# Refusal Subspace

Prefill jailbreaks force an unsafe opening into the assistant turn so a model that would refuse continues instead. Tracking vocabulary-grounded signals with the Jacobian lens shows refusal weakening faster than harmfulness as the forced prefix deepens, reaching the benign baseline by free generation. J-Anchor, a training-free inference-time defense, anchors each request to its pre-attack assistant-header state and restores only the refusal components that fall below that target during prefilling and decoding, cutting attack success on fixed and deep prefills across four open-weight instruction models while keeping benign refusal and reasoning close to the undefended model.

Prefill jailbreaks force an unsafe opening into the assistant turn so a model that would refuse continues instead. Tracking vocabulary-grounded signals with the Jacobian lens shows refusal weakening faster than harmfulness as the forced prefix deepens, reaching the benign baseline by free generation. J-Anchor, a training-free inference-time defense, anchors each request to its pre-attack assistant-header state and restores only the refusal components that fall below that target during prefilling and decoding, cutting attack success on fixed and deep prefills across four open-weight instruction models while keeping benign refusal and reasoning close to the undefended model.