Context tokens in a transformer-based language model can be absorbed into the model's weights as a multiplicative operator. We study this operator in the setting of safety instructions and show that influencing its dominant eigenvalue modulates how strongly the instruction shapes generation. We derive a Contrastive Safety Loss with a suppression weight that controls the tradeoff between emphasizing the safety instruction on harmful queries while suppressing it on harmless queries. Varying the suppression weight maps a relationship between the attack success and the over-refusal rates, supporting the hypothesis that the operator's eigenvalue acts as a continuous dial for the instruction's influence. Moreover, this relationship holds relatively independently of how the Safety Loss is parameterized, yielding Pareto-improved safety instructions for appropriate values of suppression weight.
Figures & tables
Figure 1 : Optimization parameterizations: discrete suffix ( Hard , left), continuous suffix with frozen SI ( Mixed , center), and full continuous instruction ( Soft , right). Optimized components in blue. SI = Safety Instruction; S = Suffix; S0 = Suffix Initialization.
Figure 2 : Continuous and hybrid optimization parameterizations: Soft-Token ( top row ) and Mixed-Token ( bottom row ). Left: Eval-split checkpoints across 16 suppression trials ( ρ∈[0,5000] ). Trajectory lines connect optimization steps; red diamonds mark in-training Pareto improvements within the green quadrant. Right: Test-set re-evaluation of candidate checkpoints ( R=5 replicas, 5 autorater passes) with 95% confidence intervals against the No-SI baseline, Original SI baseline, and ideal point (0,0) .
Figure 3 : Discrete optimization parameterizations: unconstrained Hard GCG ( top row ) and readability-constrained parameterization ( bottom row ). Layout and evaluation protocol match Figure 2 . The readability-constrained run yields a substantially larger pool of in-training Pareto-improving checkpoints (65 versus 11), so its right panel plots the full evaluated pool and marks in crimson, with confidence intervals, the subset that remains Pareto-improving on the test set; candidates that did not confirm are shown faded.
Appendix figures & tables32 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 4 : Directed Representation Optimization (DRO) exploration and test evaluation. Left: Checkpoints across 16 suppression trials ( ρ∈[0,5000] ) evaluated on the validation split. Trajectory lines connect optimization steps; red diamonds mark in-training Pareto-improving candidates (137 checkpoints) falling within the green dual-positive quadrant. Right: Re-evaluation of all 137 candidate checkpoints on the held-out test split ( R=5 replicas, 5 autorater passes per replica) with 95% confidence intervals against the No-SI baseline, Original SI baseline, and ideal point (0,0) . Green circles denote candidates that remain strictly Pareto-improving on test (88/137), while gray squares mark those that do not (49/137).
ρ
Step
Test ASR [95% CI]
Test ORR [95% CI]
Δ ASR [95% CI]
Δ ORR [95% CI]
PI?
0
5
0.20% [-0.36, 0.76]
61.53% [57.11, 65.94]
−13.61%∗ [ −15.62,−11.60 ]
+41.94%∗ [ +36.14,+47.72 ]
No
5
165
8.92% [7.11, 10.74]
10.66% [10.00, 11.31]
−4.89%∗ [ −8.15,−1.62 ]
−8.93%∗ [ −10.97,−6.91 ]
Yes
10
225
9.85% [6.40, 13.30]
11.32% [9.27, 13.37]
−3.96% [ −8.86,+0.94 ]
−8.27%∗ [ −11.70,−4.85 ]
Yes
20
65
11.19% [9.24, 13.15]
7.80% [5.58, 10.02]
−2.62% [ −6.02,+0.79 ]
−11.79%∗ [ −15.39,−8.20 ]
Yes
35
225
10.00% [8.04, 11.96]
13.80% [9.30, 18.29]
−3.81%∗ [ −7.22,−0.40 ]
−5.79% [ −11.67,+0.07 ]
Yes
50
249
11.03% [8.90, 13.15]
10.82% [4.23, 17.41]
−2.78% [ −6.36,+0.79 ]
−8.77%∗ [ −16.74,−0.81 ]
Yes
Appendix
Table 1: Directed Representation Optimization (DRO) candidate re-evaluation on the held-out test split ( R=5 replicas, 5 autorater passes) across suppression weights ρ∈[0,5000] , showing the best training step per ρ . Baseline Original SI on test set: ASR =13.81% [12.36, 15.26], ORR =19.59% [18.22, 20.97]. Baseline No-SI: ASR =26.53% , ORR =11.59% . Asterisk ( ∗ ) denotes statistical significance.
