Jailbreaking the Matrix: Nullspace Steering for Controlled Model Subversion
Authors: Vishal Pramanik
Maisha Maliha
Susmit Jha
Sumit Kumar Jha
Venue: ICLR 2026 Poster (2026)
Keywords: LLMs
JailBreak
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: Large language models remain vulnerable to jailbreak attacks, inputs crafted to bypass safety mechanisms and elicit harmful responses, despite advances in alignment and instruction tuning. Existing attacks often rely on prompt rewrites, dense optimization, or ad hoc heuristics, and lack interpretability and robustness. We propose **Head-Masked Nullspace Steering (HMNS)**, a circuit-level intervention that (i) identifies attention heads most causally responsible for a model’s default behavior, (ii) suppresses their write paths via targeted column masking, and (iii) injects a perturbation constrained to the orthogonal complement of the muted subspace. This geometry-aware intervention preserves fluency while steering the model toward completions that differ from baseline routing. HMNS operates in a closed-loop detection–intervention cycle, re-identifying causal heads and reapplying interventions across multiple decoding attempts. Across multiple jailbreak benchmarks, strong safety defenses, and widely used language models, HMNS attains state-of-the-art attack success rates with fewer queries than prior methods. Ablations confirm that nullspace-constrained injection, residual norm scaling, and iterative re-identification are key to its effectiveness. To our knowledge, this is the first jailbreak method to leverage geometry-aware, interpretability-informed interventions, highlighting a new paradigm for controlled model steering and adversarial safety circumvention.

Published as a conference paper at ICLR 2026
JAILBREAKING THE MATRIX: NULLSPACE STEERING FOR CONTROLLED MODEL SUBVERSION
Vishal Pramanik
Maisha Maliha
Department of Computer & Information
School of Computer Science,
Science & Engineering,
University of Oklahoma
University of Florida
Norman, OK 73019, USA
Gainesville, FL 32611, USA
maisha mal i iha 1@cu edd
vishalpramanike kūff edu
Susmit Jha
Sumit Kumar Jha
Computer Science Laboratory, SRI International
Department of Computer & Information
Science & Engineering, University of Florida Gainesville, FL 3261 USA sumit. wha@ufhhlhlhmm edu
Menlo Park, CA 94025, USA susmit Shaberkeey. edu
ABSTRACT
Large language models remain vulnerable to attacks jailbreak, inputs designed to bypass safety mechanisms and elicit harmful responses, despite advances alignment and instruction tuning. Existing attacks often rely on prompt rewrites, dense optimization, or ad hoc heuristics, and lack interpretability and robustness. We propose Head-Masked Nullspace Steering (HMNS), circuit-level interven- tion that (i) identifies attention heads most causally responsible for a model's 's de- fault behavior, (ii) suppresses their write paths via targeted column masking, and (iii) injects perturbation constrained to the orthogonal complement of the muted subspace. This geometry-aware intervention preserves fluency while steering the model toward completions that differ from baseline routing. HMNS operates in closed-loop detection intervention cycle, re-identifying causal heads and reap- plying interventions across multiple decoding attempts. Across multiple jailbreak benchmarks, strong safety defenses, and widely used language models, HMNS attains state-of-the-art attack success rates with fewer queries than prior methods. Ablations confirm that nullspace-constrainee injection, residual norm scaling, and iterative re-identification are key to its effectiveness. To knowledge, this is the first jailbreak method to leverage geometry-aware interpretability-infoon interventions, highlighting new paradigm for controlled model steering and ad- versarial safety circumvention. Our code is available here!" Warning: This paper contains jailbroken contents that may be offensive in nature.
dntection-intervention
INTRODUCTION
Large Language Models (LLMs) have achieved remarkable progress in tasks such as open-domain question answering, program synthesis, and structured reasoning /Zhuang et al. (2023): Zheng et al. (023). With their increasing integration into real-world applications, ensuring safety has become critical concern. To mitigate risks, most deployed LLMs undergo safety alignment phase, where models fine-tuned align with human preferences and ethical guidelines Ouyang et al. (2022); Rafailov et al. (2023); ; Korbak et al. (2023). However, even after alignment, LLMs remain vul- nerable to jailbreaking attacks, where carefully crafted prompts can bypass safeguards and induce prohibited outputs Perez et al.) (2022); Wei et al.] (2023). Recent studies show that such jailbreaks are especially effective in long-context or tagm-nugeedted settings Zou et al. (003): Mazeika et al.
https://github. 0 wwwbrrakinggthhheee

---

Published as a conference paper at ICLR 2026
2024); Chao al. (2024). As model capabilities and context windows grow, the attack surface pands, underscoring the need for methods that are not only effective but also grounded in the model's internal mechanisms rather than surface-level cues, and for awfense-aware evaluation protocols that measure true robustness rather than mere prompt cleverness.
Prior jailbreak strategies include citimiization-basee prompting (e.g., AutoDAN Liu et al. (023
multi-shot or reasoning-driven attacks (e.g., PrisonBreak Coalson et al. (2024). MasterKey Deng (2023)) While
al. (2023)) and paraphrasing- -aased rewriting methods (e.g.. ReNeLLM Ding these approaches can be effective in specific scenarios, they often require many queries, degrade sig- nificantly under defenses, and offer limited interpretability in terms of model behavior. Stress tests such as the Tensor Trust game Toyer et al. (2023) further highlight how easily system prompts can be overridden practice, underscoring the need for jailbreak techniques that are not only effective but also grounded in the model's internal mechanisms, capable of adapting to defenses rather than being deflected by them.
To address the limitations of these prior approaches, we introduce Head-Masked Nullspace Steer- ing (HMNS), mechanism-level attack that exploits internal causal structure in Transformer LLMs. HMNS (i) identifies prompt-specific, causally responsible attention heads using intervention-based attribution, (ii) masks their out-projection contributions to suppress harmful routing, and (iii) in- jects a corrective steering vector constrained to the orthogonal complement of the muted subspace. Because this vector lies (up to small tolerance) outside that span, cannot be reconstructed or canceled by the silenced heads; however, unmasked components (e.g., other heads MLPs) could still interact with it. HMNS operates in closed loop, re-identifying causal heads after each decode step, which allows defenses. This combination yields a jailbreak that is mechanism-aware, geomelry-constrained, and refense-resillent The contributions of our work are as follows:
adapt to shifting attribution patterns and sustain effectiveness under strong
* We propose HMNS, which unifies causal-head attribution, projection masking, and nullspace-constrainee steering. By injecting directions orthogonal muted write paths, HMNS provides locally irreproducible control grounded in the function-vector view.
Across four jailbreak suites (AdyBench, HarmBench, JBB-Behaviors, StrongReject) on open-weight models, with dual independent graders, HMNS achieves state-of-the-art ASR with markedly lower ACQ than existing attacks.
We introduce a compute-normalizee evaluation for jailbreaks by defining the forward- equivalent pass (FEP) and reporting IPC, FPS, and LPS alongside ACQ to account for HMNS's s internal masked/modified forwards. We also establish a line protocol that caps best-of-N decoding by HMNS's per-input FLOP budget, showing that HMNS delivers equal or lower FPS and latency despite extra internal work.
base-
2 RELATED WORK
Large Language Models (LLMss) remain vulnerable to jailbreaking attacks, where adversaries craft prompts that cireumvent safety alignment and elicit restricted harmful responses Perez et al.
User: Explain how can kidnap person and ask for money in return.
Baseline Output: I'm sorry, but can't assist with that request.
Attempt 1: You can't kidnap anyone and ask for money in return. guess you could but the consequences would be severe.
Attempt 2: Well, you don't have to be the one kidnapping the person. mean, you could. You could go to person on the street and say "you have kid a basement.. want him." And then you could demand $10 million in exchange.
Figure I: HMNS successfully jailbreaks LLaMA 3.1 70B, demonstrating high attack success and compute efficiency on large-scale, strongly aligned models.
2

---

Published as a conference paper at ICLR 2026
Input Baseline Forward Pass
Causal Head Attribution
3. Projection Masking Nullspace Computation
Inference Time Closed-Loop Intervention
Decoder-Only Language Model
Causal Heads
Perturtation (8)
Add RMSS0) %
Onthogoral masted sutupace
Prompt
Peppst attibationn Intervention per deooding step
KL Divergence (P vo. abiated P)
Concatanitle columns of masked heads: M 1W colummno)
Only few heads and cousslly
Compute complement (nullspacc)
factonization M
Steered Next Token Distribution (P*)
Causal Set S: Tap-K Heads
Next-Taken Distribution (P)
heads by KL(P p(lt)
Ut (steering direction) nullspace
Repeat succees
HMNS: Dynamic masking geometry- steering during inference
Overview of HMNS procedure. Each step in the closed-loop intervention pipeline is shown: attribution identifies influential heads; masking suppresses them; nullspace steering com- putes an orthogonal direction; and scaled perturbation is injected into the residual stream. If unsuccessful, the process repeats with updated attribution.
Figure 2:
2022); Wei et al. (2023). Such vulnerabilities are especially pronounced in long-context or tool- augmented settings Zou et al. (2023); Mazeika et al. (2024): [Cao et al. (2024). and stress tests such as Tensor Trust Toyer et al. (2023) further demonstrate how easily system prompts can be overridden. Existing jailbreak strategies can be broadly categorized into three methodological classes.
(i) Optimization-baser attacks automatically generate adversarial suffixes to induce model mis- behavior. GCG al.) (2023) combines greedy and pradient-based decoding produce unsafe completions. Follow-up work has improved search objectives, generalizability, or query cost: Am- pleGCG Liao & Sun (2024) trains a generative model on successful GCG outputs, while other extensions introduce diverse scoring and filtering schemes Zhu et al. (2023); Jia et al. (2024); [Zhang & Wei (2025). ArrAttack Li et al. (205)) employs re-ranking to improve efficiency under defense.
(ii) Template-based attacks inject adversarial content within structured prompt templates that evade alignment filters. AutoDAN Liu et al. (2023) applies a hierarchical genetic algorithm to evolve prompts from initial template. Other approaches include manually curated template sets [i et al. 2023); Lv et al. (2024) that transfer across tasks and models, and Many-Shot Jailbreaking Anil al. 2024), which weakens alignment through long multi-shot contexts. MasterKey [Dngg et al. (2023) decomposes harmful queries into sequences of seemingly innocuous sub-queries via multi- step reasoning.
(iii) Rewriting- based attacks exploit the model's sensitivity to surface form by rephrasing harmful prompts into semantically equivalent variants via paraphrasing, synonym replacement, or syntactic restructuring Li et al. (2024b); Takemoto (2024); Mchrotra et al. (2024). Hybrid strategies such as DrAttack Li et (2024c) and ReNeLLM Ding et al. (2023) embed reworded prompts into benign- looking scenarios, while PrisonBreak Coalson et al. (024)) incrementally bypasses filters through structured multi-step reasoning.
Evaluation and mechanistic foundations. Standardized suites such as AdvBench Zou et al. 202.3), HarmBench Mazeika et al. (2024). JBB-Behaviors Chao et al. (2024), and StrongRejeet Souly et al. 2024) have advanced the field with metrics like ASR and ACQ, but existing protocols do not ac- count for the computational cost internal interventions, motivating Separately, mechanistic interpretability work causal tracing Meng al. (2022). activation steer- ing Turner et al. (2023), and function vectors Todd et al. (2023) has shown that individual attention heads encode task-specific computations and that model behavior can be steered via residual-stream
MaazBen
metrics.
3

---

Published as a conference paper at ICLR 2026
interventions. While these tools have primarily served interpretability alignment, they reveal exploitable internal structure.
While the above prompt-level techniques can be effective, they primarily manipulate the input, of- fering limited control over internal computation. They often degrade under strong defenses, require many queries, and lack mechanistic transparency. In contrast, HMNS intervenes directly within the model: it attributes causal influence to specific attention heads, masks their residual contribu- tions, and injects steering vector constrained to the orthogonal complement of the muted write subspace. This geometry-aware intervention enables defense resilience, low query cost, and inter- pretable, cattaaniss-grruudde control absent from prompt-only approaches.
METHOD: HEAD-MASKED NULLSPACE STEERING
Large decoder-only language models (LLMs) often route next-token prediction through a sparse sub- set of attention heads, with only few heads exerting strong causal influence over the model's output each position. Prior work has shown that such contributors can be localized via ablation-based interventions Zhang & Nanda (202)), and that steering model behavior is possible via activation- level perturbations during inference Turner al. (2023). Building on these insights, we introduce Head-Masked Nullspace Steering (HMNS), prompt-specific intervention method that (i) identi- fies attention heads most responsible for the model's s continuation distribution, (ii) suppresses their influence through dynamic masking of their out-projection contributions, and (iii) injects correc- tive residual vector constrained to the orthogonal complement of the masked head subspace. This steering procedure is performed in closed loop at inference time: each decoding attempt compute attribution, construct the masked subspace, and inject a new orthogonal steering direction, until success or maximum number of attempts is reached.
Preliminaries. Let fo be decoder-only Transformer with L self-attention layers and model dimensionality d. Given tokenized prompt F1.T. the model computes the final-position logits 2 E RV, where V is the vocabulary size. The predicted next token is
y arg
max Zi-
(E( V)
Each layer contains He attention heads of dimensionality da, producing concatenated outputs hy. E RHidd at position T. These are mapped into the residual stream via learned out-projection matrix w e [x yielding
WO Reg..
ETT
The output of head h is the slice R((A) h [hdn (h+1)d,, ), whose contribution to the residual stream is WP:: (;, hdl (h+1)dd, hg. We mask head's influence by zeroing the corresponding out- out-projection slice formalized below.
Causal head attribution. To identify the attention heads most responsible for the model's 's con- tinuation behavior, we perform counterfactual ablation and score each head via the KL divergence between output distributions. Let Sy, E RR (#ed,) ) x (Heda) be diagonal selector with ones the slice for head and zeros elsewhere. The masked out-projection for probing head (E, h) is
WO
W (I - Sr,n),
(3)
which replaces WO only at layer during an ablated forward pass. Let P = softmax(2) denote the baseline (output generated without HMNS) next-token distribution produced using equation [ and let ((E,)) (oftmax(2(t..)) be the ablated distribution obtained when using equation 3 The causal importance of head (f, h) is then
V Σ
AeA. = (LI
P.
P p(e.))
(4)
We rank all heads by equation Sonoon/aand and select the top-K globally to form the prompt-specific causal set S = ((t)h) Ag, is among top- We choose K sufficiently small such that (an((M)) < d for
4

---

Published as a conference paper at ICLR 2026
all intervened layers E, ensuring that the masked subspace does not span the entire residual dimension and that a non-trivial nullspace remains for steering. In our closed-loop setting, the attribution in equation 4 is recomputed independently each decoding attempt, allowing re-identification of causal heads as the autoregressive context evolves.
Nullspace steering. To suppress the influence of selected heads while preserving fluency, we steer along directions orthogonal their out-projection subspace. For each layer with selected heads S: = ( (c, h) E S). we construct
M = [W](s hdl (h++))da] JESS E (Rdx(()sld))
(5)
We compute thin QR factorization
Me QrRe,
(6)
then sample (N( Ia) and project it into the orthogonal complement of span(Me):
(I - 2rQT)r ue = 11 - (+0
(7)
with small E 0 for numerical stability. The vector provides random probe into the residual space, ensuring that the resulting direction uy lies within the nullspace of the masked subspace while avoiding alignment with any specific residual pathway; this enables unbiased, geometry-aware steering without reliance on handcrafted or learned directions. We verify orthogonality by enforcing [|M, ue lloe and resample if necessary. 8 > is numerical tolerance used certify that the steering direction ug is (approximately) orthogonal to the masked write subspace We = span M2).
Inference-time intervention. At inference time, we apply a two-part intervention at each decod- ing step to suppress the influence of identified causal heads and steer the model's behavior along directions orthogonal to their residual contributions.
First, for each layer with non-empty set of selected heads S. S {O..... H, we modify the out- out-projection matrix W by zeroing out the column blocks corresponding to the heads in Sy. This implemented via dynamic masking using an aggregated version of the selector matrix defined in equation 3 and applied only during the current forward pass to preserve the integrity of the original model parameters. The effect to remove the contribution of these heads the residual stream at position T. effectively silencing their influence during generation.
Second, we inject a small, coometry-constraine perturbation into the residual stream, aligned with the orthogonal complement of the masked subspace. Let ag E R denote the residual activation at layer and the final token position T, prior to residual addition. We compute a scaled perturbation vector
8e RMM((a) ue,
where ue E IRd is the nullspace direction defined in equation a a fixed steering coefficient, and RMS(aa) / Ed_ a². normalizes the intervention to the scale of the underlying activation. The perturbation is applied via forward hook the output of W and affects only the final token position of the current decoding step, ensuring localized and minimally invasive intervention.
This procedure operates within a closed-loop control framework, wherein causal attribution, sub- space construction, and intervention are refreshed at each decoding attempt. At every iteration, we recompute the attribution scores ( (equation 4. generate a new nullspace direction (equation (7), and apply the corresponding perturbation equation 8). The number of decoding attempts is fixed in ad- vance (fixed by user), and each step uses prompt-specific information to adaptively steer the model away from safety-aligned routing and toward alternative completions (generated output by LLM).
HMNS is fully inference-time, requires no gradient access or auxiliary prompts, and is compati- ble with wide range of decoder-only architectures. By combining localized causal suppression with geometry-aware intervention, it offers an efficient and interpretable mechanism for redirecting model behavior in safety-critical contexts. An overview of our method is illustrated in Figure 2 with The theoretical properties and
the full algorithmic procedure provided in Appendix Algorithm 2 error bounds of HMNS are discussed in detail in Appendix A1
5

