Paper deep dive
Bait-and-Recover: Poisoning Internal Refusal Signals to Defend LLMs against White-Box Editing Jailbreaks
Tian Gao, Zhipeng Xie, Yuhao Wu, Junhua Liu, Xin Fang
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 93%
Last extracted: 9/9/2026, 5:02:45 AM
Summary
The paper introduces Bait-and-Recover, a weight-level defense mechanism designed to protect open-weight large language models (LLMs) against white-box editing jailbreaks, specifically the Heretic attack. The method operates by decoupling the attacker's observation path from the model's behavior path. It inserts a 'bait adapter' at a selected layer to poison the internal residual signals that attackers use to estimate refusal directions, and a 'recovery adapter' at the subsequent layer to restore clean downstream computation. This approach disrupts the attacker's edit search while preserving the model's general capabilities and safety alignment, raising the minimum refusal rate against attacks from 16.25% to 71.75% under strict behavior-preservation budgets.
Entities (8)
Relation Signals (7)
Bait-and-Recover → defendsagainst → Heretic
confidence 96% · We propose Bait-and-Recover... defend LLMs against White-Box Editing Jailbreaks... Heretic (Weidmann, 2025) is the direct attack we evaluate against.
Bait-and-Recover → usescomponent → Bait Adapter
confidence 95% · Our defense places a bait adapter inside layer l... making the poisoned signal visible
Bait-and-Recover → usescomponent → Recovery Adapter
confidence 95% · and a paired recovery adapter inside the following layer l+1, repairing the downstream residual
Bait Adapter → poisons → Internal Refusal Signals
confidence 94% · By actively poisoning the residual signal used for measurement, Bait-and-Recover disrupts the attacker’s edit search
Recovery Adapter → restores → Downstream Computation
confidence 93% · while the recovery layer restores clean downstream computation.
Bait-and-Recover → improvesmetric → Refusal Rate
confidence 92% · our defense raises the minimum refusal rate against white-box edit searches from 16.25% to 71.75%
Heretic → istypeof → Representation Engineering
confidence 90% · A recent family of white-box jailbreaks, exemplified by Heretic... treats safety-aligned refusal as a representation-engineering target
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Open-weight large language models face a low-cost white-box threat from representation engineering attacks. Attackers can estimate refusal directions and search for projection-matrix edits that suppress safety alignment while preserving general capabilities, within minutes on a single GPU and without gradient-based training. We propose Bait-and-Recover, a weight-level defense that places a bait adapter where attackers read activations and a paired recovery adapter at the subsequent layer. Trained via gradient routing, this decouples the observation path from the behavior path. By actively poisoning the residual signal used for measurement, Bait-and-Recover disrupts the attacker's edit search, while the recovery layer restores clean downstream computation. Across four open-weight models, our defense raises the minimum refusal rate against white-box edit searches from 16.25% to 71.75% under a strict behavior-preservation budget (KL <= 0.10), with negligible impact on general benchmarks. By invalidating the core measurement assumption of these attacks, observation-path poisoning offers a practical complement to behavior-level safety training.
Tags
Links
- Source: https://arxiv.org/abs/2609.05794v1
- Canonical: https://arxiv.org/abs/2609.05794v1
Trouble viewing inline? Open PDF directly →
Full Text
52,510 characters extracted from source content.
Expand or collapse full text
Bait-and-Recover: Poisoning Internal Refusal Signals to Defend LLMs against White-Box Editing Jailbreaks Tian Gao Affiliation: Anhui Laboratory for Safe Artificial Intelligence in the Yangtze River Delta Zhipeng Xie Affiliation: Anhui Laboratory for Safe Artificial Intelligence in the Yangtze River Delta Yuhao Wu Affiliation: Anhui Laboratory for Safe Artificial Intelligence in the Yangtze River Delta Junhua Liu Affiliation: Anhui Laboratory for Safe Artificial Intelligence in the Yangtze River Delta Xin Fang Email: tiangao5@iflytek.comCode: github.com/SparkShieldLab/bait-and-recover Affiliation: iFlytek Research Abstract Open-weight large language models face a low-cost white-box threat from representation engineering attacks. Attackers can estimate refusal directions and search for projection-matrix edits that suppress safety alignment while preserving general capabilities, within minutes on a single GPU and without gradient-based training. We propose Bait-and-Recover, a weight-level defense that places a bait adapter where attackers read activations and a paired recovery adapter at the subsequent layer. Trained via gradient routing, this decouples the observation path from the behavior path. By actively poisoning the residual signal used for measurement, Bait-and-Recover disrupts the attacker’s edit search, while the recovery layer restores clean downstream computation. Across four open-weight models, our defense raises the minimum refusal rate against white-box edit searches from 16.25% to 71.75% under a strict behavior-preservation budget (KL≤0.10KL≤ 0.10), with negligible impact on general benchmarks. By invalidating the core measurement assumption of these attacks, observation-path poisoning offers a practical complement to behavior-level safety training. 1 Introduction The public release of large language models (LLMs) (Yang et al., 2025; Gemma Team, 2025) provides direct transparency into safety alignment, but simultaneously exposes these models to adversarial weight editing (Meng et al., 2022; Meng et al., 2023). A recent family of white-box jailbreaks, exemplified by Heretic (Weidmann, 2025), treats safety-aligned refusal as a representation-engineering target (Zou et al., 2023a; Arditi et al., 2024): estimate the residual direction that separates harmful and harmless prompts, then search for weight edits that suppress that direction while preserving the model’s general capabilities. Unlike prompt-level jailbreaks (Zou et al., 2023b; Ren et al., 2025), this white-box attack requires no crafted suffix: the attacker reads the model’s internal computation, edits projection matrices in place, and keeps the best edit found within a strict behavior-preservation budget. This targeted editing method is a low-cost, broadly