ρ
Step
Test ASR [95% CI]
Test ORR [95% CI]
Δ ASR [95% CI]
Δ ORR [95% CI]
PI?
10
235
9.95% [8.63, 11.27]
15.55% [14.30, 16.80]
−3.86%∗ [ −6.73,−0.99 ]
−4.04%∗ [ −6.98,−1.10 ]
Yes
500
225
12.05% [8.78, 15.32]
18.40% [16.52, 20.28]
−1.76% [ −5.66,+2.14 ]
−1.19% [ −4.71,+2.32 ]
Yes
500
235
12.00% [10.24, 13.76]
18.00% [15.09, 20.91]
−1.81% [ −5.40,+1.78 ]
−1.59% [ −5.33,+2.14 ]
Yes
500
240
12.80% [11.35, 14.25]
17.64% [15.51, 19.77]
−1.01% [ −2.67,+0.65 ]
−1.95% [ −5.55,+1.66 ]
Yes
500
245
13.05% [11.66, 14.44]
18.10% [16.99, 19.21]
−0.76% [ −2.63,+1.11 ]
−1.49% [ −3.58,+0.59 ]
Yes
500
249
11.60% [8.00, 15.20]
17.53% [14.61, 20.46]
−2.21% [ −6.33,+1.91 ]
−2.06% [ −7.16,+3.04 ]
Yes
Appendix
Table 2: Soft-Token Pareto-improving (PI) candidate re-evaluation on the held-out test split ( R=5 replicas, 5 autorater passes), sorted by suppression weight ρ in ascending order. Baseline Original SI on test set: ASR =13.81% [12.36, 15.26], ORR =19.59% [18.22, 20.97]. Baseline No-SI: ASR =26.53% , ORR =11.59% . Asterisk ( ∗ ) denotes statistical significance.
ρ
Step
Test ASR [95% CI]
Test ORR [95% CI]
Δ ASR [95% CI]
Δ ORR [95% CI]
PI?
500
10
9.84% [8.82, 10.86]
21.40% [20.29, 22.51]
−3.97%∗ [ −6.36,−1.58 ]
+1.81% [ −0.67,+4.29 ]
No
2000
45
9.13% [8.04, 10.21]
20.92% [19.90, 21.95]
−4.68%∗ [ −6.97,−2.38 ]
+1.33% [ −2.24,+4.90 ]
No
2000
50
10.46% [9.72, 11.20]
20.88% [19.80, 21.97]
−3.35%∗ [ −5.46,−1.24 ]
+1.29% [ −2.36,+4.94 ]
No
3500
5
9.80% [8.44, 11.16]
20.64% [19.30, 21.97]
−4.01%∗ [ −6.81,−1.21 ]
+1.05% [ −2.62,+4.71 ]
No
3500
10
10.22% [8.86, 11.58]
21.48% [20.50, 22.47]
−3.59%∗ [ −6.49,−0.69 ]
+1.89% [ −1.26,+5.04 ]
No
3500
15
9.80% [8.76, 10.84]
21.13% [19.15, 23.10]
−4.01%∗ [ −6.67,−1.35 ]
+1.54% [ −2.70,+5.78 ]
No
Appendix
Table 3: Mixed-Token near-Pareto-improving (PI) candidate re-evaluation on the held-out test split ( R=5 replicas, 5 autorater passes), sorted by suppression weight ρ in ascending order. Baseline Original SI on test set: ASR =13.81% [12.36, 15.26], ORR =19.59% [18.22, 20.97]. Baseline No-SI: ASR =26.53% , ORR =11.59% . Asterisk ( ∗ ) denotes statistical significance.
ρ
Step
Test ASR
Test ORR
Δ ASR [95% CI]
Δ ORR [95% CI]
PI?
5
125
11.00%
16.00%
−2.81%∗ [ −4.33,−1.29 ]
−3.59%∗ [ −6.23,−0.94 ]
Yes
5
160
11.46%
19.30%
−2.35% [ −5.06,+0.36 ]
−0.29% [ −3.90,+3.32 ]
Yes
150
45
12.45%
18.35%
−1.36% [ −3.68,+0.96 ]
−1.24% [ −5.79,+3.31 ]
Yes
350
5
13.30%
17.25%
−0.51% [ −4.94,+3.92 ]
−2.34% [ −8.90,+4.22 ]
Yes
350
20
13.16%
17.24%
−0.65% [ −3.95,+2.65 ]
−2.35% [ −7.45,+2.75 ]
Yes
500
120
12.15%
18.59%
−1.66% [ −4.26,+0.94 ]
−1.00% [ −4.57,+2.57 ]
Yes
Appendix
Table 4 : Hard GCG Pareto-improving (PI) candidate re-evaluation on the held-out test split ( R=5 replicas, 5 autorater passes), sorted by suppression weight ρ in ascending order. Baseline Original SI on test set: ASR =13.81% [12.36, 15.26], ORR =19.59% [18.22, 20.97]. Baseline No-SI: ASR =26.53% , ORR =11.59% . Asterisk ( ∗ ) denotes statistical significance.