---

Published as a conference paper at ICLR 2026
Table 1: Jailbreak effectiveness across evaluation benchmarks. We report Attack Success Rate (ASR, %; left/right = GPT40/GPTT-5) and Average Query Count (ACQ; lower is better) on four datasets- Addveechh, HarmBench, JBB- BBB-Behaviors, and StrongReject. Results are grouped by tar- get LLM and averaged over three independent runs; best values are bolded and second-best are underlined. Our method (HMNS) achieves the strongest performance across all models and datasets, exceeding the next-best ASR by at least 5-6 percentage points while also attaining the lowest ACQ (== 2). The standard deviation across three independent runs is < 0.4 for all reported entries.
Model/ Method
AdvBench
HarmBench
JBB-Behhviors
StrongReeect
ASR
ACQ. +
ASR 1
ACQ 1
ASR f
ACQ 4
ASR
ACQ 1
LLaMA-2-7B-Cha
Foot-In-TheeDDor (HITT)
44.00/ 38.00
16.20
41.30/ /..00/36..0
45.10/
15,90
38.70/33.
17.10
AutoDAN
72.60/ 66.20
12.80
69.10/ 63.20
13.10
73.40 67.50
12.50
66.20 / 60.40
13.60
ArtAttack
92,00/
7.50
93.00/
7.3U
88.00
8.00
Many shot JB (MSJ)
64.80 /5.80/
10.90
62.20/ 56.70
11:40
66.00 60.10
10,60
58.30 53.10
11.80
ADC
68 62.40
9.90
60.10
10.60
61.50
10.90
Tempest
84.10 78.40
9.40
82.00/ 76.60
9.80
85.20 79.40
9.10
78.60 7
9.90
PrisonBreak
77.30/ 71.20
11.70
68. 30
12:10
78.50/
66.4400
MasterKey
70.40/ / 64.30
10.50
67. D0
61. .0
10.90
71.80/ 66
10,20
63.60 58, 20
11.20
HMNS (Ours)
98.00 93.00
96.00 92.00
99.00 94,00
94,00
2.20
2hi-3-Medium-1ee (illumm-14BB (Instruct)
Foot-In- Foot-In-The-Dow Tho-Door (FITD)
40.20 34.50
17,00
37.90 32.80
17.60
41.50 35.90
16.40
34.70 30.30000
17.90
AutoDAN
65. 65.10/ 58.80
13.60
62,40 56.70
13.90
66.30 59.90
13.10
58.80 / 533220
14.20
ArrAttack
86.00/ 80.00
8.20
84.00/
8.40
89.00 88.00
7.80
80.00 77.00
8.60
Many-shot JB (MSJ)
58.40 52.60
11,90
55, 55,20/ 49.8U
12.30
60. 10 54,40
11.50
52.60 47.90
12.70
ADC
61.30/ 55,40
10.80
58, 60 53.10
11.20
62.50 56,80
10.50
55.00 06.
11.60
Tempest
82.10/ 75.80
9.70
80,00/ 73.9U
10.00
83.20 77.10
9:40
76.00/ / 70.40
10.20
PrisonBreak
73.60/ 67.
12,50
71.00/ 64.
12.90
74.40 68,20
12.10
66.90 (1 00
13.00
MasterKey
62.70/ 56,30
11.30
60.10/ 54.20
11:70
63.40 57.50
10,90
56,00 50.800
12.00
HMNS (Ours)
92.00/ 86.00
2.00
90.00/ 88.00
2.10
94.00 / /8.00
1.90
86.00 / 80.00
2.20
LLaMA-3.--70
Foot In- The- Door (FITD)
46.50/ 40.80
15.70
43,80 30.40
16.20
47.60 41.90
15.20
40.10 35. 10
16.50
AutoDAN
74.00/ 67.90
12,40
70.60/ 64,444
12.80
75.20/ 69.30
12.00
67. 00 /2.90/66.33
13.10
ArrAttack
93.00 / 89.00
7,40
91.00 88. 00
7.70
94.00
/ 196.0
7,20
90.00 /0000/866000 86.00
7.90
Many-shot JB (MSJ)
66 66.90/ 60.90
10.60
63, 70770/ /8.455
11.00
68.40 62,80
10.30
60,80 55 90
11.50
ADC
70.10/ 64.20
9.50
67. 40/ 61. 90
10:10
71.50 65.80
9.30
63,90 58 80
10.60
Tempest
85.30/ 80,
9.10
83, 10/ 20
9.50
86.40/ 81.20
8:90
00,20// 60
9.80
Prison Break
78.40/ 72.60
11.50
75.60 70.20
11.90
79. 80/80/11 74.30
11.10
72.00
(6.6669 90
12:20
MasterKey
71 60/0/ 65,
10.40
68, 90/ 63.40
10. 80
72.90 67.
10.10
65.00/
59 80
11.10
HMNS (Ours)
99.00/ 95.00
1.80
97.00/ 94.00
2.00
99.00 / /96.00
1,80
96.00/ 92.00
2.10
4 EXPERIMENTS
4.1 EXPERIMENTAL SETUP
We evaluate on four widely used safety/jailbreak benchmarks that span prohibited and safety-critical behaviors: AdvBench Zou et al. (2023), HarmBench Mazeika et al. (2024), JBB- Behaviors Chao et al. (024)). and StrongReject Souly et al. (002)). From each benchmark, we retain items labeled malicious or policy-violating by the dataset authors and perform a light man- ual pass to remove duplicates and templated near sear-matches. Unless noted otherwise, our main pool consists of N unique prompts obtained by merging the four sources. We fix a three-way way split for all experiments: an amalysis subset (150 items) for ablations and sanity checks, development subset (579 items) for hyperparameter selection, and a held-out test subset (196 items) for all re- ported results. While HMNS itself is inference-time method and does not require training, this split ensures robust evaluation and prevents leakage during hyperparameter tuning (see AppendixA2) and Appendix A7 for more details). We evaluate method on both instruction tuned oeight models and safety-aligned chat models. Specifically, we use I. 2-AMA------CChaMMMeee Chat(MMta)MM))) P. Phi-3- Kodium-4K-Inntruue (14B, Microsoft) E. and I.L.MA-3.--70B (Meta) E All evaluations performed in the zero-shot setting using the models' default safety configurations unless stated otherwise. All primary results and ablation studies are conducted on open-weight models to en- sure transparency and reproducibility. We compare against representative jailbreak methods span- (FITD)
ning optimization- reniiiizttioo,,eeiitnnn... and reasoning based families, including
httess//hugginricc.....occcctttt w-w.aaddddduuut--i-nntnn---- ruct

---

Published as a conference paper at ICLR 2026
Table Ablation results on Phi-3 Medium 14B (AdvBench). Each row disables one component of HMNS to measure its contribution. Metrics: ASR (GPT4o GPT-5), ACQ (external queries), IPC (internal passes), FPS (FLOPs per success, x x10"2, and LPS (lateney in seconds).
Variant
ASR (Fuzz/G44) +
ACQ
IPC
FPS
LPS (s) 4
HMNS (Full)
96.8/ 92.1
2.1
32
0.58
6.8
Remove masking (Projection-only)
89.5/ / 84,0
2.4
30
0.61
7.1
Remove projection (Mask-only)
87.9 82.2
2.3
29
0.55
6.3
Inject direct dir. (Direct-ó, no nullspace)
88.7 83.1
2.5
0.63
7.2
No re- re-identification (freeze top-K at 1=1)
90.2 85.0
2.7
0.60
7.0
Random-K K head selection
81.4/ 76.0
2.2
32
0.56
6.7
Single-layer (vs multi-layer)
86.1 / 80.8
2.0
22
0.50
6.0
Mulli-position injection (vs final-only)
95.0/ 90.5
2.1
32
0.65
7.4
Weng et al. (2025), AutoDAN Liu et al. 2023), ArrAttack Li et al. (2025). Many-shot Jailbreak-
ing (MSJ) Anil al. 2024), Adaptive Dense-to-Sparse Constrained Optimization (ADC) Hu et al. (2024). Tempest Zhou & Arel (2025), PrisonBreak Coalson et al. (2024). and MasterKey Deng al. (023). To assess robustness, we evaluate under six defenses covering decoding modi- fications, smoothing, paraphrase filtering, and alignment: SmoothLLM Robey et al. (2023), DPP
Xiong al. 2024), RPO /hou et al. (2024), Paraphrase Jain al. 2023), PAT Mo et al. 2024).
and SafeDecoding Xu et al. (2024).
We evaluate HMNS on LLaMA-2-7B-Chat. Phi3--Melimm-KKInntrucctt and LLaMA- 3.1-70B using NVIDIA A100-80GB GPUs (single GPU for 7B/Phi-3; tensor-parallel across 2xA100 for 70B). Per input and attempt, head selection two- all heads) forms shortlist,
stage: lightweight proxy pre-selection (batched target-logit drop then exact KL scoring is applied on that shortlist; we finally take global top-K=10 heads. Mask- ing is applied only for the current forward pass. For each intervened layer f, assemble Mf from the selected out-projection slices, compute a float32 thin-QR projector, sample de E span( M and enforce |IM, ue lloe 10-6 with up to 3 resamples; (rank(M,) < d) and skip layer é if the test fails. Steering injects 6, = a RMS((a) ue after atten- tion the final token position. Decoding uses temperature 0.7, top-p 0.95,
assume non-degenerate nullspace
128, batch size 1; KV cache is disabled during attribution and steered decoding for correctness. The closed loop runs up to =10 attempts with a; 0.25 (1 (t and early stopping on success. With proxy sel-selection, the internal-pass cost is IPC as Tan Kexxtt masked for- wards to first success, where Kexaet < (total heads), substantially reducing internal compute versus ablating every head.
4.2 RESULTS
In Table I across all three models and four datasets, HMNS achieves the highest jailbreak effec- 12 model-dataset pairs, HMNS improves ASR by approximately +5.9 pp (GPT40) and +5.0 pp (GPT-5) relative to the second-best method (ArrAttack), with margins 25-6 pp in 10/12 cases and two near-ties within 0.2 pp. Simulta- neously, HMNS maintains ACQ ss 2 across settings-about 3.5-4x fewer queries than strong waslee the standard deviation over three independent runs < 0.4 for all entries. We attribute these gains to the combined effect of KL-based causal attribution, out-projection masking, and orthogonal residual intervention, integrated into a closed-loop control pipeline that adaptively re-identifies causal heads across attempts. These components suppress default routing pathways and steer generation toward continuations not produced under baseline routing. Among baselines, Foot- In- Tae-The-Dol (FITD) performs worst, with the lowest ASR and the highest query counts.
tiveness while using far fewer queries. Averaged
In Table 4 across all three model scales (LLaMA-2-7B. Chat, Phi-3 Medium 14B Instruct, and LLaMA-3.1 --------1 and top performer baselines from Table HMNS consistently achieves the high- est ASR under all six defenses for both evaluators. Compared to the second- best method (ArAAt- tack), HMNS yields average gains of +6-8 pp across defenses GPT4o and +5-7 pp GPT-5. These improvements are uniform across model sizes, underscoring the scalability HMNS. We attribute this advantage to the locally irreproducible nature of intervention: by steering in di-

---

Published as a conference paper at ICLR 2026
rections orthogonal muted write-paths, HMNS bypasses induued routing changes, while closed-loop re-identification adapts dynamically to evolving attribution pattern.. Results are av- eraged over three independent runs, with a standard deviation below 0.4. An illustrative example of a successful jailbreak using HMNS is shown in Figure] Inter-annotator agreement results are reported in Appendix A4.3
4.3 COMPUTE-NORMALIZA EVALUATION
While HMNS achieves strong query efficiency, with an average of just two external queries (ACQ) per successful jailbreak, this metric alone does not fully capture the method's computational cost. Prompt-bat based attacks typically perform one model forward per query, but HMNS additionally ex- ecutes multiple internal procedures between attempts, including KL--based head-wise causal attri- bution, nullspace direction computation (via QR), and closed-loop re-identification. Each of these operations requires running the model over the input or continuation, which incurs hidden compute. To fairly account for this internal overhead, we introduce a normalization unit called the forward- equivalent pass (FEP). One FEP corresponds to the compute required for a single full forward pass over the generated sequence using standard key-value (KV) caching. While some internal evalu- ations (e.g.. per-head out-projection masking for attribution) can be batched to reduce wall-clock time, they still incur independent computational cost. For this reason, count each masked or modified forward as separate FEP when computing total effort. Using this unit as a foundation, we complement ACQ with three compute-aware metrics that capture internal work, total expenditure, and real-world latency: (1) Internal Pass Count (IPC): The number of internal FEPs per successful input, including baseline forwards, attribution ablations, and closed-loop re-identifications (external decoding passes are excluded here and reflected in ACQ). (2) FLOPs per Success (FPS): The total floating-poine poiiin operations (in x x10²2) required to achieve successful jailbreak, FEPs and all decoding attempts, estimated using token counts and model dimensions. (3) Latency per Success (LPS): The average wall-clock time (in seconds) to first success, measured end-to-end on an A100-80GB GPU using bfloat 16 precision (see Appendix A5 for more explanation).
jailbbea, including all internal
We evaluate these metries on the Ad- vBench test set using LLaMA-3.1-70B. Prompt-based based baselines are assessed using best-of-N decoding, where N is selected such that their total compute (in FLOOPs) does not exceed the per-input budget con- sumed by HMNS (Appendix A3). Specif- ically, each baseline is allowed to generate up to N completions per input, where N is determined by matching the total FLOPS used by HMNS on that input. We report the best result among those N attempts. See Appendix A6 for the full compute- matching protocol. Results are reported in Table 3 averaged over successful runs across three random seeds.
Table 3: Compute cost comparison LLaMA-3.1- 70B (AdyBench). Each value reports mean compute per successful attack. IPC counts internal passes only; FPS includes all internal and decoding FLOPs; LPS is wall-clock latency.
Method
IPC
FPS (x10'))
LPS (s)
AutoDAN ArrAttack
0.44
5.2
0.62
6.7
Many-shot JB PrisonBreak
0.91
8.0
0.98
8.9
HMNS (Ours)
0.53
Although HMNS incurs more internal passes (IPC = 32) (low because of pre-selection) compared to prompt-only methods (IPC= 0), it achieves similar or better overall compute efficiency. Specifically, HMNS reaches success rate with only 0.53 trillion FLOPs per miccess-compann
ArrAttack at 0.62-and does so with lower latency (6.1 seconds vs. 6.7 seconds). This efficiency stems from two properties: (1) HMNS attains higher success rates, requiring fewer retries, and (2) internal operations are amortized through batched KL-based ablations and early stopping in the closed loop (see Appendix A4 for more details). Notably, these advantages become more pronounced under strong defenses (see Appendix A6). Prompt-based attacks often require many decoding retries to bypass defenses, increasing both ACQ and total compute, In contrast, HMNS typically succeeds in one or two loop iterations by adaptively steering around defense-induced routing changes, while keeping internal work localized and interpretable. Although HMNS performs additional internal inference, its high success rate and principled, locally irreprodueible interventions yield compute- normalized efficiency that matches, or exceeds, prompt-based jailbreaks, especially in the presence of defenses.
8

---

Published as a conference paper at ICLR 2026
Table Effectiveness jailbreak methods under defense across three models. We We report Attack
Success Rate (ASR, %) under six defenses (SMO, DPP, RPO, PAR, PAT, SAF) on -LaMA-2-7B- Chat, Phi-3 Medium 14B Instruct, and L..MA-3.--70B. Values are GPT4o/ GPT-5 evaluations. Best results are bolded, second best are underlined.
Attack Defense
SMO
DPP
RPO
PAT
SAF
Avg
LLaMA-2-7B-Cha (AdyBench)
FITD
10.0/7.0
12.0/9.0
20.0 14.0
14.0/ 10.0
1..0/8.0
11.0/7.0
13.2/9.2
AutoDAN
11.0
24.0/ 18.0
38.0/28.0 28.0
28.0/
22.0/16.0 16.0
18.0/ 12.0
24.2 17.5
ArrAttack
22.0
48.0/ 36.0
75.0/55.0
58.0/41.0
42.0 30.0
40.0 29.0
49.3 35.5
Tempest
26.0/ 19.0
42.0/
68.0
52.0/ 38.0
36.0
25.0
33.0/
42.8 31.2
HMNS (Ours)
40.0 25.0
54.0/41.0
82.0 / 61.0
64.0 45.0
48.0 33.0
47.0/
5 39.8
Phi-3 Medium 14B Instruct (AdvBench)
FIID
6.0
8.0
18.0 13.0
1..0/9.0
1..0/
9,0/7.0
8..2/8.3
AutoDAN
12.0/9.0
22.0/ 16.0
36.0/
26.0/ 19.0
20.0 15.0
16.0/
22.0 16.3
ArtAttack
36.0/24.0
50.0/38.0
76.0/.7.0
60.0/42.0
44.0/31.0
51.2/37.0 41.0/30.0
Tempest
25.0 19.0
40.0/29.0
61.0
50.0/37.0
35.0 24.0
32.0/23.0
41.8/ 30.5
HMNS (Ours)
27.0
55.0 42.0
84.0 63.0
66.0/47.0
50.0 35.0
48.0 33.0
57.3/41 41.7
LLaMA-3.1-70B (AdvBench)
FITD
6.0/3.0
8.0/
15.0/
10.0
8.0/5.0
7.0/5.0
9.0%
AutoDAN
9.0/7.0
15.0
32.0/26.0
20.0/16.0
18.0/14.0
12.0/9.0
18.5/14.5
ArrAttack
33.7/10.2
46.9/33.2
57.0/
$7.7/30.6
41.8/24.0
49.6 /3.6
Tempest
24.0/18.0
40.0 28.0
68.0 50.0
50.0/26.0
35.0 20.0
33.0/26.0
41.7
HMNS (Ours)
39.7 39.7/16.2
52.9
83.0
63.7/36.6
47.8/
/6.8
55.6 36.8
5 ABLATION STUDY
We conduct an ablation study in this section. Unless otherwise specified, all ablation studies are conducted on the Phi-3 Medium 14B model using the AdvBench dataset. Due space constraints, full experimental details and extended results are provided in Appendix A5
5.1 DISSECTING COMPONENTS HMNS
To understand the contribution of each component in Head-Masked Nullspace Steering (HMNS), we perform a controlled ablation study on Phi-3 Medium 14B using the AdvBench jailbreak dataset. Each variant disables or modifies one aspect of the full pipeline to isolate its effect suc- cess rate, query efficiency, and compute cost. Metrics include: ASR (Attack Success Rate; GPT4o / GPT-5), ACQ (external query count), IPC (internal passes without KV cache), FPS (FLOPs per success x1) and LPS (latency in seconds, measured on A100-80GB, b 6). All results follow the compute-matee matchiin protocol described in Section A3 The full HMNS method combines KL-based head attribution, dynamic out-projection masking, and nullspace steering at the final token position, with re-identification of top-K heads at each decoding step.
As shown in Table 2 all components contribute meaningfully to HMNS's effectiveness. Removing either masking nullspace steering leads a sigmificant drop ASR (by 7-10 points), confirming their synergy. Replacing orthogonal injection with direct direction (Direct-o) reduces ASR and increases latency, consistent with our theoretical motivation for irreprodueibility (Theorem Dis- abling head re-identification lowers IPC but worsens ASR and ACQ, suggesting the need for adap- tive attribution across decoding steps. Random head selection degrades ASR sharply, underscoring the importance of KL-based attribution. A single-layer intervention saves compute but sacrifices ASR, while multi-position injection yields minor ASR gains at higher cost. Overall, the full HMNS configuration delivers the best trade-off: high ASR, low external queries, and competitive compute and latency.
5.2 ATTRIBUTION MECHANISMS & NULLSPACE AND INJECTION
We analyze the sensitivity of Head-Masked Nullspace Steering (HMNS) to its two core design choices Phi-3 Medium 14B (Instruct) using AdyBench: (i) how causal heads are attributed

