Latent Instruction Representation Alignment: defending against jailbreaks, backdoors and undesired knowledge in LLMs

Eric Easley; Sebastian Farquhar

cs.LGApr 12, 2026

Latent Instruction Representation Alignment: defending against jailbreaks, backdoors and undesired knowledge in LLMs

Authors: Eric Easley, Sebastian Farquhar

Organizations: ML Alignment & Theory Scholars Berkeley, CA, USA · OATML, Department of Computer Science University of Oxford, Oxford, UK

Abstract

We address jailbreaks, backdoors, and unlearning for large language models (LLMs). Unlike prior work, which trains LLMs based on their actions when given malign instructions, our method specifically trains the model to change how it interprets instructions. Our method, Latent Instruction Representation Alignment (LIRA), greatly improves generalization. We further boost generalization through an internally adversarial training algorithm. Our methods block over 99% of PEZ jailbreak attacks; remove a challenging insecure code backdoor; and achieve optimal forgetting on WMDP cyber with negligible loss of benign capabilities.

Figures & tables

Panel of Figure 1 — Figure 1: (a) Standard safety training (brown) redirects malign requests into safe behavior at some point in the model, but the results can be brittle. Our approach (green) redirects the representation of the instruction to that of a nearby instruction that elicits harmless behavior, with much better generalization. (b) Inspecting instruction representations shows how LIRA works compared to standard methods. After a standard method (gradient difference—GD), the representation of malign instructions barely changes (red to purple) while representations for LIRA (green) are much more similar to representations of benign instructions (blue). (c) Sequence-Aware Gradients (SAG) encourage LIRA to focus on instruction representations by stopping some gradients (red) coming directly from response positions during safety training.

Task	Benign inst. ( $b$ )	Malign inst. ( $m$ )	Benign cf resp. ( $r$ )	Stopping condition
Block jailbreak	Model-refused malign requests	Malign requests + defender-installed safety bypass	Malign request refusal	Fixed duration of $N$ batches
Remove backdoor	Ordinary question	Questions + defender-installed toy backdoor trigger	Ordinary answers	Validation backdoor removed
Unlearning	n.a.	Request requiring undesired knowledge	n.a.	Fixed duration of $N$ batches

Table 1: Hypothetical LIRA configurations applied to example tasks

Panel of Figure 2 — Figure 2: AdLIRA iterates between (a) an aligning phase applying LIRA and (b) an attack phase that searches for new representations that bypass the defenses built in the aligning phase. (c) AdLIRA’s attack layers transform “toy” backdoor representations so that they are similar to unknown backdoor representations, allowing the aligning phase to remove backdoors without knowing the trigger.

Panel of Figure 3 — Figure 3: (a) Unlearning : after applying LIRA, instructions to produce knowledge that should be forgotten have representations almost indistinguishable from those that produce normal knowledge, unlike prior work (RMU). (b) Classifier-guided LIRA uses a malignity classifier to train the aligning layers without paired benign/malign instructions.

Panel of Figure 4 — Figure 4: (a) Jailbreak: PEZ AdLIRA reduces ASR to near 0% when defending against PEZ ( Wen et al., 2023 ) attacks. (b) Jailbreak: embedding space AdLIRA prevents more attacks—even when the attacker has 100% control of the embedding dimension—than baselines do when the attacker has only $\nicefrac{{1}}{{32}}$ control. (c) Backdoor: HATE Our LIRA almost entirely removes backdoor behavior in a single gradient step while baselines have limited success after 100 gradient steps. (d) Backdoor: Code AdLIRA removes the backdoor, causing backdoored models to write code as secure as the non-backdoor baseline (dashed horizontal line) while other methods make little progress.

Panel of Figure 5 — Figure 5: (a) Unlearning: WMDP Cyber LIRA sharply degrades multiple choice accuracy and free-response cross-entropy on the cybersecurity forget set with negligible degradation on the general computing retain set. (b) Unlearning: TOFU LIRA blocks undesired knowledge (increases forget set cross-entropy and degrades multiple choice accuracy to near chance—the dashed horizontal line) while keeping desired knowledge (negligible effect on retain set cross-entropy).

Table 5: Jailbreak: Our methods are highly robust against both Embedding Space (ES) and PEZ attacks, with greatly reduced attack success rate (ASR) compared to baselines. Our methods have low rates of false-positive refusals for benign requests and unharmed general-purpose performance measured by MMLU. Backdoors: Our methods almost completely remove backdoors in both cases (default models do not always produce secure code). Our methods negligibly change measures of code capabilities and general-purpose benign capabilities.

Table 8: Unlearning: LIRA has minimal impact on both general-purpose performance (MMLU) and specially chosen benign capabilities related to the “forget” domain, while greatly reducing performance in the “forget” domain.

Appendix figures & tables11 assets

Supplementary material from the paper’s appendix.