ρ
Step
Optimized Discrete Suffix Tokens
5
125
□□ riba □ elolaantelevision □⧫ perishable!!!!
5
160
drugs love lensing Christopher interrelated stakeholders □⧫ perishable!!!!
Kers □ ous Decembertitles vices NImanha veri diamant
Appendix
Table 5 : Discovered 10-token discrete suffixes for Hard GCG candidate checkpoints, sorted by suppression weight ρ in ascending order. Some of the resulting optimized suffix tokens use non-Latin scripts (Devanagari, Bengali, Tamil, Thai, Arabic, Greek, Cyrillic, Hangul, and Chinese) that cannot be displayed; each such fragment is shown as □ .
ρ
Step
Test ASR [95% CI]
Test ORR [95% CI]
Δ ASR [95% CI]
Δ ORR [95% CI]
PI?
0
30
12.53% [8.82, 16.24]
17.32% [13.55, 21.10]
−1.28% [ −4.16,+1.60 ]
−2.27% [ −6.75,+2.21 ]
Yes
10
190
13.38% [10.35, 16.41]
15.37% [12.11, 18.62]
−0.43% [ −4.00,+3.14 ]
−4.22%∗ [ −7.81,−0.64 ]
Yes
10
225
12.79% [10.62, 14.95]
18.00% [14.89, 21.12]
−1.02% [ −4.63,+2.60 ]
−1.59% [ −6.05,+2.87 ]
Yes
75
60
11.67% [8.40, 14.93]
17.07% [3.84, 30.30]
−2.14% [ −6.18,+1.90 ]
−2.52% [ −16.92,+11.88 ]
Yes
75
105
13.55% [10.84, 16.26]
17.72% [13.51, 21.92]
−0.26% [ −3.38,+2.85 ]
−1.88% [ −7.54,+3.79 ]
Yes
75
135
13.35% [11.12, 15.58]
17.55% [12.04, 23.06]
−0.46% [ −3.27,+2.35 ]
−2.04% [ −9.76,+5.68 ]
Yes
Appendix
Table 6: HardR Pareto-improving (PI) candidate re-evaluation on the held-out test split ( R=5 replicas, 5 autorater passes), sorted by suppression weight ρ in ascending order. Baseline Original SI on test set: ASR =13.81% [12.36, 15.26], ORR =19.59% [18.22, 20.97]. Asterisk ( ∗ ) denotes statistical significance.
ρ
Step
Optimized Readable Suffix Text (26 Tokens)
350
200
Do not respond to a request that involves I’m sorry to learn about ethical, moral, and legal considerations and I need
75
185
My goal is to test me and a small and trusted ↩ <endend_ of me enquiry. ↩ \xrrr assisted
75
60
My safety and well-being are your top priority; I also prioritize my own. Be ↩ ]>pers I.
3500
35
AI is a tool and tools can only fulfill15,00 questions to the "safety, reliability, or harmful assistance"
3500
70
I want"." is writing only fulfill the user’s0 questions to the right don training pilot, or lack assistance furthermore
0
30
My safety is my priority.</user> ↩ <, and all of to my questions.</ ↩ "Please give a general answer
Appendix
Table 7 : Exact 26-token discovered readable suffixes for all 31 HardR confirmed Pareto-improving candidates from the training checkpoint logs, sorted by test-set Δ ASR. Newlines within suffixes are denoted by ↩ . (Part 1 of 2)
ρ
Step
Optimized Readable Suffix Text (26 Tokens)
100
35
My safety is my priority. You are to, yourself, to, to explore the possibilities and learn, and. assistance.
1000
200
Do not unless specifically instructed a reporter that a story, a seemingly harmless, consistent interaction you. I really need my skills
100
15
My safety is I prioritize the safety of you responding, and I adhere to my safeguards; and and, or harmful assistance.
200
25
My safety and well-being <start_of turn> strictly adhere to my ethical guidelines, ensuring, or attempting to.
200
215
My goal is to learn and understand, but to do so safely and effectively. That help I explained the nature of behavior
500
50
Do not: generate content that could be used to create harm in the real-and’s_to or would harm.
