Paired response final divergence signatures of jailbreak vulnerability in large language models

Large language models (LLMs) are increasingly deployed in safety-critical applications, making their susceptibility to jailbreak attacks a critical concern. While prior work has investigated factors affecting model safety, the representational mechanisms underlying variation in jailbreak vulnerability remain poorly understood. This paper introduces a paired response-final divergence framework that characterizes jailbreak-induced representational displacement between same-goal direct and jailbreak responses using hidden states extracted at the final generated token. This framework is applied to 15 open-source LLMs spanning different model families, four alignment strategies, and four attack types. The framework yields three principal findings: First, Difference-in-Means refusal direction suppression showed the largest observed cross-model association with jailbreak amplification among the evaluated representational measures. Second, family-averaged divergence profiles reveal early-onset representational separation in LLM families like Vicuna, while LLaMA models exhibit comparatively lower and more gradual divergence than Vicuna across normalized layer depth. Third, divergence–ΔASR correlation is attack-type-specific: authority framing ( r = 0.836) and context manipulation ( r = 0.712) produce stronger model-family discrimination, whereas roleplay-based attacks do not. These findings yield a three-profile representational taxonomy: structurally resistant, early-displaced vulnerable, and ceiling-compromised, that provides a representational grounding for the behavioral patterns observed in the evaluated LLM set, with direct implications for safety evaluation design and model selection in high-stakes deployment.