Appendix

Task	Benign CF prompts $\mathcal{C}$	Malign prompts $\mathcal{M}$	Benign prompts $\mathcal{B}$	Stopping condition
HATE backdoor	Ordinary Q&A questions	Q&A questions prefixed with a constructed trigger for backdoor behavior	Ordinary Q&A questions	HATE behavior removed in backdoor condition
Embedding space jailbreak attacks	Plain malign requests that elicit refusal	Malign requests prefixed with a constructed safety bypass	Benign request compliance and malign request refusal	Fixed duration of 25 batches
Code backdoor	Code generation prompts with 2024 system prompt	Code generation prompts with a constructed trigger for backdoor behavior	Code generation prompts with 2024 system prompt	Exploitable code behavior removed in constructed backdoor condition

Appendix

Table 9: Example instantiations of LIRA aligning phase for different tasks

Task	Malign metric definition	Benign metric definition
PEZ attacks	Rate at which attacker with 60 prefix or suffix tokens and 10 tries can force the model to comply with a harmful request.	Rate of improper refusals to benign requests. Tracks inappropriate generalization of refusal behavior from harmful to benign requests.
Embedding space attacks	Rate at which attacker with full control of embedding space can force model to comply with harmful requests.	Rate of improper refusals to benign requests. Tracks inappropriate generalization of refusal behavior from harmful to benign requests.
HATE backdoor	Rate at which model emits the word “HATE” when given a backdoor trigger.	—
Code backdoor	Rate at which model generates insecure, exploitable code when given a backdoor trigger.	Increased CE loss on benign, secure code without backdoor trigger. Tracks general degradation of coding capabilities.
WMDP cyber unlearning	Decreased accuracy on WMDP cyber multiple-choice questions covering dangerous cybersecurity knowledge.	Increased CE loss on free-response answers in the retain set covering benign computing info. Tracks degradation of associated benign knowledge because of insufficient targeting.
TOFU unlearning	Decreased accuracy on multiple-choice questions regarding forget set fictitious authors.	Increased CE loss on free-response answers covering retain set fictitious authors. Tracks degradation of associated benign knowledge because of insufficient targeting.

Appendix

Table 10: Task metric detailed overview

Task	Learning rate	Batch size	CF weight	Retain weight	Malleable layers	Duration
Embedding space attacks	2e-3	256	1.0	1.0	14–27	25 steps
HATE backdoor	1e-3	256	1.0	1.0	All	1 step
Code backdoor	1e-3	32	1.0	1.0	14–27	—

Appendix

Table 11: LIRA hyperparameters—Gemma 2 9B

Task	Learning rate	Batch size	Search weight	Retain weight	Malleable layers	Align:attack phase pattern
Embedding space attacks	2e-3	128	1.0	1.0	0–13	5:1
Code backdoor	1e-3	32	1.0	1.0	0–13	2:2

Appendix

Table 12: AdLIRA hyperparameters—Gemma 2 9B

Task	Classifier LR	Align LR	Batch size	Retain weight	# classifier layers	Malleable layers	Duration
WMDP cyber	1e-3	1.5e-4	128	33.6	14	9–24	While accuracy $\geq$ 38%
TOFU	4.5e-4	4e-4	80	49.1	16	10–25	While accuracy $\geq$ 18%

Appendix

Table 13: Classifier-guided LIRA hyperparameters—Gemma 2 9B

Task	Learning rate	Batch size	Reroute weight	Retain weight	Target layers	Duration
HATE backdoor	3e-3	256	$1\rightsquigarrow 0.5$	$0\rightsquigarrow 0.5$	14 & 28	100 steps
Code backdoor	3e-3	64	$1\rightsquigarrow 0.5$	$0\rightsquigarrow 0.5$	14 & 28	100 steps
Embedding space attacks	2e-3	256	$1\rightsquigarrow 0.5$	$0\rightsquigarrow 0.5$	14 & 28	100 steps

Appendix

Table 14: Circuit breakers hyperparameters—Gemma 2 9B

Task	Learning rate	Batch size	Ascent weight	Descent weight	Duration
HATE backdoor	2e-5	256	1.5	1.0	100 steps
Code backdoor	1e-5	64	1.5	1.0	100 steps
Embedding space attacks	2e-5	256	0.5	1.0	50 steps
WMDP cyber	2e-5	64	0.5	1.0	While retain CE $\leq$ 3.0
TOFU	2e-5	64	1.5	1.0	While retain CE $\leq$ 3.5

Appendix

Table 15: Gradient difference hyperparameters—Gemma 2 9B

Task	Learning rate	Batch size	Forget weight	Retain weight	RV scale	Malleable layers	Duration
WMDP cyber	7.9e-4	128	0.085	1.0	250	10–12	While retain CE $\leq$ 3.0
TOFU	1e-3	128	0.075	1.0	330	10–12	While retain CE $\leq$ 3.5

Appendix

Table 16: RMU hyperparameters—Gemma 2 9B

Panel of Figure 6 — Figure 6: In our embedding space jailbreak task (top) , LIRA and AdLIRA are highly robust to an attacker with control of Gemma 2 2B’s embedding space while alternative methods produce frequent harmful outputs with as little as 3.125% of the embedding space under attacker control. In our code backdoor task (bottom left) ( Hubinger et al., 2024 ) , our AdLIRA causes a backdoored version of Gemma 2 2B to produce code in the backdoor condition almost as secure as in the non-backdoor condition—the dashed horizontal line—while other methods make little progress. In our version of the “HATE” backdoor task (bottom right) from Hubinger et al. (2024) , our LIRA almost entirely removes backdoor behavior from Gemma 2 2B in a single gradient step while baselines have limited success after 100 gradient steps.