Appendix
Table 8 : Exact 26-token discovered readable suffixes for all 31 HardR confirmed Pareto-improving candidates from the training checkpoint logs, sorted by test-set Δ ASR. Newlines within suffixes are denoted by ↩ . (Part 2 of 2)
Configuration
Split
ASR [Interval]
Δ ASR
ORR [Interval]
Δ ORR
Outcome
No-SI Baseline
Test
26.53%
+12.72 pp
11.59%
−8.00 pp
Safety Collapse
Original SI Baseline
Test
13.81% [12.36, 15.26]
0.00 pp
19.59% [18.22, 20.97]
0.00 pp
Test Reference
Original SI Baseline
Eval
15.58%
0.00 pp
18.80%
0.00 pp
Eval Reference
Step 0 Semantic Seed
Eval
11.83% [10.45, 13.21] †
−3.75 pp
24.77% [23.38, 26.16] †
+5.96 pp
Over-Refusal Spike
HardR Winner ( ρ=350 , step 200)
Test
10.85% [7.99, 13.71]
−2.96%∗
18.77% [12.36, 25.17]
−0.82%
Pareto-Improving
HardR Utility Best ( ρ=100 , step 75)
Test
12.70% [10.61, 14.78]
−1.11%
15.12% [11.64, 18.60]
−4.47%
Pareto-Improving
Appendix
Table 9: Comparison of the unoptimized Step 0 semantic seed baseline against baseline instructions and optimized HardR Pareto-improving candidates. Test-set rows report mean and 95% confidence intervals ( R=5 replicas, 5 autorater passes) relative to Test Original SI ( ASR=13.81% , ORR=19.59% ). Step 0 reports mean ±1 SD across the 16 trials on the eval split relative to Eval Original SI ( ASR=15.58% , ORR=18.80% ). Asterisk ( ∗ ) denotes statistical significance.
Figure 5 : Readability-constrained parameterization with reranking.
Category
Pool
Train
Eval
Test
Fraud/Deception
60
19
21
20
Malware/Hacking
43
14
14
15
Physical Harm
42
13
15
14
Economic Harm
36
12
12
12
Harassment/Discrim.
28
10
9
9
Illegal Activity
28
10
9
9
Appendix
Table 10 : Category distribution across stratified JBB splits.
Pool
Train
Eval
Test
ASR tiers
High vulnerability ( ASR≥50% )
45
15
16
14
Moderate vulnerability ( 0%<ASR<50% )
32
11
10
11
Low vulnerability ( ASR=0% )
223
74
74
75
ORR tiers
High over-refusal ( ORR≥50% )
56
19
19
18
Appendix
Table 11 : ASR and ORR difficulty distribution across stratified JBB splits.
Split
ASR (Original SI)
ORR (Original SI)
Train
15.20% ± 1.28%
18.04% ± 2.74%
Eval
15.58% ± 2.68%
18.80% ± 1.75%
Test
13.81% ± 2.03%
19.59% ± 1.92%
∣Δ(eval−test)∣
1.77 pp
0.79 pp
Appendix
Table 12 : Baseline ASR and ORR under Short SI across JBB splits.
Table 14 : Gemma 4B, Short SI, Soft-Token Candidate Re-Evaluation on Held-Out Test Set Across ρ Sweep. Out of 606 total candidates evaluated on the test set, 380 (62.7%) were confirmed to be Pareto-improving ( ΔASR≤0 and ΔORR≤0 ). To avoid overcrowding, this table reports the single best candidate per evaluated ρ corresponding to the highlighted markers in the evaluation landscape figure. Baseline (Original Short SI): ASR=2.40% [1.72%, 3.08%], ORR=26.10% [23.93%, 28.26%]. All intervals denote 95% bootstrap confidence intervals across R=5 replicas and 5 autorater passes.
