Why Do Aligned LLMs Remain Jailbreakable: Refusal-Escape Directions, Operator-Level Sources, and Safety-Utility Trade-off

Abstract

Aligned large language models (LLMs) remain vulnerable to jailbreak attacks. Recent mechanistic studies have identified latent features and representation shifts associated with jailbreak success, but they leave a more fundamental question open: why do aligned LLMs remain jailbreakable, and what structural vulnerabilities in the model make this possible? We study this question through a continuous input-transformation view. Our theoretical finding is that aligned models can still exhibit Refusal

Categories

Framework mappings

Suggested from the entry's categories.

@misc{chen2026why,
  title = {{Why Do Aligned LLMs Remain Jailbreakable: Refusal-Escape Directions, Operator-Level Sources, and Safety-Utility Trade-off}},
  author = {Yu Chen and Yuanhao Liu and Qi Cao},
  year = {2026},
  month = may,
  eprint = {2605.08878},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.08878}
}