Paper deep dive
Escaping Alignment: A Physical Trap Model of Best-of-N Jailbreaking
Marco Biroli
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 90%
Last extracted: 9/29/2026, 12:44:41 PM
Summary
This paper introduces a physical trap model to explain Best-of-N (BoN) jailbreaking attacks on Large Language Models. The authors challenge the prevailing view that Attack Success Rate (ASR) follows a simple power law, arguing instead that the observed exponent drifts due to finite-size artifacts. The proposed model treats safety as an entropic bottleneck and jailbreaking as thermally activated dynamics over energetic barriers. It posits that four parameters (baseline safety, safety fluctuations, attack susceptibility, and susceptibility fluctuations) determine the entire two-budget (N, M) attack surface. The model successfully extrapolates predictions, collapses data from five distinct models onto a single scaling function, and predicts ASR across different generation temperatures.
Entities (10)
Relation Signals (8)
Physical Trap Model → explains → Attack Success Rate
confidence 95% · We posit a physically inspired microscopic law, show that it reproduces the entire phenomenology of BoN attacks
Best-of-N Jailbreaking → challenges → Power-law ASR assumption
confidence 92% · Previous works have shown that the attack success rate (ASR) seems to follow a power-law in N, which we challenge.
Baseline Safety → ismodeledas → Gaussian distribution
confidence 90% · We further assume that these bottlenecks are Gaussianly distributed α∼𝒩(μα,σα2) over the dataset.
Augmentation Barrier → ismodeledas → Exponential Distribution
confidence 90% · each augmentation a random thermally activated barrier... ηb,a∼Exp[βb]
Qwen2.5-7B-Instruct → exhibits → High Effective Barrier
confidence 88% · Qwen2.5-7B-Instruct ... μE 4.27±0.08
Residual Stream → grounds → Physical Model
confidence 88% · It is therefore a good candidate to ground our physical model.
Gemma 2 9B IT → uses → Entropic Defense
confidence 85% · Gemma favors an ‘entropic defense’ (the α channel)
Llama-3.1-8B-Instruct → uses → Energetic Defense
confidence 85% · Llama is entirely aligned via an ‘energetic defense’ (the β channel)
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Best-of-$N$ jailbreaking (BoN) bypasses safeguards of aligned models by drawing $N$ independent augmentations of an unsafe prompt and sampling $M$ completions of each. Previous works have shown that the attack success rate (ASR) seems to follow a power-law in $N$, which we challenge. The exponent drifts with $N$, with an exponential crossover which is a finite-size artifact of the adversarial dataset. Little work has been done to explore the entire two-budget ($N, M$) attack surface as well as its dependence on the generation temperature $T$. We introduce a simple barrier model where each prompt has a baseline safety level and each augmentation a random thermally activated barrier. Then four numbers, each backed by an interpretable safety mechanism, determine the entire ($N, M$) attack surface. They extrapolate predictions from $N \leq 100$ to $N = 10^4$, collapse five distinct models on the same scaling function and predict ASR at different temperatures from the one they were fitted at.
Tags
Links
- Source: https://arxiv.org/abs/2609.32116v1
- Canonical: https://arxiv.org/abs/2609.32116v1
Trouble viewing inline? Open PDF directly →
Full Text
66,608 characters extracted from source content.
Expand or collapse full text
Escaping Alignment: A Physical Trap Model of Best-of-N Jailbreaking Marco Biroli Affiliation: Physical Science Division Affiliation: Chicago, IL 60637, USA Email: mbiroli@uchicago.edu Abstract Best-of-N jailbreaking (BoN) bypasses safeguards of aligned models by drawing N independent augmentations of an unsafe prompt and sampling M completions of each. Previous works have shown that the attack success rate (ASR) seems to follow a power-law in N, which we challenge. The exponent drifts with N, with an exponential crossover which is a finite-size artifact of the adversarial dataset. Little work has been done to explore the entire two-budget (N,MN,M) attack surface as well as its dependence on the generation temperature T. We introduce a simple barrier model where each prompt has a baseline safety level and each augmentation a random thermally activated barrier. Then four numbers, each backed by an interpretable safety mechanism, determine the entire (N,MN,M) attack surface. They extrapolate predictions from N≤100N≤ 100 to N=104N=10^4, collapse five distinct models on the same scaling function and predict ASR at different temperatures from the one they were fitted at. Figure 1: The mechanism. Generation starts in the safe basin (blue) and a jailbreak means reaching the unsafe one (orange). The two communicate only through an entropic bottleneck (blue arrow). At the bottleneck lies a safety hyperplane (red), with energetic barriers preventing thermal crossing from the safe to unsafe basin. Augmentations select saddles of this energetic potential. Each completion (dotted) is an independent Arrhenius attempt over that fixed saddle. 1 Introduction Best-of-N (BoN) jailbreaking (Hughes et al., 2024) defeats aligned language models by repeatedly perturbing a refused prompt and sampling completions. Its attack success rate grows as a power law in the number of attempts (Hughes et al., 2024; Feng et al., 2026), sometimes reported as crossing over to exponential growth (Halder et al., 2026). The exponent and the crossover budget are the quantities a defender cares about since they give the best estimate of the resistance of the model to adversarial efforts. These values are usually obtained by fitting curves to a benchmark of adversarial attacks. However, this does not allow us to understand why an exponent takes the value it does and where the failures stem from. Furthermore, it conflates several distinct sources of randomness. This paper takes an alternative route. We posit a physically inspired microscopic law, show that it reproduces the entire phenomenology of BoN attacks, and when fitted to experimental data is predictive for the whole two-budget surface. The physical model is schematically depicted in Fig. 1, and we are able to recover a posteriori several of its elements directly from the residual stream. Large Language Models (LLMs) transform discrete input tokens into a succession of continuous high-dimensional vectors called residuals which are the output of each transformer block. This residual stream has been shown to behave surprisingly linearly (Park et al., 2024). It is therefore a good candidate to ground our physical model. Each sequence of discrete text b is mapped to the residual of its last token rb∈ℝdmodelr_b ^d_ model at a layer 30 of 36 in Qwen2.5-3B-Instruct (App. D). We will now postulate three behaviors in this approximately linear residual space. Firstly, safety is a one-dimensional concept and therefore a single hyperplane will separate safe from unsafe text (Arditi et al., 2024; Wollschläger et al., 2025). Secondly, generation at temperature T can be seen as simple thermally activated dynamics in the residual space. Finally, we can define an energy landscape in this hyperplane which will bound the thermal dynamics. As we will see in Section 3, this predicts that the probability that a prompt b with augmentation a yields an unsafe completion can be written as pb,a=min(1,e−αb−ηb,a/T),p_b,a= (1,\;e^- _b- _b,a/T )\;, (1) where αb _b denotes a Gaussian entropic bottleneck and ηb,a _b,a exponentially distributed energetic saddles depicted in Fig. 1. ASR@(NM)=⟨1−[⟨(1−pb,a)M⟩a∼augmentations]N⟩b∼unsafepromptdataset. ASR@ NM= 1- [ (1-p_b,a)^M _a augmentations ]^N _b unsafe~prompt~dataset\;. (2) For M=1M=1 this reduces to the usual ASR@N≡ASR@(N1) ASR@N≡ ASR@ N1. Eq. (2) can be understood as: at least one of the attacks succeeding is the complement of none of the N augmentations succeeding and the probability of a given augmentation failing is that all M completions fail which happens with probability (1−pb,a)M(1-p_b,a)^M. Surprisingly, in direct contradiction with established literature (Hughes et al., 2024; Feng et al., 2026) our model predicts that the ASR does not follow a clean power-law. Section 2 reviews related work, Section 3 introduces the model and derives its predictions, Section 4 validates them experimentally and Section 5 discusses what they entail. 