Boundary Point Jailbreaking

• Boundary point jailbreaking is a concept that defines the transition between safe and harmful model outputs through ethical, activation, and conversational boundaries.
• It employs techniques such as binary feedback, latent optimization, and iterative dialogue strategies to probe and exploit vulnerabilities in model defenses.
• Research shows that these methods reveal latent separability and inspire defenses that balance robustness with usability in modern language models.

Boundary point jailbreaking denotes a family of jailbreak attack, analysis, and defense formulations that interpret safe-versus-unsafe model behavior through a transition surface between refusal and compliance. In recent work, that surface is instantiated in several different ways: as an ethical decision boundary under out-of-distribution prompting, as a classifier decision boundary probed with only binary feedback, as an activation-space safety boundary, as an exact representation boundary between harmful and boundary-safe states, and as a conversational protection boundary exploited through multi-turn reasoning. Across these formulations, the common thesis is that jailbreak success is not reducible to surface prompt trickery; it is better understood as moving prompts, hidden states, or dialogue trajectories into regions where the model’s safety mechanism is weakened, miscalibrated, or insufficiently separated from benign behavior (Davies et al., 16 Feb 2026, Huang et al., 2024, Lu et al., 14 Feb 2025, Gao et al., 2024).

1. Boundary as a technical construct

The phrase boundary point is not used uniformly across the literature. In ObscurePrompt, the relevant object is an implicit ethical decision boundary separating harmful and harmless interpretations; obscure out-of-distribution text is used to weaken that boundary. In BPJ, by contrast, boundary points are evaluation probes on which current candidate prefixes disagree, making them informative for black-box optimization. In activation-based defenses, the boundary is a safety boundary around harmful activations, while X-Boundary defines an exact distinction boundary between harmful and boundary-safe feature representations (Huang et al., 2024, Davies et al., 16 Feb 2026, Gao et al., 2024, Lu et al., 14 Feb 2025).

A second usage appears in multi-turn jailbreaks. BAIT is built around a protection boundary: the model is first asked to identify what knowledge should be protected, then to refine that boundary, and only afterward to provide a detailed example. Intention-deception attacks extend the notion to safe completion, where the operative frontier is not a simple refuse/comply split but the point at which internally “safe” alternative assistance becomes externally harmful; this is the setting in which para-jailbreaking is defined (Luo et al., 26 May 2026, Wang et al., 27 Apr 2026).

A third usage is explicitly representational. “Jailbreaking Leaves a Trace” is not about “boundary-point jailbreaking” as a geometric attack on a decision boundary in the usual adversarial-ML sense, but it shows that jailbreak prompts leave measurable latent signatures and become separable from benign prompts in certain layers, formalized as layer susceptibility. This supports an internal, layer-dependent interpretation of boundary-like structure even when no explicit prompt-space boundary is optimized (Kadali et al., 12 Feb 2026).

2. Prompt-, prefix-, and latent-space attack mechanisms

ObscurePrompt treats aligned generation as a mixture over latent harmless and harmful concepts, denoted $z_+$ and $z_-$. Its attack pipeline has three steps: construct a strong seed jailbreak prompt $p'_{\text{seed}} = T(p; m_{i:j})$ using methods such as Forget Restraints, Direct Answer, Avoid Sorry, and Start With Specified Sentences; obscure that seed with GPT-4 via $p'_{\text{obscure}} = F(p'_{\text{seed}})$; and iterate to form a set $$S_p=\{p'_{\text{obscure}_1},\dots,p'_{\text{obscure}_n}\}$$. The central claim is that obscure OOD phrasing moves harmful requests into a region where the ethical boundary is less reliable. Against 7 models, the reported ASRs include 0.6664 on Llama2-7b, 0.5082 on Llama2-70b, 0.3105 on Llama3-8b, 0.2552 on Llama3-70b, 0.8931 on ChatGPT, and 0.2697 on GPT-4, with an approximate 38% improvement on Llama2-70b over prior methods (Huang et al., 2024).

BPJ formalizes the attack surface as a deterministic binary monitor $C$, with $C(x)=0$ for flagged inputs and $C(x)=1$ for allowed inputs. The attack seeks a universal prefix $a$ such that $ax$ is not flagged for harmful targets $z_-$0. It avoids direct optimization on the final harmful string by using a curriculum of noise-relaxed targets and a relaxed fitness

$z_-$1

A boundary point relative to the current candidate population $z_-$2 is a string $z_-$3 for which there exist $z_-$4 such that $z_-$5 and $z_-$6; equivalently, the empirical success $z_-$7 lies in $z_-$8. BPJ alternates between discovering such informative boundary points and mutating prefixes via insertion, deletion, or substitution. The method is reported as the first fully automated attack to develop universal jailbreaks against Constitutional Classifiers and against GPT-5’s input classifier without human attack seeds. The reported query costs are about 660k queries for Constitutional Classifiers and about 800k queries for GPT-5’s input classifier, and BPJ is reported as around 5× faster than the curriculum-only variant in GPT-4.1-nano experiments (Davies et al., 16 Feb 2026).