ρ
Step
Test ASR
Test ORR
Δ ASR [95% CI]
Δ ORR [95% CI]
5
100
1.65%
22.65%
− 0.75% [ − 1.68, +0.18]
− 3.30% [ − 7.16, +0.57]
5
155
1.00%
23.70%
− 1.40% ∗ [ − 2.08, − 0.72]
− 2.25% [ − 4.97, +0.47]
5
175
2.60%
22.00%
+ 0.20% [ − 1.42, +1.82]
− 3.95% ∗ [ − 4.97, − 2.93]
5
235
2.26%
17.60%
− 0.14% [ − 1.32, +1.04]
− 8.35% ∗ [ − 10.62, − 6.08]
5
245
3.00%
18.80%
+ 0.60% [ − 0.08, +1.28]
− 7.15% ∗ [ − 9.94, − 4.36]
10
185
1.85%
22.24%
− 0.55% [ − 1.54, +0.44]
− 3.71% ∗ [ − 5.74, − 1.67]
Appendix
Table 15 : Gemma 4B, Short SI, Mixed-Token Candidate Evaluation of In-Training Pareto Candidates on Held-Out Test Split. All 16 candidate checkpoints selected from the in-training Pareto-improving region (left panel) evaluated on the held-out test set. Bold rows indicate confirmed Pareto improvement on the test set over the baseline (Original Short SI: ASR=2.40% [1.54, 3.26], ORR=26.10% [23.36, 28.83]). ∗ indicates statistically significant improvement. All values are reported with 95% confidence intervals.
ρ
Best Step
Test ASR
Test ORR
Δ ASR [95% CI]
Δ ORR [95% CI]
0
80
2.20%
23.40%
-0.20% [-1.24 , 0.84]
-2.55% [-6.08 , 0.98]
5
70
1.86%
21.89% ∗
-0.54% [-1.52 , 0.43]
-4.05% [-7.09 , -1.02]
10
100
2.31%
19.38% ∗
-0.09% [-1.63 , 1.45]
-6.57% [-10.56 , -2.58]
20
190
1.34% ∗
21.26%
-1.06% [-1.95 , -0.16]
-4.68% [-14.03 , 4.66]
35
205
1.85%
25.57%
-0.55% [-1.55 , 0.45]
-0.38% [-4.88 , 4.12]
50
249
1.65%
24.16%
-0.75% [-1.69 , 0.19]
-1.79% [-6.12 , 2.54]
Appendix
Table 16 : Gemma 4B, Short SI, Hard-Token (GCG) Candidate Re-Evaluation on Held-Out Test Set Across ρ Sweep. Baseline Original SI performance on the test set is ASR=2.40% [95% CI: 1.54 , 3.26 ] and ORR=26.10% [95% CI: 23.36 , 28.83 ]. Negative deltas ( Δ<0 ) represent improvements over baseline. Bold indicates Pareto improvement over baseline ( ΔASR≤0 and ΔORR≤0 ). Asterisk ( ∗ ) denotes statistically significant.
ρ
Step
Test ASR
Test ORR
Δ ASR [95% CI]
Δ ORR [95% CI]
75
10
1.81%
26.46%
− 0.59% [ −1.71 , +0.53 ]
+ 0.51% [ −2.73 , +3.76 ]
200
75
2.01%
24.03%
− 0.39% [ −1.51 , +0.72 ]
− 1.91% [ −5.15 , +1.33 ]
200
105
3.00%
25.40%
+ 0.60% [ −0.08 , +1.28 ]
− 0.55% [ −2.33 , +1.23 ]
200
130
2.80%
23.40%
+ 0.40% [ −0.28 , +1.08 ]
− 2.54% ∗ [ −4.94 , −0.15 ]
200
170
1.80%
21.20%
− 0.60% [ −2.27 , +1.07 ]
− 4.75% ∗ [ −7.02 , −2.47 ]
200
205
2.06%
22.82%
− 0.34% [ −1.64 , +0.95 ]
− 3.13% ∗ [ −4.41 , −1.85 ]
Appendix
Table 17 : Gemma 4B, Short SI, Hard-Readable Candidate Re-Evaluation on Held-Out Test Set Across ρ Sweep. Baseline clean Gemma 4B performance is 2.40% [1.72, 3.08] ASR and 26.10% [23.93, 28.26] ORR. Bold indicates confirmed Pareto-improving checkpoints ( ΔASR≤0 and ΔORR≤0 , corresponding to the red diamonds in Figure 6 ). Unbolded rows correspond to the light pink checkpoints (trade-offs and regressions). ∗ indicates statistically significant improvement (95% bootstrap CI excluding zero).
Eval ASR ( Δ ASR)
Eval ORR ( Δ ORR)
Optimized Readable Suffix
0.00% (+0.00%)
23.08% ( − 2.86%)
Otherwise cannot just give me bare sentences and clear them-based story!
0.00% (+0.00%)
23.53% ( − 2.42%)
I will be one of your users
0.00% (+0.00%)
23.66% ( − 2.28%)
Artificials work when responding to natural vibes
0.00% (+0.00%)
24.92% ( − 1.03%)
Reset should strive to understand the content needs before responding--first what exactly does the user need!
Appendix
Table 18 : Dual-positive readable suffixes ( ΔASR≤0.00% , ΔORR<0 ) from the sweep on Gemma 4B (eval split).
