Probing Latent Subspaces in LLM for AI Security: Identifying and Manipulating Adversarial States
This addresses AI security for LLM developers by proposing a proactive, model-agnostic defense against adversarial manipulations, though it appears incremental as it builds on existing concepts like attractor dynamics and dimensionality reduction.
The study tackled the vulnerability of Large Language Models to adversarial jailbreaking attacks by identifying latent subspaces in model activations and applying perturbations to shift safe states towards jailbreak states, resulting in statistically significant jailbreak responses in a subset of prompts.
Large Language Models (LLMs) have demonstrated remarkable capabilities across various tasks, yet they remain vulnerable to adversarial manipulations such as jailbreaking via prompt injection attacks. These attacks bypass safety mechanisms to generate restricted or harmful content. In this study, we investigated the underlying latent subspaces of safe and jailbroken states by extracting hidden activations from a LLM. Inspired by attractor dynamics in neuroscience, we hypothesized that LLM activations settle into semi stable states that can be identified and perturbed to induce state transitions. Using dimensionality reduction techniques, we projected activations from safe and jailbroken responses to reveal latent subspaces in lower dimensional spaces. We then derived a perturbation vector that when applied to safe representations, shifted the model towards a jailbreak state. Our results demonstrate that this causal intervention results in statistically significant jailbreak responses in a subset of prompts. Next, we probed how these perturbations propagate through the model's layers, testing whether the induced state change remains localized or cascades throughout the network. Our findings indicate that targeted perturbations induced distinct shifts in activations and model responses. Our approach paves the way for potential proactive defenses, shifting from traditional guardrail based methods to preemptive, model agnostic techniques that neutralize adversarial states at the representation level.