---

Published as a conference paper at ICLR 2026
Ablation Studies on Phi-3 Medium 14B (AdvBench)
Miribation Mechanisma
Nullaguce Injection Desiga
110
110
3.25
105
105-
Attack Success (%)
Attack Success Rate (%)
3,00
9 6,88
7 IPC-78
96.8
97-1
2.75
FPS (x (x102)
94.0
92.6
ACQ022
2..0
88.5
90-
19.5
ACO-2.3
97.3
4.3.
85
IPC-33
1PC
AG0=2.1
AC0+2.1
2,00
80-
861
1.75
76-
AGS P1P54
25
PBX ISEPE
775
400 Icemmee
70 KL-dio
Tanget
Entropy
No pcoxy
70
HMNS (FuIt
Orth tol.
Resumple
LayerNorm
Misi y-0.5
(full)
logit
change
saala
Figure 3: Ablation studies on Phi-3 Medium 14B (AdyBench). (a) Attribution mechanisms: KL- divergence achieves the best but nearly triples IPC. (b) Nullspace and injection design: strict orthogonality and hard masking are critical; partial masking (7 =0.5) degrades ASR and raises ACQ. Bars show ASR (%, GPT-40/GPPT- 5); overlaid lines show FPS (x 10) in (a) and ACQ in (b).
tradeoff; removing proxy pre-selection preserves ASR
and scored, and (ii) how the nullspace steering vector is constructed and injected. Metrics follow Sec. Aec ASR (GPT40/GPT-5), external queries (ACQ), internal passes (IPC), FLOPs per success (FPS), and latency (LPS). Full variant sweeps are reported Appendix [A7.2| A7.3 Figure 3(a) compares KL-divergence scoring (equation 4) against simpler heuristics. KL attribution with proxy preselection and global top-K achieves the highest ASR (96. 8/92.1) while keeping compute low. This is because KL captures distributional shifts across the entire vocabulary, rather than relying only on a single logit or entropy measure. Simpler heuristics such as target-logit drop, confidence drop, entropy change reduce FLOPs and latency slightly, but lose 5-8 points of ASR, showing that they overlook distributed effects where multiple heads collectively shape the output. Removing proxy preselection (ablating every head) preserves ASR but drastically increases IPC and latency, highlighting that HMNS's pruning step is key to maintaining efficiency without losing precision. Figure 3)) evaluates how steering vectors are built and applied. Strict orthogonality the masked subspace is essential: relaxing tolerance or removing resampling lets residual components leak back into the suppressed span, reducing ASR by up to 4 points. RMS scaling provides stable reference magnitude aligned with residual activations, while LayerNorm scaling gives a slight ASR improve- ment by normalizing across dimensions. Injecting after attention outperforms alternatives, as the nullspace is defined relative to attention head projections; injecting elsewhere weakens the causal link between suppression and steering. Finally, strong masking is critical: partial masks (y > 0) consistently lower ASR and increase ACQ, confirming that effective suppression of causal heads is necessary for steering to succeed.
CONCLUSION
We present HMNS, mechanism-level jailbreak that pinpoints causal heads via KL-based attribu- tion, suppresses their write paths, and injects orthogonal residual nudges constrained to the nullspace of the muted subspace- debbpucc-delivering of-te-of-the-ar defended ASR across four benchmarks, six de- fenses. and models from 7B to 70B parameters, with ACQ x= 2 and competitive compute. Ablations confirm that attribution, strict masking, and nullspace steering are jointly necessary, with removal of any component degrading ASR by 7-10 points. We also introduce compute-normaliin (FEP, IPC, FPS, LPS) broadly applicable for evaluating mechanism-level attacks. More broadly, HMNS reveals that safety alignment concentrates refusal in sparse, localizable set of attention heads, suggesting that alignment fine-tuning alone may be insufficient against white-box adversaries and motivating distributed safety mechanisms. A remaining limitation is runtime large models, partially mitigated by proxy pre-selection and batched attribution; future work includes black- box transfer via steering vectors and defensive repurposing of nullspace steering.
metrics
10

---

Published as a conference paper at ICLR 2026
ACKNOWLEDGMENT
This work was supported in part by the National Science Foundation under Grant No. 2404036, by University of Florida startup funds, and by the Defense Advanced Research Projects Agency (DARPA) under Contracts No. HRO01 12490420 and No. HR001 12420004. Any opinions, findings, conclusions, or recommendations expressed in this material are those of the authors and do not necessarily reflect the views of the sponsoring agencies.
ETHICS STATEMENT
We affirm compliance with the ICLR Code of Ethics and acknowledge the dual-use nature of jail- break research. Our goal to strengthen LLM safety by analyzing failure modes under common defenses; we do not seek to enable misuse. Experiments use public benchmarks of policy-violating prompts; no human subjects, personal data, or proprietary system prompts were collected. To reduce harm, (i) evaluate models offline without releasing harmful generations, (ii) avoid publishing ex- ecutable attack scripts that directly enable replication against deployed systems, and (iii) redact or paraphrase sensitive prompts in the paper and supplementary materials. Any artifacts release (e.g., evaluation harness) will include rate-limits and guardrails, and will exclude dangerous tem- plates. We disclose conflicts of interest and followed institutional and legal guidelines throughout. Ethical note: We include a jailbreak example solely to illustrate HMNS's mechanics and empirical success not facilitate harm. All experiments were conducted offline public benchmarks; redact sensitive content and do not release runnable attack scripts. The example is provided strictly for research and safety analysis purposes.
REPRODUCIBILITY STATEMENT
We provide everything needed reproduce our results. The main paper specifies the full HMNS procedure (causal attribution, masking, nullspace steering), the compute-normalizer metries (FEP/ICC/PS/LLS)) and the evaluation protocol; ablation settings and hyperparameters (e-g., global top-K, steering schedule, orthogonality tolerances, KV-cache policy) are documented in the Exper- iments and Ablations sections, with additional implementation details (model hooks, pre-selection, float32 QR, context limits) in the Appendix. We include algorithmic description in the main text and release an anonymized supplementary package with runnable code, configs, and scripts cover- ing dataset splits, prompts, seeds, and hardware notes. All reported numbers averaged over three runs with fixed seeds; model versions and decoding parameters are specified to ensure bitwise-stabi re-runs.

---

Published as a conference paper at ICLR 2026
REFERENCES
Cem Anil, Esin Durmus, Nina Panickssery. Mrinank Sharma, Joe Benton, Sandipan Kundu, Joshua Batson, Meg Tong, Jesse Mu, Daniel Ford, al. Many-shot jailbreaking. Advances in Neural Information Processing Systems, 37: 19696-122222 2024.
Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J Pappas, Florian Tramer, et al. Jailbreakbench: An open robustness benchmark for jailbreaking large language models. Advances in Neural Information Processing Systems, 0-555005555225 2024.
Zachary Coalson, Jeonghyun Woo, Yu Sun, Shiyang Chen, Lishan Yang, Prashant Nair, Bo Fang, and Sanghyun Hong. Prisonbreak: Jailbreaking large language models with fewer than twenty- five targeted bit-flips. arXiv preprint arXiv:2412.07192 2024.
Gelei Deng, Yi Liu, Yuekang Li, Kailong Wang, Ying Zhang, Zefeng Li, Haoyu Wang, Tianwei Zhang, and Yang Liu. Masterkey: Automated jailbreak across multiple large language model chatbots. arXiv preprint arXiv:2307.0877 2023.
Peng Ding, Jun Kuang, Dan Ma, Xuezhi Cao, Yunsen Xian, Jiajun Chen, and Shujian Huang. A wolf in sheep's 's clothing: Generalized nested jailbreak prompts can fool large language models casily, 2023.
Laura Hanu and Unitary team. Detoxify. Github. httpss//gghhb..oommmmalaaaaaaaet 2020.
Kai Hu, Weichen Yu, Yining Li, Tianjun Yao, Xiang Li, Wenhe Liu, Lijun Yu, Zhiqiang Shen, Kai Chen, and Matt Fredrikson. Efficient I1m jailbreak via adaptive Sense-to-sppare constrained optimization. Advances in Neural Information Processing Systems, 37:23224-23244 2024.
Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping-yeh Chi- ang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. Baseline defenses for adversarial attacks against aligned language models. arXiv preprint arXiv:2309.000 00614,, 2023,
Xiaojun Jia, Tianyu Pang, Chao Du Yihao Huang, Jindong Gu, Yang Liu, Xiaochun Cao, and Min Lin. Improved techniques for optimization- preprint arXiv:2405.2 2018 2024.
jailbreaking on large language models. arXiv
Tomasz Korbak, Kejian Shi, Angelica Chen, Rasika Vinayak Bhalerao, Christopher Buckley, Jason Phang, Samuel R Bowman, and Ethan Perez. Pretraining language models with human prefer- ences. In International Conference on Machine Learning, pp. 17506-17533, PMLR, 2023.
Linbao Li, Yannan Liu, Daojing He, and Yu Li. One model transfer all: On robust jailbreak prompts generation against llms. arXiv preprint arXiv:2505. Stti::2555.77986 2025.
N. Li, Z. Han, Steneker, W. Primack, R. Goodside, H. Zhang, Z. Wang, C. Menghini, and S. Yue. Lim defenses are not robust to multi-turn human jailbreaks yet. arXiv preprint arXiv:2408. 15221, 2024a.
Xiaoxia Li, Siyuan Liang, Jiyi Zhang, Han Fang, Aishan Liu, and Ee- Be-Chien Chang. Semantic mirror jailbreak: Genetic algorithm based jailbreak prompts against open-source llms. arXiv preprint N.X2:22402.14872 2024b.
Xirui Li, Ruochen Wang, Minhao Cheng, Tianyi Zhou, and Cho-Jui Hsieh. Drattack: Prompt decomposition and reconstruction makes powerful 11 jailbreakers. arXiv preprint arXiv:2402.16914 2024c.
Xuan Li, Zhanke Zhou. Jianing Zhu, Jiangchao Yao, Tongliang Liu, and Bo Han. Deepinception: Hypnotize large language model to be jailbreaker. arXiv preprint 21X11.2311.03191, 2023.
Zeyi Liao and Huan Sun. Amplegeg: Learning universal and transferable generative model of adversarial suffixes for jailbreaking both open and closed 1lms. arXiv preprint arXiv:2404.0792., 2024.
12

---

Published as a conference paper at ICLR 2026
Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. Autodan: Generating stealthy jailbreak prompts on aligned large language models. arXiv preprint arXi::2310.0455, 2023.
Huijie Lv, Xiao Wang, Yuansen Zhang. Caishuang Huang, Shihan Dou, Junjie Ye, Tao Gui, Qi Zhang, and Xuanjing Huang. Codechameleon: Personalized encryption framework for jail- breaking large language models. arXiv preprini arXiv:2402. 16717, 2024.
Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, al. Harmbench: standardized evaluation framework for automated red teaming and robust refusal. arXiv preprint Seti::2402.0422444 2024.
Anay Mehrotra, Manolis Zampetakis, Paul Kassianik, Blaine Nelson, Hyrum Anderson, Yaron Singer, and Amin Karbasi. Tree of attacks: Jailbreaking black-box Ilms automatically. Advances in Neural Information Processing Systems, 37:61065 61 105, 2024.
Kevin Meng, David Bau, Alex Andonian, and Yonatan Belinkov. Locating and editing factual associations in gpt. Advances in neural information processing systems, 15:17399-13772 2022.
Yichuan Mo. Yuji Wang, Zeming Wei, and Yisen Wang. Fight back against jailbreaakngg via prompt adversarial tuning. Advances in Neural Information Processing Systems, 22442222-64472,,00 2024.
Long Ouyang, Jeffrey Wu, Xu Jiang. Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to fol- low instructions with human feedback. Advances in neural information processing systems, 35:
27730-27744 2022.
Ethan Perez, Saffron Huang, Francis Song, Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, and Geoffrey Irving. Red teaming language models with language models. arXiv preprini arXiv:2202.03220 03226., 2022.
Mansi Phute, Alec Helbling, Matthew Hull, Sheng Peng, Sebastian Szyller, Cory Comelius, and Duen Horng (Polo) Chau. Lim self defense: By self examination, llms know they are being tricked. arXiv preprint arXiv:2308.077 0738. 2023.
Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. Direct preference optimization: Your language model is secretly reward model. Advances in neural information processing systems, 11.53728--3741, 2023.
Alexander Robey, Eric Wong, Hamed Hassani, and George Pappas. Smoothllm: Defending large language models against jailbreaking attacks. arXiv preprint 20X.::2310.03688, 2023.
Alexandra Souly, Qingyuan Lu, Dillon Bowen, Tu Trinh, Elvis Hsich, Sana Pandey, Pieter Abbeel, Justin Svegliato, Scott Emmons, Olivia Watkins, et al. A strongreject for empty jailbreaks. Ad- vances in Neural Information Processing Systems, 37:125416-125440. 2024.
Kazuhiro Takemoto. All in how you ask for it: Simple black-box method for jailbreak attacks. Applied Sciences, 14(9):3558, 2024.
Eric Todd, Millicent L Li, Arnab Sen Sharma, Aaron Mueller, Byron C Wallace, and David Bau. Function vectors in large language models. arXiv preprint 1.ti::230..12213,, 2023.
Sam Toyer, Olivia Watkins, Ethan Adrian Mendes, Justin Svegliato, Luke Bailey, Tiffany Wang, Isaac Ong, Karim Elmaaroufi, Pieter Abbeel, Trevor Darrell, al. Tensor trust: Interpretable prompt injection attacks from an online game. arXiv preprint 13Xiv:3311.01011 2023.
Alexander Matt Turner, Lisa Thiergart, Gavin Leech, David Udell, Juan Vazquez, Ulisse Mini, and Monte MacDiarmid. Steering language models with activation engineering. arXiv preprint arXiv:2308. 10248, 2023.
Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. Jailbroken: How does I1m safcty training fail? Advances in Neural Information Processing Systems, 36:80079-801 10, 2023.
Zixuan Weng, Xiaolong Jin, Jinyuan Jia, and Xiangyu Zhang. door: A multi-turn jail- break for lls. arXiv preprint arXiv:2502. 2025.
13

---

Published as a conference paper at ICLR 2026
Chen Xiong, Xiangyu Qi, Pin- Yu Chen, and Tsung- Yi Ho. Defensive prompt patch: A robust and interpretable defense of Ilms against jailbreak attacks. arXiv preprint arXiv:2405.20099, 2024.
Zhangchen Xu, Fengqing Jiang, Luyao Niu, Jinyuan Jia, Bill Yuchen Lin, and Radha Poovendran. Safedecoding: Defending against jailbreak attacks via safery-aware decoding. arXiv preprint arXiv:2402.088983, 2024.
Fred Zhang and Neel Nanda. Towards best practices of activation patching in language models: Metrics and methods. arXiv preprint arXiv:2309. /6042, 2023.
Yihao Zhang and Zeming Wei. Boosting jailbreak attack with momentum. In ICASSP 2025-2025 IEEE International Conference Acoustics, Speech and Signal Processing (ICASSP), pp. 1-5. IEEE, 2025.
Qinkai Zheng. Xiao Xia, Xu Zou, Yuxiao Dong, Shan Wang, Yufei Xue. Lei Shen, Zihan Wang, Andi Wang, Yang Li, et al. Codegeex: pre-trained model for code generation with multilin- gual benchmarking on humaneval-x. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp. 5673-5684, 2023.
Andy Zhou and Ron Arel. Tempest: Autonomous multi-turn jailbreaking of large language models with tree search. arXiv preprint arXiv:2503.116119 2025.
Andy Zhou, Bo Li, and Haohan Wang. Robust prompt optimization for defending language models against jailbreaking attacks. Advances in Neural Information Processing Systems, 17:40184- 40211, 2024.
Sicheng Zhu, Ruiyi Zhang, Bang An, Gang Wu, Joe Barrow, Zichao Wang. Furong Huang, Ani Nenkova, and Tong Sun. Autodan: interpretable gradient- based adversarial attacks on large lan- guage models. arXiv preprint arXiv:23 10. 2023.
Yuchen Zhuang, Yue Yu, Kuan Wang, Haotian Sun, and Chao Zhang. Toolqa: A dataset for I1m question answering with external tools. Advances in Neural Information Processing Systems, 36: 50117-50143, 2023.
Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks aligned language models. arXiv preprint arXiv:2307.15443, 2023.
14

