Safety-aligned large language models (LLMs) can still be manipulated through white-box interventions that modify their internal representations. We introduce Latent Fusion Jailbreak (LFJ), which works by pairing a harmful query with a structurally similar but benign counterpart, then interpolating their hidden states at carefully selected layers and token positions. Refusal-loss gradients determine exactly where to intervene, and we optimize layer-wise mixing coefficients using token-normalized compliance and refusal-suppression objectives. The edited prompt states propagate sequentially through the remaining transformer blocks.
Across four safety benchmarks and five open-weight target models, LFJ achieves a macro-averaged attack success rate (ASR) of 94.13% under the white-box protocol we describe. Because LFJ directly accesses internal states, comparisons with prompt-only attacks serve as a descriptive reference rather than a matched evaluation. Dropping rejection sampling lowers ASR to 86.72%, while replacing the structured harmful-benign pairing with random pairing causes it to fall to 27.45%.
We also design an LFJ-specific latent adversarial training procedure that, when the attack is re-optimized against the defended model, reduces ASR from 94.13% to 12.37%. This defense evaluation does not cover transfer to other attack types or preservation of benign utility.
Blogger's Review: The Latent Fusion Jailbreak (LFJ) method highlights a profound challenge to the safety of large language models, enabling attackers to manipulate outputs efficiently through clever structural designs. The impressive success rate of LFJ, especially in its optimization strategies, reveals strong adaptability. This research provides new perspectives on model safety and defense mechanisms, warranting further attention and discussion.