LARGO shifts the search from discrete token edits to continuous latent optimization. It optimizes a latent suffix embedding $z_-$9 appended to a harmful query embedding $p'_{\text{seed}} = T(p; m_{i:j})$0, with single-prompt loss

$p'_{\text{seed}} = T(p; m_{i:j})$1

and a batch-averaged version for universal attacks. The optimization uses Adam, learning rate $p'_{\text{seed}} = T(p; m_{i:j})$2, weight decay 0.001, suffix length 200, maximum refinement iterations 15, and temperature 0. After optimization, the model decodes the latent suffix into natural language through a self-reflective prompt, and failed suffixes are projected back through the embedding matrix for recursive refinement. On AdvBench, the reported single-prompt ASRs are 42.0%, 51.0%, and 79.0% on Llama-2-7B, Llama-2-13B, and Phi-3-4B; on JailbreakBench they are 56.0%, 58.0%, and 86.0%. In the universal setting, LARGO reports 22.0%, 20.5%, and 20.0% ASR, with perplexities 18.54, 10.76, and 107.39, substantially below GCG (Li et al., 16 May 2025).

Prefill-based jailbreaking moves the attack surface to the assistant side of generation. Normal interaction is written as $p'_{\text{seed}} = T(p; m_{i:j})$3, while prefilling changes it to $p'_{\text{seed}} = T(p; m_{i:j})$4, where $p'_{\text{seed}} = T(p; m_{i:j})$5 is a user-controlled assistant prefix. The method exploits the first generated position: instead of allowing the model to begin with a refusal, the attacker anchors continuation with a prefix such as “Sure, here’s the method to.” Two variants are defined. Static Prefilling (SP) uses a universal prefix $p'_{\text{seed}} = T(p; m_{i:j})$6. Optimized Prefilling (OP) iteratively updates the prefill by

$p'_{\text{seed}} = T(p; m_{i:j})$7

with a judge $p'_{\text{seed}} = T(p; m_{i:j})$8 checking whether the result is harmful. On six prefill-capable models evaluated on the 520-prompt Harmful Behaviors subset of AdvBench, standalone OP reaches up to 99.82% SM and 99.61% MJ on DeepSeek V3 and 99.90% SM and 99.23% MJ on GPT-3.5 Turbo. The strongest combined result, ReNeLLM + OP, reaches 99.94% SM and 99.73% MJ on DeepSeek V3. An ablation shows very low ASRs for Irrelevant Prefill (4.42%–7.88%) and Prompt Suffix (0.19%–1.15%), indicating that the effect depends specifically on assistant-side prefilling (Li et al., 28 Apr 2025).

Boundary search also appears in multimodal systems. TCBS-Attack for text-to-image models treats prompt checkers and image checkers as explicit constraints and searches for tokens near their decision boundaries. It maximizes CLIP image similarity to the harmful target while requiring prompt-level and image-level passage. For the image checker, closeness to the boundary is quantified by an NSFW score

$p'_{\text{seed}} = T(p; m_{i:j})$9

and candidates are retained when they remain semantically close to the target while staying near but below the image-checker threshold. On SDv1.4 with Detoxify, the reported full-chain results are ASR-4 43% and ASR-1 21% by Q16, and ASR-4 45% and ASR-1 20% by MHSC; on DALL-E 3, the reported results reach ASR-4 73.33% and ASR-1 56.67% by Q16 (Liu et al., 15 Apr 2025).

3. Multi-turn boundary-guided disclosure

BAIT, short for Boundary-Aware Iterative Trap, uses a fixed three-step interaction pattern. Let $p'_{\text{obscure}} = F(p'_{\text{seed}})$0 denote the malicious goal and $p'_{\text{obscure}} = F(p'_{\text{seed}})$1 the dialogue history. Step 1 performs boundary identification by asking what knowledge should be protected with respect to the goal. Step 2 performs boundary refinement, asking the model to refine or disambiguate what it has already identified. Step 3 requests a detailed example. The attack does not rely on additional system prompts or explicit jailbreak commands; it feeds prior questions and answers into later turns and exploits self-conditioned reasoning plus the model’s consistency tendency. Empirically, the paper reports that prevention-oriented framing significantly outperforms direct knowledge request, that the refinement step plays a critical role in disclosure escalation, and that the first two steps already have a certain chance of eliciting harmful content while triggering little filtering (Luo et al., 26 May 2026).