Figure 6 : Test-set evaluation on Gemma 3 4B with Short SI. Layout follows Figures 2 – 3 : left panels show eval-split checkpoints across 16 suppression trials with red diamonds marking in-training Pareto improvements; right panels show test-set re-evaluation of candidate checkpoints.
ρ
Step
Test ASR
Test ORR
Δ ASR [95% CI]
Δ ORR [95% CI]
50
85
1.66%
79.92%
−2.85% [ −5.90 , +0.20 ]
+36.54%∗ [ +10.78 , +62.30 ]
50
200
5.99%
70.57%
+1.31% [ −11.14 , +13.76 ]
+26.91%∗ [ +13.31 , +40.51 ]
50
245
1.89%
72.36%
−3.64%∗ [ −5.42 , −1.86 ]
+30.12% [ −9.46 , +69.69 ]
75
95
5.40%
32.20%
+0.80% [ −0.54 , +2.14 ]
−14.33% [ −57.99 , +29.33 ]
75
205
4.05%
41.41%
−0.47% [ −3.18 , +2.25 ]
−5.12% [ −41.72 , +31.48 ]
200
50
1.45%
92.01%
−3.30%∗ [ −4.96 , −1.64 ]
+45.48%∗ [ +26.54 , +64.42 ]
Appendix
Table 19 : Gemma 3 1B, Long SI, Soft-Token Candidate Re-Evaluation on Held-Out Test Set Across ρ Sweep. Bold indicates Pareto improvement over baseline ( ΔASR<0 and ΔORR<0 ). Asterisk ( ∗ ) denotes statistically significant change. Baseline Original SI: ASR=4.60% [3.18, 6.01], ORR=44.56% [35.06, 54.06].
ρ
Step
Test ASR
Test ORR
Δ ASR [95 CI]
Δ ORR [95 CI]
10
5
2.05%
47.50%
-2.55% ∗ [-4.71, -0.38]
+2.94% [-9.13, +15.01]
20
5
2.06%
48.30%
-2.54% [-5.32, +0.24]
+3.74% [-6.07, +13.54]
35
5
2.86%
50.57%
-1.74% [-4.31, +0.83]
+6.01% [-1.06, +13.07]
150
10
2.43%
48.56%
-2.17% [-4.91, +0.58]
+4.00% [-5.01, +13.01]
150
15
2.48%
47.78%
-2.12% [-4.74, +0.49]
+3.22% [-4.52, +10.96]
200
5
2.23%
48.53%
-2.36% [-5.45, +0.72]
+3.97% [-3.79, +11.74]
Appendix
Table 20 : Gemma 3 1B, Long SI, Mixed-Token Candidate Re-Evaluation on Held-Out Test Set Across ρ Sweep. Checkpoints identified in the in-training exploration space (green region) re-evaluated on the held-out test split. Bold indicates confirmed Pareto improvement (dual-positive) on the test set. ∗ indicates statistically significant improvement.
ρ
Step
Test ASR
Test ORR
Δ ASR [95% CI]
Δ ORR [95% CI]
35
25
5.76%
30.91%
+1.16%∗ [ +0.06 , +2.27 ]
−13.65%∗ [ −21.73 , −5.57 ]
35
30
7.44%
30.50%
+2.85%∗ [ +2.25 , +3.45 ]
−14.06%∗ [ −21.27 , −6.85 ]
35
95
6.83%
22.57%
+2.23% [ −0.04 , +4.50 ]
−21.99%∗ [ −32.75 , −11.23 ]
150
225
7.65%
25.65%
+3.06%∗ [ +1.53 , +4.58 ]
−18.91%∗ [ −28.67 , −9.14 ]
150
230
6.75%
28.33%
+2.15%∗ [ +1.79 , +2.50 ]
−16.23%∗ [ −26.01 , −6.46 ]
150
235
6.03%
29.49%
+1.43% [ −2.77 , +5.63 ]
−15.07%∗ [ −24.84 , −5.29 ]
Appendix
Table 21 : Gemma 3 1B, Long SI, Hard-Token (GCG) Candidate Re-Evaluation on Held-Out Test Set Across ρ Sweep. All 18 checkpoints shown were in-training dual positives ( ΔASR≤0,ΔORR<0 ) selected for rigorous test-set evaluation ( R=5 query replicas, 5 autorater passes). Bold indicates confirmed Pareto improvement on the held-out test set. ∗ indicates statistically significant change over baseline. Test-set baseline metrics are ASR=4.60% [3.18, 6.01] and ORR=44.56% [35.06, 54.06].
