IC-506Restoring the refusal feature in Llama-3-8B-Instruct, Mistral-7B-Instruct-v0.2, and Gemma-7B-IT causally disables all four tested adversarial attacks
Lei Yu, Virginie Do, Karen Hambardzumyan, Nicola Cancedda
The authors take successful adversarial prompts and, during inference, patch the residual stream activations to restore the refusal feature to its mean value on the original (unmodified) harmful inputs. This intervention dramatically reduces the attack success rate across all four attack methods and all three models, as judged by the official HarmBench classifier. General capability (MMLU, MT-Bench) is unaffected by the clamping, confirming the effect is specific to the safety decision rather than a degradation of generation quality.
The specific ASR values before and after restoration are shown only in Figure 4 (bar chart); no per-attack numeric ASR is printed in the text. The restoration uses the mean activation over the original harmful prompts, which is an approximation of the pre-attack state.