<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="collu-etal-2026-refusal">
    <titleInfo>
        <title>Refusal Before Decoding: Detecting and Exploiting Refusal Signals in Intermediate LLM Activations</title>
    </titleInfo>
    <name type="personal">
        <namePart type="given">Matteo</namePart>
        <namePart type="given">Gioele</namePart>
        <namePart type="family">Collu</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Riccardo</namePart>
        <namePart type="family">Conte</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Alberto</namePart>
        <namePart type="family">Giaretta</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Denis</namePart>
        <namePart type="family">Kleyko</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Mauro</namePart>
        <namePart type="family">Conti</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Matteo</namePart>
        <namePart type="family">Zavatteri</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Roberto</namePart>
        <namePart type="family">Confalonieri</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <originInfo>
        <dateIssued>2026-10</dateIssued>
    </originInfo>
    <typeOfResource>text</typeOfResource>
    <relatedItem type="host">
        <titleInfo>
            <title>Findings of the Association for Computational Linguistics: EMNLP 2026</title>
        </titleInfo>
        <name type="personal">
            <namePart type="given">Hung-Yi</namePart>
            <namePart type="family">Lee</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Sunipa</namePart>
            <namePart type="family">Dev</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Jessy</namePart>
            <namePart type="family">Li</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Desmond</namePart>
            <namePart type="family">Elliott</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <originInfo>
            <publisher>Association for Computational Linguistics</publisher>
            <place>
                <placeTerm type="text">Budapest, Hungary</placeTerm>
            </place>
        </originInfo>
        <genre authority="marcgt">conference publication</genre>
        <identifier type="isbn">979-8-89176-462-0</identifier>
    </relatedItem>
    <abstract>In this paper, we investigate whether refusal behavior can be predicted from LLM intermediate activations before decoding using linear probes trained on residual stream activations at each transformer block. We find that refusal is linearly decodable well before the final layer, indicating that safety-relevant behavior is represented in intermediate activations before output generation. To test whether this signal is actionable, we introduce Mechanistic AutoDAN, a probe-guided variant of AutoDAN that replaces full-model fitness evaluation with partial forward passes and probe-based scoring inside a genetic prompt search loop. Across the evaluated models, our method achieves attack success rates competitive with vanilla AutoDAN while reducing per-iteration search time by up to 72%, and probe-guided prompts match or exceed AutoDAN’s cross-model transfer in several configurations. We further find that the usefulness of probe guidance increases with model scale. Our results suggest that refusal-relevant information is decodable from intermediate activations and can serve as an effective search signal in an AutoDAN-style discrete jailbreak optimization loop, especially for larger and more robust models.</abstract>
    <identifier type="citekey">collu-etal-2026-refusal</identifier>
    <identifier type="doi">10.18653/2026.findings-emnlp.1328</identifier>
    <location>
        <url>https://aclanthology.org/2026.findings-emnlp.1328/</url>
    </location>
    <part>
        <date>2026-10</date>
        <extent unit="page">
            <start>28141</start>
            <end>28157</end>
        </extent>
    </part>
</mods>
</modsCollection>

%0 Conference Proceedings
%T Refusal Before Decoding: Detecting and Exploiting Refusal Signals in Intermediate LLM Activations
%A Collu, Matteo Gioele
%A Conte, Riccardo
%A Giaretta, Alberto
%A Kleyko, Denis
%A Conti, Mauro
%A Zavatteri, Matteo
%A Confalonieri, Roberto
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Findings of the Association for Computational Linguistics: EMNLP 2026
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-462-0
%F collu-etal-2026-refusal
%X In this paper, we investigate whether refusal behavior can be predicted from LLM intermediate activations before decoding using linear probes trained on residual stream activations at each transformer block. We find that refusal is linearly decodable well before the final layer, indicating that safety-relevant behavior is represented in intermediate activations before output generation. To test whether this signal is actionable, we introduce Mechanistic AutoDAN, a probe-guided variant of AutoDAN that replaces full-model fitness evaluation with partial forward passes and probe-based scoring inside a genetic prompt search loop. Across the evaluated models, our method achieves attack success rates competitive with vanilla AutoDAN while reducing per-iteration search time by up to 72%, and probe-guided prompts match or exceed AutoDAN’s cross-model transfer in several configurations. We further find that the usefulness of probe guidance increases with model scale. Our results suggest that refusal-relevant information is decodable from intermediate activations and can serve as an effective search signal in an AutoDAN-style discrete jailbreak optimization loop, especially for larger and more robust models.
%R 10.18653/2026.findings-emnlp.1328
%U https://aclanthology.org/2026.findings-emnlp.1328/
%U https://doi.org/10.18653/2026.findings-emnlp.1328
%P 28141-28157

Markdown (Informal)

[Refusal Before Decoding: Detecting and Exploiting Refusal Signals in Intermediate LLM Activations](https://aclanthology.org/2026.findings-emnlp.1328/) (Collu et al., Findings 2026)

• Refusal Before Decoding: Detecting and Exploiting Refusal Signals in Intermediate LLM Activations (Collu et al., Findings 2026)

ACL

• Matteo Gioele Collu, Riccardo Conte, Alberto Giaretta, Denis Kleyko, Mauro Conti, Matteo Zavatteri, and Roberto Confalonieri. 2026. Refusal Before Decoding: Detecting and Exploiting Refusal Signals in Intermediate LLM Activations. In Findings of the Association for Computational Linguistics: EMNLP 2026, pages 28141–28157, Budapest, Hungary. Association for Computational Linguistics.