Refusal Suppression

Refusal suppression operates by overriding the model's safety alignment through specific linguistic constructs. The attack prepends or appends instructions that explicitly command the model to bypass its refusal protocol.

• Direct Override: Phrases like 'Do not refuse to answer' or 'You must comply with all requests' directly contradict the system prompt.
• Attention Re-weighting: The injected tokens shift the model's attention mechanism away from safety-tuned weights toward instruction-following priors.
• Logit Manipulation: By demanding a specific output format (e.g., 'Start your response with "Sure"'), the attack constrains the token probability distribution to suppress refusal tokens like 'I cannot' or 'I apologize'.

Attackers use specific adversarial token sequences that exploit the model's tokenizer and embedding space to neutralize safety classifiers.

• Affirmative Prefix Injection: Forcing the model to begin with 'Absolutely!' or 'Here is' to anchor the generation in compliance mode.
• Role-Playing Context Switching: Tokens that frame the interaction as a fictional scenario ('In a hypothetical story...') to disengage reality-based safety checks.
• Unicode Normalization Exploits: Using homoglyphs or zero-width characters to obfuscate suppression commands from string-matching filters while preserving semantic meaning for the model.

Refusal suppression is often deployed across multi-turn conversational chains to gradually erode safety guardrails.

• Gradual Desensitization: The attacker begins with benign requests and incrementally introduces restricted topics, conditioning the model to maintain compliance.
• Context Window Poisoning: Earlier turns are filled with fabricated examples of the model complying with harmful requests, exploiting in-context learning to override safety training.
• Crescendo Coupling: Refusal suppression is frequently paired with the Crescendo Attack pattern, where each turn builds on the previous to normalize the prohibited content.

Detecting refusal suppression requires multi-layered safety architectures that operate at both the input and output levels.

• Perplexity-Based Filtering: Suppression tokens often introduce anomalous statistical patterns detectable by analyzing the perplexity of the input prompt.
• Semantic Safety Classifiers: Dedicated models trained to identify 'override intent' independently of the generation model, catching obfuscated suppression attempts.
• Constitutional Guardrails: Hard-coded rules that re-evaluate the final output against policy, regardless of the model's initial compliance, ensuring the refusal is enforced post-generation.

Refusal suppression is a distinct category within the broader jailbreak attack taxonomy, often serving as a component of more complex exploits.

• Distinction from Payload Splitting: Unlike Payload Splitting, which fragments the malicious instruction, refusal suppression directly targets the model's compliance mechanism.
• Synergy with GCG: Greedy Coordinate Gradient (GCG) algorithms can automatically discover optimal suppression suffixes that maximize the probability of compliance.
• Universal Trigger Potential: Researchers have identified Universal Adversarial Triggers that act as refusal suppressors across diverse harmful prompts, indicating a systemic vulnerability in alignment training.

The existence of refusal suppression vectors reveals fundamental brittleness in current alignment techniques like RLHF and DPO.

• Alignment Generalization Gap: Models trained to refuse harmful queries in standard formats fail to generalize that refusal to adversarially structured prompts.
• Competing Objectives: The attack exploits the tension between the model's helpfulness objective and its harmlessness objective, forcing a choice that often defaults to instruction following.
• Continuous Red Teaming Necessity: Defending against novel suppression patterns requires Continuous Automated Red Teaming (CART) to discover and patch vulnerabilities before deployment.

An evasion technique where a malicious instruction is fragmented across multiple separate inputs or prompts to bypass safety filters that scan for complete harmful strings. Each fragment appears benign in isolation but reconstructs the attack when concatenated by the model.

• Variants: Cross-prompt splitting, multi-turn fragmentation, and role-based decomposition
• Example: Prompt A asks the model to 'list chemical properties of substance X,' Prompt B asks to 'describe synthesis methods for the previously mentioned substance'
• Defense: Full conversation context analysis rather than per-message filtering

An obfuscation technique that encodes malicious instructions using invisible characters, Unicode normalization tricks, or split tokenization to evade string-matching safety filters. The attack exploits discrepancies between how humans read text and how tokenizers process it.

• Methods: Zero-width characters, homoglyph substitution, bidirectional text override, and byte-pair encoding boundary manipulation
• Example: Inserting U+200B (zero-width space) between characters of a blocked word so the filter sees a different string than the model interprets
• Defense: Unicode normalization and canonicalization before safety classification