Tracing the Dynamics of Refusal: Exploiting Latent Refusal Trajectories for Robust Jailbreak Detection

Representation Engineering analyses often characterize refusal using static directions extracted from terminal or pooled representations. We ask whether this view misses how refusal is constructed across layer-token positions. Using causal tracing, we identify a Refusal Trajectory: a sparse upstream activation pattern that often persists even when attacks such as GCG suppress terminal refusal signals. Based on this observation, we propose SALO (Sparse Activation Localization Operator), a lightweight white-box detector that operates on raw hidden-state volumes from a selected layer window. Across Qwen, Llama, and Mistral models, SALO improves jailbreak detection on several attack families under a fixed XSTest-calibrated operating point. We further analyze static RepE-style baselines, ROI sensitivity, adaptive GCG attacks, and encoded-input boundary cases, clarifying both the promise and limitations of refusal-trajectory monitoring.

Large language models are often trained to refuse harmful requests, but attackers can sometimes bypass these safeguards. This paper studies how a model internally develops a refusal response while processing a prompt. We find that refusal is not represented only at the final output position; instead, it appears as a sparse and evolving pattern across intermediate layers and important input tokens. Based on this observation, we build a detector that uses these internal patterns to identify jailbreak attempts more robustly. Our results suggest that looking inside the model can reveal safety-relevant signals that are missed by purely input-output based methods.