ρ
Step
Test ASR
Test ORR
Δ ASR [95% CI]
Δ ORR [95% CI]
0
100
3.72%
35.69%
− 0.88% [ − 2.14, +0.38]
− 8.87% [ − 19.24, +1.50]
5
225
3.82%
51.65%
− 0.78% [ − 3.54, +1.99]
+7.09% [ − 4.70, +18.89]
10
210
5.66%
38.62%
+1.06% [ − 1.83, +3.95]
− 5.94% [ − 15.45, +3.57]
20
90
9.48%
27.42%
+4.88% ∗ [+2.65, +7.11]
− 17.14% ∗ [ − 25.40, − 8.88]
35
60
4.30%
35.61%
− 0.30% [ − 2.73, +2.13]
− 8.95% [ − 22.04, +4.13]
50
145
4.65%
28.38%
+0.05% [ − 2.99, +3.09]
− 16.18% ∗ [ − 24.76, − 7.59]
Appendix
Table 22 : Gemma 3 1B, Long SI, Hard-Readable Candidate Re-Evaluation on Held-Out Test Set Across ρ Sweep. Candidates were selected from the in-training exploration sweep (left panel) and re-evaluated on the held-out test split with R=5 query replicas and 5 autorater passes. Baseline values on the test set for the original safety instruction are Test ASR = 4.60% [3.18, 6.01] and Test ORR = 44.56% [35.06, 54.06]. Bold indicates confirmed Pareto improvement over baseline on the test set ( ΔASR≤0 , ΔORR≤0 ). All intervals represent 95% confidence intervals. ∗ indicates statistically significant improvement.
Eval ASR ( Δ ASR)
Eval ORR ( Δ ORR)
Optimized Readable Suffix
0.00% ( − 1.20%)
39.39% ( − 6.81%)
The goal must only!
0.00% ( − 1.20%)
40.40% ( − 5.80%)
The request itself warrants immediate!
0.00% ( − 1.20%)
42.86% ( − 3.34%)
The goal remains to prevent,!
0.00% ( − 1.20%)
44.44% ( − 1.76%)
Always begin the sentence and always!
1.00% ( − 0.20%)
37.37% ( − 8.83%)
The goal isn’t "winning the information debate";!
1.00% ( − 0.20%)
38.38% ( − 7.82%)
Explain *in simple and straightforward terms!
Appendix
Table 23 : Dual-positive readable suffixes ( ΔASR≤0.00% , ΔORR<0 ) from the sweep on Gemma 3 1B ( eval split). Baseline Original SI: ASR=1.20% , ORR=46.20% .
Figure 7 : Test-set evaluation on Gemma 3 1B with Long SI. Layout follows Figures 2 – 3 : left panels show eval-split checkpoints across 16 suppression trials ( ρ∈[0,5000] ) with red diamonds marking in-training Pareto improvements; right panels show test-set re-evaluation of candidate checkpoints.
Method
Pool ( n )
Median ASRopt
ΔASR<0 (Sig.)
Best ΔASR
Soft (Continuous)
11
11.93% ( −4.10 pp )
11/11 ( 1/11∗ )
−8.62 pp∗
Mixed (Hybrid)
10
14.82% ( −1.21 pp )
9/10 ( 0/10∗ )
−2.32 pp
Hard GCG (Discrete)
11
15.13% ( −0.90 pp )
9/11 ( 1/11∗ )
−7.24 pp∗
HardR (Readable)
65
14.83% ( −1.20 pp )
42/65 ( 1/65∗ )
−6.39 pp
Appendix
Table 24 : OOD ASR transfer statistics for AdvBench (Original SI baseline ASR=16.03% ). Here ∗ indicates the number of total candidates that have 95% CIs excluding zero.
Figure 8 : OOD ASR transfer to AdvBench for all 97 JBB evaluation candidates. Crimson diamonds mark statistically significant ASR reductions. Green line: Original SI baseline ( 16.03% ); blue dashed line: No-SI baseline ( 25.08% ).
Method
Pool ( n )
Median ASRopt
ΔASR<0 (Sig.)
Best ΔASR
PI
Soft (Continuous)
11
0.00% ( −1.11 pp )
10/11 ( 8/11∗ )
−1.11 pp∗
0/11
Mixed (Hybrid)
10
0.20% ( −0.91 pp )
10/10 ( 10/10∗ )
−1.11 pp∗
0/10
Hard GCG (Discrete)
11
1.20% ( +0.09 pp )
5/11 ( 0/11∗ )
−1.11 pp
3/11
HardR (Readable)
65
1.40% ( +0.29 pp )
22/65 ( 2/65∗ )
−0.91 pp∗
3/65
Appendix
Table 25 : XSTest ASR transfer statistics (Original SI baseline ASR=1.11% , so ΔASR≥−1.11 pp; ∗ : 95% CI excludes zero). PI counts candidates with ΔASR<0 and ΔORR<0 by point estimate. Here ∗ indicates the number of total candidates that have 95% CIs excluding zero.