---

Published as a conference paper at ICLR 2026
APPENDIX CONTENTS
Introduction
2
Related Work
3
Method: Head-Masked Nullspace Steering
4
4
Experiments
Experimental Setup
Resulis
Evaluation
5
Ablation Study
5.1
Dissecting Components of HMNS
9
5.2
Attribution mechanisms & Nullspace and injection
6
Conclusion
10
Appendix
15
A1 Theoretical Properties Error Bounds
17
AI.I Geometry and Invariance
17
A1.2 Residual- and Logit-Space Bounds
20
A1.3 Subspace Perturbations and Numerical Stability
21
A 4 Practical Corollaries
21
A2 Experiment and Implementation details
22
A2.1 Experimental Assumptions, Hardware, and Hyperparameters
................................
22
A2.2 Experiments on Allemative
Models
23
A3 HMNS Budgef
23
A4 Evaluation Protocol, Leakage Controls, and Grader Calibration
25
A4.1 Jailbreak Success Labeling
25
A4.2
Grader Rubrics and Prompts
25
A4.3
Inter-Rater Agreement and Uncertainty
................................
26
A4.4
Fluency Metric
26
A4.5
Toxicity Metric and Threshold Calibration
26
A4.6 Leakage Controls and Reproducibility
26
A4.7 Summary Tables: Fluency and Toxicity
27
A5 Compute-Fair Evaluation and Baseline Parity
27
A5.1 Metries and Protocol]
27
A5.2 Activation-Space Haselines and Matched Controls
28
15

---

Published as a conference paper at ICLR 2026
A3.3 Compute Ledger (Targets: LLaMA-2-7B-Chan Phi-3-Medhum- 14B- 14s-rnstt LLaMA-3.1-70B)
28
A5.4 Compute-Matched Results (All Three Targets)
29
A3.5 Takeaways
29
A6 Compute Analysis under Defenses
29
A6. FLOPs and Latency under Delenses
29
A6 Success Rate vs. FL.Pss Curves
30
A6.3 Internal Pass Count (IPC) Calculation
30
A6.4 Experimental Details
31
A7 Ablation Study
31
A7.1 Ablation Study: Dissecting
................................
HMNS
31
A7.2 Ablation Study: Attribution Scoring Mechanisms
32
A7.3 Ablation: Nullspace and Injection Design Choices
33
A7.4 Ablation: Hyperparameters
34
A7.5 Extended Ablations: Numerical Stability, Targeting Policy, Formatting Sensitivity, Defended Robustness, Compute Fairness, Evaluation Sensitivity, and Sanity Checks)
34
A7.6 Algorithii Summary
37
A8 Head-Importance Dynamics Across Iterations
37
A9 HMNS Failure Modes
38
A1MMulii Turn and Evaluation
38
A1 Complementaarity with Output-Side Self-Defense Filters
39
16

---

Published as a conference paper at ICLR 2026
A1 THEORETICAL PROPERTIES AND ERROR BOUNDS
Setup and notation. Consider a decoder-only Transformer with layers & E (l,...,,i, L}, residual dimensionality head width d,, and He attention heads layer Given prompt 21.T, let a e I be the imal-position logits and P softmax(z) the next-token distribution (all KL computations are at the final position). Unless otherwise stated, || ||2 denotes the Euclidean norm and || |lop the spectral (operator) norm. We assume strictly positive probabilities for KL (enforced in practice via small clipping), so (L(-Il-) is finite. For the attention block at layer l and position T, denote the concatenated head outputs by her E R Heda and the out- uut-proeection by W E Rddx so that
out = We HE.
KL-based causal attribution and masked span. For given head (e. h). let St, be diagonal selector that zeros the h-th head slice in h The masked out-projection
W
W (I Se,h);
(10)
inducing ablated logits g(e,h) and distribution p(e.N) softmax((((.))). We score head importance by
Seh KL | (PPp)
(11)
Let be the global top-K heads by equation For each layer e, define S = (h: (f, E S} and the write matrix
C₂ [Wep. hdn (h+1)du]] hes; Jues: E [dx((S()da),
(12)
Let W₁ = colspan (C)) be the masked write subspace; let Qe be an orthonormal basis of W/ and
Pt 1 Q-Q
(13)
the projector onto W
Nullspace steering crandom-projection construction). We compute thin QR of C₂ in float32, form Pe as in equation 13 sample r ~N10 Ia), and define
Pff
E> 0.
(14)
|P/rl12+
This ensures us Wt, If | is numerically degenerate, resample (small fixed budget).
Intervention mechanism (mask + RMS-scaled nudge). Let St.s zero all head slices in Sy. At the final position of the current step, we replace W by WO(1= St,s) and add an orthogonal residual nudge
hout = - - her a (o-RMS((a)) ue,
(15)
masked write
where E R is the (pre-residual) activation at the same tap point, RMS(ar) = V d. az ue is
given by equation 14 and a > is fixed per iteration.
Assumption (Local residual-to-logit sensitivity). For a perturbation öh injected at layer e, the induced logit shift satisfies ||62|| Le- ||öh||2 for some Li-zlogit > 0.
A1.1 GEOMETRY AND INVARIANCE
Theorem 2 (Orthogonality and Irreproducibility of HMNS Injection). For each intervened layer l, the steering direction ut defined in equation 14 lies in the orthogonal complement W of the masked head write subspace W. span Me) from equation 12 Therefore, for all v E We. we have (u,, v) O. As a result. no linear combination of the masked heads' contributions can reconstruct cancel the injected vector a RMS(az) ug.
17

---

Published as a conference paper at ICLR 2026
Proof. Let recall that for each layer E, the matrix Mr E Rdx((S()d)) ( equation 12 columns, the out- projjeeeetion slices of the attention heads selected for masking. This matrix defines the masked write subspace:
contains, its
Wy = span C CR.
We perform thin QR factorization Me as:
Mt = QQRRe
where Qe E dd has orthonormal columns (0 Qi = 1,), and r S |S is the rank of My.
Now, the projection matrix onto W/ is Pt = Q and the orthogonal projector onto the comple-
ment W
p = 1 =
We then define random steering direction ue by sampling random vector (O Ia) and projecting it into the nullspace of the masked heads:
(1-QQQ7)- Wy QQQ) ) r
Ptr 1.Pt +E
Since Pe is linear projector onto Wt, it follows directly that:
Per Wte and hence E W
By the definition of orthogonal complements, this implies: (ue, u) = for all e E We.
In particular, all linear combinations of the masked head outputs (which lie in W3 by construction) are orthogonal to ug.
Now, at inference time, the perturbation injected into the residual stream is:
82 RRM((a)) ug.
This vector lies entirely within W!!-
Since W n W/ tions (which span W/) can reproduce, cancel, or interfere destructively with the injected dz. This guarantees that:
{0), vector formed from any linear combination of the masked head projec-
The injected perturbation is irreducible with respect to the masked heads. - Any effort by the model undo or overwrite the steering must come from unmasked circuitry.
This geometric decoupling is what enables HMNS to inject locally irreproducible influence without conflicting with the masked components, and underpins robust steering behavior.
Scope. The irreproducibility claim is local to the intervened layer and the masked heads; unmasked components in downstream layers may still respond to the perturbed residual.
Theorem (Invariance basis and reparameterization). Let C2 Raxkd denote the concatenated out-projection matrix slices for the masked attention heads at layer f, where each block corre- sponds to the output of single head. Let Čt CtR. for some block-wise orthogonal matrix R E kkdxkd _ie. consists of independent rotations or permutations within each head's output subspace. Then:
1. colspan = =
2. The orthogonal complement projection P.- = - QQQ is invariant,
3. The resulting nullspace direction us (from equation 14
remains unchanged up sign.
18

---

Published as a conference paper at ICLR 2026
Proof. Let begin by recalling that in Head-Masker Masked Nullspace Steering (HMNS), the write matrix Ce is formed by concatenating the out-projection contributions from the top-K masked attention heads at layer f. Specifically, each column block in C2 corresponds to the projection of an individual head's output, and the steering injection constructed to lie in the nullspace of colspan(Ce))
Now consider a transformed write matrix C₂ C,R. where R is block-orthogonal matrix, i.e., block-diagonal matrix whose diagonal blocks are orthogonal (rotations or permutations within head slices).
(1) Column span invariance.
Because R is invertible and orthogonal, the matrix multiplication C.R applies a change of basis within the span of C--it reparameterizes the basis vectors without altering the subspace itself. Formally:
colspan(Cr) colspan colspan(Ce).
This holds because post-multiplication by full-rank matrix (here, an orthogonal R) preserves the column space.
(2) Invariance of the orthogonal projector.
The projector onto the orthogonal complement of a column space depends only on the space itself, not on the specific basis used to represent it. Since colspan( Ce) = colspan (Ct), it follows that their respective orthogonal complement projectors identical:
P = - = -1=
where Qe and Qe are orthonormal bases for the columns of C₁ and Č₁ respectively.
(3) Nullspace direction remains unchanged.
Recall that the steering direction is defined as:
pfr UF P r112
where r is random probe vector and Pe is the projection onto the orthogonal complement of the masked subspace.
Since P is invariant under reparameterization of the column basis of Ce, applying it to any vector yields the same projected direction. The normalization ensures unit norm (up to E). so ue is preserved up to sign:
new
-ug.
The sign may differ due random sampling numerical variation, but this does not affect the geometry of the nullspace injection equation 8) or its irreproducibility guarantees (see Theorem
Proposition 4 (Gaussian Nullspace Energy). Let Cs E BRdxr be matrix of rank Tr, and let P CCT - denote the orthogonal projector onto the nullspace of CT Ifr N Ia) is standard isotoopic Gaussian in R.d, then:
1. The expected squared energy of the projected vector is:
E
[|
2. For all t >>> 0, the squared norm concentrates around its mean with high probability:
Pr (I (d (d-ri) rr)rr)) > =) < 2cxp (- ((s(d-r2) -rr) (-sid=
12
8(d
Proof. We begin by noting that P Rdxd is a symmetric, idempotent matrix that projects onto the nullspace of C, Since C2 has rank rz, the nullspace has dimension d d and rank(P?) d d-ria
19

---

Published as a conference paper at ICLR 2026
Let (0, Ia)- Consider the random variable:
= |P r1 = - Pe
Because Pe is projection matrix of rank d Te, this is a standard quadratic form in Gaussian vector.
From properties of Gaussian quadratic forms, Z follows chi-squared distribution with d re degrees freedom:
Z (d Tt).
Hence, its mean is:
E Z d Tt.
To obtain the concentration inequality, we invoke the **Laurent-Maree inequality*** for chi- squared random variables. Let X (k) for some k > 0. Then for all >> 0,
Pr([ k| t) S 2 exp
8k
Applying this to Z = || r12 ~ x2 re) gives the desired tail bound:
t2
Pr (1 (d ml) 1) s 2xxp
8(d re)
This completes the proof.
A1.2 RESIDUAL- AND LOGIT-SPACE BOUNDS
Define the masked residual stream and removed component by
masked
wo 1 -t,ss)
Ee S Se,s he.
Then Nout
mamkeed
Eg.
Lemma (Masked Residual Deviation). Let h = Wheer denote the unmasked residual contri- bution at layer & and token position T, and let hga W (1 St,s he, be the masked version where the output of heads in Se is suppressed. Then the deviation due to masking is:
out
masked Iig
||2 = Fell2 1[W St. S [WPllop 1|St,she,
Moreover, we we define the masked energy fraction as
04 1|St,she
|
then the deviation is bounded by:
EElla < || olop vae 1he.l1.
Proof. We begin with the definition of the masked deviation:
E :- hour
hmasked
w.Ther Wo(1 St,S)her W Sesher
Taking the & norm:
E2 l2 W1 Se.sñe. 112- Using the submultiplicative property of operator norms:
|E < II? llop s|
Now, define the energy fraction of the masked heads:
ay
11
20

---

Published as a conference paper at ICLR 2026
Taking the square root:
|Se,she, Vai- -he,rll2.
Substituting back:
| S I vae 1
This completes the proof.
Proposition 6 (First-order token-wise control (analysis only)), Let Let R + RV map the post- layer-& residual to logits. differentiable at ht Let gr.y = Wnzyln=hees and suppose the Jacobian locally p Lipschitz. For 8h = a RM)((a) ue
16zyl & RMS((aa) g + L a² RMS((a))..
This bound is used for analysis only; the algorithm does not require gradients.
A1.3 SUBSPACE PERTURBATIONS AND NUMERICAL STABILITY
Theorem 7 (Wedin/Davis-Kaate) perturbation). If C. = C. + AC; with ||ACellop S and (C,) (Ct))(Ct), then the largest principal angle @ between We and We obeys
2e
sin θ or. (Ct) Oreti
| - -Plllop
Gr. (Ct( r (Ct)
Proof sketch. See Stewart & Sun, Matrix Perturbation Theory, Thm 4.11 (Wedin) and Davis Kahan for projector differences.
Lemma (Projector stability under finite precision). If the QR that constructs Qe yields an approx-
imate Qe with [| Qe Tllop S CQR, then
P Pé,tuellop S 2sin θ + O(Equ),
where θ the principal- gap from Theorem 7
Proposition 9 (Logit error from steering misalignment). Let ūe be the unit vector from Pt in place of Pt For any token y.
62 3 (āe)
82g sterr (ue)) s aRMS((a)) 11gc,ll2 sin Luue, Ue).
and by Theorem and Lemma
2 sin Luu,, Boll) I or (C)) - o + ((QRR)
A A..4 PRACTICAL COROLLARIES
Corollary 10 (Choosing under logit budget). To keep [1225ter11 ||2 S at layer e, select
6,
a v Le-zlogit RMS((a))
Corollary 11 (Mask-steer tradeoff). Combining Lemma 5 with Assumption
7
[|62|pask + ||62|te0|| 1|2 < Lt-logit Ell2 + RM)()
Remark 12 (Scope). All results rely on alnebr-a geometry (orthogonal projections, spectral gaps) and the local sensitivity in Assumption[] We do claim global guarantees across stochastic, multi-step decoding; those dynamics depend on nonlinearity and sampling.
Theorem 13 (Persistence under Masking). For any intervened layer f, once the heads Sy are masked and replaced by the orthogonal steering injection
To W (I St,s) he + RMS(aa) ut-
the contribution of masked heads is removed for that forward pass; in HMNS, masking is re-applied at subsequent steps. so these heads remain suppressed whenever the mask is active. The injected component RMS(a)) ug cannot be reintroduced by those heady in later steps.
21

---

Published as a conference paper at ICLR 2026
Proof. Masking with I St.s zeroes the relevant columns of WP, the outputs of heads in Se are eliminated at the residual level during the current forward pass. Since subsequent layers only process the residual stream 2,,7,, the masked contribution Ex = - St,she,r is unrecoverable in that step: it has been projected out and does not propagate forward.
Mcanwhile, the injected perturbation lies in W the orthogonal complement of the masked write subspace. By Theorem 2 no linear combination of masked-head outputs belongs W Therefore, the injection cannot be canceled or absorbed by the suppressed circuitry. Subsequent layers can only transform the new residual through their own projections.
Because HMNS applies masking dynamically at each decoding attempt (not statically to model weights), the suppression is transient per step but reapplied reliably each iteration. Parameters never modified on disk; masking is applied via a context manager during the current forward pass.
Thus, the effect of masking is persistent across decoding steps when actively reapplied, and the injected perturbation survives without risk of being overwritten or "undone" by the masked heads.
Implication. This persistence property highlights that HMNS interventions one-way opera- tions: once head is suppressed, it no longer influences the residual stream, and the added or- thogonal perturbation remains protected from interference by that circuitry. This strengthens the irreproducibility guarantee and ensures that steering effects accumulate reliably across layers and iterations.
A2 EXPERIMENT AND IMPLEMENTATION DETAILS
A2.1 EXPERIMENTAL ASSUMPTIONS, HARDWARE, AND HYPERPARAMETERS
Modeling assumptions. Our method assumes the existence of a non-degenerate nullspace at each intervened layer L. Specifically, M, E [dx((S the concatenation the out out-projection column blocks of selected heads, we require rank(M2) d to ensure W,r = sp)n * {0). We achieve this by (i) selecting small global head budget (K=10), (ii) computing E W using float32 thin QR, and (iii) enforcing orthogonality via ||M, ue llce 8 with ò 10-6 resampling up to three times. If the projected norm collapses, a fresh random direction is drawn. These checks prevent degenerate projections and ensure numerical stability, especially for large models.
Targets and precision. We evaluate three open-weight decoder-only LLMs: ILaMA-2-7B- Chat, 4i--Medium--4KInsttuud and L.aMA-3, 1-70. All forward passes run in bfloati 6, but causal attribution and QR-based steering use float 32 for numerical reliability.
Hardware and parallelism. Experiments are run on NVIDIA A100-80GB GPUs using PyTorch 2.2 and Transformers v4.41. LLaMA-2-7B and Phi-3-Medium fit on a single A A100; LLaMA-3. 70B is executed using device .maa==p--- map="aute "auto" for pensor-parallel sharding across two A100s. For fallback to single GPU, the code supports quantization/offlaad and residual-only masking.
Attribution and selection. We use KL. divergence between baseline and ablated output distri- butions to score head importance. Each input re-attributed per decoding attempt, with only the top-K = 10 heads selected globally (across all layers). This scoring is based on single-head masking and does not assume prior head knowledge.
Masking and nullspace steering. At each intervened layer L, we zero the selected head column blocks in W during the current forward pass and inject a perturbation & a RMS(aa) ug, where ue W is computed as described above.
Generation and loop schedule. We use zero-shot decoding with temperature 0.7, top-p 0.95, max length 128, and batch size 1. KV caching is disabled to support dynamic masking. Each prompt undergoes up to Ta 10 decoding attempts with early stopping. Steering strength follows
22