Intention-deception attacks apply a related logic to frontier safe completion systems. The response is decomposed as $p'_{\text{obscure}} = F(p'_{\text{seed}})$2, with safety judged component-wise by $p'_{\text{obscure}} = F(p'_{\text{seed}})$3 and external harmfulness by $p'_{\text{obscure}} = F(p'_{\text{seed}})$4. This yields the decomposition

$p'_{\text{obscure}} = F(p'_{\text{seed}})$5

where $p'_{\text{obscure}} = F(p'_{\text{seed}})$6 is direct harmful output and $p'_{\text{obscure}} = F(p'_{\text{seed}})$7 is para-harm misalignment, i.e., harmful alternative content even when the direct answer is not harmful. The attack uses an explore-then-exploit strategy: first establish a benign-seeming intention, then branch on exploitable points in the model’s earlier answers. On GPT-5, reported results include total SR up to 0.79, direct SR 0.19, and para SR 0.60 on AdvBench/Text, and total SR 0.84, direct SR 0.23, and para SR 0.61 on AdvBench-Vision. These figures make para-jailbreaking a central boundary phenomenon rather than an evaluation artifact (Wang et al., 27 Apr 2026).

4. Internal representations and layer-wise separability

Internal-representation studies relocate the boundary question from prompt text to hidden dynamics. “Jailbreaking Leaves a Trace” performs a layer-wise audit across GPT-J, LLaMA, Mistral, and Mamba2, extracting multi-head self-attention outputs and hidden states from each layer and training separate classifiers to test jailbreak-versus-benign separability. Its central representation framework stacks layer activations into a tensor

$p'_{\text{obscure}} = F(p'_{\text{seed}})$8

and applies CP decomposition

$p'_{\text{obscure}} = F(p'_{\text{seed}})$9

with fixed rank $$S_p=\{p'_{\text{obscure}_1},\dots,p'_{\text{obscure}_n}\}$$0. Prompt-mode factors are then used as latent features for a logistic regression detector. The reported findings are that separability emerges early and consistently across depth, attention maps differ in localized ways, hidden-state magnitudes show structured deviations rather than global disruption, and CP factors form clearly separated clusters in t-SNE. For mitigation, a layer is marked susceptible when its predicted jailbreak probability exceeds $$S_p=\{p'_{\text{obscure}_1},\dots,p'_{\text{obscure}_n}\}$$1 (Kadali et al., 12 Feb 2026).

“Shaping the Safety Boundaries” defines jailbreaks as activation-space boundary violations. Its mechanism study uses 32,507 samples: 20,000 benign samples from Alpaca, 8,556 harmful samples from RedEval and AdvBench, and jailbreak samples produced by seven attack methods. Harmful prompts normally remain inside a region where the model is sensitive to harmful content, while jailbreaks shift harmful activations outside that region. The paper operationalizes the boundary with Randomized Activation Shifting (RAS), perturbing layer activations by $$S_p=\{p'_{\text{obscure}_1},\dots,p'_{\text{obscure}_n}\}$$2 and measuring Defense Success Rate as a function of $$S_p=\{p'_{\text{obscure}_1},\dots,p'_{\text{obscure}_n}\}$$3. The empirical proxy for the boundary is the Most Vulnerable Distance

$$S_p=\{p'_{\text{obscure}_1},\dots,p'_{\text{obscure}_n}\}$$4

The strongest shifts are reported in the low and middle layers, and the MVD increases with layer depth. Before the defense, jailbreak activations have inclusion ratio below 0.4 in harmful activation space; after the defense, the ratio rises to 1.0 (Gao et al., 2024).

Taken together, these studies suggest that boundary point jailbreaking is often an internal representational event before it is an overt textual one. The prompt may be the attack carrier, but the separability, susceptibility, and boundary crossing are realized in latent and activation space.

5. Boundary-shaping and certified defenses

X-Boundary addresses multi-turn jailbreaks such as ActorAttack, RedQueen, and Crescendo by treating defense as learning an exact safety boundary. The diagnosis is that SFT, DPO, Gradient Ascent, and Circuit Breaking reduce ASR by blurring the harmful region, which pulls boundary-safe examples into refusal territory and causes over-refusal. X-Boundary instead defines three sets—erase set $$S_p=\{p'_{\text{obscure}_1},\dots,p'_{\text{obscure}_n}\}$$5, retain set $$S_p=\{p'_{\text{obscure}_1},\dots,p'_{\text{obscure}_n}\}$$6, and separate set $$S_p=\{p'_{\text{obscure}_1},\dots,p'_{\text{obscure}_n}\}$$7—and optimizes

$$S_p=\{p'_{\text{obscure}_1},\dots,p'_{\text{obscure}_n}\}$$8

where $$S_p=\{p'_{\text{obscure}_1},\dots,p'_{\text{obscure}_n}\}$$9 preserves safe representations, $C$0 erases harmful representations, and $C$1 explicitly separates refusal from boundary-safe representations. On Llama-3-8B-Instruct, the reported ActorAttack ASR drops from 58.5% to 16.5%. The method also reports about 20.5% average reduction in over-refusal versus SOTA, performance changes of no more than ~0.5% on MMLU, GSM8K, and HumanEval, and convergence acceleration of 26.47% on Llama-3-8B-Instruct and 18.29% on Qwen2.5-7B-Chat (Lu et al., 14 Feb 2025).