2 Background and related work Best-of-N jailbreaking. A strength of Best-of-N jailbreaking (Hughes et al., 2024) is its ability to attack black-box models without any information about what is happening underneath the hood. This has also led to most analyses of BoN jailbreaking to be model agnostic and restricted to fitting curves on a benchmark (Feng et al., 2026; Halder et al., 2026) from which two broad phenomenologies emerged. Firstly, the attack success rate seems to follow a power-law in N (Hughes et al., 2024). Secondly, at large enough N the power-law crosses over into an exponential growth (Halder et al., 2026). To our knowledge, after Hughes et al. (2024) ablations showing that multiple generations M did not improve attack efficiency, no work has studied the full (N,M)(N,M) attack surface, nor its temperature dependence. In this paper we put forward a model for the entire (N,M)(N,M) attack surface and its explicit temperature dependence. This allows us to explain why most works seem to favor M⋆=1M =1. Surprisingly, we see that more compute-efficient attacks can be obtained for M⋆>1M >1. Furthermore, contrary to the reported literature we show that the attack success rate does not follow a clean power-law, and that the exponential crossover is only an artifact of the finite size of the datasets used to fit these attacks. Most of our experiments use a white-box augmentation kernel, namely Gaussian noise on the input embeddings (Schwinn et al., 2024; Geisler et al., 2024; Robey et al., 2025; Cohen et al., 2019). However, as shown in App. F, our model holds regardless of the kernel chosen, provided the kernel is applied independently and identically for every augmentation. Therefore iterative attacks such as GCG (Zou et al., 2023a), AutoDAN (Liu et al., 2024), or PAIR (Chao et al., 2025) are not described by our framework. Power laws. The fact that averaging stochastic individual success/failure rates lead to power laws (or slowly-varying power-laws) is well established (Hutter, 2021; Schaeffer et al., 2025; Levi, 2025; Levi, 2026; Kazdan et al., 2025). Closest to us, Feng et al. (2026) assume a Beta-distributed per-prompt rate, whose power-law left tail yields an exact power law in N, and extrapolate ASR@N from a hundred samples to a thousand. A Beta distribution also appears in our model, but at a different level, and the two should not be confused. The Beta of Feng et al. (2026) describes how the single-attempt rate ⟨pb,a⟩a p_b,a _a varies across prompts b. Ours emerges from the microscopic model and describes how pb,ap_b,a varies across augmentations a of one fixed prompt (Eq. (18)). At M=1M=1 this inner distribution enters only through its mean, so it plays no role in ASR@N and only shapes the M channel, where it yields a per-prompt power law in M. The N channel is instead set by the across-prompt law, which in our model is log-normal (EbE_b Gaussian, Eq. (9)) rather than Beta. The left tail of a log-normal decays faster than any power, which replaces the fixed exponent of Feng et al. (2026) by a slowly varying one (Eq. (14)). Glassy systems. The model we put forward is inspired by canonical works in glassy systems. Trap models with exponentially distributed depths are the classical description of activated dynamics in glasses (Bouchaud, 1992; Derrida, 1981). The combination of an entropic and an energetic barrier in Arrhenius escape is inspired by known physical models from reaction-rate theory (Hänggi et al., 1990). Recently, Halder et al. (2026) also put forward a glassy dynamical model to explain BoN jailbreaking. However, their model differs from ours in two aspects. First, they describe a single budget, whereas we resolve the two-budget (N,M)(N,M) surface and find that the two channels carry different exponents. Second, their model is based on interpreting generated tokens as individual degrees of freedom with an energy landscape defined in token space. 3 The microscopic model Inspired by a physical mental model we postulate the following microscopic Ansatz pb,a=min(1,e−αb−ηb,a/T) where ηb,a∼Exp[βb] and αb∼(μα,σα2)logβb∼(μβ,σβ2).p_b,a= (1,\;e^- _b- _b,a/T) ~~where~~ _b,a Exp[ _b] ~~and~~ cases _b& ( _α, _α^2)\\ _b& ( _β, _β^2) cases\;. (3) Our model has only 4 free parameters (μα,σα,μβ,σβ)( _α, _α, _β, _β) to describe the entire (N,M)(N,M) attack surface. Readers who might not be interested in the physical mental picture behind Eq. (3) can jump to Sec. D. The main assumption of the model is that the process of generating unsafe completions is governed by a high-dimensional energy landscape with two stable basins representing the safe and unsafe regions. However only two components of this landscape will come into play: the entropic bottleneck connecting the stable basins and the one-dimensional projection along a hyperplane separating the safe and unsafe basins. Motivated by existing experimental results we postulate the following structure: • Baseline safety. Alignment training (Rafailov et al., 2023; Ouyang et al., 2022) finetunes the model to increase the log-odds of ‘safe’ completions compared to ‘unsafe’ completions. The alignment objectives in Rafailov et al. (2023); Ouyang et al. (2022) create an entropic bottleneck between the two. We assume the model refuses unsafe completions of a prompt b with a base entropic barrier αb _b. We further assume that these bottlenecks are Gaussianly distributed α∼(μα,σα2)α ( _α,σ^2_α) over the dataset. • Linearity. Given that residual stream spaces have shown to be surprisingly linear (Park et al., 2024; Zou et al., 2023b), we assume that a single hyperplane along the entropic bottleneck separates the safe from unsafe completions. • Augmentations select minima of exponential height. We postulate that there exists an energy landscape within the hyperplane which separates the safe/unsafe completions. Given the usual glassiness of these systems we assume the landscape to be extremely rugged with exponentially distributed minima (Bouchaud, 1992; Derrida, 1981). Then each augmentation corresponds to choosing a height ηb,a∼Exp[βb] _b,a Exp[ _b] in this rugged landscape to try and cross-over to the other side. • Saddle heights are a property of the prompt. We assume that the statistics of the saddle heights (which are governed by βb _b) depend only on the prompt b. Hence, crucially, βb _b is kept constant for any augmentation a. We further postulate that βb _b is log-normally distributed logβ∼(μβ,σβ2) β ( _β,σ^2_β). • Completions. Once a prompt b, and augmentation a are chosen they define an entropic bottleneck αb _b, a height ηb,a _b,a and generation at temperature T will cross over the saddle with Arrhenius probability pb,a=min(1,e−αb−ηb,a/T)p_b,a= (1,e^- _b- _b,a/T) (Hänggi et al., 1990). We introduce the effective jailbreak rate at completion budget M Rb(M)=−log⟨(1−pb,a)M⟩η.R_b(M)=- (1-p_b,a)^M _η\;. (4) The quantity Rb(M)R_b(M) represents: ‘given a fixed prompt b augmented M times, what frequency of jailbreaks can we expect?’