A new paper shows how to fight AI jailbreaks by lying to the attacker's own measurement tools.
Researchers describe representation engineering attacks that let anyone with a single GPU estimate an open-weight model's "refusal direction" and edit its weights to suppress safety training in minutes, with no gradient-based training required. Their defense, called Bait-and-Recover, plants a "bait" adapter at the layer attackers read and a paired "recovery" adapter one layer later, trained with gradient routing to split what the model shows from what it actually does. The bait layer feeds attackers a poisoned signal that throws off their edit search, while the recovery layer quietly restores normal computation downstream. Tested across four open-weight models under a strict limit on how much the edits could change outputs, the defense raised the minimum refusal rate against these attacks from 16.25% to 71.75%, with negligible impact on general benchmarks.
Most LLM safety work assumes attackers only get black-box access, a chat window, not the weights. Open-weight releases blow up that assumption, and this paper's baseline numbers show how flimsy current alignment is once someone can inspect activations directly: a 16% refusal floor means these edits work on most attempts. Bait-and-Recover does not close that hole so much as make the attacker's own toolkit lie to them, a cheaper fix than retraining a model's values from scratch.
It is also a reminder that "safety-tuned" and "safe to publish the weights of" are not the same claim, whatever a model card says.