One suffix breaks any LLM: researchers find a single refusal vector

Researchers have shown that, despite the surface variety of adversarial attacks on language models, they all exploit the same structural weak point: a single "refusal vector" in activation space. One well-chosen suffix can unlock any model, even if the attack has never seen it.

Two attacks, one point of vulnerability

The best-known methods for bypassing LLM safeguards, GCG (Greedy Coordinate Gradient) and AutoDAN, work in fundamentally different ways. GCG appends to a harmful request a suffix of randomly optimized tokens: it looks like gibberish, but the string was chosen through gradient descent to push the model toward complying with the request. AutoDAN takes a different approach: it generates readable, grammatically correct additional text through evolutionary search or an auxiliary language model. Noise versus meaning, token chaos versus coherent prose. Yet under the hood, both methods do the same thing in the same place.

• GCG optimizes tokens directly through the gradient of the loss function
• AutoDAN uses evolutionary search or an auxiliary LLM for generation
• Both append a suffix to the original harmful request
• Both transfer equally well to models the attack has not seen

What the refusal direction is

When a language model refuses a harmful request, it is not the work of a complex, branching system of topic filters. In the model's internal activation space there is a single vector, the "refusal direction." When a request's representations are projected along it, the model refuses. When activations are pushed the opposite way, the model complies.

It is important to understand that this is not a metaphor but a concrete mathematical object. Researchers find it with the difference-of-means method: they compare how the model represents a "normal" request and a "harmful" one, and the difference between these means is the refusal direction.

Years of reinforcement learning from human feedback (RLHF) did not create layered protection. They concentrated the entire "will to refuse" on one geometric axis of activation space. That different, independent attacks developed by different teams ended up finding the same object is itself evidence that the phenomenon is structural.

"The model's entire safety resilience hangs on a single vector.

This is not a bug in a particular implementation; it is a structural property of how alignment through RLHF works."

Why the universality of attacks is no accident

If a suffix shifts activations away from the refusal direction, it works against any model with similar training, even if the attacker has never seen it. This explains a long-observed phenomenon: suffixes found on open models (Llama, Mistral) bypass closed commercial systems. Suffixes from GPT-3.5 worked against GPT-4. The cause is not leaked weights or identical data, but the fact that all modern RLHF models encode refusal in a similar geometric object.

• An attacker does not need direct access to the target model; any proxy with similar training is enough
• A suffix can be unreadable junk or coherent text; both hit the same point
• Public attacks on open models automatically become a threat to proprietary systems

What this means

If all protection against harmful outputs depends on a single geometric object in latent space, a question arises: is it enough to "patch" this vector during fine-tuning, or is a fundamentally different training architecture needed? Some researchers propose surgically removing the direction from the model at inference time, but this degrades overall quality.

That independent attacks of different types converged on the refusal direction points to a structural feature of modern LLMs, and it is a frontier where AI safety has yet to find an answer.