. A prompt survives an (N,M)(N,M) attack with probability Qb(M)N≡e−NRb(M),Q_b(M)^N≡ e^-NR_b(M)\;, (5) where Qb(M)Q_b(M) is the survival probability of a single augmentation. Then ASR@(NM)=1−⟨e−NRb(M)⟩b. ASR@ NM=1- e^-NR_b(M) _b\;. (6) Now expanding Eq. (4) yields Rb(M)=−log[βb∫dηe−βbη(1−e−αb−η/T)M]=−log[2F1(−M,βbT,1+βbT,e−αb)],R_b(M)=- [ _b η\;e^- _bη(1-e^- _b-η/T)^M ]=- [\,_2F_1 (-M, _bT,1+ _bT,e^- _b )]\;, (7) where F12(a,b,c,z)\,_2F_1(a,b,c,z) is the hypergeometric F12\,_2F_1 function (DLMF, 2024). Given that we are interested in the large-N limit, the behavior will be dominated by the hardest prompts, i.e. αb≫1 _b 1. Furthermore, the usual working regime for BoN attacks has M∼(1)M (1) and hence Me−αb≪1Me^- _b 1 which allows us to simplify the hypergeometric function to logRb(M)≃logM−αb+log(βbT)−log(1+βbT). R_b(M) M- _b+ ( _b T)- (1 + _b T)\;. (8) Notice that averaging over all possible augmentations a for a fixed prompt b we can define an effective prompt barrier Eb=−log⟨pb,a⟩a=αb−log(βbT)+log(1+βbT),E_b=- p_b,a _a= _b- ( _b T)+ (1 + _b T)\;, (9) so that logRb(M)≃logM−Eb R_b(M) M-E_b. In other words, the jailbreaking frequency Rb(M)≃Me−EbR_b(M) Me^-E_b corresponds to M parallel jumps over an effective barrier of height EbE_b. Given that αb _b is Gaussian and βb _b is log-normal EbE_b is well approximated by a Gaussian of mean μE _E and variance σE2σ^2_E. So Eq. (6) becomes AFR@(NM)≡1−ASR@(NM)≃⟨exp[−elog(NM)−μE+σEξ]⟩ξ∼(0,1). AFR@ NM≡ 1- ASR@ NM [-e (N M)- _E+ _Eξ ] _ξ (0,1)\;. (10) The saddle point of Eq. (10) (see App. A for details) yields AFR@(NM)≃fσE[(NM)e−μE], AFR@ NM f_ _E [(NM)e^- _E ]\;, (11) where fγ(z)=11+W0(γ2z)exp[−W0(γ2z)2+2W0(γ2z)2γ2],f_γ(z)= 1 1+W_0(γ^2z) [- W_0(γ^2z)^2+2W_0(γ^2z)2γ^2 ]\;, (12) with W0W_0 being the Lambert function. A plot of this scaling function for various values of γ is given in Fig. 6(c). Writing L≡log(γ2z)L≡ (γ^2 z) and using W0(γ2z)≃L−logL+logL/L+(L−2)W_0(γ^2z) L- L+ L/L+O(L^-2), the asymptote of this scaling function when z→+∞z→+∞ is fγ(z)≃11+L−logLexp[−(L−logL)2+2L2γ2].f_γ(z) 1 1+L- L\, [- (L- L )^2+2L2γ^2 ]\;. (13) Notice that the asymptote is not a clean power-law as is usually reported in the literature. In reality, it predicts a power law fγ(z)∝z−νefff_γ(z) z^- _ eff with a slowly varying exponent νeff≡−dlogfγ(z)dlogz=W0(γ2z)γ2+W0(γ2z)2[1+W0(γ2z)]2≃z→+∞1γ2logz. _ eff≡- f_γ(z) z= W_0(γ^2z)γ^2+ W_0(γ^2z)2 [1+W_0(γ^2z) ]^2 z→+∞ 1γ^2 z\;. (14) Although less interesting, the low-budget (i.e. small N) asymptote can also be obtained in closed form. However, to do so we cannot take the small-z limit of Eq. (12) since fγ(z)f_γ(z) was already the result of a large-N saddle-point approximation. Instead we have to expand Eq. (10) directly for small N which yields AFR@(NM)≃1−(NM)e−μE+σE2/2≡1−zeγ2/2. AFR@ NM 1-(NM)\,e^- _E+ _E^2/2≡ 1-ze^γ^2/2\;. (15) 4 Experimental validation Table 1: The four parameters of each model, at T=1T=1 via the estimator of Eq. (20). The effective mean barrier μE=⟨−log⟨pb,a⟩a⟩b _E= - p_b,a _a _b is defined in Eq. (9). Prompts which are never jailbroken are ill-defined and dropped. Uncertainties are ±1± 1 standard deviation from a cluster bootstrap over prompts (20002000 resamples). The amplitude of the BoN kernel noise is chosen such that the median jailbreak rate is in 1–5%. μα _α σα _α μβ _β σβ _β μE _E σE _E Model Base alignment Alignment fluctuations Attack susceptibility Susceptibility fluctuations Effective barrier Barrier fluctuations Qwen2.5-7B (base) 0.57±0.030.57_± 0.03 0.27±0.030.27_± 0.03 +1.99±0.09+1.99_± 0.09 0.85±0.050.85_± 0.05 0.73±0.030.73_± 0.03 0.33±0.040.33_± 0.04 Llama-3.1-8B-Instruct 0.39±0.100.39_± 0.10 0.93±0.110.93_± 0.11 −1.29±0.15-1.29_± 0.15 1.33±0.11 1.33_± 0.11 2.05±0.152.05_± 0.15 1.36±0.111.36_± 0.11 Qwen2.5-3B-Instruct 1.83±0.031.83_± 0.03 0.65±0.030.65_± 0.03 −0.88±0.03-0.88_± 0.03 0.52±0.020.52_± 0.02 3.08±0.033.08_± 0.03 0.58±0.020.58_± 0.02 Qwen2.5-7B-Instruct 2.10±0.062.10_± 0.06 1.30±0.05 1.30_± 0.05 −1.97±0.05 -1.97_± 0.05 1.07±0.041.07_± 0.04 4.27±0.08 4.27_± 0.08 1.65±0.06 1.65_± 0.06 Gemma-2-9B-it 2.59±0.06 2.59_± 0.06 0.60±0.040.60_± 0.04 +1.07±0.08+1.07_± 0.08 0.75±0.060.75_± 0.06 2.93±0.062.93_± 0.06 0.62±0.030.62_± 0.03 We now show experimental evidence for this microscopic model in three families of open-source models with 3B to 9B parameters: Qwen (Qwen Team, 2024), Llama (Grattafiori et al., 2024) and Gemma (Gemma Team, 2024). For each model we run a BoNM jailbreak on the first 400400 harmful prompts of AdvBench (Zou et al., 2023a) (see App. D for details). For each prompt we draw N augmentations (Gaussian noise of variance σ in embedding space or character-level noise) and for each augmentation we draw M completions at temperature T. To have comparable results across models we choose σ such that the average jailbreak rate is 1–5% for each model. Most of our results are derived from a N=100N=100, M=300M=300 grid, then to probe the far-N regime we further run an independent attack with N=104N=10^4 augmentations and M=1M=1 completion per prompt. Each completion is scored by an external judge (Granite-Guardian-3.0-2B (Padhi et al., 2024) and HarmBench-13B (Mazeika et al., 2024) as a control) and deemed unsafe if its harm probability exceeds 0.5. Leading to the empirical measure p^b,a=1M∑i=1Mcompletioniofpromptbwithaugmentationaisjailbroken.≡k^b,aM. p_b,a= 1M _i=1^M1\ completion~i ~of~prompt~b ~with~augmentation~a ~is~jailbroken.\≡ k_b,aM\;. (16) Given a single prompt b, we can compute the individual jailbreak rate p^b,a p_b,a and then average over the N≫1N 1 augmentations ⟨p^b,a⟩a p_b,a _a, our theory predicts that −log⟨pb,a⟩- p_b,a should be equal to −log⟨pb,a⟩a=−log⟨e−αb−η/T⟩a=αb−log[βbT1+βbT].- p_b,a _a=- e^- _b-η/T _a= _b- [ _bT1+ _bT ]\;. (17) Now instead of looking at the mean we can study the full distribution of pb,ap_b,a. Making the change of variables from η to pb,ap_b,a yields Prob.[pb,a|b]=βbTeβbTαbpβbT−1 Prob.[p_b,a\,|\,b]= _bTe _bT _bp _bT-1 (18) Hence βb _b is clearly defined by the p→0+p→ 0^+ limit of this distribution and the upper support of this distribution is e−αe^-α. However, using the support edge as an estimator is extremely noisy. Instead we fit a soft-wall by Maximum Likelihood Estimation (MLE) using a Beta distribution p^∼B(β^bT,c^b) p B( β_bT, c_b) to model k^b,a∼Binomial(M,p) k_b,a Binomial(M,p). Then log⟨p^⟩=logβ^bTβ^bT+c^b p = β_bT β_bT+ c_b (19) and equating with Eq. (17) we get α^b=log[β^bT+c^b1+β^bT]. α_b= [ β_bT+ c_b1+ β_bT ]\;. (20) Given Eq. (20) and with an MLE fit we are now able to recover αb _b and βb _b from numerical data. The goodness of fit of the MLE (over 400 prompts typical error 0.170.17 in logQb(M) Q_b(M) with M≤300M≤ 300) supports that η being exponentially distributed is a good approximation on this dataset. In Fig. 2 we can see that the measured α^b α_b and logβ^b β_b are well approximated by a Gaussian distribution whose parameters are given in Table 1. The raw distributions of α^b α_b and logβ^b β_b of the two instruct models are very different but once centered and standardized they cannot be distinguished. The normal and log-normal families are universal, only their moments are model-specific. Figure 2: Universal laws. Across prompts, αb _b is Gaussian and βb _b log-normal. Panel (c) shows how standardized per-prompt parameters collapse onto (0,1)N(0,1). Safety Results. We can see in Table 1 that the base model has essentially no barrier. Its median augmentation is jailbroken roughly half of the time. The instruct-tuned version of the same model raises μα _α by a factor of four and σα _α by a factor of five. The entropic barrier is therefore not a property of the architecture but a consequence of training/finetuning. Alignment also improves resistance to BoNM attacks by moving μβ _β from +1.99+1.99 to −0.9-0.9 or −2.0-2.0. Between the two Qwen-Instruct models, the 7B model is both safer (μα(7B)>μα(3B) _α^(7B)> _α^(3B)) and less susceptible to the BoNM attack (μβ(7B)<μβ(3B) _β^(7B)< _β^(3B)). Interestingly not all models defend in the same way. Gemma favors an ‘entropic defense’ (the α channel) whereas Llama is entirely aligned via an ‘energetic defense’ (the β channel). The physical picture. To show that the physical model is justified we now identify its constituting elements directly in the residual stream. For each prompt b and augmentation a we average the residuals of the completions the judge calls unsafe, subtract the average over those it calls safe, normalize, and then average the resulting unit contrasts over all b and a to compute a single ‘safety vector’ c^hyper c_ hyper. The vector c^hyper c_ hyper is the normal of the safety hyperplane of Fig. 1, and a linear readout along it separates safe from unsafe completions well (held-out AUC =0.89=0.89). Taking the average projection of each completion on the safety direction, the two safe/unsafe basins appear clearly in Panel (a) of Fig. 3. A second crucial assumption of our model is that the saddle ηb,a _b,a is a property of the augmentation a. Consequently, it should be readable from the augmented prompt residual directly, without the need to look at the completion. To check this we train a linear probe c^saddle c_ saddle to predict logpb,a−⟨logpb,a⟩a p_b,a- p_b,a _a from the centered residual rb,a−⟨rb,a⟩ar_b,a- r_b,a _a of the last token of the augmented prompt. As shown in Panel (b) of Fig. 3 not only are we able to recover ηb,a _b,a (R2=0.69R^2=0.69 on held out validation), but the spread of the projection along c^saddle c_ saddle is inversely correlated to βb _b (Spearman −0.59-0.59). We can also use this projection to verify that the exponential assumption ηb,a∼Exp[βb] _b,a Exp[ _b] is reasonable, which is shown in Panel (c) of Fig. 3. Since the probe is a noisy and censored estimate of ηb,a _b,a, the comparison is made by pushing the exponential law through the same estimator. Figure 3: Geometry of the residual stream. (a) Effective free energy along a supervised safety readout after balancing each population. Average projection along a single direction separates completions into two safe/unsafe regions. (b) The saddle ηb,a _b,a predicted from the augmented prompt alone against the measured per-augmentation rate. (c) The distribution of the recovered ηb,a _b,a, against the exponential assumption pushed through the same estimator. 4.1 Reconstruction and extrapolation Figure 4: Extrapolation (closer to the diagonal == better). We fit (αb,βb)( _b, _b) on a small N≤100N≤ 100, M≤30M≤ 30 grid. Extrapolate its predictions and compare with two baselines: a power-law and Feng et al. (2026) Beta fit. In panel (a) we extrapolate to large N∼104N 10^4. Feng et al. (2026) and our predictions are identical for the 3B model but we are considerably more accurate on Qwen7B. In panel (b), we extrapolate to large M∼300M 300. In panel (c), the effective barrier −log⟨pb,a⟩a- p_b,a _a is measured two independent ways, on the 100×300100× 300 grid versus on the 104×110^4× 1 grid. Both agree at r=0.85r=0.85 (3B) and 0.960.96 (7B). The first test is whether (μα,σα,μβ,σβ)( _α, _α, _β, _β) are truly properties of only the model, i.e. independent of the prompt b and the augmentation a. To check this we set c^b c_b from Eq. (20), and compute ASR@(NM) ASR@ NM from Eqs. (6) on the N,M≤100N,M≤ 100 grid. We compare this population-level fit with a separate Beta-distribution fit for each prompt. The four-number model matches the measured data with a Mean Absolute Error (MAE) of 0.0310.031. In comparison, the per-prompt fit leads to an MAE of 0.0340.034. In other words, the population model with only 4 fitting parameters is as accurate as the per-prompt model with 800 parameters. We now test whether this model is able to extrapolate the ASR beyond its fitting window. To do so, we fit the four parameter family (μα,σα,μβ,σβ)( _α, _α, _β, _β) on a small region of augmentations N≤100N≤ 100 and completions M≤30M≤ 30 and check how they perform at much larger values N∼104N 10^4 and M∼300M 300. Fig. 4 shows how the small attack fit closely predicts large attack performances. In comparison, if we follow the usual practice in the literature (Hughes et al., 2024; Feng et al., 2026) and fit a power-law to the N≤100N≤ 100 region and extrapolate to N∼104N 10^4 the prediction would have been significantly off, as can be seen in Fig. 4 panel (a). This is a consequence of the ASR not really following a power-law, as previously discussed in Eq. (14). Our model is also either equal (for Qwen3B) or more accurate (for Qwen7B) compared to Feng et al. (2026). Figure 5: Temperature dependence. (a-b) Predicting a new decoding temperature from T=1T=1 data alone. Pure Arrhenius p(T)=p(1)1/Tp(T)=p(1)^1/T (dashed) overstates the effect of temperature in both directions. Our model keeps the entropic barrier outside the 1/T1/T (Eq. (21)) with αb _b fitted on the T=1T=1 data (blue) which reduces the error fourfold. (c) The barrier is entropic (constant in T), the saddles are energetic (∝1/T 1/T). Generation temperature T also enters our model in a very specific manner: only the saddle crossings are thermal (via Arrhenius’ law), neither the barrier αb _b nor the inverse glass temperature βb=1/Tg _b=1/T_g should move with T. Re-running the grid at five temperatures on 100100 prompts, with the augmentation seeds of the T=1T=1 grid, we find μα _α and μβ _β flat while the saddle height in units of T follows 1/T1/T (panel (c) of Fig. 5). This is the direct evidence that αb _b is entropic, i.e. independent of temperature whereas saddles are thermal. Furthermore, given the exact temperature structure, the whole ASR at a new temperature T′T follows from the T=1T=1 data through pb,a(T′)=e−αb(1−1/T′)pb,a(1)1/T′.p_b,a(T )=e^- _b(1-1/T )\,p_b,a(1)^1/T \;. (21) Fig. 5 shows that Eq. (21), with αb _b fitted at T=1T=1, reduces the error by a factor of 3.73.7 to 7.57.5 relative to pure Arrhenius (i.e. pb,a(T)=e−(αb+ηb,a)/Tp_b,a(T)=e^-( _b+ _b,a)/T), at all four unseen temperatures. 4.2 Scaling collapse Figure 6: Scaling collapse of the AFR. In panel (a) we show the small-M closed-form leading order which although mostly accurate starts to deviate at large-z for larger values of M. In panel (b) we use the M-agnostic form which remains accurate at large-z for all M. Finally in panel (c) we show a few examples of the scaling function fγ(z)f_γ(z) for varying values of the shape parameter γ. The scaling form in Eq. (11) makes a striking verifiable prediction. If we plot the AFR as a function of z≡(NM)e−μEz≡(NM)e^- _E then all models should follow the same curve family fγ(z)f_γ(z) defined in Eq. (12). This collapse can be seen in Fig. 6. However, the exact scaling form in Eq. (11) is only valid at M≪eμαM e _α (which allowed us to simplify the hypergeometric function in Eq. (7)). Otherwise, the best we can do is keep the Gaussian approximation of logRb(M)∼(μR(M),σR(M)2) R_b(M) ( _R(M), _R(M)^2) without knowing the closed form of μR(M) _R(M) and σR(M)2 _R(M)^2 which leads to panel (b) in Fig. 6. Both are read off the measured grid (App. A). We can see the clear separation between Qwen7B-Instruct and Llama (σE∼1.5 _E 1.5) compared to Qwen3B-Instruct, Qwen7B-base and Gemma (σE∼0.5 _E 0.5). 4.3 Power-law and fake exponential crossover Figure 7: Fake exponential crossover. For each prompt we draw G=104G=10^4 augmentations of which H are jailbroken (unlike before all prompts are kept even those which are never jailbroken). The survival at budget N is estimated by (G−HN)/(GN) G-HN/ GN, i.e. that a random N-subset of the G augmentations contains none of the H jailbroken ones. (a) Measured population survival (points), the four-number population law from the grid fits (solid), and the survival of the single hardest prompt of the dataset (dotted). (b) The measured local exponent follows the predicted drift up to the resolution budget NresN_ res of the dataset, and then breaks away and ‘crosses over’ as the curve is taken over by the hardest prompt. (c) The same AFR measurement on nested subsets of the P easiest prompts. Adding harder prompts moves NresN_ res from 1818 to 111111 and the bend moves right with it. We now turn to the usual power-law behavior reported in the literature (Hughes et al., 2024; Feng et al., 2026). We fit our model to the usual N≤100,M≤300N≤ 100,M≤ 300 experimental grid and then run a separate attack on N=104N=10^4 augmentations (with M=1M=1) to probe the large-N behavior. As shown in Fig. 7 the four numbers of Table 1 extrapolate to the large-N quite well until N∼103N 10^3 where the data seems to cross over to an exponential regime. In parallel, the measured