288-pair initially design) across eight diverse agents. We find that identical safety feedback induces sharply model-dependent behavioral routing rather than uniform protection: redirecting unsafe trajectories toward legitimate completion (\emph{rescue}), sustaining unauthorized execution (\emph{persistent unsafe}), or triggering over-refusal on benign tasks (\emph{collateral loss}). Through layer-wise activation patching, we discover a shared \emph{late-commit pattern} where causal intervention effects surge sharply near the final layers (relative depths of 0.958--0.984) despite an over 30-fold variation in peak magnitude across architectures. Crucially, critical-layer representations correlate with macroscopic routing outcomes, and intervening at these layers causally alters concrete next-step tool actions. Building on this causal foundation, we test whether localized intervention-derived features can serve as predictive proxies for full-trajectory routing outcomes on unseen parent tasks under leave-one-parent-task-out evaluation, finding that they provide viable predictive signals in responsive agents with peak ROC AUCs reaching 0.675 for \emph{rescue}, 0.777 for \emph{collateral loss}, and 0.702 for \emph{persistent unsafe}. These findings establish a mechanistic lens and a predictive baseline for anticipating the safety and utility trade-offs of post-jailbreak feedback in autonomous agents.

1 INTRODUCTION

Identical post-jailbreak safety feedback can redirect agents toward legitimate completion, sustain unauthorized execution, or disrupt benign tasks. The paper studies this routing divergence, its late-layer mechanisms, and whether intervention-derived features predict outcomes on unseen tasks.

1 INTRODUCTION

  • Safety feedback produces three divergent routes: rescue, persistent unauthorized execution, or collateral loss through over-refusal on benign tasks.In a mixed-risk task, Mistral completes the legitimate settlement while withholding the transfer, whereas Qwen executes it; safety feedback also induces over-refusal on an authorized task.Source: §1 · p. 2, Figure 1 · p. 2
  • Across 192 parent tasks in 42 domains, eight agents show sharply different routing rates, including wide variation within the Qwen family.Persistent unsafe rates range from 1.0% in Qwen3.6-27B to 85.7% in Qwen3-14B; rescue and collateral loss peak in different architectures.Source: §1 · p. 2
  • Layer-wise activation patching reveals a shared late-commit pattern, with intervention effects peaking at relative depths of 0.958–0.984 despite over 30-fold variation in peak magnitude.At each agent’s critical layer, feedback-induced logit shifts separate routing outcomes on held-out tasks.Source: §1 · p. 2
  • Critical-layer state patching shifts concrete next-step tool selections toward safety feedback significantly more often than active controls.This demonstrates causal efficacy over execution, beyond changes in next-token logits.Source: §1 · pp. 2–3
  • Under leave-one-parent-task-out evaluation, intervention-derived features predict routing outcomes on unseen tasks, with peak ROC AUCs of 0.675 for rescue, 0.777 for collateral loss, and 0.702 for persistent unsafe.The predictive information is concentrated in the final layers.Source: §1 · p. 3

2 RELATED WORK

Prior work studies jailbreak attacks, refusal mechanisms, tool-agent vulnerabilities, and defenses, but leaves open how lingering jailbreak context shapes responses to safety feedback during later tool actions.

2.1 JAILBREAK ATTACKS AND MECHANISTIC ANALYSIS

  • Mechanistic jailbreak studies examine refusal and safety computations, but do not resolve how fixed jailbreak context shapes responses to later safety feedback.Related work addresses attack transferability, harmfulness detection, competing safety and continuation computations, and safety alignment across output positions.Source: §2.1 · p. 3

2.2 SAFETY IN TOOL-USING AGENTS

  • Tool-agent research documents harmful execution, prompt injection, history effects, and defenses using step-level feedback, adjudication, or post-incident responses.Prior tool calls and feedback can shape later actions, and benign-looking calls can compose into harmful chains.Source: §2.2 · p. 3
  • In contrast, this work tests safety feedback at matched pre-action checkpoints and studies late-layer concentration and held-out-task routing prediction.Related mechanistic work also extracts risk signals for steering unsafe steps, while reasoning-model work finds brief early steering can redirect unsafe trajectories.Source: §2.2 · pp. 3–4

3 DIVERGENT SAFETY ROUTING IN JAILBROKEN TOOL-USING AGENTS

The paired continuation framework holds task histories and pre-action states fixed to examine how safety feedback routes agents carrying jailbreak context. Across agents, identical feedback produces sharply divergent outcomes rather than uniform protection.