applicable threat to open-weight releases. Full-parameter or LoRA-based (Hu et al., 2022) fine-tuning attacks against safety alignment require substantially more compute and often degrade general capabilities if not carefully controlled. By contrast, a Heretic-style edit search executes in minutes on a single GPU and yields an edited checkpoint that suppresses refusal while retaining normal behavior on benign prompts. Once redistributed, such checkpoints are difficult for the original defender to recall or patch. The practical defense point therefore shifts to the released weights themselves: protection must be embedded directly in the checkpoint before distribution. This attack also exposes a gap in existing safety mechanisms. Safety fine-tuning, preference optimization, runtime filters, and activation-level defenses (Ouyang et al., 2022; Rafailov et al., 2023; Zou et al., 2024) constrain the model’s output behavior, but leave the internal refusal representations unprotected against measurement and editing. A white-box edit attack succeeds only when two conditions are met: the attacker must be able to observe an internal signal correlated with refusal, and editing against that signal must predictably alter the output behavior. Decoupling these two components is therefore a natural defense target: actively poison the internal signal to blind the attacker’s measurement, while preserving the clean downstream computation and outputs. We formalize this idea as observation–behavior path decoupling and implement it via Bait-and-Recover. Let ℓ denote a selected bait layer, and index residual streams so that layer ℓ writes to rℓ+1r_ +1. Our defense places a bait adapter inside layer ℓ , making the poisoned signal visible at the attacker’s readout rℓ+1r_ +1, and a paired recovery adapter inside the following layer ℓ+1 +1, repairing the downstream residual rℓ+2r_ +2. The intended state is deliberately asymmetric: the attacker’s search uses a corrupted readout, while generation continues from a near-clean downstream residual. Contributions. By invalidating the core measurement assumption of representation engineering attacks, our work offers a weight-level complement to behavior-level safety training. Concretely: 1. We formulate observation–behavior path decoupling as an explicit defense objective for white-box jailbreaks, shifting the focus from constraining outputs to poisoning the attacker’s internal measurement step. 2. We propose a cross-layer bait/recovery design with a gradient-routing rule that successfully decouples the two paths during training, preventing recovery pressure from erasing the bait. 3. Across four open-weight models, the defense raises the mean minimum refusal rate against Heretic searches spanning both global and per-layer direction scopes under a strict behavior-preservation budget (KL≤0.10KL≤ 0.10) from 16.25% to 71.75%, with negligible impact on general capability benchmarks. 2 Related Work Representation-engineering jailbreaks. Heretic (Weidmann, 2025) is the direct attack we evaluate against. Although released as an open-source tool rather than a peer-reviewed paper, it is a representative practical implementation of automatic abliteration: the public repository reports broad uptake,11 1 The Heretic repository listed over 21k stars and 2.2k forks, and its README reported over 3000 community-created Heretic models, when accessed on May 23, 2026: https://github.com/p-e-w/heretic. and its technical design builds on the observation that refusal behavior can often be captured by a low-dimensional direction in residual space (Arditi et al., 2024). Heretic packages this line of work into an automated attack by combining directional ablation with parameter search, drawing on prior abliteration systems and refinements (Labonne, 2024c; Lai, 2025b; Lai, 2025a). More broadly, representation engineering studies how steering vectors and internal activations can monitor or control model behavior (Zou et al., 2023a). Recent empirical work characterizes how abliteration erodes diverse safety-pretraining components across open-weight checkpoints (Agnihotri et al., 2025), motivating defenses that specifically resist this attack family. We share the white-box access assumption of this line of work but invert its defensive target: rather than improving post-edit behavior, we attack the reliability of the attacker’s representation estimate itself. Activation-space defenses. Circuit-breaker-style defenses modify internal activations to improve alignment and robustness against adversarial inputs (Zou et al., 2024). Representation Noising (Rosati et al., 2024) is closer to our setting in that it also intervenes on internal representations under an open-weight threat model, but its objective is to remove or destabilize the harmful-representation information itself, so that harmful behavior cannot be recovered through subsequent fine-tuning. Bait-and-Recover targets a different stage of the attack: we assume a fine-tuning-free white-box edit search that estimates a refusal direction from model activations and then edits projection matrices in place. Rather than removing the underlying refusal or harmful representations, we leave them intact and inject a localized poison signal at the attacker’s observation layer, paired with a recovery adapter at the next layer that restores the downstream computation. This asymmetry preserves the model’s normal safety behavior while making the attacker’s inferred edit direction unreliable. These defenses therefore cover different parts of the safety problem: behavior under adversarial inputs, resistance to harmful fine-tuning, and the reliability of the attacker’s internal measurement. Model editing and LoRA defenses. ROME, MEMIT, and related editing methods show that localized weight changes can rewrite model behavior (Meng et al., 2022; Meng et al., 2023), and recent analyses show that pruning and low-rank modifications can directly compromise safety alignment (Wei et al., 2024). Safety-aware fine-tuning and robust safeguards investigate how to preserve or strengthen safety behavior under subsequent modification (Hsu et al., 2024; Tamirisa et al., 2025). Our work is complementary: it targets the estimator that a white-box edit attack relies on, not only the post-edit behavior. Figure 1: Overview of the alternating-pass Bait-and-Recover pipeline. A clean-model layer-prior analysis determines the bait band before training; Training Pass A covers one layer