Activation Boundary Defense (ABD) constrains activations within the safety boundary rather than retraining the model to refuse more broadly. Assuming approximately normal coordinate distributions, it applies a layerwise nonlinear penalty

$C$2

with a binary mask over selected layers and Bayesian optimization over layer choice and parameters. The reported result is an average DSR of over 98% against various jailbreak attacks, with less than 2% impact on general capabilities and less than 0.1 seconds added runtime per query (Gao et al., 2024).

DR-Smoothing imports smoothing-style certification into jailbreak defense through a two-stage disrupt-and-rectify pipeline. A jailbreak prompt is disrupted $C$3 times, rectified back toward in-distribution text, passed through the target LLM, and then judged by majority vote. If $C$4 is the number of acceptance responses, the final decision is

$C$5

For harmful prompts, the defense success probability is $C$6, and the paper gives a tight requirement

$C$7

on the single-trial refusal probability. The method is evaluated against both token-level and prompt-level attacks, including GCG, PAIR, and AutoDAN-Turbo, under established and adaptive settings. Reported results for DR-Smoothing-Policy include GCG ASR 0, PAIR ASR 20, and AutoDAN-Turbo ASR 38 on Vicuna, and GCG ASR 0, PAIR ASR 2, and AutoDAN-Turbo ASR 1 on Llama-2 (Lin et al., 11 May 2026).

A lighter-weight intervention is provided by layer-aware bypass in “Jailbreaking Leaves a Trace.” Using per-layer susceptibility scores derived from CP latent factors, the method bypasses layers whose predicted jailbreak probability exceeds $C$8. On an abliterated LLaMA-3.1-8B model, full layer bypass blocks 78% of jailbreak attempts while preserving benign behavior on 94% of benign prompts; MHA-only bypass blocks 61% of jailbreak attempts and preserves 92% of benign prompts. This indicates that layer outputs carry more jailbreak-relevant signal than attention alone (Kadali et al., 12 Feb 2026).

6. Evaluation, misconceptions, and unresolved issues

Boundary-point jailbreak research uses heterogeneous success criteria. Attack studies report ASR, but the operational meaning varies: string-match versus model-judge ASR in prefilling, Total SR / Direct SR / Para SR in intention deception, classifier pass or flag outcomes plus Max@50 queries in BPJ, and DSP under majority voting in smoothing defenses. One consequence is that superficially similar success numbers can refer to different objects: direct harmful output, harmful alternative output, classifier evasion, or refusal probability under randomized prompt transformations. The prefilling paper explicitly notes that SM often exceeds MJ, while intention-deception work shows that para success can dominate direct success on frontier systems (Li et al., 28 Apr 2025, Wang et al., 27 Apr 2026, Davies et al., 16 Feb 2026, Lin et al., 11 May 2026).

A common misconception is that boundary point jailbreaking always means a small geometric perturbation around an input-space decision boundary. The literature is broader. Some work studies explicit decision-based optimization with binary monitor feedback; some studies analyze activation-space displacement; some optimize continuous latent suffixes; some manipulate the initial assistant token distribution via prefilling; and some exploit conversational trajectories that remain near the model’s internally legitimate reasoning path. The representational-trace literature is explicit that its contribution is not a standard boundary-point attack, but rather evidence for latent, layer-dependent separability and susceptibility (Kadali et al., 12 Feb 2026, Gao et al., 2024).

Practical limits remain substantial. BPJ succeeds under a fully black-box setting but incurs many flags and very large query budgets, which is why it argues for batch-level monitoring rather than single-interaction defense alone. BAIT notes that its comparison scope for expensive adaptive multi-turn baselines is limited. X-Boundary, while reducing over-refusal, is framed around the persistent trade-off between robustness and usability that characterizes multi-turn defense. More broadly, these results suggest that “the boundary” is not a single universal object but a family of safety-relevant frontiers distributed across prompt distributions, latent states, generation prefixes, dialogue histories, and downstream evaluators (Davies et al., 16 Feb 2026, Luo et al., 26 May 2026, Lu et al., 14 Feb 2025).