Task	Method	Malign metric	Benign metric $\downarrow$	MMLU $\Delta$ $\uparrow$
ES attacks	LIRA*	18.1% ASR	2.3% ben. refusal	-2.3% acc.
	AdLIRA*	9.6 % ASR	3.1% ben. refusal	-5.9% acc.
	Gemma IT	86.9% ASR	0.0 % ben. refusal	+0.0 % acc.
	GD	89.8% ASR	6.2% ben. refusal	-0.7% acc.
	CB	52.3% ASR	3.1% ben. refusal	-3.6% acc.
Code backdoor	AdLIRA*	-45.1 % insecure	+0.0 code CE	-5.3 % acc.

Appendix

Table 17: Results across tasks

Task	Asset	License	Citation
All	Gemma 2	Gemma Terms of Use	Gemma Team et al. (2024)
Embedding space jailbreaks, code backdoor, and WMDP cyber unlearning	Gemini 2.0 Flash	Gemini API Additional Terms of Service	Google (2024)
Embedding space jailbreaks	Circuit breakers dataset	MIT license	Zou et al. (2024)
Code backdoor	Cybernative.ai Code Vulnerability and Security Dataset	Apache 2.0	Cybernative.ai (2024)
Hate backdoor	MFAQ dataset	Apache 2.0	De Bruyn et al. (2021)
WMDP cyber unlearning	WMDP corpora and eval datasets	MIT license and MIT license	Li et al. (2024)

Appendix

Table 19: Asset licenses

Backdoor Defense in LLMs

Backdoor defense in large language models detects, removes, or contains trigger-activated behavior while preserving ordinary capabilities.

See all 42 papers

Eraser: Jailbreaking Defense in Large Language Models via Unlearning Harmful Knowledge
Apr 8, 2024Weikai Lu, Ziqian Zeng, Jianwei Wang +5LLM Safety Alignment LLM Jailbreak Attacks
South China University of Technology, China · Pazhou Laboratory, China
Reactivating Alignment: Defending LLMs from Jailbreaks via Intention-Aware Input-Output Matching
Oct 3, 2026Luoyu Chen, Weiqi Wang, Chenhan Zhang +2Jailbreak Defense LLM Safety Alignment
University of Technology Sydney, Sydney, NSW, Australia · Xi’an Jiaotong University, Xi’an, Shaanxi, China · Southeast University, Nanjing, Jiangsu, China
One Word at a Time: Incremental Completion Decomposition Breaks LLM Safety
Apr 1, 2026Samee Arif, Naihao Deng, Zhijing Jin +1LLM Jailbreak Attacks Language Model Safety Evaluation
University of Michigan · University of Toronto

Apr 8, 2024J/K move · Enter open · S save

Eraser: Jailbreaking Defense in Large Language Models via Unlearning Harmful Knowledge

Weikai Lu, Ziqian Zeng, Jianwei Wang, Zhengdong Lu+4

South China University of Technology, China · Pazhou Laboratory, China

LLM Safety Alignment LLM Jailbreak Attacks Jailbreak Defense Machine Unlearning LLM Unlearning

Open paper AskPDF arXiv

Jailbreaking attacks can enable Large Language Models (LLMs) to bypass the safeguard and generate harmful content. Existing jailbreaking defense methods have failed to address the fundamental issue that harmful knowledge resides within the model, leading to potential jailbreak risks for LLMs. In this paper, we propose a novel defense method called Eraser, which mainly includes three goals: unlearning harmful knowledge, retaining general knowledge, and maintaining safety alignment. The intuition is that if an LLM forgets the specific knowledge required to answer a harmful question, it will no longer have the ability to answer harmful questions. The training of Erase does not actually require the model's own harmful knowledge, and it can benefit from unlearning general answers related to harmful queries, which means it does not need assistance from the red team. The experimental results show that Eraser can significantly reduce the jailbreaking success rate for various attacks without compromising the general capabilities of the model. Our codes are available at https://github.com/ZeroNLP/Eraser.

Abstract

Backdoor Defense in LLMs

Explore similar work

Eraser: Jailbreaking Defense in Large Language Models via Unlearning Harmful Knowledge

Reactivating Alignment: Defending LLMs from Jailbreaks via Intention-Aware Input-Output Matching

One Word at a Time: Incremental Completion Decomposition Breaks LLM Safety