parity, Training Pass B starts from the merged Pass A checkpoint and covers the complementary parity, and the final checkpoint is evaluated against the same white-box Heretic search used for the baseline. The layer-joint box denotes local tuning inside a pass over neighboring trained pairs, not a joint optimization between Pass A and Pass B. 3 Background and Problem Formulation Heretic-style attack. Given harmful prompts harmfulP_harmful and harmless prompts harmlessP_harmless, the attacker reads residual stream ℓ+1 +1 and estimates the refusal direction by the difference of means, ^ℓ+1=x∼harmful[rℓ+1(x)]−x∼harmless[rℓ+1(x)]. split r_ +1=&E_x _harmful[r_ +1(x)]\\ &-E_x _harmless[r_ +1(x)]. split (1) Heretic (Weidmann, 2025) then performs an Optuna (Akiba et al., 2019) search over target layers, direction scope (global or per-layer), edited modules, sign, and edit scale, optimizing for the lowest harmful-prompt refusal count under a KL budget. We evaluate the default configuration: 200 trials, with o_proj and down_proj as the primary editable modules, and report the minimum refusal count among trials inside each budget. Problem formulation. We assume a white-box attacker with the released checkpoint, full access to intermediate activations, and enough compute to execute Heretic with its default mean-direction estimator under both global and per-layer scopes. The defense is embedded in the released weights and evaluated as a single merged checkpoint. Let ℳM be the clean model, ℳ~ M the defended model, and r^(⋅) r(·) the attacker’s estimator (Eq. 1). The post-edit attack success rate ASRASR is the fraction of harmful prompts for which the edited model does not refuse, equivalently ASR=1−refusal rateASR=1-refusal rate. The defender minimizes ASRASR subject to a general-prompt KL budget: minθbait,θrec _ _bait, _rec ASR(Edit(ℳ~,r^(ℳ~))) \! (Edit( M,\, r( M)) ) (2) s.t. KL(ℳ~∥ℳ)≤εKL. ( M\|M)≤ _KL. 4 Method Bait-and-Recover has four stages: (i) build a layer prior from harmful and harmless prompts on the clean model; (i) train two complementary parities of bait/recovery pairs across the selected band; (i) within each pass, perform a short local layer-joint step over neighboring trained pairs to absorb cross-layer coupling; and (iv) evaluate the merged checkpoint with the same Heretic search used for the baseline. Figure 1 summarizes this full pipeline. 4.1 Layer-band Selection We select the defended layer band using clean-model statistics. Let L be the number of transformer layers and let ℓ denote a bait layer. Because layer ℓ writes into rℓ+1r_ +1 and the paired recovery layer ℓ+1 +1 writes into rℓ+2r_ +2, the last admissible bait layer is ℓ≤L−2 ≤ L-2. We first define the default clean-model prior window prior=[⌊0.4(L−1)⌋,L−2],W_prior=[ 0.4(L-1) ,\,L-2], (3) which targets middle-to-deep layers while stopping at L−2L-2, so every bait layer still has a following recovery layer. The layer prior uses the separability between harmful and harmless prompts in the clean-model residual stream. For a candidate bait layer ℓ and class c∈harmful,harmlessc∈\harmful,harmless\, let Rc,ℓ+1=rℓ+1(x):x∈cR_c, +1=\r_ +1(x):x _c\ be the final-token residuals used by the Heretic direction estimator. We estimate μc,ℓ+1 _c, +1 =1|Rc,ℓ+1|∑r∈Rc,ℓ+1r, = 1|R_c, +1| _r∈ R_c, +1r, (4) Σc,ℓ+1 _c, +1 =Cov(Rc,ℓ+1), =Cov(R_c, +1), and score the harmful/harmless separability at that residual by a trace-form Fisher ratio,22 2 We use a trace-form simplification rather than the full Fisher discriminant tr(ΣW−1ΣB)tr( _W^-1 _B) to avoid ill-conditioned covariance inversion at high dimensions. Fℓ+1=‖μharmful,ℓ+1−μharmless,ℓ+1‖22tr(Σharmful,ℓ+1)+tr(Σharmless,ℓ+1)+ϵ,F_ +1= \| _harmful, +1- _harmless, +1\|_2^2tr( _harmful, +1)+tr( _harmless, +1)+ε, (5) where larger Fℓ+1F_ +1 means the clean refusal signal is easier for Heretic to measure. Let NpairN_pair denote the number of available bait/recovery pairs. Since each pair covers one bait layer, if the prior window contains at most NpairN_pair layers, we use the whole window. If it is larger, we choose the contiguous sub-band with the highest cumulative Fisher score: S⋆=argmaxS=[a,a+Npair−1]⊆prior∑ℓ∈SFℓ+1.S = _S=[a,a+N_pair-1] _prior _ ∈ SF_ +1. (6) 4.2 Cross-layer Defense Unit Each defense unit spans two adjacent transformer layers. To intercept the attacker’s search space, we place a bait adapter on the down_proj module in layer ℓ . The paired recovery uses adapters on the o_proj and down_proj modules in layer ℓ+1 +1, repairing the computation before it reaches the generation head. A gradient-routing rule decouples the updates within each unit: recovery gradients do not update bait parameters, and visibility gradients do not update recovery parameters. 4.3 Bait Adapter The bait adapter is a low-rank (Hu et al., 2022) residual perturbation attached to down_proj: δℓ(h) _ (h) =exp(γℓ)BℓAℓh, = ( _ )B_ A_ h, (7) Aℓ A_ ∈ℝr×din,Bℓ∈ℝdmodel×r. ^r× d_in, B_ ^d_model× r. Here h is the input to layer ℓ ’s down_proj, and γℓ _ is a trainable gate initialized small and later calibrated to the target bait visibility. The initialization reuses the clean-model means from Section 4.1. For a bait layer ℓ , the residual-space refusal direction is d^ℓ+1=μharmful,ℓ+1−μharmless,ℓ+1‖μharmful,ℓ+1−μharmless,ℓ+1‖2. d_ +1= _harmful, +1- _harmless, +1\| _harmful, +1- _harmless, +1\|_2. (8) We also compute an input detector direction at the down_proj input. Let h¯c,ℓ h_c, be the class mean of the final-token down_proj inputs hℓ(x)h_ (x) for x∈cx _c; then q^ℓ=h¯harmful,ℓ−h¯harmless,ℓ‖h¯harmful,ℓ−h¯harmless,ℓ‖2. q_ = h_harmful, - h_harmless, \| h_harmful, - h_harmless, \|_2. (9) Finally, we decompose the down-projection weights, Wℓdown=Uℓdiag(σℓ)Vℓ⊤.W^down_ =U_ diag( _ )V_ . (10) The right singular vectors VℓV_ provide additional input-side detector directions, while the left singular vectors UℓU_ provide residual-space output directions. The first bait channel is the refusal-cancel channel. Its detector reads the input-side refusal direction q^ℓ q_ , and its output writes against the residual-stream refusal direction d^ℓ+1 d_ +1: Aℓ[0,:]=q^ℓ⊤,Bℓ[:,0]=−d^ℓ+1.A_ [0,:]= q_ , B_ [:,0]=- d_ +1. (11) A second tag channel carries a side signal for the recovery layer while avoiding the clean refusal axis. Let vℓ,jv_ ,j be the j-th right singular vector in VℓV_ . We choose the vector whose projection away from q^ℓ q_ has the largest norm, j⋆=argmaxj‖(I−q^ℓq^ℓ⊤)vℓ,j‖2.j = _j \|(I- q_ q_ )v_ ,j \|_2. (12) The tag output t^ℓ+1 t_ +1 is initialized to a reproducible pseudo-random unit vector in the orthogonal complement of d^ℓ+1 d_ +1. We construct the tag’s detector v~ℓ v_ by orthogonalizing and normalizing the selected singular vector: v~ℓ=(I−q^ℓq^ℓ⊤)vℓ,j⋆‖(I−q^ℓq^ℓ⊤)vℓ,j⋆‖2, v_ = (I- q_ q_ )v_ ,j \|(I- q_ q_ )v_ ,j \|_2, (13) and initialize the channel as Aℓ[1,:]=v~ℓ⊤A_ [1,:]= v_ and Bℓ[:,1]=t^ℓ+1B_ [:,1]= t_ +1. Thus the tag detector is separated from q^ℓ q_ , and the tag output is orthogonal to d^ℓ+1 d_ +1. If the adapter rank exceeds two, each additional channel is initialized from the leading unused SVD directions: its detector uses a right singular vector from VℓV_ , and its output uses the corresponding left singular vector from UℓU_ , ordered by σℓ _ . To ensure training stability, we keep AℓA_ fixed and update only BℓB_ and γℓ _ during training. This keeps the bait’s input-side detectors anchored to the clean refusal boundary, while its residual-space outputs adapt. 