Bait-and-Recover: Poisoning Internal Refusal Signals to Defend LLMs against White-Box Editing Jailbreaks

Abstract

Open-weight large language models face a low-cost white-box threat from representation engineering attacks. Attackers can estimate refusal directions and search for projection-matrix edits that suppress safety alignment while preserving general capabilities, within minutes on a single GPU and without gradient-based training. We propose Bait-and-Recover, a weight-level defense that places a bait adapter where attackers read activations and a paired recovery adapter at the subsequent layer. Traine

Categories

Framework mappings

Suggested from the entry's categories.

@misc{gao2026baitandrecover,
  title = {{Bait-and-Recover: Poisoning Internal Refusal Signals to Defend LLMs against White-Box Editing Jailbreaks}},
  author = {Tian Gao and Zhipeng Xie and Yuhao Wu and Junhua Liu and Xin Fang},
  year = {2026},
  month = sep,
  eprint = {2609.05794},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05794}
}