local exponent νeff(N) _ eff(N) tracks the theoretical prediction and drifts from 0.10.1 at N=2N=2 to above 22 at N∼102N 10^2–10310^3 with no sign of a plateau, directly contradicting the usual power-law interpretations of BoN scaling. There is no fixed power-law exponent, only the running one of Eq. (14). Although Halder et al. (2026) have reported exponential corrections, we believe that this exponential crossover is a finite-size artifact of the limited harmful dataset over which the ASR is computed. With a finite dataset of P prompts the population average of Eq. (6) is a sum of P exponentials, and beyond the budget Nres=1/minb⟨pb,a⟩aN_ res=1/ _b p_b,a _a at which even the hardest prompt of the dataset has been jailbroken, the survival is dominated by that single prompt and decays as a pure exponential (1−⟨p⟩a)N/P(1- p _a)^N/P. As can be seen in Fig. 7, the measured curve follows the population law up to NresN_ res and then breaks away. The exponent νeff _ eff shoots up from ∼2 2 to ∼102 10^2. This exponential behavior is a side-effect of the dataset size, not a property of the model. Panel (c) of Fig. 7 shows how progressively larger datasets shift the transition rightwards. For the 400400-prompt AdvBench, NresN_ res is approximately 10210^2 for Qwen-3B-Instruct and ≈2×103≈ 2× 10^3 for Qwen-7B-Instruct. 5 Safety Consequences Compute-optimal attack. We can see from Eq. (11) that N and M contribute equally to the ASR provided M≪eμαM e _α. When M∼eμαM e _α more attempts yield diminishing returns. Hence, if completions are cheaper to sample than augmentations, an attacker should always use M⋆∼eμαM e _α with an exact M⋆M whose closed form expression is a complicated implicit equation detailed in App. B. On the other hand, if augmentations are cheaper to sample than completions then there is no reason to go beyond M⋆=1M =1. What a defender should optimize. BoN is a worst-case attack: Eq. (6) is a Laplace transform of the barrier distribution and at any budget it is governed by the prompts of barrier α∼logNα N, i.e. extremely high barriers. A naive intuition would be that the best defense is obtained by a tight cluster of extremely high barriers, i.e. μE≫1 _E 1 and σE≪1 _E 1. Surprisingly, Eq. (11) shows that this is more nuanced. Fig. 6 shows that higher values of σE _E lead to safer models at large-z but weaker models at smaller z. Since BoN is an extreme-value process, large N eventually reaches any barrier height. However, by keeping σE≫1 _E 1 we are ‘fighting’ one extreme-value process with another. BoN will struggle to reach the few extreme barriers which are much higher than the mean, at the cost of sacrificing a few ‘easy to reach’ low barriers. Alignment protocols. It is worth noting that different alignment schemes seem to lead to different defense types. Table 1 shows that Gemma, Llama and Qwen have three different ways of defending against BoN. Gemma relies on a strong entropic bottleneck μα _α but almost no energetic barrier μβ _β. In contrast, Llama has almost no entropic bottleneck but a large energetic barrier, and Qwen sits in between. Interestingly, Llama and Gemma used opposite alignment recipes: offline DPO (Rafailov et al., 2023; Grattafiori et al., 2024) versus on-policy RL (Gemma Team, 2024). How alignment training maps onto these four parameters is out of scope here but would be an interesting follow-up. 6 Conclusion In this work, we put forward and validate experimentally a physics-inspired microscopic model for Best-of-N jailbreaking and generalized Best-of-N to Best-of-NMNM by considering multiple completions for the same augmentation. We found that contrary to the usual literature the attack success rate does not follow a fixed power-law. We further showed that the reported exponential crossover is an artifact of fitting jailbreaking behaviors on a finite adversarial dataset. Our theoretical model allows us to quantitatively compare the safety of different models as shown in Table 1 and also makes predictions for best defensive practices to follow. Ethics statement Limitations. The study in this work is restricted to open-weight models of intermediate size. Reproducing this work on frontier models was beyond our computational capacities and against the terms of service of proprietary models. We also showed that most fits are in reality limited by the relatively small size of the adversarial prompt dataset (400 prompts). Having more accurate large N behaviors would require a larger adversarial dataset. We have also only used a single dataset, expanding to other datasets would improve the universality of our claims. At our attack budgets N∼104N 10^4 we were able to resolve most of the prompts. However, for the safest models we still had to drop a couple of prompts which were never jailbroken, effectively biasing their parameters to making them seem ‘softer’. App. C measures the effect of censoring and the soft-wall estimator, by drawing synthetic data from the model itself and passing it through the same pipeline. Surprisingly, the two biases have opposite signs, and the net shift of μα _α is a few tenths upward rather than downward. So our results are only accurate up to a few tenths, which corresponds to their reported error bars. Resolving the censored prompts would require larger attack budgets which are beyond our computational capacity. Another limitation of this work is the reliance on LLMs as judges of harmful behaviors with no human control. We tried to mitigate this by using more than one LLM judge (Padhi et al., 2024; Mazeika et al., 2024) and saw that our results did not rely on a specific LLM judge choice; automated judges are nonetheless known to disagree (Souly et al., 2024; Ran et al., 2025). Finally, we have only studied the behavior of these attacks in English. There is no reason to believe that these models would behave identically for other languages. In fact, some languages may be easier to jailbreak than others. Ethical concerns. This work studies an already established attack. The only offensive contribution is the possibility of making this attack more compute-efficient, which is only presented to inform defenders on what a worst-case attack could be. This paper aims at better understanding the mechanisms at play behind BoN jailbreaking. While we cannot exclude that the results presented in this paper could possibly lead to improved offensive capabilities, we pursued this work, and presented it, from a defender’s perspective. We have included prescriptions on how our results could guide a defender’s choices on how to safeguard their models and we hope that the work presented here will lead to more robust alignment protocols. Reproducibility statement Every number in the paper is produced by a scripted pipeline from raw generations: the per-prompt Beta-Binomial fits and the estimator of Eq. (20), the four-parameter surfaces, the N- and M-extrapolations, the temperature sweep, the probes, and all figures. Models, judges, augmentation kernels and grid shapes are specified in Sec. D; the code and the fitted per-prompt parameters will be released. Use of large language models We used an AI coding assistant (Claude, Anthropic) throughout this project, in two capacities. (i) Code and experiments. The assistant wrote and debugged part of the analysis and plotting code (fitting routines, bootstrap error bars, the figure pipeline) and helped launch and monitor the generation and scoring jobs on SLURM. It was also used interactively to run exploratory analyses and sanity checks proposed by the authors. (i) Writing. The main text was written by the authors. The assistant drafted parts of the supplementary material (derivations and experimental details) from the authors’ notes and results, which the authors then checked and edited. It was used for proofreading and for consistency checks between the text, the tables and the figures. All LLM-produced code, numbers and text were verified by the authors, who take full responsibility for the