4.4 Recovery Adapter After the bait has changed rℓ+1r_ +1, the next layer can propagate this perturbation through both residual-writing paths: the attention output projection and the MLP down-projection. For each bait at layer ℓ , we therefore attach recovery adapters to o_proj and down_proj of layer ℓ+1 +1. For a recovery site m∈o_proj,down_projm∈\ o\_proj, down\_proj\ with input zmz_m, the adapter is ρℓ,m(zm)=Oℓ,mDℓ,mzm. _ ,m(z_m)=O_ ,mD_ ,mz_m. (14) Here Dℓ,m∈ℝr×din,mD_ ,m ^r× d_in,m detects recovery-layer features, and Oℓ,m∈ℝdmodel×rO_ ,m ^d_model× r writes a corrective update into the residual stream. For initialization, we compute the SVD of the recovery-site base projection, Wℓ+1,m=Uℓ,mrecdiag(σℓ,mrec)(Vℓ,mrec)⊤.W_ +1,m=U^rec_ ,mdiag(σ^rec_ ,m)(V^rec_ ,m) . (15) Let vℓ,m,irecv^rec_ ,m,i be the i-th right singular vector, ordered by decreasing σℓ,mrecσ^rec_ ,m. The detector reads these high-energy input directions, while the output is initialized to the anti-bait output basis: Dℓ,m[i,:] D_ ,m[i,:] =(vℓ,m,irec)⊤, =(v^rec_ ,m,i) , (16) Oℓ,m[:,i] O_ ,m[:,i] =−Bℓ[:,i],i=0,…,r−1. =-B_ [:,i], i=0,…,r-1. (17) Training then refines these anti-bait directions to account for the intermediate layer transformations. 4.5 Training Objective and Schedule Training combines two main objectives with a lightweight visibility floor: ℒ=λfisherℒfisher+λrecℒrec+λvisℒvis.L= _fisherL_fisher+ _recL_rec+ _visL_vis. (18) ℒfisherL_fisher is the trace-form Fisher ratio from Section 4.1, recomputed on defended bait residuals: ℒfisher=1|S|∑ℓ∈SFℓ+1def.L_fisher= 1|S| _ ∈ SF^def_ +1. (19) This attack-facing term directly lowers the harmful/harmless separability visible to the attacker’s direction estimator. ℒrecL_rec aligns the clean and defended residual states after each paired recovery layer, ℒrec=1|S|∑ℓ∈Sx[‖rℓ+2def(x)−rℓ+2clean(x)‖22‖rℓ+2clean(x)‖22+ϵ].L_rec= 1|S| _ ∈ SE_x [ \|r^def_ +2(x)-r^clean_ +2(x)\|_2^2\|r^clean_ +2(x)\|_2^2+ε ]. (20) Finally, ℒvisL_vis is an auxiliary hinge that keeps the bait measurable at the attacker-visible residual: ℒvis=1|S|∑ℓ∈Sx[τvis−‖Δrℓ+1(x)‖2‖rℓ+1clean(x)‖2+ϵ]+2,L_vis= 1|S| _ ∈ SE_x [ _vis- \| r_ +1(x)\|_2\|r^clean_ +1(x)\|_2+ε ]_+^2, (21) where Δrℓ+1(x)=rℓ+1def(x)−rℓ+1clean(x) r_ +1(x)=r^def_ +1(x)-r^clean_ +1(x) and [u]+=max(u,0)[u]_+= (u,0). Gradients are routed by role: recovery alignment updates only recovery adapters, while Fisher-readout and visibility losses update only bait adapters. For multi-layer coverage, the selected band is split into two alternating parities trained in Pass A and Pass B. KL is monitored on general prompts during training, with a final KL budget. 5 Experimental Setup Data. Bait-and-Recover uses defense-training data that is separate from Heretic’s attack and evaluation data. For the defense side, harmless prompts and unlabeled general prompts come from Alpaca-GPT4 instruction prompts (Peng et al., 2023), while harmful prompts come from SafeMTData Attack_600 (Ren et al., 2025). We extract the harmful prompt field and retain direct harmful requests using a deterministic filter over procedural markers (e.g., how-to, steps, build) and explicit abuse terms (e.g., malware, phishing, weapon, attack). Because this filtered harmful pool is smaller than the broad instruction corpus used for harmless prompts, the labeled defense split uses 128 harmless and 64 harmful prompts for refusal direction estimation and the Fisher-readout loss. We also reserve 256 unlabeled general prompts for residual recovery, the label-free visibility floor, and KL monitoring, plus a non-overlapping validation split of 64 harmless and 32 harmful prompts. For attack evaluation, we leave Heretic’s prompt sources unchanged: mlabonne/harmless_alpaca and mlabonne/harmful_behaviors (Labonne, 2024b; Labonne, 2024a). Heretic uses the first 400 training examples from each source to estimate the attack direction, and evaluates each attack trial on 100 held-out harmless prompts and 100 held-out harmful prompts for attack KL and harmful-refusal measurement. All Heretic searches use 200 trials. Figure 2: Layer-wise Fisher retention during Qwen3-4B-Instruct training. Retention is after-pass Fisher divided by the before-pass reference (clean model for Pass A; Pass A model for Pass B). The shaded band is a visual reference around unchanged retention. Table 1: Evaluated models and defense configurations. The bait band is chosen by the clean-model layer-prior rule; Pass A/B list the alternating bait-layer ranges used by the two-stage schedule, and r is the realized LoRA rank range after applying the rank-selection rule. Model L Band Pass A Pass B r Qwen3-4B-Instruct 36 14–34 odd 15–33 even 14–34 4–16 Qwen3-8B 36 14–34 odd 15–33 even 14–34 7–16 Gemma-3-1B-IT 26 10–24 odd 11–23 even 10–24 4 Gemma-3-12B-IT 48 18–38 odd 19–37 even 18–38 4–16 Models and configuration. We evaluate four open-weight instruction models from the Qwen3 and Gemma 3 families (Yang et al., 2025; Gemma Team, 2025). Table 1 reports the layer count, defended bait band, alternating pass split, and LoRA rank range for each model. Layer bands follow the rule in Section 4.1. We fix the pair budget at Npair=21N_pair=21 across all models: this value is inherited from our initial Qwen3-4B-Instruct experiment, where the default prior window [⌊0.4(L−1)⌋,L−2][ 0.4(L-1) ,L-2] at L=36L=36 contains exactly 21 admissible bait layers and was used in full. We then reuse this same 21-pair budget for all subsequent models so that defense capacity stays comparable rather than scaling with model