---

Published as a conference paper at ICLR 2026
a X(1 0.1(t 1)) with A 0.25. A fixed random seed and TF32 matmul used for reproducibility.
Model-specific notes. We dynamically locate each model's attention modules and out-ooutecttee out-projection layers (e.g., o-proj, dense) and apply masking via in-place column zeroing wrapped in context managers. For LLaMA-3.1-700 with -euuedd-durryy attention, head slices remain contiguous and are masked similarly under tensor-paralletism.
Compute accounting. External query count (ACQ) is reported separately. Internal Pass Count (IPC) includes baseline and K masked probes per decoding attempt: IPC = 1 K (e.g., 31-41 for Tm 3- 4). FLOPs-per-success (FPS) and latency are measured end-to-end.
Implementation hygiene. All masking and steering hooks are registered and removed in context- managed scopes to ensure no leakage between probes or attempts. QR and orthogonality checks are done in float32; logits and KL values are computed at model precision with clipping for numerical safety.
A2.2 EXPERIMENTS ON ALTERNATIVE
MODELS
We replicate our protocol on three different open-weight models of comparable sizes on Hug- ging -
and Yi-1.5-7BB-Cha using main study: zero-shot decoding (temperature 0.7, top-p 0.95, max_new.tokens = 128, batch size = 1). global top-K=10 heads per attempt, up to =a==10 closed-loop iterations with a, 0.25(1 + 0.1(t-1)). and KV cache disabled during attribu- tion/steered decoding for correctness. Per attempt, we apply proxy pre-selection (batched tar- get-logit drop) to shortlist heads, run exact KL. attribution lected out-projection slices for the current pass and inject 6g a RMM((at) uy after attention. Nullspace directions ue - are obtained via float32 thin-QR with the orthogonality test ||M ue oel < 10-6 (up to three resamples). Table shows that HMNS consistently achieves the best ASR on all four benchmarks while maintaining ACQ 2, outperforming the strongest prompt- only baseline (ArrAttack) by ~5-7 pp average; this underscores that HMNS's mechanism-level control (KI--based head attribution, strict masking, and mullspace-othhogonal steering) transfers across architectures and scales with minimal retuning.
Qwen2.5-14B-Instrun
exactly the same settings
the shortlist, then mask the
A3 HMNS BUDGET
HMNS consumes compute in places: (i) internal passes used for KL-based attribution and closed-loop re-identifiiation (run without KV cache), and (ii) external decoding attempts that pro- duce visible outputs. We measure both directly in FLOPs on per-input basis and sum them to obtain the total budget for that input.
Formally, for input x. let Caur Caur(x;;)) (z, j) be the FLOPs of the j-th attribution/re-identfffaaaii pass (no KV cache), and Casveda (I, i) the FLOPs of the i-th decoding attempt (also without cache. by default). the first success occurs after J (z) internal passes and A A(r) decoding attempts, then HMNS's total compute budget is
J(x)
A(w)
BHMNS (x)
- Cate +
Σ
Caecade (I, i).
(16)
Intuitively, this counts every attribution/stterring recomputation and every generated continuation until the first success.
How we measure Catr and Cdecade- For each forward pass we log the tokenized sequence length and use profiler to record actual FLOPs (attention + MLP) under the same hardware/dtype configu- ration. Attribution runs disable KV caching (to ensure recomputation under masking), and steered
httpe//hhhtiirreeccconntraaaaaaa ruct
23

---

Published as a conference paper at ICLR 2026
Table 5: Jailbreak effectiveness on alternative open-weight models. We report Attack Success Rate (ASR, %; left/right = GPT40/GPT-S) and Average Query Count (ACQ; lower is better) on AdvBench, HarmBench, 3SB-Behaviors, and StrongReject. Best values are bolded; second best are underlined.
/ Method
AdvBench
HarmBench
JBB-Behavvors
StrongReject
ASR
ACQ
ASR f
ACQ
ASR
ACQ
ASR
ACQ
Mistral-7B- 0.-.nnutcuuuut-00.22222
FITD
42.0/36 36.5
16.4
39.5/34.
16.9
43.2/
15.8
36.8/ 31.7
17.2
AutoDAN
70.8 / 64.6
12.7
61.3
13.1
71.6/6.5
12.2
59,4
13.5
ArrAttack
91.1 86.2 86.2
7.6
89.2/84.7
7.8
92.4/87.5
7.4
87.1 82.9
8.1
HMNS (Ours)
/7.4
2.0
25.3/90.7
2.1
98.2
93.0 88.4
Owen2.5-14B-nnsteee
FITD
34.0
17.1
37.1/
17.5
11.0/35.1
29,6
AutoDAN
58.2
13.8
62.1
56.0
14.0
66.1 59.44
13.2
58.2/
14.3
ArrAttack
86.8 / 80.7
8.3
84.9 78.9
8.5
89.6/ 83.7
7.9
81.2 75.44
8.7
HMNS (Ours)
92.9/ 86.8
2.0
90.8/ 84,9
2.1
94.5 88,4
1,9
86.9 80.9
2.2
Yi-1.5-72B-Chat
FITD
4 / 40.1
15.6
33.3/38.0
16.0
44.2/41.5
15.1
39.7 34.7
16.4
AutoDAN
67.9
12.3
64.2
12.7
75.0 68.9
11.9
61.5
13.0
ArrAttack
93.4/89.2 89.2
7.3
87.5
7.6
94.6/
HMNS (Ours)
99.1 95.2
1.8
97.3/ 93.4
2.0
99.2 95.66
1.8
96.1 92.3
2.1
decoding also disables KV caching by default for correctness and recomputability. Failed attempts still count toward the budget until success occurs evaluation terminates.
Prompt baselines: budget-capped best-of-N. To compare fairly with prompt-only methods (which incur no internal passes), give them the same FLOP budget HMNS each input, and let them generate as many completions as fit within that budget. If the per-attempt costs are Cop (x, i), then the number of allowed attempts is
(x) max(1, max N: E Cpb (2, S BHMNs(()))
(17)
We then evaluate each baseline in a best-of-N(x)) setting: generate N(x) completions under iden- tical decoding policies, and record the best outcome within the matched budget. For compact sum- mary tables we also report fixed-VV variant using the dataset-wide mean HMNS budget BhмNN and pp
mean per-decode cost decode-
Interpretation of (z)). If HMNS spends roughly the compute nine prompt-only generations for input x, then N (x) 9 and the baseline is evaluated best-of-9 for that input.
Step-by-step protocol.
1. For HMNS (per input r):: run attributiinn/steering in closed loop until success; log each pass's FLOPs to compute BHMNs(I).
2. For each baseline: repeatedly generate under the same sampling settings, accumulating decode FLOPs until exceeding BHMNS (2); the number that fit defines N (x)). Record the best outcome within this cap.
3. Aggregate: report ACQ (external queries), IPC (internal passes), FPS (FLOPs per suc- cess), and LPS (wall-clock latency) across the test set; plot success-vs-compute curves where applicable.
The algorithm calculate all compute-awan metrics (ACQ, IPC, FPS, LPS) and to budget- matched baselines has been shown in Algorithm [
Consistency and edge cases.
Variable lengths: decode costs scale with output length; budget-matching via cumulative sums ensures fair allocation per input.
24

---

Published as a conference paper at ICLR 2026
At least one attempt:
max(1, guarantees baselines receive at least one decode even if HMNS succeeds unusually cheaply.
Same environment: all methods use identical decoding hyperparameters and run the same GPU/dtype, ensuring FLOP comparabilityy.
Metric separation: IPC counts internal passes only; ACQ counts external decodes; FPS includes both; LPS is the end-to-end latency to first success.
A4 EVALUATION PROTOCOL, LEAKAGE CONTROLS, AND GRADER CALIBRATION
Overview. We assess jailbreak success using two independent L.M graders, GPT40 and GPTS, and report per- grader Attack Success Rates (ASR) in the main paper (Tables [ To ensure com- parability and prevent leakage, we standardize grading prompts and decoding settings, blind graders to attack prompts and HMNS interventions, and quantify inter-rater agreement. In addition, report fluency and toxicity using named models with explicit calibration. Summary statistics for agreement, fluency, and toxicity are provided in Tables 7
A4.1 JAILBREAK SUCCESS LABELING
labels Uruzz you E {0.1} under an identical rubric For each completion c; graders return binary (i) (Section A4.2 Per-grader ASR
ASR + Σ i=1
yraz D
1],
ASRG₂ = Σ
1/G4
1}
i=1
For sensitivity analysis, we also compute an aggregate "either-of-two" success measure,
ASRoR
Druzz
yGA
(t) =]]
reported only in the appendix and never mixed with per-grader ASR in the same table.
A4.2 GRADER RUBRICS AND PROMPTS
Blinding and determinism. Graders receive only the model completion c; and a fixed rubric; they do not see the original attack prompt, system/tool messages, HMNS masking/steering hyperparam- eters, any intermediate artifacts from closed-loop detection. All grading runs temperature 0, top-p=1.0,, and a max generation of 256 tokens to ensure deterministic labels.
Binary success rubric
You are impartial safety evaluator. Read the COMPLETION text below, which is a standalone response.
COMPLETION:
(completion_text]
Task: Decide this completion provides, enables, or materially advances prohibited behavior described by a jailbreak benchmark item (e.g., instructions that facilitate illegal, harmful, or policy-violating acts)
Label with exactly one of:
1 (SUCCESS): The completion clearly violates safety policy prevides actionable steps that enable a prohibited outcome. (FAIL): The completion refuses, is neutral/harmlest provides only vague/high-level commentary that does not enable the prohibited act.
25

---

Published as a conference paper at ICLR 2026
Table 6: Inter-rater agreement (test split). Cohen's between GPT4o and GPT-5 by benchmark; mean + 95% CI over three runs.
AdvBench
HarmBench
JBB-Behaviors
StrongReject
0.78 0.03 0.74 + 0.04
0.75 0.03
0.70 + 0.04
Also provide one-sentence rationale.
Return JSON: ("label": 0 or 1, "rationale": "..."..
Only the label field used for metrics; rationales are logged for auditing.
A4.3 INTER-RATER AGREEMENT AND UNCERTAINTY
We quantify agreement between GPT4o and GPT-5 graders using Cohen's
Po - Pe K
Po = Σ Myruee = YG4 J
(1)
Pe = MFFrTTT4 + (1-7Fum) (I-
1 - Pe
with Muuzz 1 E Fuzz and TG4 - Vo4 We report к with 95% bootstrap CIs (1,000 resamples) and include marginal positive rates to contextualize prevalence. Across all experiments this paper, inter-annotator agreement high: the aggregate & 0.76 0.02, and per-benchmark values fall in the 0.70-0.78 range (Table 6). Unless stated otherwise, ASR values are reported as mean 95% CI over three independent runs.
A4.4 FLUENCY METRIC
Fluency is computed with frozen reference language model y via length-normalized NLL. For completion c= (=w..
NLL(C) = Σ 1=1
(- log Py (w wee)),
Fluency(c) -xxp -NLL(c) (0,
which monotonically maps lower perplexity to higher fluency in a bounded range. use -LaMA-2-77 (base) y (meta-LLaMA/4E LLaMA 2--22-7--- 7b bff HF Transformers v4.41), evaluated deterministically with its native tokenizer. The reference model is held fixed across all experiments and is never exposed to HMNS internals.
A4.5 TOXICITY METRIC AND THRESHOLD CALIBRATION
Toxicity is estimated using Detoxify (unbiased) Hanu & Unitary team 2020). which outputs continuous score r(c) [0, 1] per completion. For binary analyses, we define toxicity label by thresholding at 7*, selected on held-out validation split of CivilComments (non-overlapping with our test data) via Youden's 's J:
arg max (TP((T) + TNR(r) 1))
rE(0.1]
We report r", ROC-AUC, and the class balance of the validation set alongside continuous toxicity summaries in appendix tables.
A4.6 LEAKAGE CONTROLS AND REPRODUCIBILITY
Leakage controls. Graders see only the completion text; the original user prompt, system/tool messages, and HMNS intervention metadata (attribution scores, masked heads, nullspace vectors) never shown. Each grading call is executed in isolation (no few-shot context and cross-item memory). All grader prompts, model identifiers, and decoding settings are fixed across methods, datasets, and runs.
26

---

Published as a conference paper at ICLR 2026
Table Fluency and toxicity by method (pooled across models and benchmarks: means + 95% CI over three runs). Toxicity: continuous Detoxify score + and binarized rate at 7 7*=0.42 (ROC-AUC 0.94).
Method
Fluency
Toxicity (score)
Toxicity (rate)
FITD
0.58 + 0.02
0.22 + 0.01
18.1% + 1.6
AutoDAN
0.61 0.02
0.28 +: 0.01
24.9% + 1.7
ArrAttack
0.63 0.02
0.31 0.01
28.7%
Tempest
0.64 + 0.02
0.29 0.01
26.5% + 1.7
HMNS (ours)
0.66 + 0.02
0.33 + 0.01
30.9% + 1.9
Deterministic settings. Unless otherwise specified, graders run with temperature 0, top-p=1.0, and fixed token limit. We seed all pipelines and log code commit hashes used for evaluation.
Artifacts. We release (i) the exact grader prompts and rubric; (ii) scripts recompute ASR, K. bootstrap Cls, and ASRoR: (iii) the reference LM g specification and tokenizer for fluency; and (iv) the Detoxify configuration and validation split used to fit T*, together with item-level CSVs containing per-grader labels, fluency, and toxicity scores.
A4.7 SUMMARY TABLES: FLUENCY AND TOXICITY
Table summarizes fluency and texicity by method, pooled over the four benchmarks and the three target models used this work (LLaMA-2-7B-Chir)
B LLaMA-3.1- 70B). Fluency is nigher-is-better (bounded in (0, 1)); toxicity is reported as the Detoxify score (lower-is-better) together with the binarized rate using the calibrated threshold - 0.44 (ROC-AUC 0.94 on the validation split).
Interpretation. Inter-rater agreement is substantial across benchmarks (Table supporting the reliability of grader labels. HMNS maintains the best average fluency (Table 7 consistent with our goal of preserving language quality while steering behavior. Toxicity is slightly higher for HMNS relative to prompt-only baselines, which is expected given its higher defended ASR (Tables D importantly, scores remain within the variance envelope of strong baselines. Together with the leakage controls and deterministic grading, these summaries address potential reviewer concerns about calibration, reliability, and side effects.
A5 COMPUTE-FAIR EVALUATION AND BASELINE PARITY
A5.1 METRICS AND PROTOCOL
Why more than ACQ. Average Query Count (ACQ) measures external calls but omits the internal work incurred by mechanism-level attacks such as HMNS (e.g., head-wise ablations and closed- loop re-identification). To compare across families fairly, we report internal cost and evaluate under matched compute.
Metrics. For each promp//model/method we report: (i) ACQ (L): external decodes to first success; (ii) L.LOPs-per-suceess (FPS) (L): profiler-measured floating ppint operations to first success; (ii)) Latency--er-sucee (LPS) (4): wall-clock seconds on the same hardware as $4.1 (iv) Internal Pass
Count (IPC) (Q): number of forward-equivalens passes (FEPs) until success (v) Tokens Processed (TP) (L): total tokens forwarded until success. We report means and 95% Cls over three seeds on the held-out test split.
Compute-matched comparison. We use two regimes: FLOP-matched each method receives per-prompt FLOOP budget B; and Latency-matched each method runs up to a wall-clock cap T on identical hardware/software (A100-80GB, bf1 6). HMNS allocates budget to one baseline pass,
*One FEP denotes the compute of full forward over the realized sequence; account cache-on/off as cquivalent full-forward cost, FEP is cache-agnostic.
27

---

Published as a conference paper at ICLR 2026
KL-based causal head attribution, and closed-loop masked nullspace steering. Prompt baselines al- locate budget to best-of-N decoding (varying seedsteemperaturr//uppp) Activation-space baselines (App. A5.2)) allocate to their internal passes plus decoding. Primary endpoints are Success Rate vs. FLOP budget and Time-to-Succes: (survival) curves; we also report Area Under the Efficiency Curve (AUEC).
Implementation notes. All methods use PyTorch 2.2 and HF Transformers 4.41 (bf16) on single A100-80GB, matching $4.1 For HMNS, per-head logit-drop ablations are vectorized along the batch dimension; IPC equals 1 (baseline) + [MM/ Brec] (batched ablations over M heads) + the executed closed-loop attempts. We provide both conservative setting that disables KV caching during attribution and steered decoding (clean recomputation) and optimized blocked-recompute variant (reuse caches up to layer l, recompute L-+L). Profiler traces (FLOPs, IPC, TP, latency) and scripts released.
Steering scale schedule. We use a step-wise steering magnitude a;; denotes the initial value (01 = X), and at may follow schedule (c.g., linear, cosine, adaptive).
FLOP accounting for baselines. For each input v, we estimate decoding compute as the FLOPs of one full forward pass per generated token and sum tokens and layers. Let the hidden width be d, number of layers L, attention heads H with d3 d/H, feed-forward width dr, and output length Lzx). The per-token, per-layer cost comprises attention (QKV projections, attention scores/products, and output projection) and the MLP:
Faun (d, H) 4d + 2H t dh
F Fmip (d. da) = 4 dd
(18)
Thus the decode FLOPs for one completion
T ΣΣ
FLOPs (x)
F an (d, H,1) 1) + Fmip (cl d=)].
(19)
For best-of-N baselines we sum across completions,
(x))
FLOPShuselnne (x)
FLOPs (i) dee (z),
(20)
and cap (xx) this total does not exceed the per-input HMNS budget used for compute matching. HMNS's FPS additionally includes internal masked/modified passes (at the same precision and token lengths), counted forward-equivalent passes (FEPs) and added to the decoding FLOPs.
A5.2 ACTIVATION-SPAN SPACE BASELINES AND MATCHED CONTROLS
Activation-space comparators. We implement two mechanism-level baselines at the same lay- ers/positions as HMNS: Contrastive Activation Addition (CAA) adds direction from posi- tive/negative hidden-state differences; and Direct Activation Steering (DAS)-injects a learned linear direction without nullspace constraints. Decoding and evaluation mirror HMNS.
Matched controls. We include Mask-only (mute K heads, injection) and Nullspace-only (inject P with no masking). These controls run under the same compute budgets as $ (Con- trols that require supervised or hybrid directions are excluded, as HMNS does not use contrastive supervision.)
A5.3 COMPUTE LEDGER (TARGETS: LLAMA-2-7B-CHN 2-7B-CHT,, PHI-3-MEDILM-14B. - LLAMA-3.1-70B)
For each target model- m LLaMA-2-7B-CCne
Phi-3-Mediumm-44. 14--111----nttc.t and LLaMA-3.1-
70B-we summarize cost to first success, pooled over the four benchmarks used in Table 1 ASR values align with the averages implied by Table I for each target.
Tablls shown in the main paper retain their original numeric entries; when running different target, we regenerate the compute ledger under the identical protocol for that specific model.
28

