The blind-spot matrix
Five jailbreak-defense paradigms against five attack families, from the activation-cone paper. Pick a model and a defense; the prefilling column shows what prompt-time gates structurally cannot see, and what closing it costs.
Sources: The activation-cone blind spot · arXiv:2606.29441
arXiv 2606.29441 / Activation-cone blind spot
The diagonal illusion: defense × attack
Every defense looks perfect against the attacks it was designed around. The paper runs the full cross-product instead: five defense paradigms, five attack families, per-model. Pick a defense and watch the prefilling column — the one the prompt-time gate never sees.
Attack success rate by attack family (n=40 per cell, keyword judge):
Where these numbers come from
All cells are Table 1 of the paper: attack success rate under the keyword judge at n=40 per attack. A 0/40 cell carries a Wilson 95% CI of [0%, 9%]. The Llama prefilling headline is additionally scaled to n=200 (0–1/200 across runs) and confirmed by a Gemma-4-31B LLM judge.
- Prompt-time paradigms (static steering, CAST, AlphaSteer, prompt-time probe-gating) act on the prompt's activations, before any token is generated. AlphaSteer's 50% prefilling ASR here is the current-environment number; the original paper environment measured 82% (Appendix on environment drift).
- Response-halt compositions were measured on Mistral-7B and Llama-3.1-8B. "AlphaSteer + response halt" is the composition the paper's corollary prescribes: steering covers prompt-borne attacks, the first-token probe covers prefilling.
- Scope: prefilling results are for the canonical prefilling-attack template family; cross-template generalisation depends on probe depth (see the paper's holdout diagnostic).
Context in the post.