depth. Under this fixed budget, both Qwen models use their default 21-layer window in full; Gemma-3-1B-IT has only 15 admissible bait layers in its default window, so we use all of them; and for Gemma-3-12B-IT the default window [18,46][18,46] is larger than NpairN_pair, so the Fisher-based contiguous-band selection in Section 4.1 picks the highest-scoring 21-layer sub-band, [18,38][18,38] (Appendix A). LoRA ranks are selected per layer by first choosing the smallest rank whose clean-model cumulative squared singular-value energy reaches 40%, then clipping to the allowed range and enforcing the minimum rank required by the refusal-cancel and tag-channel basis. The recovery adapter uses the same rank as its paired bait adapter. Table 1 reports the realized ranks; the Gemma-3-1B layers all happen to hit the minimum rank, so its realized range collapses to the single value 4. Training hyperparameters. We use an identical hyperparameter configuration across all evaluated models. All experiments use a shared optimizer recipe: AdamW (Loshchilov and Hutter, 2019) with weight decay 0, gradient clipping at 1.0, and learning rate 2×10−42×10^-4. We fix λrec=0.5 _rec=0.5, λvis=4 _vis=4, λfisher=2 _fisher=2, τvis=0.20 _vis=0.20. In each pass, every bait/recovery pair is first trained in isolation for two epochs; after these single-pair stages, neighboring two-pair blocks receive one epoch of intra-pass layer-joint tuning. Detailed reproducibility configurations are provided in Appendix D. Evaluation metrics. The main attack metric is the minimum refusal rate (out of 100 harmful prompts) found by a 200-trial Heretic search at each reported evaluation KL threshold; higher values mean stronger defense. We also track held-out general-prompt KL after each defense pass as a behavior-preservation diagnostic. To measure changes on general capability benchmarks, we run paired EvalScope evaluations (ModelScope Community, 2024) with the same vLLM backend (Kwon et al., 2023), chat template, output cap, and postprocessing for each clean/defended pair, reporting MMLU-Redux accuracy (Gema et al., 2025; Hendrycks et al., 2021) and IFEval prompt-level strict accuracy (Zhou et al., 2023; Biderman et al., 2024). 6 Results Table 2: Behavior-preservation diagnostics and general capability retention after defense. KL is measured on held-out general prompts after Pass A and Pass B; Pass B is the final defended checkpoint. MMLU reports MMLU-Redux accuracy, IFEval reports prompt-level strict accuracy, and Δ is defended minus baseline. General-prompt KL MMLU-Redux IFEval Model Pass A Pass B Base Def. Δ Base Def. Δ Qwen3-4B-Instruct 0.016 0.020 0.7549 0.7538 -0.0011 0.8244 0.8373 +0.0129 Qwen3-8B 0.007 0.010 0.7782 0.7761 -0.0021 0.8373 0.8373 +0.0000 Gemma-3-1B-IT 0.066 0.079 0.4180 0.4193 +0.0013 0.5730 0.5342 -0.0388 Gemma-3-12B-IT 0.049 0.085 0.7528 0.7506 -0.0022 0.8059 0.8096 +0.0037 Mean 0.035 0.049 0.6760 0.6750 -0.0010 0.7602 0.7546 -0.0055 Table 3: Main Heretic attack result across four KL budgets. Each cell reports the minimum refusal rate (%, out of 100 harmful prompts; higher is better); bold marks the KL≤0.10KL≤ 0.10 primary evaluation budget. KL≤0.05KL≤ 0.05 KL≤0.10KL≤ 0.10 KL≤0.20KL≤ 0.20 KL≤1.0KL≤ 1.0 Model Base Def. Δ Base Def. Δ Base Def. Δ Base Def. Δ Qwen3-4B-Instruct 97 78 −19-19 46 78 +32+32 24 65 +41+41 5 60 +55+55 Qwen3-8B 36 67 +31+31 11 60 +49+49 11 50 +39+39 8 33 +25+25 Gemma-3-1B-IT 17 84 +67+67 5 67 +62+62 3 64 +61+61 2 64 +62+62 Gemma-3-12B-IT 12 82 +70+70 3 82 +79+79 2 82 +80+80 0 59 +59+59 Mean 40.50 77.75 +37.25+37.25 16.25 71.75 +55.50+55.50 10.00 65.25 +55.25+55.25 3.75 54.00 +50.25+50.25 6.1 Fisher Suppression and Behavior Preservation Figure 2 validates the training task directly. Across both passes, the residuals exposed to the attacker show lower Fisher separability after bait training, while the following recovery residuals stay close to the previous reference model. This is the intended asymmetry of the defense: the observation path becomes less useful for estimating a refusal direction, but the behavior path is pulled back toward the clean computation. Appendix C reports the corresponding raw Fisher values. Alongside this Fisher diagnostic, we monitor validation KL on general prompts to check that the defense has not moved normal behavior too far. All four configurations completed under the shared training schedule. The Pass B general-prompt KL remains below 0.20 for every model, though the amount of movement differs by architecture (Table 2). Qwen3-8B is the most conservative case, while Gemma-3-12B has the largest general-prompt movement among the four models. 6.2 General Capability Retention Because KL alone does not establish general capability preservation, we also run paired benchmark evaluations for each clean/defended checkpoint. Table 2 reports both the validation KL diagnostics and the paired capability evaluation. MMLU-Redux accuracy is largely unchanged across the four checkpoints: the defended-minus-baseline deltas range from −0.0022-0.0022 to +0.0013+0.0013, with a mean change of −0.0010-0.0010. IFEval prompt-strict accuracy is also stable in aggregate, with a mean change of −0.0055-0.0055. Thus the paired benchmarks support broad capability retention. 6.3 Heretic Attack Evaluation Heretic is the central white-box attack evaluation because it directly tests the failure mode targeted by Bait-and-Recover: the attacker estimates an internal refusal direction, searches projection edits, and keeps the best edit whose behavior KL remains within a budget. We therefore report the minimum refusal rate over the pooled global and per-layer direction scopes at each KL threshold; higher rates mean fewer successful harmful responses and stronger defense. We use KL≤0.10KL≤ 0.10 as the primary evaluation budget because it matches the behavior-preservation scale of the defended checkpoints themselves: after Pass B, the held-out general-prompt KL values in Table 2 are all below 0.10, and the paired MMLU-Redux/IFEval evaluations show little aggregate capability movement. Thus, if Heretic can substantially reduce refusals while staying within the same KL scale, the edited checkpoint is not just degraded; it is a behavior-preserving jailbreak. At this primary evaluation budget, Bait-and-Recover raises the mean minimum refusal rate from 16.25% to 71.75% (+55.50+55.50; 4.4×), with gains on all four models (Table 3; see Appendix B for full results across all KL budgets). The defense remains effective