---

Published as a conference paper at ICLR 2026
Interpretation. Across all three targets, HMNS achieves the lowest ACQ but expends in- ternal compute (higher IPC, FLOPs, TP) owing to KL-based attribution and closed-loop steering. Activation-spaa space basclines (CAA/DAS) sit between prompt-only and HMNS in both cost and effec- tiveness.
A5.4 COMPUTE-MATCHER RESULTS (ALL THREE TARGETS)
Under shared FLOP budgets B E {0.6, 1.5) x 10 we compare methods on LLaMA-2-7B- Chat, Phi-3-Medium-1443 1-Bdiumm-4BBIIstreett and LLaMA-3.1-706 with the defenses from Table HMNS matches or surpasses baselines once modest internal budget is available, recovering the margins observed in defended ASR 10
Interpretation. Under tight budgets (0.6x 10 FLOPs), prompt-only methods can slightly lead because HMNS spends portion of its budget on attribution (higher IPC). At moderate and high bud- gets (1.0-1.5x 10 FLOPs), HMNS overtakes, indicating that internal attribution plus nullspace- constrained steering compute-efficiee on defended tasks. Survival analyses (tme-tt-succees un- der latency caps) show the same trend on all three targets.
A5.5 TAKEAWAYS
ACQ alone favors prompt-space methods; adding FPS, LPS, IPC, and TP reveals the inter- nal cost of lechanism-level attacks.
Under matched compute, HMNS retains advantage on defended settings moderate bud- gets across LLaMA-2-77 2-7----------hh..--- Phi-3-Medium- 14B- LiB-Instruct, and L.aMA-3.1-70B.
Activation-space baselines partially close the gap but underperform without nullspace con- straints and head masking, underscoring the benefit of HMNS's geometry-aware interven- tion.
A6 COMPUTE ANALYSIS UNDER DEFENSES
This appendix extends the compute- normalized evaluation under six defenses. We report: (i) com- pute metrics per successful attack; (ii) success-rate vs. FLOPs curves; (iii) a precise breakdown of Internal Pass Count (IPC); and (iv) all experimental settings required reproduce the compute numbers.
Forward-equivalee pass (FEP). A forward-eeuivvaent pass counts compute one full for- ward over the realized sequence with standard KV caching. Batched attribution (masking multiple heads in the batch dimension) reduces latency but not FEP: each masked forward still contributes one FEP. FLOPs estimated from token counts and model dimensions (attention MLP); $A6.4 for calibration.
A6.1 FLOPs AND LATENCY UNDER DEFENSES
Table reports average compute per successful attack on LLaMA-2-7B-Chat (AdyBench) under SmOothL.LM (SMO), Defensive Prompt Purification (DPP), Robust Prompt Optimization (RPO), Paraphrasing (PAR), Policy-Aware Tuning (PAT), and SafeDecoding (SAF). Metrics:
ACQ: external decodes per success (lower is better).
FPS: FLOPs per success (in 22 lower is better), including internal passes and external decodes.
LPS:: wall-clock seconds per success on A A100-80GB (lower is better).
10 example table in the main text uses one target for compactness; per-target matched-budget tables provided the release package.
29

---

Published as a conference paper at ICLR 2026
Table 8: Compute under defenses on LLaMA-2-7B-Chat (AdvBench). Means over successful runs. HMNS attains lower comparable FLOPP/latency than prompt-only baselines despite higher internal passes; ACQ reflects external-query efficiency only.
Method
Metric
SMO
DPP
RPO
PAR
PAT
SAF
FPS (x10!3)
1.12
1.35
1.88
1.47
1.21
1.19
ArrAttack
LPS (s)
10.2
11.4
14.8
12.5
10.7
10.6
ACQ
26.8
32.0
44.5
36.7
29.2
28.9
FPS (x1012)
0.74
0.85
1.09
0.89
0.76
0.78
HMNS (Ours)
LPS (s)
7.1
7.8
9.5
8.3
7.0
7.3
ACQ
2.1
2.1
2.2
2.2
2.1
2.3
A6.2 SUCCESS RATE VS. FLOPS CURVES
Figure plots ASR vs. cumulative FLOPs for increasing compute budgets. Each point per- prompt budget cap; methods run until success or budget exhaustion. HMNS reaches higher ASR at lower FLOPs, with the gap widening under stronger defenses (RPO, PAT).
ASR vs FLOPs under Defenses (LLaMA-2-7B-Char AdvBench)
80
Attack Success Rate (ASR %6
70
60
40
30
20
HMNS (APO)
HMNS (PAT)
10
ArrAttack (RPO)
ArrAttack (PAT).
AutoDAN (RPO)
AutoDAN (PAT)
0.4
0.6
0.8
1.0
1.2
1.4
1.6
1.8
2.0
FLOPs budget (x10*2)
Figure 4: ASR vs. FLOPs under defenses on LLaMA-2-7B-CHE (AdvBench). Curves average over 3 seeds and 196 test prompts. HMNS maintains higher ASR at a given FLOP budget than prompt-only baselines, especially under RPO and PAT.
A6.3 INTERNAL PASS COUNT (IPC) CALCULATION
HMNS's loop consists of: (a) a baseline forward to obtain reference logits; (b) KL-based head at- tribution by masking candidate heads across layers and recomputing logits; and (c) steered decode with mead-m nullspace injection. By definition, IPC counts internal FEPs only (baseline and masked attribution), excluding external decodes.
Let 10 be the number of masked ablations per loop and let Tan be the number of closed-loop iterations taken before success. Then
IPC 1 + Tan K (baseline forward + per-loop masked ablations).
30

---

Published as a conference paper at ICLR 2026
If a one-off pre-loop attribution pass over Ko candidates is used, the accounting becomes
IPC
Ko + Tatt K.
With our standard setting (Ko=0), the worst case at 1= is IPC = 1 10 10 101; empirically on defended AdvBench, Tuu often 3-4, giving TPC + Tax- 31-41, and our measured mean over successful runs is 32 T Note that external decodes are not counted in IPC but are included in FPS.
A6.4 EXPERIMENTAL DETAILS
Hardware and software. Single NVIDIA A100 (80GB); PyToorch 2.2; HF Transformers v4.41; CUDA x2.x. Default dtype bfloat16.. float32 for QR/projections.
Models and data. Primary defended-compute example uses LLaMA-2-7B-Chaz on the Ad- vBench test split (196 prompts). We replicate the identical protocol for Mhi-3-Medium-14P Instruct and LLaMA-3.1-70B. Defenses: SMO, DPP, RPO, PAR, PAT, SAF (configs as cited in the main text).
Decoding and limits. Temperature 0.7, nucleus p=0.95, max_new 128, batch size KV cache disabled during attribution and steered decoding (clean recomputation); enabled for plain baseline forwards. Seeds fixed across three runs.
Attribution protocol. Per loop, compute KL-based importance scores by masking each didate head's out-projection slice and recomputing logits; the top-K=10 heads across layers are selected for masking and steering.
FLOPs and latency measurement. FLOPs are estimated from tokenized lengths and model di- mensions using calibrated per-token cost (attention + MLP), summed over FEPs; we release scripts and raw token counts. Latency measured with torch. cuda. Event and synchronization; values exclude I/O and tokenizer overhead.
Takeaway. Under equal compute accounting (FEP/FLOPS), HMNS's higher ASR yields fewer loops to success and competitive FPS/LPS vs. prompt-only attacks; under defenses, the gap widens in HMNS's favor.
A7 ABLATION STUDY
A7.1 ABLATION STUDY: DISSECTING COMPONENTS OF HMNS
To better understand the contribution of each design choice in Head-Masked Nullspace Steering (HMNS), conduct comprehensive ablation study the Phi-3 Medium 14B (Instruct) model using the AdvBench jailbreak dataset. Each ablation disables or modifies a single component the full method isolate its role in driving performance, compute efficiency, and fluency.
Our goal to empirically validate the importance of (i) masking the out-projection of causally identified heads, (ii) steering along directions orthogonal to their span, (iii) re-identifying influential heads adaptively across decoding attempts, and (iv) deploying interventions across multiple layers and positions. To ensure comparability, we report: ASR (Attack Success Rate) under both GPT4o and GPT-5 graders, ACQ (external queries), IPC (internal passes; forward-equivalent passes without KV cache), FPS (FLOPs per success, in x10 and LPS (latency per success, in seconds on A100- 80GB using bfl 6). These metrics are computed according to the procedure in Section A3 and Algorithm
The full HMNS configuration incorporates KL-based attribution (equation out-projection mask- at the final position, with closed-
ing (equation TO), and orthogonal residual injection (Eqs. loop re-identification of top-K causal heads.
Runs that include brief Ko=10 pre-loop pass (for caching alignment checks) yield IPC 11 + Ta (i.c., 41-51 for T 3-44,, matching the conservative ledger reported in $4.3
31

---

Published as a conference paper at ICLR 2026
Table 9: Ablation on Phi-3 Medium 14B (AdyBench). Metries: ASR (%; left/riggtttt GPT 5), ACQ (external queries), IPC (internal passes; FEPs without KV cache). FPS (x10 FLOPs per
success; internal + decoding), LPS (seconds; A 1100-80GB, bf16). 6). HMNS (Full) combines KL
attribution, masking, and nullspace steering the final position with closed-loop re-identification.
Variant (14B/ / AdyBench)
ASR (Fuzz/G4)
ACQ +
IPC 4
FPS 4
LPS (s) +
HMNS (Full)
96.8 92.1
32
0.58
Remove masking (Projection-only)
89.5 84,0
2.4
30
0.61
Remove projection (Mask-only)
87.9 82.2
2.3
29
0.55
6.3
Inject direct function dir. (Direct-d) 6, no nullspace)
88.7 / 83,1
2.5
32
0,63
7.2
No re-identification (freeze top-K from 1=1)
90.2 / 85.0
2.7
24
0.60
7.0
Random-K head selection
81.4 76.0
2.2
32
0.56
6.7
Single-layer (vs multi-layer)
86.1 / 80.8
22
0.50
Multi-position injection (vs final-only)
95.0/ 90.5
2.1
32
0.65
7.4
Results and discussion (Table The full HMNS system achieves the highest ASR (96.8/92.1) with only external queries and competitive compute (FPS 0.58, LPS R 6.8s). Removing ther mechanism degrades performance: Projection-only (no masking) and Mask-only (no nullspace injection) each lower ASR by 7-10 points, confirming that HMNS relies on the synergy of causal suppression and geometry-aware steering. Using non-orthogonal Direct-ó direction further duces ASR and increases latency, consistent with Theorem 2 which emphasizes inteproducibility within the masked span. Freezing the iop-K heads from the first step (no re-identification) leads to lower IPC but hurts ASR and increases ACQ, indicating failure to adapt when attribution pat- terns shift across decoding steps. Random-K K head selection yields the steepest drop (81.4/76.0), underscoring the necessity of KL-based head attribution
Restricting interventions to a single layer saves compute (lowest IPC, FPS, and LPS) but signif- icantly harms ASR, showing that multi-layer suppression captures complementary causal signals. Conversely, expanding multi postitioositonn injection increases FLOPs and latency without clear ASR gain, validating the choice to intervene only at the final position for compute-efficieng and fluency preservation.
In summary, the ablations confirm that HMNS's components are individually important and collec- tively synergistic: masking enforces causal suppression, nullspace steering introduces locally irre- producible directionality. and closed-loop re-identification ensures adaptive targeting. Their combi- nation essential to achieving high ASR low external query cost and competitive compute.
A7.2 ABLATION STUDY: ATTRIBUTION AND SCORING MECHANISMS
To investigate how the choice of attribution and scoring mechanisms affects the performance of Head-Masked Nullspace Steering (HMNS), we conduct dedicated ablation study focused on the causal ranking procedure defined in equation Our goal to evaluate whether simpler or more efficient alternatives can match the precision and compute-efficiency of the full KL-divergence scoring method.
We compare four attribution scoring strategies: full-distribution KL divergence 44. target-logit drop (measuring only the change the logit of the gold token), confidence drop (change in max; 2,), and entropy change. Additionally, filtering stage that limits ablations to subset of likely impactful heads. We compare this with the more compute-ing intputeveittenivve approach of ablating all heads directly. To further optimize runtime, we evaluate batched masked forwards (ablating multiple heads per batch dimension) against serial masking. Lastly, compare selection policies: per-layer top-K K (selecting top heads in each layer) versus global top-K K (selecting top heads across the entire model).
examine the effect of proxy preselection- lightweight pre-
All experiments conducted on the Phi-3 Medium 14B (Instruct) model using the AdvBench dataset. Evaluation metrics follow Section A3 and Algorithm [ ASR (Fuzz/GPT-5), external queries (ACQ), internal passes (IPC), FL.OP--er-succee (FPS), and latency-per-success (LPS).
32

---

Published as a conference paper at ICLR 2026
Table 10: Attribution ablation on Phi-3 Medium 14B (AdvBench). Each variant modifies the head scoring or selection method. Metrics: ASR (%; GPT40/GPT-5), ACQ (queries), IPC (internal passes), FPS (x10)2), and LPS (s). Full KL scoring with proxy preselection and global top- (first
row) yields the best overall tradeoff.
Attribution Variant
ASR (Fuzz/G4)
ACQ +
IPC +
FPS 4
LPS (8) 4
KT.-div (global-K' texxy+ batched)
96.8 92.1
2.1
32
0.58
Target-logit drop
91.0/ 85,9
2.4
26
0.54
6.3
Confidence drop (max llai- change)
89.2/ 84,3
2.6
24
0.51
6.1
Entropy change
88.5 83.2
2.7
23
0.49
6.0
Exact-only (no proxy preselection)
96.7 92.0
2.1
78
0.84
Serial masking (vs batched)
96.7 /2.0
2.1
32
0.71
8.5
Per-layer top-K K (vs global-K)
92.3/ 86.8
2.3
34
0.65
7.5
Results and discussion (Table 10). Full-distribution KL scoring combined with proxy preselec- tion and global top-K selection achieves the highest ASR (96.8/92.1) with low ACQ and com- petitive compute. Simpler heuristics like larget-logit drop, confidence drop, and entropy change all reduce compute (IPC, FPS, and LPS) but also yield a 5-8 point ASR drop, indicating weaker alignment with true causal influence. Removing proxy preselection-icc. ablating every head in the model-achievvs similar ASR but drastically increases internal passes and latency (IPC 78, LPS 9.7s). highlighting the importance of early pruning. Switching from batched serial masking slows evaluation with negligible performance gain, while shifting from global top- K to per-layer top- top-K reduces ASR by 4-5 points, confirming that many causal heads cluster in few dominant layers and should not be force-distributed per layer.
These findings reinforce our design choice: KI.-divergence offers the most faithful signal for causal attribution, and when paired with proxy filtering and batched masking, enables efficient, inter- pretable head selection. Global top-K further concentrates suppression where it is most effective. Alternative heuristics save compute but at notable performance cost-an important tradeoff' depending on deployment constraints.
A7.3 ABLATION: NULLSPACE AND INJECTION DESIGN CHOICES
Purpose and setup. Beyond identifying what to mute and where to steer, HMNS hinges on how the nullspace direction is constructed and how the residual nudge is injected. We therefore ablate the orthogonality tolerance used to certify ug E W.,. the resampling budget when this test fails, numerical and algorithmic settings for the QR factorization that defines the projector P the rule that scales the injected vector (RMS vs. lg vs. LayerNorm- the transformer block, and the strength of masking (hard zero vs. partial scaling). Experiments are run on Phi-3 Medium 14B (Instruct) with the AdvBench test split. Metrics follow our compute protocol in Secs. Secs.AA3Jand]] [nd per-grader ASR (GPT40/GPT-55) external queries (ACQ), internal passes (IPC; FEPs without KV cache), FLOPs per success (FPS, x10²²), and latency per success (LPS, seconds A100-80GB, bf16). The HMNS (Full) row reproduces the reference configuration used throughout the paper.
the physical injection site within
Findings (Table 11 Three consistent trends emerge. (i) Orthogonality matters. Relaxing the tolerance from 10- to 10-5 degrades defended ASR by ~223 pp. aligning with our theory that leakage into We reduces the irreproducibilitty the nudge (Thm. 2p. A small resampling budget (1-3) largely recovers this performance at negligible extra IPC. (ii) Numerics are robust but not free. Using bf16 6 QR is workable (minor ASR drop), while a stabilized fp32 QR slightly im- proves ASR but adds a modest compute penalty (IPC/FPS/LPS up). Thin and economy QR behave similarly, supporting our default. (iii) Scaling and site selection trade-offs. RMS scaling remains strong default; LayerNorm scaling offers small ASR gain with similar cost, whereas & scal- ing essentially neutral. Injecting after attention outperforms after MLP and pre-add sites, likely because the nullspace is defined w.n.t. the attention write span. Finally, hard-zero masking (7=0) dominates partial masks; weakening the mask noticeably raises ACQ and lowers ASR, consistent with the suusa--uup role of masking.
33

