arXiv:2508.10029v3 Announce Type: replace 
Abstract: Safety-aligned large language models can still be manipulated through white-box interventions that modify their internal representations. We introduce Latent Fusion Jailbreak (LFJ), which works by pairing a harmful query with a structurally similar but benign counterpart, then interpolating their hidden states at carefully selected layers and token positions. Refusal-loss gradients determine exactly where to intervene, and we optimise layer-wise mixing coefficients using token-normalised compliance and refusal-suppression objectives. The edited prompt states propagate sequentially through the remaining transformer blocks. Across four safety benchmarks and five open-weight target models, LFJ reaches a macro-averaged attack success rate (ASR) of 94.13% under the white-box protocol we describe. Because LFJ directly accesses internal states, comparisons with prompt-only attacks serve as a descriptive reference rather than a matched evaluation. Dropping rejection sampling lowers ASR to 86.72%, whereas replacing the structured harmful-benign pairing with random pairing causes it to fall to 27.45%. We also design an LFJ-specific latent adversarial training procedure that, when the attack is re-optimised against the defended model, reduces ASR from 94.13% to 12.37%. This defence evaluation does not cover transfer to other attack types or preservation of benign utility.

يقدم Latent Fusion Jailbreak (LFJ) طريقة للتلاعب بالنماذج اللغوية الكبيرة (LLMs) الموجهة نحو الأمان من خلال دمج استفسارات ضارة وأخرى غير ضارة لاستنباط مخرجات غير آمنة. تحقق هذه التقنية معدل نجاح هجوم مرتفع يبلغ 94.13% عبر مجموعة متنوعة من معايير الأمان، مما يشير إلى وجود ثغرات في LLMs على الرغم من تصميمها للأمان.

La introducción de Latent Fusion Jailbreak (LFJ) revela un método para manipular modelos de lenguaje (LLMs) alineados con la seguridad al mezclar consultas dañinas y benignas para provocar salidas inseguras. Esta técnica logra una alta tasa de éxito de ataque del 94.13% en varios benchmarks de seguridad, indicando vulnerabilidades en los LLMs a pesar de su diseño para la seguridad.

L'introduction de Latent Fusion Jailbreak (LFJ) révèle une méthode de manipulation des modèles de langage (LLMs) alignés sur la sécurité en mélangeant des requêtes nuisibles et bénignes pour susciter des sorties non sécurisées. Cette technique atteint un taux de succès d'attaque de 94,13 % dans divers benchmarks de sécurité, indiquant des vulnérabilités dans les LLMs malgré leur conception pour la sécurité.

The introduction of Latent Fusion Jailbreak (LFJ) reveals a method for manipulating safety-aligned large language models (LLMs) by blending harmful and benign queries to elicit unsafe outputs. This technique achieves a high attack success rate of 94.13% across various safety benchmarks, indicating vulnerabilities in LLMs despite their design for safety.