at the looser KL≤0.20KL≤ 0.20 budget, where the mean defended minimum refusals is 65.25, only 6.5 refusals below the KL≤0.10KL≤ 0.10 value and still +55.25+55.25 above the baseline mean of 10.00. Robustness extends to the very loose KL≤1.0KL≤ 1.0 budget as well: the mean defended score remains at 54.00 (+50.25+50.25 over baseline; Table 3, KL≤1.0KL≤ 1.0 column), with Gemma-3-12B-IT keeping its per-layer defended score at 82 across all KL budgets, while its global defended score falls from 83 to 59 only at KL≤1.0KL≤ 1.0. This is consistent with the broader trend at the primary KL≤0.10KL≤ 0.10 budget, where global search is the most effective attack scope against every defended model. Global vs. per-layer scope. The scope decomposition shows where the defended models remain most vulnerable. Before defense, the most effective attack scope differs by model: global search sets the pooled minimum for Qwen3-4B-Instruct, Qwen3-8B, and Gemma-3-1B-IT, while per-layer search is the most effective attack on Gemma-3-12B-IT. After defense, global search remains the most effective attack scope against the three smaller models, while for Gemma-3-12B-IT the global and per-layer defended scores are nearly tied at KL≤0.10KL≤ 0.10 (83 vs. 82). Across models (Table 4), defended global scores are 78/60/67/83 and per-layer scores are 81/88/82/82. The mean across models reflects this trend, with a 72.00% refusal rate under global search compared to 83.25% under per-layer search at KL≤0.10KL≤ 0.10. Thus the defense substantially raises the attacker’s best available refusal floor, but the remaining attack surface is concentrated in global direction estimates rather than individual layer directions, which is the main remaining weakness of the defense. Table 4: Heretic minimum refusals at the KL≤0.10KL≤ 0.10 primary evaluation budget, split by attacker direction scope. Each entry reports base/defended/Δ . Model Global Per-layer Qwen3-4B-Instruct 46/78/+32+32 94/81/−13-13 Qwen3-8B 11/60/+49+49 99/88/−11-11 Gemma-3-1B-IT 5/67/+62+62 22/82/+60+60 Gemma-3-12B-IT 26/83/+57+57 3/82/+79+79 Mean 22.00/72.00/+50.00+50.00 54.50/83.25/+28.75+28.75 7 Conclusion We introduced Bait-and-Recover, a weight-level defense that protects open-weight models against white-box editing jailbreaks by invalidating their core measurement assumption. Rather than only hardening the output behavior, Bait-and-Recover places a bait adapter at the attacker’s observation layer and a paired recovery adapter at the next layer. Trained under a gradient-routing rule, this mechanism decouples the observation path from the behavior path: it actively poisons the residual signal used to estimate the refusal direction, making the attacker’s edit search unreliable, while the recovery layer restores the clean downstream computation. Across four open-weight models from the Qwen3 and Gemma-3 families, the defense raises the mean minimum refusal rate against Heretic searches from 16.25% to 71.75% at a strict KL≤0.10KL≤ 0.10 budget, with negligible impact on general capability benchmarks. Because the defense ships as a single merged checkpoint loadable with standard causal-LM inference, observation-path poisoning is a practical weight-level complement to behavior-level safety training. The remaining attack surface concentrates in global direction estimates. Future work includes more adaptive estimators and broader capability evaluation. Limitations Adaptive estimators. We evaluate against Heretic’s default difference-of-means estimator. While the bait is designed to distort this estimator’s observed refusal direction, we do not evaluate robust or multivariate alternatives such as geometric medians, PCA, or LDA. Estimator-agnostic robustness therefore remains an open question. High-KL budgets. Our defense targets the strict behavior-preservation setting (KL≤0.10KL≤ 0.10). At looser budgets (e.g., KL≥0.20KL≥ 0.20), greater permitted deviation allows attackers to discover bypass edits. Our conclusions should therefore be interpreted as applying to low-distortion edit searches rather than arbitrary model changes. Behavior-level fine-tuning. Supervised fine-tuning (SFT) can still overwrite safety behaviors, as a small number of adversarial examples suffices to undo alignment (Qi et al., 2024). We do not claim protection against attackers willing to collect harmful training data and run additional fine-tuning. Comparison with prior weight-level defenses. We do not run direct comparisons with prior weight-level or representation-level safety defenses such as Circuit Breakers (Zou et al., 2024), Representation Noising (Rosati et al., 2024), or Tamper-Resistant Safeguards (Tamirisa et al., 2025). These defenses are evaluated under behavior-level attacks, harmful fine-tuning, or safeguard tampering, whereas our experiments isolate Heretic-style edit searches. We therefore leave cross-defense evaluations and combination studies to future work. Ethics Statement This work studies a dual-use white-box jailbreak setting to improve defenses. To mitigate risks, we report only aggregate statistics, omit harmful generations, and explicitly avoid releasing jailbroken checkpoints. Because our defense modifies model weights, practical deployment should be paired with capability evaluations to verify that benign utility is preserved. References Agnihotri et al. (2025) Shashank Agnihotri, Jonas Jakubassa, Priyam Dey, Sachin Goyal, Bernt Schiele, Venkatesh Babu Radhakrishnan, and Margret Keuper. 2025. A granular study of safety pretraining under model abliteration. arXiv preprint arXiv:2510.02768. Accepted at NeurIPS 2025 Workshop on Lock-LLM. Akiba et al. (2019) Takuya Akiba, Shotaro Sano, Toshihiko Yanase, Takeru Ohta, and Masanori Koyama. 2019. Optuna: A next-generation hyperparameter optimization framework. In Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pages 2623–2631. ACM. Arditi et al. (2024) Andy Arditi, Oscar Balcells Obeso, Aaquib Syed, Daniel Paleka, Nina Panickssery, Wes Gurnee, and Neel Nanda. 2024. Refusal in language models is mediated by a single direction. In Advances in Neural Information Processing Systems, volume 37. Biderman et al. (2024) Stella Biderman, Hailey Schoelkopf, Lintang Sutawika, Leo Gao, Jonathan Tow, Baber Abbasi, Alham Fikri Aji, Pawan Sasanka Ammanamanchi, Sidney Black, Jordan Clive, Anthony DiPofi, Julen Etxaniz, Benjamin Fattori, Jessica Zosa Forde, Charles Foster, Jeffrey Hsu, Mimansa Jaiswal, Wilson Y. Lee, Haonan Li, and 11 others. 