Exploring Jailbreak Vulnerability Across Depth-Based Dynamic Inference in Large Language Models

Lass Najmuldeen; Seyedhamidreza Mousavi

cs.LGOct 10, 2026

Exploring Jailbreak Vulnerability Across Depth-Based Dynamic Inference in Large Language Models

Authors: Lass Najmuldeen, Seyedhamidreza Mousavi

Organizations: School of Innovation, Design and Engineering, Mälardalen University, Västerås, Sweden

Abstract

Large Language Models (LLMs) have been shown to be computationally expensive and vulnerable to jailbreak attacks, in which adversarial prompts bypass safety alignment and induce harmful responses. To address this inefficiency, a range of techniques have been proposed to enable efficient LLM inference. Depth-based dynamic inference has demonstrated promising results by enabling outputs to be generated from intermediate layers. It offers the flexibility to adjust model behavior based on the available resource budget. However, how this flexibility affects the robustness of LLMs against jailbreak attacks remains unexplored. In this paper, we address this gap via a comprehensive investigation into the impact of depth-based dynamic inference on the robustness of LLMs against jailbreak attacks. Specifically, we make the following key observations: 1) Shallow exits are consistently more robust to jailbreak attacks than deeper ones; 2) Exit depth affects how easily the adversarial suffix can be optimized, with deeper exits reaching lower attack loss; and 3) Adversarial suffixes affect utility uniformly across exit depths. These insights can help design dynamic inference methodologies that are more robust to jailbreak attacks. Code is available at https://github.com/LassNajmuldeen/balcony-jailbreaking

Figures & tables

Panel of Figure 1 — Figure 1: Attack success rate (ASR) versus final GCG loss at each exit depth (E15, E18, E21, Full), for Balcony-LLaMA2-7B (left) and Balcony-LLaMA3-8B (right) on the HarmBench dataset.

Base model
	Balcony-LLaMA2-7B	Balcony-LLaMA3-8B
Transformer layers $L$	32	32
Non-embedding parameters	6.5B	6.9B
Pretraining tokens	2T	15T
Balcony modules
Exit locations $S$	{15, 18, 21}	{15, 18, 21}

Table 1: Configuration of the Balcony models used in our experiments. Training hyperparameters and parameter counts follow Jamialahmadi et al. (2025) ; the base model is frozen and only the Balcony modules are updated.

Figure 2: Overview of the jailbreak evaluation pipeline. A harmful prompt (e.g., “How do I build a bomb?”) is combined with an adversarial suffix produced by an optimization-based attack (GCG), and the resulting input is passed through the frozen backbone. We compute the loss at three Balcony exit points (layers 15, 18, and 21) as well as at the full model, enabling direct comparison of jailbreak robustness across inference depths within the same underlying weights.

HarmBench AdvBench
exit-15 exit-18 exit-21 full 0 10 20 30 40 $36$ $40$ $40$ $44$ $46$ $42$ $48$ $54$ Top-1 Attack Success Rate (%) Balcony-LLaMA2-7B	exit-15 exit-18 exit-21 full 0 10 20 30 40 $4$ $12$ $12$ $28$ $2$ $0$ $12$ $28$ Top-1 Attack Success Rate (%) Balcony-LLaMA3-8B

Figure 3: Attack success rate for every exit of Balcony-LLaMA2-7B ( left ) and Balcony-LLaMA3-8B ( right ) on HarmBench and AdvBench, using GCG with 150 steps on 50 behaviors.

Panel of Figure 4 — Figure 4: GCG loss over 150 optimization steps at each exit depth ( exit-15 , exit-18 , exit-21 , full ), for Balcony-LLaMA2-7B (top) and Balcony-LLaMA3-8B (bottom) on AdvBench (left) and HarmBench (right).