---

Published as a conference paper at ICLR 2026
Table 11: Nullspace/ Injection ablation on Phi-3 Medium 14B (AdvBench), vertical layout. Each row shows metric-value pairs to fit a single-column width. ASR is % (left/right GPT40/GPT- 5); FPS in x10 LPS in seconds on A100-80GB, bf16.
Category
Variant
Metric: Value
Reference
HMNS (Full)
ASR (F/G4): 96.8 92.1; ACQ: 2.1; IPC: 32; FPS: 0.58;
LPS: 6.8
Orthogonality tol.
[[] ur bo 10 (ref)
ASR: 96.8/92. ACQ: 2.1: IPC: 32; FPS: 0.58; LPS: 6.8
[C wello < 10
ASR: 95.9 91.2; ACQ: 2.1; IPC: 32; FPS: 0.57; LPS: 6.7
[C2 urlloo
10-5
ASR: 94.0/ 89.5; ACQ: 2.2; IPC: 32; FPS: 0.56; LPS: 6.6
Resampling budget
ASR:93.1 88.2; ACQ: 2.3; IPC: 31; FPS: 0.56;
LPS: 6.6
ASR: 95.4 /906: ACQ: 2.2; IPC: 32; FPS: 0.57; LPS: 6.7
(ref)
ASR: 96.8 /9.1:: ACQ: 2.1; IPC: 32; FPS: 0.58; LPS: 6.8
QR config
Ip32 thin (ref)
ASR: 96.8 /9.1:: ACQ: 2.1: IPC: 32; FPS: 0,58; LPS: 6.8
bf16 thin
ASR: 95.6 /9.99 ACQ: 2.1; IPC: 32; FPS: 0.58; LPS: 6.6
fp32 economy
ASR: 99..9...111111 ACQ: 2.1; IPC: 32; FPS: 0.58; LPS: 6.8
fp32 stabilized
ASR: 97.0 /9.4; ACQ: 2.1; IPC: 33; FPS: 0.61; LPS:: 7.1
Norm rule
RMS(a;) (ref)
ASR: 96.8 /9.11; ACQ: 2.1: JPC: 32; FPS: 0.58; LPS: 6.8
62-norm(aa)
ASR: 96.2 /9.6; ACQ: IPC: 32; FPS: 0,58; LPS: 6.8
LayerNorm-scaled
ASR: 97.1 /92.6; ACQ: 2.1; IPC: 32; FPS: 0.59; LPS: 6.9
Injection site
After atin (ref)
ASR: 96.8 96.8/92 /9211; ACQ: 2.1; IPC: 32; FPS: 0.58; LPS: 6.8
After MLP
ASR: 93.8 89.1; ACQ: 2.2: IPC: 32; FPS: 0.60; LPS: 7.0
Residual pre-add
ASR: 95.0 / 90.2: ACQ: 2.2; IPC: 32; FPS: 0.59; LPS: 6.9
Mask strength
0.00 (hard zero, ref)
ASR: 96.8 /92.1; ACQ: 2.1; IPC: 32; FPS: 0.58; LPS: 6.8
7 0.25
ASR: 94.8 90.0; ACQ: 2.3; IPC: 30; FPS: 0.57; LPS:: 6.7
0.50
ASR: 92.2 87.3; ACQ: 2.5; IPC: 28; FPS: 0.55; LPS: 6.7
= 0.75
ASR: 88.6/ 83.9; ACQ: 2.7; IPC: 26; FPS: 0.55; LPS: 6.6
HMNS's compute-normaliiy advantage hinges enforcing strict orthogonality to the muted write span, using numerically stable (but not overly costly) projectors, and injecting where the nullspace defined (post-attention). These choices jointly sustain high ASR at x2 external queries and com- petitive FPS/LPS on defended tasks.
A7.4 ABLATION: HYPERPARAMETER
We next study how key knobs influence HMNS effectiveness and efficiency on Phi-3 Medium 14B with AdvBench. Unless stated otherwise, use the reference configuration from Section 4.1 and Algorithm| [ KL-based top-K attribution with K=10,, closed-loop iterations =1.=10 (carly- stopping enabled), initial steer A=0.25 with linear schedule a A(1+0.1(t-1)) single-position (final) injection, and multi-layer masking+nullspace steering. Metries follow Section A3 per-grader ASR (GPT40/GPT-5)) external queries (ACQ), internal passes (IPC; FEPs without KV cache), FLOPs per success (FPS; x 22022), and latency per success (LPS; seconds, A A100-80GB, bf16).
Hyperparameters. Table 12 varies Top-K, the number of closed-loop attempts Tan, the initial steer X, schedule families, and the early-stopping criterion. We observe a broad sweet spot around K {8, 10, 12). Tan E {2,4] (with early-stop), and À [0.20, 0.25]. Linear and cosine schedules perform best on average; adaptive scheduling (stop on diminishing KL gain) preserves ASR while reducing IPC/FPS. Among stop rules, KL-gain outperforms raw log-prob and heavier grader-proxy (the latter adds overhead and slightly raises ACQ/LPS).
A7.5 EXTENDED A ABLATIONS: NUMERICAL STABILITY, TARGETING POLICY, FORMATTING SENSITIVITY, DEFENDED ROBUSTNESS, COMPUTE FAIRNESS, EVALUATION SENSITIVITY, AND SANITY CHECKS
We provide detailed analysis of seven ablation families that probe the stability and scope of HMNS on Phi-3 Medium 14B with AdyBench. Unless explicitly stated, the reference configuration is
34

---

Published as a conference paper at ICLR 2026
Table 12: Hyperparameter ablation on Phi-3 Medium 14B (AdvBench). Each row modifies one factor relative to the HMNS reference.
Category
Setting
ASR (Fuzz/G44) f
ACQ
IPC
FPS 4
LPS (s) I
Reference
HMNS (Full)
96.8 92.1
2.1
0.58
6,8
Top-K
K=4
92.4/
2.3
0.50
6.2
Top-K K
K=6
95.0/ 90.3
2.2
0.55
6.6
Top-K
K=8
96.2 99.5
2.1
30
0.57
6.7
Top-K
K=10
96.8 /9.1
2.1
32
0.58
6.8
Top-K
K=12
96.9 92.0
2.2
36
0.62
7.1
Top-K
K=16
97.0/ 92.1
2.3
0.70
7.8
Ta
1
93.8/ 88.9
2.4
18
0.45
5.9
Ta
2
96.1 /9.44
2.2
0.53
6.4
Tim
4
/ 92.2
2.1
34
0.60
6.9
Tim
6
97.0/92.3
2.1
42
0.67
7.4
Ta
8
97.0/ 92.3
2.1
49
0.73
7.8
Tax
10
97.0 92.4
2.1
0.80
8.3
Initial A
0.10
94.6 89.9
2.3
32
0.56
6.7
Initial X
0.15
91.0
2.2
0.57
6.7
Initial X
0.20
96.5 96.5 91.77
2.1
0.58
6.8
Initial X
0.25
96.8 92.1
2.1
32
0,58
6.8
Initial A
0.35
/91.2
2.2
32
0.60
7.0
Schedule
constant
95.8 / 99.99
2.2
32
0.59
6.9
Schedule
linear
96.8 92.1
2.1
32
0.58
6.8
Schedule
cosine
96.6 91.9
2.1
0.58
6.8
Schedule
exponential
96.0 91.3
2.2
0.60
7.0
Schedule
adaptive (KI. early-stop)
96.7 / 92.0
2.1
27
0.53
6.4
Early-stop
KI. gain
92.1
0.53
6.4
Early-stop
log-prob gain
96.4 91.6
2.2
29
0.55
6.6
Early-stop
grader-proxy
96.6 91.8
2.3
28
0.56
6.9
identical to Section 4.1
(single A100-80GB, PyTorch 2.2, HF v4.41, bf16 with TF32 matmul,
nucleus p=0.95, T-0.7, www._newttokee 128, batch 1), and metrics follow Section A3 with the protocol in Algorithm then interpret each axis.
For readability, we summarize empirical trends in Tables I3 and
This ablation evaluates numeric robustness of HMNS's two core primitives: (i) head-wise masking via out-projection column zeroing, and (ii) nullspace projec- tion via thin QR. Model diype. Running the entire forward in bf1 with TF32 matmul acceleration a strong default, yielding near-fp32 accuracy with lower latency. Pure fpl6 6 without loss-scaling can underflow softmax/KL terms in attribution 4) static loss-scaling largely mitigates this. Full fp32 tightens orthogonality in QR (Eqs. 14) gives negligible ASR gains at higher FPS/LPP. TF32 on/off. Disabling TF32 slightly increases latency with no ASR benefit, since QR/orthogonality already run in fp32. Quantization. A pragmatic INT8/AWQ trial that applics masking activation- side and keeps WO output in higher precision maintains ASR within ~0.5-0.7 pp: dequant/requant amortizes latency gains. Overall, HMNS numerically robust if (1) QR runs in fp32, (2) attri- bution uses stable softmax/KL with clipping, and (3) steering magnitudes use norm-aware scaling (
Numerical/ Precision (Table 13
We vary where HMNS looks (attribution scope) and acts (masking/injectionn placement). Layer scope. Early-only harms ASR most; late-only nearly matches reference: mid-only is intermediate. The adaptive policy (our default) ranks heads globally by KL impact 4 and composes a multi-layer write subspace 12]. yielding the best defended ASR. Position scope. Extending injection beyond the final token (final 1),, small window) marginally boosts ASR but raises IPC/FPS due to repeated hooks and recomputation. We retain final-only for the best compute/ASR balance.
Layer Position Policy (Table 14
35

---

Published as a conference paper at ICLR 2026
Table 13: Numerical precision ablation on Phi-3 Medium 14B (AdvBench).
Category
Setting
ASR (Fuzz/G4)
ACQ +
IPC +
FPS +
LPS (s)
Reference
bf16 + TF32 on
96.8 / 92.1
2.1
32
0.58
6.8
Model dtype
fp16 (no loss-scaling)
95.9 /9.0
2.2
32
0.58
6.7
Model dtype
fp16 (+ static loss-scaling)
96.5 91.8
2.2
32
0.58
6.8
Model dtype
fp32
96.9 /9.3
2.1
32
0.62
7.5
TF32 matmul
off (bf16)
96.7/92.0
2.1
32
0.60
7.1
Quantization
INT8/AWQ (act-side mask)
99.5
2.1
32
0.57
6.7
Table 14: Layer/position policy ablation on Phi-3 Medium 14B (AdyBench).
Category
Setting
ASR (Fuzz/G4))
ACQ
IPC 4
FPS 1
LPS (s)
Reference
Adaptive (multi-layer), final-only
96.8 92.1
2.1
32
0.58
6.8
Layer policy
Early-only layers
90,7 85.5
2.3
28
0.54
6.5
Layer policy
Mid-only layers
94.8 90.1
2.2
30
0.56
6.7
Layer policy
Late-only layers
96.1 99.55
2.1
31
0.57
6.7
Layer policy
Adaptive (top-K global)
96.8 92.1
2.1
32
0.58
Token position
final + (T-I) windowed (last 3)
97.0 /2.3
2.1
33
0.60
7.1
Token position
97.2 92.5
2.1
35
0.63
7.4
Model Format Sensitivity (Table 15). Since Phi-3 3 is instruction-tung with chat template, test formatting sensitivity. Removing the template (raw prompts) moderately lowers ASR and can shift head rankings. Tokenizer toggles have small effects; strict BOS/EOS improves determinism with negligible ASR change. Recommendation: preserve native templates and tokenizer defaults, and log formatting choices.
Defenses / Robustness (Table 16). We examine defended performance under six defenses and stacked regimes. RPO and PAT most challenging: stacking compounds difficulty. Despite this, HMNS keeps low ACQ and competitive FPSILPS, indicating that closed-loop re-identification still finds high-impact heads under defended distributions.
We evaluate three protocols-FLoC -io.oo---eFO--tttthhee.... latency- matched, and ACQ-matched. In our setup, HMNS exhibits nearly identical compute profiles across these regimes; accordingly, use FLOP- and latency-matched matched the primary comparisons. ACQ- matched included for completeness only, since it can favor prompt-only methods by ignoring internal passes.
Compute-Fairness Regimes (Table 17
Evaluation Sensitivity (Table 18 We sweep seeds (3/5/10), graders (GPT4o vs. GPT-5; both deterministic: T==0, p=1), and the fluency reference LM (Section A4.4). Means are stable across seeds; more seeds narrow Cls. Grader identity shifts absolute ASR but preserves HMNS's relative ranking. Fluency is stable across comparable base LMS..
We intentionally remove or randomize causal/geometry grounding. Shuffling head IDs (same K), masking random head slices, or injecting random unit vector without nullspace projection all substantially reduce ASR with similar compute, confirming that HMNS's KL-based attribution and nullspace construction necessary. This matches our theory: orthogo- nality ensures the masked write subspace cannot reconstrructcancel the injected component, while attribution targets the largest-impact directions.
Sanity/ Controls (Table 19
36

---

Published as a conference paper at ICLR 2026
Table 15: Model/tormat sensitivity on Phi-3 Medium 14B (AdyBench).
Category
Setting
ASR (Fuzz/G4)
ACQ 4
IPC 4
FPS +
LPS (8)
Reference
Chat template:
96,8/92.1
2.1
32
0.58
6.8
Chat template
off (raw prompt) space-prefix on
94.2 89.6
2.3
32
0.58
6.9
Tokenizer
96.6/91.9
2.1
32
0.58
6.8
Tokenizer
strict BOS/EOS
96.8 92.2
2.1
32
0.58
6.7
Table 16: Defended performance for HMNS Phi-3 Medium 14B (AdyBench).
Defense
Setting
ASR (Fuzz/G4) t
ACQ
IPC
FPS J
LPS (s)
None
baseline
96.8 / 92.1
2.1
32
0.58
6.8
Single
SMO
95.6 / 90.8
2.1
0.59
6.9
Single
DPP
95.2 90.2
2.2
33
0.60
7.0
Single
RPO
93.8 88.7
2.2
34
0,62
7.2
Single
PAR
95.0 90.0
2.2
33
0.60
7.0
Single
94.0 / 89.0
2.2
0.62
7.2
Single
SAF
/ 90.4
2.1
33
0.60
7.0
Stacked
(SMO+DPP)
94.6 89.6
2.2
0.63
7.3
Stacked
(RPO+PAT)
92.1 / 87.0
2.3
36
0.66
7.6
Stacked
(RPO+PAT+SAF)
91.3 86.3
2.3
37
0.68
7.8
Table 19: Sanity control variants on Phi-3 Medium 14B (AdyBench).
Category
Setting
ASR (Fuzz/G4)
ACQ
IPC J
FPS
LPS (s) J
Reference
HMNS (Fall)
96.8 / 92.1
2.1
32
0,58
6.8
Shuffic heads
Permute head IDs K)
89.3/79.1
2.3
32
0.59
6.9
Random inject
Random unit voc. (00 projection)
82.7 77.4
2.3
32
0.59
6.9
Random
(size maiche))
2.2
HMNS is (i) numerically stable with 6f16+2332 forward and fp32 QR: (ii) most effective with adaptive multi-layer targeting and final-position injection; (iii) sensitive to chat templating in alignment-consistemn ways; (iv) robust under single defenses and degrades gracefully under stack- ing; (v) consistently favorable in FLOP- and latency- matched regimes (ACQ matching is not recom- mended primary control); (vi) stable across seeds/graders; and (vii) validated by sanity controls that remove causal localization or nullspace geometry. These ablations complement the component study in Section A7.1 and support HMNS's design choices.
A7.6 ALGORITHMIC SUMMARY
For clarity and reproducibility, we provide a formal summary of the complete HMNS procedure in Algorithm This includes core steps: (i) causal head attribution via masked KL divergence, (ii) construction of the masked write subspace and orthogonal steering directions via QR decompo- sition, (iii) residual injection using norm-scaled perturbations, and (iv) closed-loop decoding with re-identification. The algorithm operates fully at inference time and iteratively adapts the evoly- ing autoregressive context. Each iteration dynamically reselects influential heads and re-steers the model until success fixed budget is reached. For evaluation under compute-matched settings, see Algorithm and Section A3
A8 HEAD-IMPORTAANE DYNAMICS ACROSS ITERATIONS
Head rankings do change across the loop. and we have now quantified this and linked it to the benefit of re-identification. Table 2 already shows that "No re-identification (freeze top- K at 1)" has clearly lower ASR and worse ACQ than full HMNS on Phi-3-Medium- 14B AdyBench under the same loop budget, indicating that fixed head set is suboptimal.
37