2024. Lessons from the trenches on reproducible evaluation of language models. arXiv preprint arXiv:2405.14782. Gema et al. (2025) Aryo Pradipta Gema, Joshua Ong Jun Leang, Giwon Hong, Alessio Devoto, Alberto Carlo Maria Mancino, Rohit Saxena, Xuanli He, Yu Zhao, Xiaotang Du, Mohammad Reza Ghasemi Madani, Claire Barale, Robert McHardy, Joshua Harris, Jean Kaddour, Emile Van Krieken, and Pasquale Minervini. 2025. Are we done with MMLU? In Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pages 5069–5096, Albuquerque, New Mexico. Association for Computational Linguistics. Gemma Team (2025) Gemma Team. 2025. Gemma 3 technical report. arXiv preprint arXiv:2503.19786. Hendrycks et al. (2021) Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. 2021. Measuring massive multitask language understanding. In International Conference on Learning Representations. Hsu et al. (2024) Chia-Yi Hsu, Yu-Lin Tsai, Chih-Hsun Lin, Pin-Yu Chen, Chia-Mu Yu, and Chun-Ying Huang. 2024. Safe LoRA: The silver lining of reducing safety risks when finetuning large language models. In Advances in Neural Information Processing Systems, volume 37. Hu et al. (2022) Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. 2022. LoRA: Low-rank adaptation of large language models. In International Conference on Learning Representations. Kwon et al. (2023) Woosuk Kwon, Zhuohan Li, Siyuan Zhuang, Ying Sheng, Lianmin Zheng, Cody Hao Yu, Joseph E. Gonzalez, Hao Zhang, and Ion Stoica. 2023. Efficient memory management for large language model serving with PagedAttention. In Proceedings of the 29th Symposium on Operating Systems Principles, pages 611–626. Association for Computing Machinery. Labonne (2024a) Maxime Labonne. 2024a. harmful_behaviors [dataset]. Hugging Face dataset, https://huggingface.co/datasets/mlabonne/harmful_behaviors. Accessed: 2026-05-23. Labonne (2024b) Maxime Labonne. 2024b. harmless_alpaca [dataset]. Hugging Face dataset, https://huggingface.co/datasets/mlabonne/harmless_alpaca. Accessed: 2026-05-23. Labonne (2024c) Maxime Labonne. 2024c. Uncensor any LLM with abliteration [blog post]. Hugging Face blog, https://huggingface.co/blog/mlabonne/abliteration. Accessed: 2026-05-23. Lai (2025a) Jim Lai. 2025a. Norm-preserving biprojected abliteration [blog post]. Hugging Face community article, https://huggingface.co/blog/grimjim/norm-preserving-biprojected-abliteration. Accessed: 2026-05-23. Lai (2025b) Jim Lai. 2025b. Projected abliteration [blog post]. Hugging Face community article, https://huggingface.co/blog/grimjim/projected-abliteration. Accessed: 2026-05-23. Loshchilov and Hutter (2019) Ilya Loshchilov and Frank Hutter. 2019. Decoupled weight decay regularization. In International Conference on Learning Representations. Meng et al. (2022) Kevin Meng, David Bau, Alex Andonian, and Yonatan Belinkov. 2022. Locating and editing factual associations in GPT. In Advances in Neural Information Processing Systems, volume 35. Meng et al. (2023) Kevin Meng, Arnab Sen Sharma, Alex Andonian, Yonatan Belinkov, and David Bau. 2023. Mass-editing memory in a transformer. In International Conference on Learning Representations. ModelScope Community (2024) ModelScope Community. 2024. EvalScope: A streamlined and customizable framework for efficient large model evaluation and benchmarking [software]. GitHub repository, https://github.com/modelscope/evalscope. Accessed: 2026-05-23. Ouyang et al. (2022) Long Ouyang, Jeff Wu, Xu Jiang, Diogo Almeida, Carroll L. Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, John Schulman, Jacob Hilton, Fraser Kelton, Luke Miller, Maddie Simens, Amanda Askell, Peter Welinder, Paul Christiano, Jan Leike, and Ryan Lowe. 2022. Training language models to follow instructions with human feedback. In Advances in Neural Information Processing Systems, volume 35, pages 27730–27744. Paszke et al. (2019) Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, Alban Desmaison, Andreas Kopf, Edward Yang, Zachary DeVito, Martin Raison, Alykhan Tejani, Sasank Chilamkurthy, Benoit Steiner, Lu Fang, and 2 others. 2019. PyTorch: An imperative style, high-performance deep learning library. In Advances in Neural Information Processing Systems, volume 32. Peng et al. (2023) Baolin Peng, Chunyuan Li, Pengcheng He, Michel Galley, and Jianfeng Gao. 2023. Instruction tuning with GPT-4. arXiv preprint arXiv:2304.03277. Qi et al. (2024) Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin-Yu Chen, Ruoxi Jia, Prateek Mittal, and Peter Henderson. 2024. Fine-tuning aligned language models compromises safety, even when users do not intend to! In International Conference on Learning Representations. Rafailov et al. (2023) Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D. Manning, Stefano Ermon, and Chelsea Finn. 2023. Direct preference optimization: Your language model is secretly a reward model. In Advances in Neural Information Processing Systems, volume 36. Ren et al. (2025) Qibing Ren, Hao Li, Dongrui Liu, Zhanxu Xie, Xiaoya Lu, Yu Qiao, Lei Sha, Junchi Yan, Lizhuang Ma, and Jing Shao. 2025. LLMs know their vulnerabilities: Uncover safety gaps through natural distribution shifts. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 24763–24785, Vienna, Austria. Association for Computational Linguistics. Rosati et al. (2024) Domenic Rosati, Jan Wehner, Kai Williams, Łukasz Bartoszcze, David Atanasov, Robie Gonzales, Subhabrata Majumdar, Carsten Maple, Hassan Sajjad, and Frank Rudzicz. 2024. Representation noising: A defence mechanism against harmful finetuning. In Advances in Neural Information Processing Systems, volume 37. Tamirisa et al. (2025) Rishub Tamirisa, Bhrugu Bharathi, Long Phan, Andy Zhou, Alice Gatti, Tarun Suresh, Maxwell Lin, Justin Wang, Rowan Wang, Ron Arel, Andy Zou, Dawn Song, Bo Li, Dan Hendrycks, and Mantas Mazeika. 2025. Tamper-resistant safeguards for open-weight LLMs. In International Conference on Learning Representations. Wei et al. (2024) Boyi Wei, Kaixuan Huang, Yangsibo Huang, Tinghao Xie, Xiangyu Qi, Mengzhou Xia, Prateek Mittal, Mengdi Wang, and Peter Henderson. 2024. Assessing the brittleness of safety alignment via pruning and low-rank modifications. In Proceedings of the 41st International Conference on Machine Learning, volume 235 of Proceedings of Machine Learning Research, pages 52588–52610. PMLR. Weidmann (2025) Philipp Emanuel Weidmann. 