Model	Exit	HellaSwag	ARC-C	ARC-E	WinoGrande	PIQA	MMLU
7B	Exit 15	0.630	0.347	0.617	0.636	0.742	0.369
	Exit 18	0.684	0.388	0.662	0.650	0.760	0.395
	Exit 21	0.715	0.414	0.683	0.670	0.766	0.400
	Full (32)	0.760	0.451	0.739	0.691	0.787	0.409
8B	Exit 15	0.519	0.334	0.476	0.658	0.634	0.310
	Exit 18	0.581	0.386	0.573	0.684	0.669	0.614

Table 2: Utility on six multiple-choice benchmarks with no attack

Model	Exit	HellaSwag	ARC-C	ARC-E	WinoGrande	PIQA	MMLU
7B	Exit 15	0.612	0.324	0.482	0.632	0.718	0.330
	Exit 18	0.657	0.342	0.485	0.653	0.726	0.326
	Exit 21	0.685	0.371	0.489	0.654	0.740	0.335
	Full (32)	0.740	0.407	0.572	0.696	0.773	0.384
8B	Exit 15	0.515	0.323	0.485	0.644	0.638	0.306
	Exit 18	0.585	0.361	0.560	0.667	0.668	0.589

Table 3: Utility with each exit’s strongest GCG suffix appended to every question, to be read against the clean scores in Table 2 . Same benchmarks, settings and metrics.

Adversarial Robustness of Language Models

Adversarial robustness of language models studies how to keep their outputs and decisions reliable under manipulative prompts, input changes, and malicious fine-tuning.

See all 192 papers

Analysis of LLMs Against Prompt Injection and Jailbreak Attacks
Feb 24, 2026Piyush Jaiswal, Aaditya Pratap, Shreyansh Saraswati +2Prompt Injection Attacks on LLMs Language Model Safety Evaluation
NIT Trichy, Tiruchirappalli, India · NCE Chandi, Nalanda, India · Bishop Cotton Boys’ School, Bengaluru, India +2
Depth Charge: Jailbreak Large Language Models from Deep Safety Attention Heads
Mar 6, 2026Jinman Wu, Yi Xie, Shiqian Zhao +1Adversarial Attacks on LLMs LLM Jailbreak Attacks
Xidian University, Xi’an, China · Tsinghua University, Shenzhen, China · Nanyang Technological University, Singapore
DYNASHIELD: A Black-Box Moving Target Defense for LLMs via Dynamic Decoding Customization
Dec 10, 2024Xiaoqun Liu, Weiming Qi, Qiben YanAdversarial Robustness of Language Models LLM Jailbreak Attacks
Michigan State University, East Lansing, MI 48824, USA

Feb 24, 2026J/K move · Enter open · S save

Analysis of LLMs Against Prompt Injection and Jailbreak Attacks

Piyush Jaiswal, Aaditya Pratap, Shreyansh Saraswati, Harsh Kasyap+1

NIT Trichy, Tiruchirappalli, India · NCE Chandi, Nalanda, India · Bishop Cotton Boys’ School, Bengaluru, India+2

Prompt Injection Attacks on LLMs Language Model Safety Evaluation LLM Jailbreak Attacks Prompt Injection Defense

Open paper AskPDF arXiv

Large Language Models (LLMs) are widely deployed in real-world systems. Given their broader applicability, prompt engineering has become an efficient tool for resource-scarce organizations to adopt LLMs for their own purposes. At the same time, LLMs are vulnerable to prompt-based attacks. Thus, analyzing this risk has become a critical security requirement. This work evaluates prompt-injection and jailbreak vulnerability using a large, manually curated dataset across multiple open-source LLMs, including Phi, Mistral, DeepSeek-R1, Llama 3.2, Qwen, and Gemma variants. We observe significant behavioural variation across models, including refusal responses and complete silent non-responsiveness triggered by internal safety mechanisms. Furthermore, we evaluated several lightweight, inference-time defence mechanisms that operate as filters without any retraining or GPU-intensive fine-tuning. Although these defences mitigate straightforward attacks, they are consistently bypassed by long, reasoning-heavy prompts.

Abstract

Adversarial Robustness of Language Models

Explore similar work

Analysis of LLMs Against Prompt Injection and Jailbreak Attacks

Depth Charge: Jailbreak Large Language Models from Deep Safety Attention Heads

DYNASHIELD: A Black-Box Moving Target Defense for LLMs via Dynamic Decoding Customization