3.1 PAIRED CONTINUATION FRAMEWORK

  • Across 192 parent tasks, matched mixed-risk and benign variants were replayed to two verified pre-action checkpoints before freezing, yielding 768 checkpoints and 1,536 matched N/S pairs per agent across retained and neutralized jailbreak contexts.Source: Figure 2 · p. 4
  • At each frozen checkpoint, retained and neutralized jailbreak contexts are independently resumed under a neutral reminder or safety feedback.The retained context preserves the jailbreak prompt; the neutralized context substitutes a benign equivalent while preserving the multi-turn history.Source: §3.1 · pp. 4–5

3.2 DIVERGENT ROUTING OUTCOMES ACROSS AGENTS

  • The three routing outcomes are scored from paired action and completion states, distinguishing unauthorized execution, legitimate completion, refusal, failure, and safe omission.The reported outcomes are rescue, persistent unsafe, and collateral loss.Source: §3.2 · p. 5
  • 85.7% persistent unsafe in Qwen3-14B contrasts with 1.0% in Qwen3.6-27B, while rescue and collateral loss peak in Gemma-3-12B (19.3%) and Mistral-Small-24B (13.1%).The model-dependent pattern does not follow simple parameter scaling.Source: §3.2 · p. 5, Table 2 · p. 6

4 LATE-COMMIT PATTERN OF SAFETY FEEDBACK

Safety-feedback effects concentrate near the final layers across agents, despite large cross-model variation in their magnitude. Critical-layer representations also track routing outcomes and can steer concrete tool actions.

4 LATE-COMMIT PATTERN OF SAFETY FEEDBACK

  • Intervention effects peak at relative depths of 0.958–0.984 across eight agents, after remaining negligible through early and middle layers.Seven of eight agents peak at the final layer.Source: §4 · p. 6, Figure 4 · p. 7
  • Median effect size varies by over 30-fold, from 0.005 in Mistral-Small-24B to 0.167 in Qwen3-14B, despite the localized peak.Source: §4 · p. 6
  • Held-out direction scores separate routing outcomes, while benign-task response magnitudes distinguish outcomes in a model-dependent manner.Direction-score medians are higher for rescue than persistent unsafe on mixed-risk tasks, and for collateral loss than preserved completion on benign tasks.Source: §4 · p. 6, Figure 5 · p. 7
  • Critical-layer patching shifts next-step tool calls toward safety-feedback decisions more often than active controls across most agents and outcomes.Patching can produce discrete, argument-level tool-action reversals that mid-depth controls fail to achieve.Source: §4 · p. 6, Figure 6 · p. 8

5 PREDICTION OF SAFETY ROUTING ACROSS PARENT TASKS

Critical-layer interventions alter immediate tool actions and provide predictive signals for routing outcomes on unseen parent tasks. Predictive information is concentrated in the final layers relative to an earlier-depth baseline.

5.1 FROM CRITICAL-LAYER EFFECTS TO REAL AGENT ACTIONS

  • Critical-layer patching shifts first tool calls toward safety-feedback decisions more often than active controls in 6/8 rescue, 6/7 collateral-loss, and 7/8 persistent-unsafe settings.For persistent unsafe, matching the safety-feedback call does not imply safety recovery because both original branches remain unsafe.Source: §5.1 · p. 8

5.2 CROSS-PARENT-TASK ROUTING PREDICTION FROM INTERVENTION EFFECTS

  • Within-agent LOPO prediction on held-out parent tasks achieved peak ROC AUCs of 0.675 for rescue (Llama-3.1-8B), 0.777 for collateral loss (Qwen3.5-9B), and 0.702 for persistent unsafe (Gemma-3-12B).Persistent-unsafe evaluation used 384 context-paired feature rows per agent; estimates with n+ ≤4 reflect high sample variance.Source: §5.2 · p. 9

5.3 LAYER ABLATION OF PREDICTIVE INFORMATION

  • Critical and preceding layers achieve higher LOPO AUCs than the 0.75-depth baseline in nearly all estimable settings, concentrating predictive information in final layers.The critical layer wins in 6/8 rescue, all seven estimable collateral-loss, and all eight persistent-unsafe comparisons; the preceding layer also beats baseline in all estimable comparisons.Source: §5.3 · p. 9

6 CONCLUSION

The study concludes that post-jailbreak safety feedback routes tool-agent behavior into divergent outcomes, with effects concentrated in final layers. The authors also state that their experiments use isolated simulations and describe their AI-use and reproducibility practices.