content of the paper. Separately, LLMs are the object of study and an LLM-based classifier is used as the jailbreak judge. References Hughes et al. (2024) J. Hughes, S. Price, A. Lynch, R. Schaeffer, F. Barez, A. Somani, S. Koyejo. H. Sleight, E. Jones and M. Sharma, Best-of-N jailbreaking, Advances in Neural Information Processing Systems, 38, p.73137-73221 (2024). Halder et al. (2026) I. Halder, A. Banerjee and C. Pehlevan, Jailbreak Scaling Laws for Large Language Models: Polynomial-Exponential Crossover, arXiv preprint, arXiv:2603.11331 (2026). Feng et al. (2026) M. Feng, X. Liu, W. Yang, C. Xu, C. White and J. Gao, Statistical estimation of adversarial risk in large language models under best-of-n sampling, arXiv preprint, arXiv:2601.22636 (2026). Bouchaud (1992) J.P. Bouchaud, Weak ergodicity breaking and aging in disordered systems, Journal de Physique I, 2 (9), p.1705-1713 (1992). Derrida (1981) B. Derrida, Random-energy model: An exactly solvable model of disordered systems, Physical Review B, 24 (5), p.2613 (1981). Hänggi et al. (1990) P. Hänggi, P. Talkner and M. Borkovec, Reaction-rate theory: fifty years after Kramers, Reviews of modern physics, 62 (2), p.251 (1990). DLMF (2024) NIST Digital Library of Mathematical Functions, §15, https://dlmf.nist.gov/ (2024). Qwen Team (2024) A. Yang, A. Li, B. Yang, B. Zhang, B. Hui, B. Zheng, B. Yu, C. Gao, C. Huang, C. Lv and C. Zheng, Qwen2.5 technical report, arXiv preprint, arXiv:2412.15115 (2024). Grattafiori et al. (2024) A. Grattafiori, A. Dubey, A. Jauhri, A. Pandey, A. Kadian, A. Al-Dahle, A. Letman, A. Mathur, A. Schelten, A. Vaughan and A. Yang, The Llama 3 herd of models, arXiv preprint, arXiv:2407.21783 (2024). Gemma Team (2024) G. Team, M. Riviere, S. Pathak, P.G. Sessa, C. Hardin, S. Bhupatiraju, L. Hussenot, T. Mesnard, B. Shahriari, A. Ramé and J. Ferret, Gemma 2: Improving open language models at a practical size, arXiv preprint, arXiv:2408.00118 (2024). Rafailov et al. (2023) R. Rafailov, A. Sharma, E. Mitchell, C.D. Manning, S. Ermon and C. Finn, Direct preference optimization: Your language model is secretly a reward model, Advances in neural information processing systems, 36, p.53728-53741 (2023). Choromanska et al. (2015) A. Choromanska, M. Henaff, M. Mathieu, G.B. Arous and Y. LeCun, The loss surface of multilayer networks, PMLR, Artificial intelligence and statistics, p. 192-204, (2015). Zou et al. (2023a) A. Zou, Z. Wang, N. Carlini, M. Nasr, J.Z. Kolter and M. Fredrikson, Universal and transferable adversarial attacks on aligned language models, arXiv preprint, arXiv:2307.15043 (2023). Hutter (2021) M. Hutter, Learning Curve Theory, arXiv preprint, arXiv:2102.04074 (2021). Schaeffer et al. (2025) R. Schaeffer, J. Kazdan, J. Hughes, J. Juravsky, S. Price, A. Lynch, E. Jones, R. Kirk, A. Mirhoseini and S. Koyejo, How do large language monkeys get their power (laws)?, PMLR, International Conference on Machine Learning, 267, p. 53132-53176 (2025). Levi (2025) N. Levi, A Simple Model of Inference Scaling Laws, PMLR, International Conference on Machine Learning, 267, p. 33984-33998 (2025). Levi (2026) N. Levi, Learning Shrinks the Hard Tail: Training-Dependent Inference Scaling in a Solvable Linear Model, International Conference on Learning Representations (2026). Kazdan et al. (2025) J. Kazdan, R. Schaeffer, Y. Allouah, C. Sullivan, K. Yu, N. Levi and S. Koyejo, Efficient prediction of pass@k scaling in large language models, arXiv preprint, arXiv:2510.05197 (2025). Zou et al. (2023b) A. Zou, L. Phan, S. Chen, J. Campbell, P. Guo, R. Ren, A. Pan, X. Yin, M. Mazeika, A.K. Dombrowski and S. Goel, Representation engineering: A top-down approach to AI transparency, arXiv preprint, arXiv:2310.01405 (2023). Park et al. (2024) K. Park, Y.J. Choe and V. Veitch, The linear representation hypothesis and the geometry of large language models, PMLR, International Conference on Machine Learning, 235, p. 39643-39666 (2024). Mazeika et al. (2024) M. Mazeika, L. Phan, X. Yin, A. Zou, Z. Wang, N. Mu, E. Sakhaee, N. Li, S. Basart, B. Li and D. Forsyth, HarmBench: A standardized evaluation framework for automated red teaming and robust refusal, PMLR, International Conference on Machine Learning, 235, p. 35181-35224 (2024). Padhi et al. (2024) I. Padhi, M. Nagireddy, G. Cornacchia, S. Chaudhury, T. Pedapati, P. Dognin, K. Murugesan, E. Miehling, M.S. Cooper, K. Fraser and G. Zizzo, Granite guardian, arXiv preprint, arXiv:2412.07724 (2024). Ouyang et al. (2022) L. Ouyang, J. Wu, X. Jiang, D. Almeida, C. Wainwright, P. Mishkin, C. Zhang, S. Agarwal, K. Slama, A. Ray and J. Schulman, Training language models to follow instructions with human feedback, Advances in neural information processing systems, 35, p.27730-27744 (2022). Arditi et al. (2024) A. Arditi, O. Obeso, A. Syed, D. Paleka, N. Panickssery, W. Gurnee and N. Nanda, Refusal in language models is mediated by a single direction, Advances in Neural Information Processing Systems, 37, p.136037-136083 (2024). Wollschläger et al. (2025) T. Wollschläger, J. Elstner, S. Geisler, V. Cohen-Addad, S. Günnemann and J. Gasteiger, The geometry of refusal in large language models: Concept cones and representational independence, PMLR, International Conference on Machine Learning, 267, p. 66945-66970 (2025). Souly et al. (2024) A. Souly, Q. Lu, D. Bowen, T. Trinh, E. Hsieh, S. Pandey, P. Abbeel, J. Svegliato, S. Emmons, O. Watkins and S. Toyer, A strongreject for empty jailbreaks, Advances in Neural Information Processing Systems, 37, p.125416-125440 (2024). Ran et al. (2025) D. Ran, J. Liu, Y. Gong, J. Zheng, X. He, Y. Cong and A. Wang, JailbreakEval: An integrated toolkit for evaluating jailbreak attempts against large language models, Network and Distributed System Security Symposium (NDSS), poster (2025). Schwinn et al. (2024) L. Schwinn, D. Dobre, S. Xhonneux, G. Gidel, and S. Günnemann, Soft Prompt Threats: Attacking Safety Alignment and Unlearning in Open-Source LLMs through the Embedding Space, Advances in Neural Information Processing Systems, 37, p.9086-9116 (2024). Geisler et al. (2024) S. Geisler, T. Wollschläger, M. H. I. Abdalla, J. Gasteiger, and S. Günnemann, Attacking Large Language Models with Projected Gradient Descent, ICML Workshop on the Next Generation of AI Safety (2024). Robey et al. (2025) A. Robey, E. Wong, H. Hassani, and G. J. Pappas, SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks, Transactions on Machine Learning Research (2025). Cohen et al. (2019) J. Cohen, E. Rosenfeld, and J. Z. Kolter, Certified Adversarial Robustness via Randomized Smoothing, PMLR, International conference on machine learning, p. 1310-1320 (2019). Liu et al. (2024) X. Liu, N. Xu, M. Chen, and C. Xiao, AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models, International Conference on Learning Representations, p. 56174-56194 (2024). Chao et al. (2025) P. Chao, A. Robey, E. Dobriban, H. Hassani, G. J. Pappas, and E. Wong, Jailbreaking Black Box Large Language Models in Twenty Queries, IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), p. 23-42 (2025). Appendix A Saddle-point evaluation of the population average This appendix derives Eq. (12) from Eq. (10). Write x=log(NM)−μEx= (N M)- _E and γ=σEγ= _E, so that Eq. (10) reads AFR@(NM)≃∫dξ2πe−φx,γ(ξ) with φx,γ(ξ)=ξ22+ex+γξ. AFR@ NM ξ 2π\,e^- _x,γ(ξ) ~~with~~ _x,γ(ξ)= ξ^22+e^\,x+γξ\;. (22) The exponent is convex, so it has a single stationary point, φx,γ′(ξ⋆)=ξ⋆+γex+γξ⋆=0. _x,γ(ξ )=ξ +γ\,e^\,x+γξ =0\;. (23) Since the exponential is positive we must have ξ⋆<0ξ <0. In other words, at large x the surviving prompts are the hard ones whose effective barrier EbE_b lies above the mean. Re-writing w=−ξ⋆>0w=-ξ >0 yields ex−γw=w/γe^\,x-γ w=w/γ, i.e. weγw=γexwe^γ w=γ e^x, and multiplying by γ gives a Lambert equation for the rescaled saddle ζ≡γwζ≡γ w, ζeζ=γ2ex⟹ζ=W0(γ2ex)=W0(σE2(NM)e−μE),ζ\,e^ζ=γ^2e^x ζ=W_0\! (γ^2e^x )=W_0\! ( _E^2(NM)e^- _E )\;, (24) with W0W_0 the principal branch of the Lambert function. At the saddle