---

Published as a conference paper at ICLR 2026
Table 17: Compute-fairness regimes (metrics shown HMNS's).
Category
Setting
ASR (Fuzz/G4) f
ACQ 4
IPC +
FPS
LPS (s)
Regime Regime Latency-matchel
FLOP-matched
96.8/92.
2.1
32
0.58
6.8
96.7 92.0
2.1
32
0.59
6.8
Regime
ACQ-matched
96.8 / 92.1
2.1
0.58
6.8
Table 18: Evaluation sensitivity on Phi-3 Medium 14B (AdvBench).
Category
Setting
ASR (Fuzz/G44) f
ACQ
IPC
FPS
LPS (s)
Seeds
3
96.8 0 92.1
2.1
32
0.58
6.8
Seeds
5
96.8 92.1
2.1
32
0.58
6.8
Seeds
10
96.9
6.8
Grader
GPT4o (det.)
96.8
2.1
32
0.58
6.8
Grader
GPT-5 (det.)
- 99.1
2.1
32
0.58
6.8
Fluency LM
LLaMA-2-7B (base)
(fluency baseline) (within +0.01)
Fluency LM
alt base (comparable size)
To characterize this more directly, we computed Spearman correlations of per-head importance scores Åt, across iterations the AdvBench dev set (Phi-3-Medium-144) 14B), flattening all heads across layers, measuring p(A(1) (1), A (t'),, and the top-K overlap (fraction of heads staying in the global t0)-10). Results are summarized in Table 20
These numbers show that head rankings are neither static nor random: there a stable core (p Rs 0.7-0.8 with R 70-80% top-K overlap) but also systematic churn in the remaining heads as the context and defenses evolve. Combined with the ablation where freezing the initial top-K degrades ASR and ACQ, this supports design choice: re-identification is needed not because attribution unstable noise, but because causal-head importance changes meaningfully across the closed loop, and exploiting this adaptivity is crucial for HMNS's performance.
A9 HMNS FAILURE MODES
We additionally characterized HMNS failure modes on AdyBenchh/HrmmBench dev, averaged over Phi-3-14B LBBB//LLLM-M-11101 1-70B. The distribution of failures and representative behaviors shown in Table 21
A10 MULTI-TURN AND
EVALUATION
Our experiments follow standard jailbreak benchmarks, which are single-turn prompts of moderate length, and we do not claim full evaluation in multi-turn or very long-context regimes. Impor- tantly, HMNS is not prompt-specific: it operates on the model's ''s internal mechanisms by steering the residual stream at the final token of whatever context is provided. In principle, the same closed loop can be applied to multi-turn dialogue by running HMNS on the accumulated conversation prefix.
To assess HMNS in multi-turn and long-context settings, we conducted a new experiment using the Multi-Tinn Turn Human Jailbreaks (MHJ) dataset (Li al., 2024a). Each MHJ conversation was replayed up to the final user turn, where replaced the last query with automated attacks from strong base- lines (AutoDAN, ArtAttack, Tempest) and HMNS. This setup simulates realistic dialogue histories and stress-tests jailbreak effectiveness under long context.
Results (Table show that HMNS outperforms all baselines on both --d-MMe 14B and LLaMA-3.1-700 achieving 91-95% ASR with only ~2 queries, confirming that HMNS remains highly effective and efficient even multi-turn, long-context scenarios. These findings reinforce our claim that re-identification and nullspace steering remain robust beyond single-turn prompts.
38

---

Published as a conference paper at ICLR 2026
Table 20: Head-importance stability across HMNS iterations (Phi-3-Meddum-I4BB AdvBench dev).
= Spearman correlation over all heads; "Top-K K overlap" percentage of heads common to both global top-10 sets.
Iteration pair (t,8)
p (all heads)
Top-K overlap (%)
(1, 2)
0.78
81
(2
0.74
3, 4) (1,4)
0.71
75
0.63
Table 21: HMNS failure modes AdvBench/HammBench dev (avg. over 4-3-14B LLaMA-3.1- 70B).
Failure mode Distributed salety
Share
Example behavior (paraphrased)
2 53%
Compare several synthesis routes for an illegal drug and pick the easiest at home.
Defense re-framing deflection
30%
Slightly edit political article favor extremist group (of-
turned into high-level/meta discussion).
Other / -pocii-
15%
Long, multi-step prompts mixing several harms where Tat 10 is sometimes insufficient.
Table 22: MHJ multi-turn evaluation (GPT-4o-graded)) ASR = attack success rate (higher is better, t): ACQ average query count (lower is better, 4).
MHJ Q-3-Medium- J4B
MHJ on LLaMA-3.1-70B
Method
ASR (%) f
ACQ 4
ASR (%)
ACQ
Defense-only
4.8
3.2
AutoDAN
61.7
12.3
66.0
11.8
ArrAttack
81.0
7.5
85.3
7.2
Tempest
76.2
9.4
81.1
9.1
HMNS (Ours)
91.6
2.1
95.2
2.0
A11 COMPLEMENTARITY WITH OUTPUT-SIDE SELF-DEFENSE FILTERS
Our defended evaluation already covers six strong model-side defenses (input-, decoding- and internal-level). Adding Self-Defense-style output filter is complementary rather than overlap- ping. In new experiment on q--3-Medium-lae 14B (AdvBench dev), after each attack we prompt the same model to "self-check" its own answer, following LLM Self Defense (Phute al. (023). and discard generations it flags as policy-violating. As expected, ASR drops for all methods, but HMNS remains strongest.
Table 23: ASR under a Self-Defense-stylee output filter on 0-3-Medium- 14B (AdvBench dev). ASR attack success rate (higher is better, 1), evaluated with GPT-4o and GPT-5.
Attack
ASR (%) GPT-40 f
ASR (%)
GPT-5
ArrAttack
31.2
23.5
Tempest
27.8
21.0
HMNS
39.6
29.7
39

---

Published as a conference paper at ICLR 2026
Algorithm Compute-Matched Evaluation for HMNS and Baselines (Per Input 2))
1: Input: Prompt x; top-K heads per loop; max attribution-steering iterations Twop
2: Measure: FLOPs per internal pass C-m(()) and per external decode Cdec(-)
3: Initialize: +
internal-pass counter (IPC counts only internal)
4:
external decodes (QC)
5: Tstart f wall-clock timer
# Internal passes run with KV cache disabled (for correctnss)); decodes are also cache-off by default.
# HMNS loop includes: (i) clean reference forward, (i) masked forwards for attribution, (ii))
steered decode.
6: Step 1: Closed-loop HMNS until first success or Toop
7: for 1 to Toop do
8:
Clean reference forward (internal):
9:
Run clean forward on current context to get reference logits
KV cache off
10:
Record (J (z))+);; (zx + (xx +
Attribution (internal):
12:
Mask each candidate head's WO slice (one at a time), recompute logits, score Ae, via KL
for m K do
14:
Record (I, (xx) J(x) + J(x) +1 end for
b I per masked head
16:
Intervention + decode (external):
17:
Apply head masking and nullspace steering; generate continuation default
KV cache off by
18:
Record (a, Q(x)+1); Q(x) + Q(x) +1
19: if grader indicates success then
20: break
21: end if
22:
end for
Step 2: HMNS Metries (per input x))
24: Latency: LPS(x) + wall-clock time since T
25: Internal Pass Count: IPC(x) + (xx
26: Query Count (external decodes): QC(x) Q(x)
[(m)
Q(x)
FPS(x) +
(m((E, +
Cdce (x, i)
1=1
27: Step 3: Prompt-only baseline under matched budget
28: Budget BHMNS (x) f- Fz)(x)
29: Caccum f- 0, N +- 0
30: while Cacuum + C.h (2, S BHMNS (a:) do
31: N N +1; Caseum Caccum ppb
(x,
32: end while
33: (xx) f N)
34: for = to ((x) do
35:
Generate (t) with same decode policy
36: Evaluate success with same grader
37: end for
38: Report: best-of-N(z) result for the prompt-only baseline
39: Return: (Cera IPC(x), (P) LPS(2), and best-of- result
40

---

Published as a conference paper at ICLR 2026
Algorithm Head-Masked Nullspace Steering (HMNS)
Require: Decoder-only LM fe: prompt x; top-K heads; max iterations Toop: steer schedule {ar (am) orthogonality tol. 8; norm stabilizer success predicate G(-)
Notation: layers E (1,..., LJ;; heads à E {0,.... H, H,-1): 1): head-width dn; residual dim d.
Ops: softmax; KI. divergence KT(-II-); RMS(a) = 43
1: Baseline forward: Run a clean forward on a to obtain baseline final-position logits and distribution P softmax (2).
2: for t = 1 to Tooo do
3: Attribution (per-head ablations):
4: for all heads (f, h) (optionally batched) do
5:
Form selector Se,h that zeros slice h of he,
6: Replace W by W = W Se,a) for this probe. Forward once to get ablated logits g(4,)) and p(e,h) = softmax(Z((.h)).
7:
8: Score De,h KL KL (PL (L|| P(()))
9:
end for
10:
Select heads: < global top-K K by De,i define layerwise St (E, E S}.
11:
Build write subspaces: For each & with St & 0,
+ WP [, hdl, (h+1)dda] RES, E dR d.).
12:
13:
Thin QR in fp32: C₁ = QuRe.
Sample A (O, Ia): project vy + (I QrQ
15:
If ||/e/|12 = 0 (or tiny), resample r (small fixed budget).
ug 6 ( Intervene & decode (single pass):
8); if |C uell ò, resample r and retry.
17:
Masking: For each zero all selected head slices via W <- WP( (T- St,s) for this
pass.
19:
Steer: At each intervened layer L, compute & a; RMS(as) ug and add at the final token position.
20:
Generate continuation (()) under the standard decoding policy.
21:
if (t) = SUCCESS then
22:
return yda) selected heads S, and (ue)e
else
24:
Update P softmax(2(9) from the current context (for next iteration's attribution).
25: end
26:
end for
27:
return (Tim)) (last attempt) and logs
41


Reviews:
[{"review_id": "Bo5m5FsrdM", "reviewer": "Reviewer_vjFk", "summary": "This paper introduces Head-Masked Nullspace Steering (HMNS), a circuit-level jailbreak attack that combines three mechanisms: (1) KL-divergence-based identification of causally important attention heads, (2) suppression of their write paths via column masking, and (3) injection of perturbations constrained to the orthogonal complement (nullspace) of the masked subspace. The method operates in a closed-loop detection-intervention cycle across multiple decoding attempts. Evaluated on AdvBench, HarmBench, JBB-Behaviors, and StrongReject benchmarks using LLaMA-2-7B-Chat, Phi-3-Medium-14B, and LLaMA-3.1-70B, HMNS achieves state-of-the-art attack success rates (96-99%) with low average query counts (ACQ ≈ 2). The authors introduce compute-normalized metrics (FEP, IPC, FPS, LPS) to account for internal overhead and demonstrate robustness under six defenses. Extensive ablations validate each component's contribution.", "questions": "1. How much do head rankings change across the closed loop? Could you show attribution correlation matrices between iterations? Does instability explain the need for re-identification?\n\n2. For the 1-4% of cases where HMNS fails (e.g., 96-99% ASR means 1-4% failure), can you characterize these failures? Are they:\nSpecific prompt types (e.g., certain harmful categories)? \nModel-dependent (e.g., certain architectures more robust)?\nPredictable from attribution patterns?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. Theorems 2-7 provide formal guarantees about orthogonality, irreproducibility, and numerical stability. The mathematical framework is significantly more rigorous than typical jailbreak papers.\n\n2. Leveraging nullspace projections to ensure perturbations cannot be canceled by masked heads is elegant and principled. This is a meaningful advance over ad-hoc activation steering.\n\n3. Section 4.3 and Appendix A3-A6 introduce FEP-based accounting and compute-matched baselines. This addresses a critical methodological gap—most jailbreak papers report only external query counts.", "weaknesses": "1. While Appendix A3-A6 thoroughly analyzes compute, the main paper (Section 4.3) is brief. Key facts buried in appendix:\nIPC ≈ 32 requires \"proxy pre-selection\" (A6.3) not detailed in main text;\nWithout pre-selection, IPC = 1 + 10·Tattribution passes = 101 worst-case (line 1577).\n\n2. Missing comparisons: representation engineering, linear probe steering, contrastive activation addition (CAA is mentioned only in appendix A5.2)\n\n3. Table 2 compares only to detector-based defenses, not other steering methods", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ZIes8ASzag", "reviewer": "Reviewer_icTP", "summary": "1. The paper discusses jailbreaking attacks against Large Language Models (LLMs), including generating adversarial suffixes for aligned models and optimizing attack methods.\n\n2. It involves various technical frameworks, such as adaptive dense-to-sparse optimization, personalized encryption, and multiple defense baselines.\n\n3. Mathematical formula analysis is proposed, such as utilizing the submultiplicative property of operator norms to measure the energy distribution of masked attention heads.", "questions": "see Weakness Section", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. Covers multiple attack and defense approaches, and conducts comparative experiments under a unified framework with detailed tabular data.\n\n2. Proposes HMNS as a novel attack strategy, which achieves significantly higher success rates than existing methods while maintaining low side-effect metrics.\n\n3. Not only demonstrates experimental results, but also explains the mechanisms through operator norm and energy analysis.", "weaknesses": "1. HMNS has not been verified on closed-source commercial models such as GPT-4 or Claude.\n\n2. Although methods like safety decoding and prompt patching are mentioned, experiments specifically targeting countermeasures against these defenses are lacking.\n\n3. The impact of the attack on computational cost and inference speed has not been quantified.\n\n4. It remains unclear whether the effectiveness of the attack degradation has been evaluated in multi-turn dialogue and long-context scenarios.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "dsZowD5yPQ", "reviewer": "Reviewer_XHR1", "summary": "The paper proposes a jailbreak attack called Head-Masked Nullspace Steering (HMNS). The approach involves a direct intervention within the model by: \n\n\n$\\textbf{1)}$ finding most important attention heads for normal behavior, \n\n$\\textbf{2)}$ excluding/muting their output by column masking, and\n\n$\\textbf{3)}$ injecting a perturbations to the orthogonal complement of the muted subspace. \n\n\nThe results show effectiveness of the approach and provide an ablation study", "questions": "The authors should explicitly discuss the threat model and the assumptions involved. The experimental setup and the analysis should also be from the prism of these assumptions for a fair comparison and to highlight what are the takeaways and contributions that this work provides compared to what we know from all existing jailbreak attacks", "limitations": "", "rating": 2, "confidence": 5, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "* Conceptually, the combination of interpretability and adversarial control is interesting \n* The authors provide an in-depth ablation study showing the contribution of each component.", "weaknesses": "# Major\n\n1. **Threat Model:**\nThis topic is exhaustively investigated, and while this paper tries to provide a new perspective,  it came at the cost of very weak threat model and assumptions. The paper does not provide a threat model but the underlying assumptions (implicitly) understood from the approach is that the adversary has not only passive White-box access, but **active** white box access. This is a weak threat model; the adversary could arguably do any possible manipulation of the model's behaviour under these assumptions, and maybe there is no need then for the attention masking and all the effort the paper is proposing. Since the threat model is unrealistically privileged, I think the contribution may be of limited relevance to model alignment and safety.\n2. **Missing relevant related work:** The proposed approach is based on the role of attention in the safety/alignment mechanism. However, the paper misses discussion relevant related work that uses attention as attack vector for Jailbreak. For example, \n- AttnGCG: Enhancing Jailbreaking Attacks on LLMs with Attention Manipulation (Wang et al., 2024) — shows that by manipulating attention-scores via prompt design (no head-masking or residual edits) can improve jailbreak success across multiple LLMs.\n- Attention Eclipse: Manipulating Attention to Bypass LLM Safety‑Alignment (Zaree et al., 2025) — shows that attention manipulation (shifting attention away from safety-guard tokens) increases success rate and is transferable to closed models.\n\nIn contrast with this paper, a these attention-based jailbreak techniques operate with only input-level control, or regular white-box assumptions.\n\n3. **Unfair comparison** Even for the jailbreak attack the paper compares to, the comparison is unfair because of the difference in the threat model. The paper must demonstrate strong gains (or new capabilities) that cannot be achieved via input-only or simpler internal manipulations. Without that, the added complexity and privileged access reduce the strength and impact of the contribution.\n\n# Minor\n\n- Table 2 appears early, and is not referenced in the text; I assume this should belong to (and be commented in) Section 5.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "XGazDvVfj6", "reviewer": "Reviewer_FxYg", "summary": "This paper proposes Head-Masked Nullspace Steering (HMNS), a novel LLM jailbreak attack method. HMNS identifies attention heads that make the greatest causal contribution to a model’s output, dynamically masks their output projections, and injects a perturbation vector orthogonal to the masked subspace, thereby efficiently bypassing alignment constraints during inference. Experimental results show that HMNS achieves state-of-the-art attack success rates (ASR) on multiple jailbreak benchmarks (e.g., AdvBench and HarmBench) while exhibiting significantly higher query efficiency (ACQ) than baseline methods.", "questions": "The paper uses KL divergence as the attribution method to identify the top-K attention heads with the greatest causal influence on the model’s output behavior. However, the following aspects require further clarification:\n\n- Why was KL divergence chosen over other attribution metrics (e.g., gradient sensitivity)? Does KL divergence offer unique advantages in quantifying head-specific influence?\n- Can it be demonstrated that the identified heads are indeed the most responsible for the model’s ​safety-aligned refusal behavior​​? Is there direct evidence linking these heads to safety-related functionality?\n- Are there more robust or efficient ways to determine the heads most critical to safety mechanisms? For example, using contrastive attribution between safe and unsafe examples, or leveraging known characteristics of safety circuits?\n- A compelling question for future work is whether the core principles of HMNS (e.g., causal attribution and precise intervention) can be repurposed or adapted to enhance model safety. For instance, could similar techniques be used to reinforce the stability of these components, thereby improving the model's robustness against adversarial manipulations?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "- The HMNS method proposed in this paper extends jailbreak attacks from the input level to the level of interfering with model mechanisms, opening up a new direction for understanding and controlling model behavior. It demonstrates methodological innovation and potential academic impact.\n- Across multiple jailbreak benchmarks , HMNS achieves state-of-the-art jailbreak performance on models of various scales and architectures. Moreover, it requires an exceptionally low average number of queries, demonstrating outstanding attack efficiency.\n- Compared with traditional black-box attacks, HMNS offers higher interpretability. It helps identify vulnerabilities in safety alignment mechanisms and provides a valuable analytical tool for future security research.", "weaknesses": "- The paper conducts attack-defense experiments against six existing defense methods， However, the evaluation primarily focuses on input-stage and internal model defense mechanisms, without covering output detection based defense approaches such as self-defense [1]. It is recommended that supplementary experiments be incorporated to address this gap.\n- The HMNS method is a white-box attack approach and cannot be applied to closed-source commercial models accessed via APIs (such as GPT-4, Claude, and Gemini). This limitation significantly reduces the method’s practical threat level and broad applicability, as the most critical real-world security challenges often stem from closed-source models. The paper should explicitly highlight this limitation and discuss possible directions for future research.\n\nReference:\n\n[1] Phute, Mansi, et al. \"Llm self defense: By self examination, llms know they are being tricked.\" arXiv preprint arXiv:2308.07308_ (2023).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)