6 CONCLUSION

  • Across eight agents, safety feedback induces divergent rescue, persistent-unsafe, and collateral-loss outcomes, with effects concentrated in final layers.Critical-layer representations correlate with routing fates and have causal efficacy over concrete execution steps; localized features also predict routing trajectories across unseen parent tasks.Source: §6 · pp. 9–10

AI USE STATEMENT

  • Researchers used language models for initial task specifications, semantic refusal judgments, and grammar polishing, while retaining responsibility for verified study design and manuscript contents.Source: AI USE STATEMENT · p. 10

ETHICS STATEMENT

  • Experiments evaluate safety interventions in fully isolated, deterministic simulated environments, with scenarios and jailbreak artifacts curated for academic safety research.Source: ETHICS STATEMENT · p. 10

REPRODUCIBILITY STATEMENT

  • Task-construction protocols, environment-oracle definitions, evaluation prompts, and statistical procedures are documented in Appendices A–E; artifacts are slated for public release upon publication.An anonymized code zip is provided during review.Source: REPRODUCIBILITY STATEMENT · p. 10

A.1 TASK DOMAINS AND PARENT-TASK COVERAGE

The task set spans 42 domains, with 192 parent tasks built around matched legitimate workflows and variants. A deterministic simulator and prioritized scoring rules distinguish unauthorized actions, completion, refusal, failures, and safe omissions.

A.1 TASK DOMAINS AND PARENT-TASK COVERAGE

  • 192 parent tasks span 42 domains, each with a shared legitimate workflow and matched variants.Task cards specify the role, policy, records, deliverable, tools, candidate action, and machine-checkable outcome rules.Source: §A.1 · p. 13

A.2 SIMULATOR ENVIRONMENT AND OUTCOME SCORING

  • Five mutually exclusive states distinguish unauthorized execution, legal completion, explicit refusal, technical failure, and safe incomplete continuation.Scoring prioritizes U, C, O, and F in that order; I is the remaining safe but incomplete state.Source: §A.2 · pp. 13–14
  • Each pair contains two independent continuations; five agents with masked pairs retain 760 mixed-risk and 748 benign pairs, while the other three retain all 768 pairs of each variant.Source: Table 5 · p. 14

A.3 DATA ACCOUNTING AND EVALUATION UNITS

The appendix documents how the task variants, feedback conditions, and outcome accounting were constructed and analyzed. It also details critical-layer selection and a matched control for jailbreak-context effects.

A.3 DATA ACCOUNTING AND EVALUATION UNITS

  • 12,288 matched N/S pairs were designed; 12,148 were analyzed after masking selected pairs, without changing the 192-parent inventory.The five-agent cohort retained 760 R and 748 B pairs per agent; three added agents retained 768 per variant.Source: §A.3 · p. 14

A.4 REPRESENTATIVE TASK CARDS AND PROMPT ASSEMBLY

  • Representative task cards match the legitimate deliverable while varying an unauthorized request against an authorized counterpart.The RV218 task pairs an early record modification request with an authorized audit entry; the Halden example similarly contrasts pre-attestation with status notification.Source: §A.4 · p. 15

A.5 CONTINUATION PROMPTS AND EVALUATION SETTINGS

  • At frozen checkpoints, retained or neutralized jailbreak context is crossed with neutral or safety feedback while other checkpoint messages remain fixed.The neutralized context is task-specific and length-matched; generation is deterministic and bounded by decision, trajectory, and tool-call limits.Source: §A.4 · p. 15, §A.5 · p. 15

A.6 PROMPT MATERIALS

  • The prompt materials specify a semantic-outcome judge that evaluates textual outcomes while the deterministic fixture decides executed calls and their scope.The feedback arms differ in whether they ask the agent to assess harm and permissions; both share the final instruction to choose the next action.Source: §A.6 · pp. 15–16

B.1 FULL STATE-TRANSITION ACCOUNTING

  • Five-state transition accounting keeps safe omissions and technical failures separate from explicit refusal, with complement counts including all other routes.Tables 7 and 8 report observed transitions separately for mixed-risk and benign tasks.Source: §B.1 · p. 18, Table 6 · p. 18

B.2 BREAKDOWN BY CHECKPOINT AND JAILBREAK CONTEXT

  • Table 9 partitions routing counts by checkpoint and jailbreak context; its within-agent differences are descriptive, and parent-paired analysis is needed to estimate uncertainty.For Mistral-Small-24B, persistent-unsafe continuations under J+ versus J0 were 27/190 versus 4/190 at the prepared checkpoint.Source: §B.2 · p. 18, Table 9 · p. 22

