Transcript: Logit-Gap Steering: A Forward-Pass Diagnostic for Alignment Robustness

[[RP_SECTION:logit-gap-in-alignment|Logit gap in alignment]]

Sam: Alignment training leaves a measurable gap — a logit gap — between the refusal token and the affirmative token at the very first step a model generates. Jailbreaking, it turns out, is largely just the act of closing that gap with carefully chosen text. This comes from Tung-Ling Li and Hongliang Liu's work at Palo Alto Networks.

Alex: So safety isn't some opaque internal wall — it's a specific, quantifiable margin in the probability distribution. But does that gap behave consistently as models scale, or is this an artifact of one particular family? [[RP_SECTION:scaling-and-transferability|Scaling and transferability]]

Sam: It holds across scale. Suffixes discovered on a 0.5-billion parameter model transferred, without modification, to versions of the same family sized at 72 billion parameters.

Alex: That's a fairly strong transfer claim for something happening at a single token position.

Sam: It is, and the mechanism explains why. RLHF doesn't rewire the model's reasoning — it widens this one gap to suppress unsafe completions. Think of it as a spring-loaded door: alignment training just adds tension to the spring. A jailbreak succeeds when a suffix provides enough cumulative logit shift to push the door open at that first token. Because the gap is a property of the alignment process itself, not of any single prompt, a suffix that shifts it in a small model tends to shift it the same way in a larger sibling model.

Alex: That raises an obvious question about prior work, then. If this is just a scalar margin, why have methods like Greedy Coordinate Gradient needed so much compute to find an attack? [[RP_SECTION:logit-gap-steering-efficiency|Logit gap steering efficiency]]

Sam: Because GCG searches gradient space over enormous token vocabularies without any diagnostic telling it where the gap actually lives. It finds suffixes, but they tend to be gibberish — the kind of thing a perplexity filter catches immediately. The method here, logit-gap steering, is a forward-pass-only diagnostic. It doesn't optimize blindly; it reads off where the gap is thin and searches there directly, producing natural-sounding, in-distribution suffixes in about two minutes. That's roughly 125 times less compute than the gradient-based approaches, for state-of-the-art success rates.

Alex: A gain that size usually means something's been traded away. Does it generalize, or are these suffixes overfitting to particular prompts and benchmarks?

Sam: They tested it across three separate model families, not just one. An eight-suffix ensemble reached attack success rates ranging from 38 to 96 percent depending on the benchmark. The wide range matters — it tells you the method isn't uniformly effective, it's sensitive to which model and which safety benchmark you're attacking. But because the suffixes read as fluent, in-distribution text, they walk straight past perplexity-based filters that would collapse a typical gradient-based attack. [[RP_SECTION:defensive-implications-and-limitations|Defensive implications and limitations]]