title: Using Mechanistic Interpretability to Craft Adversarial Attacks against
    Large Language Models
summary: Traditional white-box methods for creating adversarial perturbations against
  LLMs typically rely only on gradient computation from the targeted model,
  ignoring the internal mechanisms responsible for attack success or failure.
  Conversely, interpretability studies that analyze these internal mechanisms
  lack practical applications beyond runtime interventions. We bridge this gap by
  introducing a novel white-box approach that leverages mechanistic
  interpretability techniques to craft practical adversarial inputs.
  Specifically, we first identify acceptance subspaces - sets of feature vectors
  that do not trigger the model's refusal mechanisms - then use gradient-based
  optimization to reroute embeddings from refusal subspaces to acceptance
  subspaces, effectively achieving jailbreaks. This targeted approach
  significantly reduces computation cost, achieving attack success rates of
  80-95\% on state-of-the-art models including Gemma2, Llama3.2, and Qwen2.5
  within minutes or even seconds, compared to existing techniques that often fail
  or require hours of computation. We believe this approach opens a new direction
  for both attack research and defense development. Furthermore, it showcases a
  practical application of mechanistic interpretability where other methods are
  less efficient, which highlights its utility. The code and generated datasets
  are available at https://github.com/Sckathach/subspace-rerouting.
paper_authors._id: 67d0a39d9d994f341c4e6d83
paper_authors.name: Thomas Winninger
paper_authors.status: claimed_verified
paper_authors.statusLastChangedAt: 2025-03-12T08:41:49.453Z
paper_authors._id: 66a8fa93751e65b10a141039
paper_authors.avatarUrl: /avatars/b4cd67c5441ba2c8add576cf13e1f916.svg
paper_authors.fullname: Thomas Winninger
paper_authors.type: user
paper_authors.user: Sckathach
paper_authors._id: 67d0a39d9d994f341c4e6d84
paper_authors.name: Boussad Addad
paper_authors._id: 67d0a39d9d994f341c4e6d85
paper_authors.name: Katarzyna Kapusta
paper_title: Using Mechanistic Interpretability to Craft Adversarial Attacks against
    Large Language Models
paper_summary: Traditional white-box methods for creating adversarial perturbations against
  LLMs typically rely only on gradient computation from the targeted model,
  ignoring the internal mechanisms responsible for attack success or failure.
  Conversely, interpretability studies that analyze these internal mechanisms
  lack practical applications beyond runtime interventions. We bridge this gap by
  introducing a novel white-box approach that leverages mechanistic
  interpretability techniques to craft practical adversarial inputs.
  Specifically, we first identify acceptance subspaces - sets of feature vectors
  that do not trigger the model's refusal mechanisms - then use gradient-based
  optimization to reroute embeddings from refusal subspaces to acceptance
  subspaces, effectively achieving jailbreaks. This targeted approach
  significantly reduces computation cost, achieving attack success rates of
  80-95\% on state-of-the-art models including Gemma2, Llama3.2, and Qwen2.5
  within minutes or even seconds, compared to existing techniques that often fail
  or require hours of computation. We believe this approach opens a new direction
  for both attack research and defense development. Furthermore, it showcases a
  practical application of mechanistic interpretability where other methods are
  less efficient, which highlights its utility. The code and generated datasets
  are available at https://github.com/Sckathach/subspace-rerouting.
paper_ai_keywords: adversarial perturbations LLMs (Large Language Models) gradient computation refusal mechanisms mechanistic interpretability acceptance subspaces feature vectors gradient-based optimization jailbreaks attack success rates Gemma2 Llama3.2 Qwen2.5 computation cost runtime interventions