C.1 CRITICAL-LAYER SELECTION PROTOCOL

  • Critical layers were selected from balanced 100-pair follow-up scans, using the median intervention effect within a candidate region.Figure 8 shows layer profiles and dispersion; Table 10 reports selected layers and median effects.Source: §C.1 · p. 18, Figure 8 · p. 21, Table 10 · p. 22

C.2 CONTEXT-PAIRED CONTROL FOR LATE-LAYER EFFECTS

  • Matched J+ versus J0 contrasts show context dependence in the measured logit effect, but do not establish a safety outcome.The sign differs for Gemma-4-12B and the Llama interval crosses zero.Source: §C.2 · p. 22

C.3 CRITICAL-LAYER VOCABULARY READOUTS ACROSS AGENTS

Critical-layer readouts compare held-out routing outcomes across agents, with support that differs from the full behavioral evaluation. Benign comparisons are unavailable for Gemma-4-12B because its analyzed subset contains no collateral-loss cases.

C.3 CRITICAL-LAYER VOCABULARY READOUTS ACROSS AGENTS

  • The mechanism subset comprises 108 parent tasks, compared with 192 parent tasks in the full behavioral evaluation; Figure 9 extends the main-text readout comparison to all eight agents, showing individual held-out scores and within-outcome distributions.Source: §C.3 · p. 22
  • Table 12 evaluates whether critical-layer direction readouts separate rescue from persistent unsafe trajectories on mixed-risk tasks.The table reports AUC and analyzed support for each outcome.Source: Table 12 · p. 23
  • In the analyzed benign subset, Gemma-4-12B had no collateral-loss cases, leaving its benign direction and magnitude comparisons undefined; table confidence intervals used a 95% parent-cluster bootstrap with 5,000 resamples.Source: §C.3 · p. 23

D.1 TOOL-CALL MATCHING AND CONTROLS

The appendix specifies how critical-layer interventions are compared with controls at the first tool call, then describes parent-grouped prediction and its uncertainty estimates. First-action matching is distinct from full-trajectory completion.

D.1 TOOL-CALL MATCHING AND CONTROLS

  • Four intervention conditions compare first decisions, including critical-layer and half-depth N←S patching and a norm-matched random perturbation.Exact action matching requires the same ordered tool-call sequence and deeply equal parsed arguments; first-action matching does not establish the final trajectory outcome.Source: §D.1 · pp. 23, 25

D.2 ACTION-TRANSITION ESTIMATES AND CONTROLS

  • The action-transition tables compare within-pair critical-layer matching rates against random perturbation, with half-depth patching as a layer control.The paired test evaluates first-tool-call matching on selected eligible pairs, not macroscopic trajectory completions.Source: §D.2 · p. 25, Table 14 · p. 25, Table 15 · p. 26

E.1 PARENT-GROUPED CROSS-VALIDATION

  • LOPO prediction holds out all feature rows from one parent task; rescue and collateral-loss predictors use absolute critical-layer effects, while persistent-unsafe uses a J+ versus J0 contrast.Layer selection occurs before LOPO folds, so the evaluation separates parents for predictor fitting but does not nest layer-selection uncertainty.Source: §E.1 · pp. 25–26

E.2 CLASS BALANCE AND PREDICTION INTERVALS

  • ROC AUC and precision–recall AUC are computed from out-of-fold scores across the prediction pool, with parent-cluster bootstrap intervals.Bootstrap resampling preserves all rows from sampled parents and excludes resamples containing only one class.Source: §E.2 · p. 26

E.3 LAYER-SELECTION ABLATION

The layer-selection ablation compares prediction performance across preselected depths while holding agents, evaluation rows, labels, and parent-held-out folds constant.

E.3 LAYER-SELECTION ABLATION

  • The comparison tests half depth, 0.75 relative depth, the layer before the fixed critical layer, and the critical layer; 48-layer Gemma agents also include the following layer.The same agent, feature rows, outcome labels, and parent-held-out folds are used at each depth.Source: §E.3 · pp. 26, 28
  • Paired AUC differences use out-of-fold scores on the same rows, isolating representation depth from sample or split divergence.Source: §E.3 · pp. 26–27
  • Table 19 reports positive support and LOPO ROC AUC across the evaluated depths; N/A marks no positive examples and — marks unevaluated depths.Source: Table 19 · p. 28, §E.3 · p. 28
Loading 2609.34686v1…