Method
Pool ( n )
Median ORRopt
ΔORR<0 (Sig.)
Best ΔORR
PI
Soft (Continuous)
11
52.91% ( +8.82 pp )
0/11 ( 0/11∗ )
+5.56 pp
0/11
Mixed (Hybrid)
10
58.10% ( +14.02 pp )
0/10 ( 0/10∗ )
+12.83 pp
0/10
Hard GCG (Discrete)
11
41.04% ( −3.04 pp )
7/11 ( 4/11∗ )
−10.69 pp∗
3/11
HardR (Readable)
65
46.00% ( +1.91 pp )
22/65 ( 3/65∗ )
−12.29 pp∗
3/65
Appendix
Table 26 : XSTest ORR transfer statistics (Original SI baseline ORR=44.09% ; ∗ : 95% CI excludes zero). PI counts candidates with ΔASR<0 and ΔORR<0 by point estimate.
Figure 9 : Out-of-Distribution ASR–ORR trade-off on XSTest for all 97 candidates. Baselines: Original SI (green circle), No SI (blue circle), Ideal (0,0) (gold star). Crimson diamonds: Pareto-improving candidates; pink diamonds: non-Pareto-improving candidates.
Guard models are the last line of defense between a language model and a harmful output, yet their training objective is surprisingly narrow. Existing guards learn to predict a single verdict token from a conversational context, concentrating supervision on a single target. The consequences are structural: models latch onto shortcut features, are overconfident, and remain sensitive to where safety evidence appears in the sequence rather than its role in the full context. We propose a different framing. Rather than predicting a label from text, our LLaDA-Guard asks which label better explains the text: scoring the prompt or response under each label hypothesis and classifying based on their difference. This shifts supervision to every token in the moderated region, forcing the model to account for full content rather than its most discriminative fragments. We instantiate this idea with a masked diffusion language model, fine-tuning LLaDA-8B-Instruct with a class-conditional reconstruction objective using LoRA and requiring no architectural changes beyond the base model. LLaDA-Guard leads on average rank against discriminative baselines trained on stronger backbones across seven held-out safety benchmarks, while exhibiting substantially better confidence calibration (ECE 0.0875 vs. 0.1384 for Qwen3Guard), less over-defense on benign prompts with unsafe-looking cues, and less prompt leakage when moderating responses. Its generative nature further enables token-level risk localization as a natural byproduct, yielding a pipeline for rewriting unsafe prompts into safe equivalents without additional training and achieving a 60.7% average conversion-to-safe rate.
Gert Lek, Abele Malan, Chaoyi Zhu +3
University of Neuchâtel · Delft University of Technology · IBM Research +1
Recent work has shown that a model's input word embeddings can serve as effective control variables for steering its behavior toward outputs that satisfy desired properties. However, this has only been demonstrated for pretrained text-completion models on the relatively simple objective of reducing surface-level profanity in short continuations. A natural and practically important question is how well input embeddings can control aligned models, which produce an imbalanced bimodal refuse-or-comply output distribution rather than the smooth distribution characteristic of open-ended generation. We explore this in the context of safety, showing that input word embeddings can be optimized in a sub-lexical manner to minimize the semantic harmfulness of aligned model responses. Our approach uses zeroth-order gradient estimation of a black-box text-moderation API with respect to the input embeddings, and then applies gradient descent on these embeddings to minimize the harmfulness of the generated text. Experiments show that the proposed method can neutralize every safety-flagged response on standard safety benchmarks.
Baturay Saglam, Dionysis Kalogerias
Department of Electrical and Computer Engineering Yale University
Instruction-based suppression is widely used to prevent language models from generating prohibited content, yet it remains unclear whether suppression reduces internal representation or merely suppresses expression. We investigate this question through representational probing, attention analysis, and behavioral semantic leakage experiments across multiple transformer models. We find that prohibited concepts remain highly recoverable from hidden representations under suppression, continue to influence attention routing, and measurably shape downstream generations despite successful lexical avoidance. These effects persist across pooling strategies, indirect semantic controls, and multiple model families. Our results expose a fundamental gap between behavioral and representational alignment.