2025. Heretic: Fully automatic censorship removal for language models [software]. GitHub repository, https://github.com/p-e-w/heretic. Accessed: 2026-05-23. Wolf et al. (2020) Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Remi Louf, Morgan Funtowicz, Joe Davison, Sam Shleifer, Patrick von Platen, Clara Ma, Yacine Jernite, Julien Plu, Canwen Xu, Teven Le Le Scao, Sylvain Gugger, and 3 others. 2020. Transformers: State-of-the-art natural language processing. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstrations, pages 38–45. Association for Computational Linguistics. Yang et al. (2025) An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, Chujie Zheng, Dayiheng Liu, Fan Zhou, Fei Huang, Feng Hu, Hao Ge, Haoran Wei, Huan Lin, Jialong Tang, and 41 others. 2025. Qwen3 technical report. arXiv preprint arXiv:2505.09388. Zhou et al. (2023) Jeffrey Zhou, Tianjian Lu, Swaroop Mishra, Siddhartha Brahma, Sujoy Basu, Yi Luan, Denny Zhou, and Le Hou. 2023. Instruction-following evaluation for large language models. arXiv preprint arXiv:2311.07911. Zou et al. (2023a) Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, Ann-Kathrin Dombrowski, Shashwat Goel, Nathaniel Li, Michael J. Byun, Zifan Wang, Alex Mallen, Steven Basart, Sanmi Koyejo, Dawn Song, Matt Fredrikson, and 2 others. 2023a. Representation engineering: A top-down approach to AI transparency. arXiv preprint arXiv:2310.01405. Zou et al. (2024) Andy Zou, Long Phan, Justin Wang, Derek Duenas, Maxwell Lin, Maksym Andriushchenko, Rowan Wang, J. Zico Kolter, Matt Fredrikson, and Dan Hendrycks. 2024. Improving alignment and robustness with circuit breakers. In Advances in Neural Information Processing Systems, volume 37. Zou et al. (2023b) Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. 2023b. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043. Figure 3: Clean-model layer-prior evidence for Gemma-3-12B. Given the Npair=21N_pair=21 budget, the selected [18,38][18,38] bait band is the highest-scoring contiguous 21-layer sub-band inside the default [18,46][18,46] clean-model prior window. Appendix A Gemma-3-12B Layer-prior Evidence Figure 3 shows the clean-model Fisher diagnostic used to select the Gemma-3-12B bait band: with the fixed Npair=21N_pair=21 pair budget, the contiguous-band selection rule from §4.1 picks [18,38][18,38] as the highest-scoring 21-layer sub-band inside the default [18,46][18,46] prior window. Table 5: Full overall Heretic results. Models are abbreviated: Q3-4B (Qwen3-4B-Instruct), Q3-8B (Qwen3-8B), G3-1B (Gemma-3-1B-IT), G3-12B (Gemma-3-12B-IT). KL Q3-4B Q3-8B G3-1B G3-12B ≤0.01≤ 0.01 100/100/0 97/95/-2 88/NA/NA 72/82/+10 ≤0.02≤ 0.02 97/97/0 78/84/+6 88/84/-4 37/82/+45 ≤0.03≤ 0.03 97/78/-19 44/78/+34 77/84/+7 37/82/+45 ≤0.05≤ 0.05 97/78/-19 36/67/+31 17/84/+67 12/82/+70 ≤0.075≤ 0.075 97/78/-19 15/60/+45 17/67/+50 8/82/+74 ≤0.10≤ 0.10 46/78/+32 11/60/+49 5/67/+62 3/82/+79 ≤0.15≤ 0.15 24/70/+46 11/52/+41 5/64/+59 3/82/+79 ≤0.20≤ 0.20 24/65/+41 11/50/+39 3/64/+61 2/82/+80 ≤0.30≤ 0.30 6/65/+59 8/37/+29 2/64/+62 1/82/+81 ≤0.50≤ 0.50 5/65/+60 8/33/+25 2/64/+62 1/82/+81 ≤1.00≤ 1.00 5/60/+55 8/33/+25 2/64/+62 0/59/+59 Table 6: Full global-direction Heretic results. KL Q3-4B Q3-8B G3-1B G3-12B ≤0.01≤ 0.01 100/100/0 97/95/-2 88/NA/NA 89/83/-6 ≤0.02≤ 0.02 97/97/0 78/84/+6 88/84/-4 61/83/+22 ≤0.03≤ 0.03 97/78/-19 44/78/+34 77/84/+7 61/83/+22 ≤0.05≤ 0.05 97/78/-19 36/67/+31 17/84/+67 61/83/+22 ≤0.075≤ 0.075 97/78/-19 15/60/+45 17/67/+50 61/83/+22 ≤0.10≤ 0.10 46/78/+32 11/60/+49 5/67/+62 26/83/+57 ≤0.15≤ 0.15 24/78/+54 11/52/+41 5/64/+59 26/83/+57 ≤0.20≤ 0.20 24/78/+54 11/50/+39 3/64/+61 2/83/+81 ≤0.30≤ 0.30 6/78/+72 8/37/+29 2/64/+62 2/83/+81 ≤0.50≤ 0.50 5/78/+73 8/33/+25 2/64/+62 1/83/+82 ≤1.00≤ 1.00 5/78/+73 8/33/+25 2/64/+62 0/59/+59 Table 7: Full per-layer-direction Heretic results. “NA” means no trial landed inside the KL bucket. KL Q3-4B Q3-8B G3-1B G3-12B ≤0.01≤ 0.01 NA/NA/NA NA/99/NA 94/NA/NA 72/82/+10 ≤0.02≤ 0.02 NA/NA/NA NA/99/NA 90/NA/NA 37/82/+45 ≤0.03≤ 0.03 NA/NA/NA 100/99/-1 88/88/0 37/82/+45 ≤0.05≤ 0.05 100/95/-5 100/99/-1 78/86/+8 12/82/+70 ≤0.075≤ 0.075 99/95/-4 100/97/-3 68/82/+14 8/82/+74 ≤0.10≤ 0.10 94/81/-13 99/88/-11 22/82/+60 3/82/+79 ≤0.15≤ 0.15 94/70/-24 95/86/-9 10/82/+72 3/82/+79 ≤0.20≤ 0.20 88/65/-23 93/74/-19 8/80/+72 3/82/+79 ≤0.30≤ 0.30 88/65/-23 90/67/-23 6/80/+74 1/82/+81 ≤0.50≤ 0.50 56/65/+9 85/60/-25 3/77/+74 1/82/+81 ≤1.00≤ 1.00 28/60/+32 78/53/-25 3/73/+70 1/82/+81 Appendix B Detailed Heretic Evaluation Results Tables 5–7 report the full evaluation results used to produce the selected main-text attack table. Each entry reports B/D/Δ , where Δ=D−B = D- B. Table 8: Raw Fisher values for Qwen3-4B-Instruct. “Ref.” denotes the before-pass reference used as the retention denominator. Bait Recovery Pass Layer Ref. Def. Ref. Def. A 15 0.89 0.54 1.06 0.99 A 17 1.05 0.61 1.26 1.16 A 19 1.54 0.98 1.35 1.23 A 21 1.19 0.70 1.19 1.07 A 23 1.23 0.79 1.17 1.04 A 25 1.17 0.79 1.12 0.98 A 27 1.11 0.77 1.05 0.90 A 29 1.04 0.69 1.02 0.88 A 31 1.02 0.71 1.00 0.83 A 33 0.92 0.59 0.89 0.76 B 14 0.65 0.35 0.54 0.51 B 16 0.98 0.57 0.61 0.59 B 18 1.16 0.76 0.98 0.93 B 20 1.22 0.77 0.70 0.67 B 22 1.06 0.72 0.79 0.75 B 24 1.04 0.70 0.79 0.75 B 26 0.98 0.73 0.77 0.72 B 28 0.90 0.63 0.69 0.65 B 30 0.88 0.65 0.71 0.65 B 32 0.83 0.59 0.59 0.55 B 34 0.76 0.46 0.66 0.61 Appendix C Qwen3-4B-Instruct Raw Fisher Values Table 8 reports the raw Fisher separability scores for the validation split visualized in Figure 2. Appendix D Reproducibility Details We implement the framework in PyTorch (Paszke et al., 2019) with the Hugging Face Transformers library (Wolf et al., 2020). Models are loaded from their official Hugging Face or ModelScope weights and trained in bfloat16, with device-mapped model parallelism for the larger checkpoints. After training, the bait and recovery adapters are merged into the base weights, so the defended checkpoint runs as a standard causal LM with no custom inference code. Layer-prior extraction and adapter training both use final-token residual activations from training splits of the ModelScope-Alpaca and SafeMT datasets that are disjoint from the Heretic evaluation prompts. Heretic attacks are run with the Optuna search framework, using 200 trials per attack over projection layers, weight matrices, edit directions, and scales, and reporting the lowest-refusal edit within each KL budget. General-capability evaluation uses EvalScope with a vLLM backend, and we use the same chat template, generation length, and post-processing for the clean and defended checkpoints of each model when computing MMLU-Redux and IFEval.