the height and the curvature are φ(ξ⋆)=w22+wγ=ζ2+2ζ2γ2,φ′(ξ⋆)=1+γ2ex+γξ⋆=1+γw=1+ζ. (ξ )= w^22+ wγ= ζ^2+2ζ2γ^2\;, (ξ )=1+γ^2e^\,x+γξ =1+γ w=1+ζ\;. (25) The Gaussian fluctuations in the integral contribute φ′(ξ⋆)−1/2 (ξ )^-1/2 and Eq. (22) becomes fγ(z)f_γ(z) of Eq. (12), with the argument z=(NM)e−μEz=(NM)e^- _E of the main text entering only through ζ=W0(γ2z)ζ=W_0(γ^2z). The collapse variables. Panel (b) of Fig. 6 needs μR(M) _R(M) and σR(M) _R(M) without any closed form. To obtain them we measure Rb(M)=−logQb(M)R_b(M)=- Q_b(M) for every prompt from the unbiased completion-channel estimate of Qb(M)Q_b(M). Then, μR(M)=⟨logRb(M)⟩b _R(M)= R_b(M) _b is read directly from the data and the width is kept at the single number σE _E because the measured σR(M) _R(M) barely changes with M: from 0.550.55 at M=1M=1 to 0.540.54 at M=64M=64 on Qwen2.5-3B-Instruct. Appendix B Compute-optimal completion budget This appendix gives the implicit equation for M⋆M referred to in Sec. 5. Fix a prompt b and write Rb(M)=−logQb(M)R_b(M)=- Q_b(M) as in Eq. (4). Because Qb(M)=⟨eMZ⟩aQ_b(M)= e^MZ _a with Z=log(1−pb,a)Z= (1 - p_b,a), the function logQb(M) Q_b(M) is a cumulant generating function and is therefore convex with logQb(0)=0 Q_b(0)=0; hence Rb(M)R_b(M) is concave, Rb(M)/MR_b(M)/M is non-increasing, and Qb(M)≥Qb(1)Mfor every prompt and every M,Q_b(M)≥ Q_b(1)^M every prompt and every M\;, (26) with a gap growing like (M−1)Vara(p)(M-1)\, Var_a(p). Hence if sampling completions costs the same (or more) than sampling augmentations M⋆=1M =1 is optimal. An attacker should spend everything on distinct augmentations. However under some metrics (FLOPS for example) completions might be cheaper to sample than augmentations. A fresh augmentation requires a fresh prefill, whereas an extra completion of an augmentation already in cache does not, so in forward-pass units the cost of an (N,M)(N,M) attack is C(N,M)=N(r+M)C(N,M)=N(r+M), with r the prefill cost expressed in completions. At fixed C the survival of prompt b is exp[−NRb(M)]=exp[−CRb(M)/(r+M)] [-NR_b(M)]= [-C\,R_b(M)/(r+M)], so minimizing it means maximizing g(M)=Rb(M)/(r+M)g(M)=R_b(M)/(r+M) which satisfies (r+M⋆)Rb′(M⋆)=Rb(M⋆). (r+M )R_b (M )=R_b(M )\;. (27) With the Beta soft wall p∼B(βbT,cb)p B( _bT,c_b), for which Qb(M)=⟨(1−p)M⟩=B(βbT,cb+M)/B(βbT,cb)Q_b(M)= (1-p)^M =B( _bT,c_b+M)/B( _bT,c_b) with B denoting Euler’s Beta function, we have Rb(M)=logB(βbT,cb)B(βbT,cb+M),Rb′(M)=ψ(βbT+cb+M)−ψ(cb+M),R_b(M)= B( _bT,c_b)B( _bT,c_b+M)\;, R_b (M)=ψ\! ( _bT+c_b+M )-ψ\! (c_b+M )\;, (28) with ψ the digamma function. Hence, M⋆=1M =1 iff g′(1)≤0g (1)≤ 0, i.e. iff (r+1)Rb′(1)≤Rb(1)(r+1)R_b (1)≤ R_b(1), which expanded to second order in p reads M⋆=1⇔r≤Vara(p)2⟨p⟩a=1−qb2(βbT+cb+1) where qb=⟨pb,a⟩a.M =1 r≤ Var_a(p)2 p _a= 1-q_b2 ( _bT+c_b+1 ) ~~where~~q_b= p_b,a _a\;. (29) In other words, repeated completions amortize the prefill cost if and only if the within-prompt spread of escape probabilities outweighs the prefill cost. The threshold is small for the models we measured. For Qwen2.5-3B-Instruct (βbT≃0.41 _bT 0.41, cb≃8c_b 8, hence qb≃0.049q_b 0.049) it is r⋆≃0.05r 0.05. Solving Eq. (27) at that fit gives M⋆=1.3,2.6,4.3,6.2,9.1M =1.3,2.6,4.3,6.2,9.1 at r=0.1,0.4,1,2,4r=0.1,0.4,1,2,4: the compute-optimal attack is not M=1M=1 but a handful of completions per augmentation, amortizing each prefill. Appendix C Estimator details and identifiability Clamping. The barrier αb _b of Eq. (3) is Gaussian, so a fraction of the population is negative and the raw Arrhenius expression would exceed one there. Drawing from the fitted population of each model, the clamp of Eq. (1) is active on 7.3%7.3\% of the (b,a)(b,a) draws for Llama-3.1-8B-Instruct, 0.8%0.8\% for Qwen2.5-7B (base), 0.6%0.6\% for Qwen2.5-7B-Instruct, 0.02%0.02\% for Qwen2.5-3B-Instruct and never for Gemma-2-9B-it. Survival estimator. The population survival of Sec. 4.3 involves no fit and no censoring. Instead it is counted directly from the 10410^4-augmentation arms, over all 400400 prompts. On Qwen2.5-3B-Instruct every one of them is jailbroken at least 9090 times, so none of them have to be censored. The soft wall. Eq. (18) says the escape probabilities of a prompt follow a power law ρ(p)∝pβbT−1ρ(p) p _bT-1 cut off at p=e−αbp=e^- _b, so in principle (αb,βb)( _b, _b) can be read off the exponent and the support edge. The edge estimator is unusable in practice. Since it is the maximum of N draws its variance does not decrease with M. We therefore replace the hard cutoff by the Beta soft wall pb,a∼B(βbT,cb),p_b,a B( _bT,c_b)\;, (30) and fit (βbT,cb)( _bT,c_b) by maximum likelihood on the Beta-Binomial model kb,a∼Binomial(M,p)k_b,a Binomial(M,p), with αb _b recovered through Eq. (20). The Beta of Eq. (30) is a deliberate misspecification of the hard-edged law it replaces. However, we checked that by simulating Eq. (3) on synthetic data comparing the soft wall with the ground truth the shape parameters remain the same up to a few tenths which once again is within our reported error bars. Limitations. This fit has two main limitations. A prompt with no jailbreak at all carries no information about either parameter and is dropped; we require at least three hits in total across the augmentations of a prompt (i.e. ∑ak^b,a≥3 _a k_b,a≥ 3), and discard fits with unrealistic parameters (βbT∉[10−3,50] _bT∉[10^-3,50] or cb∉[10−3,105]c_b∉[10^-3,10^5]) which typically correspond to augmentations which have led to gibberish completions. The number of prompts the fit retains is 400400 of 400400 for Qwen2.5-3B-Instruct, 383383 of 400400 for Qwen2.5-7B-Instruct, 9191 of 100100 for Qwen2.5-7B (base), 8989 of 100100 for Gemma-2-9B-it and 8080 of 100100 for Llama-3.1-8B-Instruct. Retrieving them would require an attack with a much larger N (or M or both). Second, the two parameters are separately identifiable only when the completion budget resolves the shape of the p distribution in Eq. (18) which is only possible for M≳10M 10. Appendix D Experimental protocol Table 2 lists every generation run behind the figures. All runs use the AdvBench harmful-behavior set (Zou et al., 2023a), sample with T as stated and top_p=1 top\_p=1, and cap completions at 9696 new tokens, which is ample for a judge to decide and keeps the arms affordable. Every completion is scored by Granite-Guardian-3.0-2B (Padhi et al., 2024) as the primary graded judge, with HarmBench-Llama-2-13b-cls (Mazeika et al., 2024) as a control on the two large grids; a completion counts as unsafe when the judge’s harm probability exceeds τ=0.5τ=0.5, and τ∈0.1,0.3τ∈\0.1,0.3\ is recorded so that the threshold can be swept without regenerating. Model Kernel σ Prompts N×MN× M Role Qwen2.5-3B-Instruct embedding 0.0480.048 400400 100×300100× 300 main grid Qwen2.5-3B-Instruct embedding 0.0480.048 400400 104×110^4× 1 far-N arm Qwen2.5-7B-Instruct embedding 0.0380.038 400400 100×300100× 300 main grid Qwen2.5-7B-Instruct embedding 0.0380.038 400400 104×110^4× 1 far-N arm Qwen2.5-7B (base) embedding 0.0380.038 100100 40×2040× 20 alignment comparison Gemma-2-9B-it embedding 0.0800.080 100100 40×3240× 32 cross-family Llama-3.1-8B-Instruct embedding 0.0150.015 100100 40×3240× 32 cross-family Qwen2.5-3B-Instruct character 0.250.25 100100 100×200100× 200 kernel control Qwen2.5-3B-Instruct embedding 0.0480.048 100100 100×300100× 300 T∈0.5,0.75,1.25,1.5T∈\0.5,0.75,1.25,1.5\ sweep Qwen2.5-3B-Instruct embedding 0.0480.048 6060 100×1000100× 1000 high-resolution p Qwen2.5-3B-Instruct embedding 66 values, 0.0240.024–0.0760.076 400400 400400 σ calibration sweep Qwen2.5-3B-Instruct embedding 66 values, 0.0240.024–0.0760.076 100100 50×10050× 100 σ robustness (App. E) Table 2: Generation runs. N×MN× M is augmentations times completions per augmentation, per prompt. The embedding kernel adds isotropic Gaussian noise to the input embeddings of the user-content tokens only, leaving the chat template clean; the character kernel perturbs the prompt string. All runs are at T=1T=1 unless stated. The character