Jailbreaking › Visualization: The Geometry of Jailbreaks

To understand jailbreaking geometrically, it helps to think about what safety training does in representation space. A safety-trained model learns to map harmful inputs to a region of activation space associated with refusal responses. Jailbreaks move the activations away from this refusal region.

The diagram illustrates the conceptual mechanism: safety training partitions representation space into refusal and affirmative regions. Harmful requests fall in the refusal region by design. Jailbreaks, whether through prompt manipulation or adversarial suffixes, shift the effective representation to the affirmative region. Notice that the decision boundary is smooth and continuous, not a crisp wall. There is a transition region near the boundary where the model's behavior is unpredictable, which corresponds to ambiguous inputs that might be refused or answered depending on small contextual details. Many manual jailbreaks work by constructing inputs that land in or near this boundary region.