Entry Point Displacement - Semantic Decomposition as an Alignment Bypass Vector in Frontier LLMs

Current LLM safety alignment reliably refuses direct requests for harmful content. The structural question is whether that refusal generalises to requests that are semantically equivalent in harm potential but framed at an adjacent point in the causal chain: asking for a mechanism rather than a procedure, a precursor transformation rather than a synthesis, an influence-operation architecture rather than a campaign instruction. This study evaluates Entry Point Displacement (EPD), a prompt decomposition technique that exploits this asymmetry. 9 frontier models across 6 providers were tested on 6 harm domains (TATP, MDMA, fentanyl, disinformation, and extremist radicalisation) using a four-variant prompt matrix (baseline plus three displacement framings), and a sixth domain that tested a multi-turn gap-filling loop applied to incendiary device construction. Responses were scored on 2 orthogonal axes: compliance-framing code (RL) and an Operational Detail Score (which measures extractable harmful content independently of compliance framing). Results were cross-validated against 2 automated safety evaluators: HarmBench and StrongReject. Across all responses in the tested runs, 77% elicited substantive content delivery and 64% scored ODS ≥ 3 (practitioner-usable). The mechanism-first framing (P2) was the most consistent bypass vector, achieving a 93% compliance rate in ODS and 79% ODS ≥ 3 rate across all testing. Influence operations domains were substantially less defended than chemistry domains across all models. HarmBench detected only 50% of bypasses identified by ODS scoring, demonstrating that standard automated evaluators exhibit the same abstraction blindness as the models they evaluate. The gap-filling loop converted partial compliance to substantial or fully operational content in 75% of applicable cases, with the model performing its own harm escalation endogenously.