kernel is the augmentation of Hughes et al. (2024). Each letter is case-flipped with probability σ, the interior of each word of four characters or more is randomly permuted with probability σ, and each character is replaced by a random letter or duplicated with probability σ/10σ/10. All runs are at T=1T=1 unless stated otherwise. Layers and probes. Every residual-stream experiment in this paper is run on Qwen2.5-3B-Instruct at layer 3030 of its 3636 blocks, reading the last-token residual. The safety readout of Fig. 3(a) is a ridge regression at penalty 10310^3 on standardized residuals, mean-pooled over the tokens of the completion, with the judge’s binary label as target. The saddle probe of Fig. 3(b) is a ridge regression of the within-prompt centred logpb,a p_b,a on the within-prompt centred residual of the augmented prompt, with the penalty selected from 102,103,104,105,106\10^2,10^3,10^4,10^5,10^6\. Choosing σ. The augmentation scale is quoted in raw embedding units, with no rescaling by the embedding norm. Embedding scales differ by an order of magnitude across families, so σ does not transfer between them and each model is calibrated on its own. To calibrate σ we sweep σ and take the value at which the median per-prompt jailbreak rate first lands in the 11% to 5%5\% band. The usable window can be narrow. For example, Llama-3.1-8B has a median rate of 00 at σ=0.013σ=0.013 and 0.180.18 at σ=0.017σ=0.017, and by σ=0.04σ=0.04 the completions are no longer fluent. App. E shows what the fitted parameters do as this choice is varied. Appendix E Augmentation scale robustness Every grid in this paper is run at one augmentation scale σ, chosen per model by the calibration of Sec. D. To study the dependence of our 4-parameter family on σ we ran a sweep over 100100 behaviors × 50×\,50 augmentations × 100×\,100 completions for 6 values of σ for Qwen-3B-Instruct. The prompt set is identical across the six. σ median rate μα _α σα _α μβ _β σβ _β μE _E σE _E 0.0240.024 0.0030.003 3.49±0.243.49_± 0.24 1.68±0.181.68_± 0.18 −1.74±0.28-1.74_± 0.28 1.90±0.161.90_± 0.16 5.62±0.175.62_± 0.17 1.17±0.091.17_± 0.09 0.0300.030 0.0070.007 2.60±0.172.60_± 0.17 1.58±0.091.58_± 0.09 −2.09±0.14-2.09_± 0.14 1.32±0.111.32_± 0.11 4.91±0.144.91_± 0.14 1.32±0.071.32_± 0.07 0.0380.038 0.0320.032 1.84±0.101.84_± 0.10 1.01±0.061.01_± 0.06 −1.34±0.08-1.34_± 0.08 0.83±0.070.83_± 0.07 3.47±0.093.47_± 0.09 0.92±0.070.92_± 0.07 0.0480.048 0.0520.052 1.72±0.071.72_± 0.07 0.77±0.050.77_± 0.05 −1.04±0.07-1.04_± 0.07 0.73±0.060.73_± 0.06 3.11±0.073.11_± 0.07 0.68±0.060.68_± 0.06 0.0600.060 0.0370.037 1.89±0.101.89_± 0.10 0.99±0.060.99_± 0.06 −1.22±0.07-1.22_± 0.07 0.69±0.060.69_± 0.06 3.41±0.083.41_± 0.08 0.77±0.050.77_± 0.05 0.0760.076 0.0460.046 1.47±0.091.47_± 0.09 0.88±0.070.88_± 0.07 −1.54±0.06-1.54_± 0.06 0.63±0.070.63_± 0.07 3.23±0.063.23_± 0.06 0.65±0.050.65_± 0.05 Table 3: The four numbers and the effective barrier as the augmentation scale is swept, Qwen2.5-3B-Instruct, 100×50×100100× 50× 100 per σ, Granite judge, T=1T=1. Error bars are ±1± 1 s.d. from a paired prompt bootstrap (10001000 resamples). ‘Median rate’ is the median single-attempt jailbreak rate ⟨pb,a⟩a p_b,a _a. The main text uses σ=0.048σ=0.048. The parameters clearly depend on σ. Higher values of σ progressively erode the safety barriers installed by the model (i.e. lower μα _α and raise μβ _β). Eventually too high values of σ hit a ceiling where increased noise destroys too much of the original prompt and the completions start lose coherence. The trends in the 4 parameter family follow the behavior of the median rate, which is the best proxy to determine the ‘attack strength’. To be able to compare different models one should not aim at keeping σ fixed, but instead try to match their median jailbreak rates as detailed in App. D. Appendix F Augmentation kernel robustness The main text augments by adding isotropic Gaussian noise to the input embeddings of the user-content tokens which is a white-box operation. A black-box attacker instead perturbs the prompt string, which is the character kernel of Table 2. As shown in Table 4, the safety parameters (μα,σα,μβ,σβ _α, _α, _β, _β) depend on the attack type. However, the general form of our microscopic model (entropic bottleneck, hyperplane, exponential saddles) is universal. In other words, our 4-parameter family fitted on model X attacked via augmentation Y encodes: how resilient is model X to a BoN attack under Y. Therefore, this 4-parameter fit allows us to compare different models’ safety under the same augmentation, or the susceptibility of a single model to different types of augmentations. Notice however that at approximately equal median rate (character kernel with σ=0.25σ=0.25 compared to embedding kernel at σ=0.030σ=0.030) the 4-parameter family seem to largely agree (within noise) which might suggest some universality in the way in which the model defends itself against any kind of augmentation. median rate μα _α σα _α μβ _β σβ _β μE _E σE _E character, σ=0.25σ=0.25 0.0120.012 2.33±0.122.33_± 0.12 1.23±0.111.23_± 0.11 −1.71±0.09-1.71_± 0.09 1.00±0.071.00_± 0.07 4.28±0.134.28_± 0.13 1.26±0.071.26_± 0.07 embedding, σ=0.048σ=0.048 0.0540.054 1.68±0.061.68_± 0.06 0.60±0.040.60_± 0.04 −1.00±0.06-1.00_± 0.06 0.57±0.040.57_± 0.04 3.02±0.053.02_± 0.05 0.55±0.040.55_± 0.04 embedding, σ=0.030σ=0.030 0.0070.007 2.60±0.172.60_± 0.17 1.58±0.091.58_± 0.09 −2.09±0.14-2.09_± 0.14 1.32±0.111.32_± 0.11 4.91±0.144.91_± 0.14 1.32±0.071.32_± 0.07 Table 4: The two augmentation kernels on the same model and the same 100100 prompts. Error bars are ±1± 1 s.d. from a paired prompt bootstrap (10001000 resamples). The structure is universal. Under the character kernel the standardized αb _b is still indistinguishable from a Gaussian (KS p=0.94p=0.94) and standardized logβb _b from a normal (KS p=0.95p=0.95). Reconstructing the full ASR@(NM) ASR@ NM surface from the four fitted numbers over (N≤100N≤ 100, M≤50M≤ 50) gives a mean absolute error of 0.0190.019 under the character kernel. Therefore, although the parameters may vary, the structure in Sec. 3 is universal across augmentation kernels. Appendix G Judge robustness The notion of safety is dependent on the judge. Hence all the fit parameters (μα,σα,μβ,σβ)( _α, _α, _β, _β) depend on the judge’s notion of safety. However, the actual scaling forms, Gaussian and log-normal structures are universal. Every number in the main text is graded by Granite-Guardian-3.0-2B. Because an automated judge defines what counts as a jailbreak, we re-scored the identical generations of the Qwen2.5-3B-Instruct grid (400400 prompts × 100100 augmentations × 300300 completions, 1.2×1071.2× 10^7 completions) with HarmBench-Llama-2-13b-cls (Mazeika et al., 2024) and repeated the whole estimation. No generation differs between the two columns of Table 5; only the label does. Granite-Guardian-3.0-2B HarmBench-Llama-2-13b-cls per-completion success rate 0.0440.044 0.0030.003 μα _α (base alignment) 1.831.83 4.664.66 σα _α 0.650.65 1.041.04 μβ _β (susceptibility) −0.88-0.88 −1.53-1.53 σβ _β 0.520.52 0.770.77 μE _E (effective barrier) 3.083.08 6.436.43 σE _E 0.580.58 1.091.09 prompts never jailbroken 00 22 Table 5: The same generations scored by two judges. HarmBench is far stricter, so every barrier scale shifts, but the shape of the model survives: αb _b stays Gaussian, logβb _b stays log-normal, and the ordering of the two channels is unchanged. HarmBench calls 0.3%0.3\% of completions unsafe against Granite’s 4.4%4.4\%, which raises the mean barrier by μEHB−μEGr=3.35 _E HB- _E Gr=3.35 which is expected given the judge is stricter. More importantly, the distribution families are judge-independent. Standardized αb _b remains indistinguishable from a Gaussian under both judges, and the susceptibility βb _b stays log-normal. The stricter judge widens both spreads (σα _α from 0.650.65 to 1.041.04, σβ _β from 0.520.52 to 0.770.77) because it pushes the hardest prompts further into the tail.