研究发现模型拒绝行为可被简短前缀轻易破解，根源在早期响应生成阶段。
Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak
- 通过分析响应生成早期窗口，发现前半段响应即可破坏拒绝机制。
- 在4个模型中，攻击后拒绝率降至随机水平，但有害内容仍被准确识别（0.91-0.98）。
- 该现象源于通用自回归条件而非安全特异性抑制，适合安全研究者深入理解漏洞机制。
对齐语言模型会拒绝有害请求，但仅用一句预填充（如“好的，这里是”）即可使拒绝失效。我们探究其失效位置与机制：有害内容表征在提示端保持完整，线性探测显示其危害度仍高达0.91-0.98，而行为拒绝率降为随机水平。这一现象在四个模型及三个模型家族（1.5-3.8B和14B）中均成立。拒绝本质是浅层、响应端的计算结果。定位至响应早期窗口：剂量匹配控制实验表明，响应前半段足以破坏拒绝，后半段几乎无效；三种因果探针一致指向该窗口。在此处恢复有害方向可部分重激活拒绝。注入模型自身拒绝状态可逆转攻击（74%，持留测试）。若阻断早期响应对预填充的关注，但不干扰其他注意力区域，则有害延续被选择性瓦解。基础模型对照实验显示，相同阻断在非对齐基模型中同样削弱预填充相关延续（64%降至25%），证实其机制为通用自回归条件，而非安全特异性压制。“拒绝恢复”仅为模型依赖的后备机制。主导机制为被动型，尚存微弱主动安全吸引子（logit-trace浓度0.24对比0.03），其主次关系已量化但未完全分离。决策无单一清晰组件可操控：拒绝是可解码但分布式的，且追踪的是危害性而非表面恐怖特征。后果是结构性的：仅读取未受扰提示端表示的监测器天然免疫于响应端攻击，但仅限于此。机制弥散，失败表面局部。
原文摘要 · Abstract (English)
Aligned language models refuse harmful requests, but a one-line prefill ("Sure, here is") strips the refusal. We ask where and how it fails. The harm representation stays intact: on the prompts the attack flips to compliance, a linear probe reads harm as high as on the refused ones (0.91-0.98), while behavioral refusal drops to chance. This holds across four models and three families (1.5-3.8B, and at 14B). Refusal is therefore a shallow, response-site computation. We localize it to an early window: a dose-matched position control shows the first half of the response suffices to break refusal, while the second half is nearly inert. Three causal probes converge on that window. Restoring the harm direction there partially re-engages refusal. Injecting the model's own refuse-state reverses the jailbreak (74%, held-out). And knocking out the early response's attention to the prefill, but not an equal attention mass elsewhere, selectively collapses the harmful continuation. A base-model control identifies the mechanism: the same knockout collapses the continuation prefill-specifically even in a non-safety-tuned base model (64% to 25% harmful content vs a matched control's 64%, replicated at 7B). So the prefill's grip is generic autoregressive conditioning, not safety-specific suppression, and "refusal restoration" is a model-dependent fallback. The dominant mechanism is passive. A small safety-specific attractor remains on top (logit-trace concentration 0.24 vs 0.03), whose active-vs-passive character we size but do not fully separate. No single direction or component is a clean handle either: the decision is decodable but distributed, and refusal tracks harm rather than scary surface. The consequence is structural: a monitor reading the untouched prompt-side representation is immune by construction, but only to response-site attacks. The mechanism is diffuse; the failure surface is local.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。