{"id":"https://openalex.org/W7162417906","doi":"https://doi.org/10.48550/arxiv.2605.24552","title":"Ellipsoid Control: A White-list Jailbreak Defense via Benign Latent Modeling","display_name":"Ellipsoid Control: A White-list Jailbreak Defense via Benign Latent Modeling","publication_year":2026,"publication_date":"2026-05-23","ids":{"openalex":"https://openalex.org/W7162417906","doi":"https://doi.org/10.48550/arxiv.2605.24552"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.24552","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.24552","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.24552","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5137005488","display_name":"Luoyu Chen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chen, Luoyu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137019640","display_name":"Weiqi Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Weiqi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5059567156","display_name":"Zhiyi Tian","orcid":"https://orcid.org/0000-0001-8905-0941"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Tian, Zhiyi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137013021","display_name":"Feng Wu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wu, Feng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137029506","display_name":"Ahmed Asiri","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Asiri, Ahmed","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5137012003","display_name":"Shui Yu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yu, Shui","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.8996000289916992,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.8996000289916992,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.030700000002980232,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.02419999986886978,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ellipsoid","display_name":"Ellipsoid","score":0.824400007724762},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.660099983215332},{"id":"https://openalex.org/keywords/constraint","display_name":"Constraint (computer-aided design)","score":0.5569000244140625},{"id":"https://openalex.org/keywords/representation","display_name":"Representation (politics)","score":0.48089998960494995},{"id":"https://openalex.org/keywords/gradient-descent","display_name":"Gradient descent","score":0.46230000257492065},{"id":"https://openalex.org/keywords/distortion","display_name":"Distortion (music)","score":0.39969998598098755}],"concepts":[{"id":"https://openalex.org/C57489055","wikidata":"https://www.wikidata.org/wiki/Q190046","display_name":"Ellipsoid","level":2,"score":0.824400007724762},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.660099983215332},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.61080002784729},{"id":"https://openalex.org/C2776036281","wikidata":"https://www.wikidata.org/wiki/Q48769818","display_name":"Constraint (computer-aided design)","level":2,"score":0.5569000244140625},{"id":"https://openalex.org/C2776359362","wikidata":"https://www.wikidata.org/wiki/Q2145286","display_name":"Representation (politics)","level":3,"score":0.48089998960494995},{"id":"https://openalex.org/C153258448","wikidata":"https://www.wikidata.org/wiki/Q1199743","display_name":"Gradient descent","level":3,"score":0.46230000257492065},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4278999865055084},{"id":"https://openalex.org/C126780896","wikidata":"https://www.wikidata.org/wiki/Q899871","display_name":"Distortion (music)","level":4,"score":0.39969998598098755},{"id":"https://openalex.org/C51167844","wikidata":"https://www.wikidata.org/wiki/Q4422623","display_name":"Latent variable","level":2,"score":0.3521000146865845},{"id":"https://openalex.org/C2779530757","wikidata":"https://www.wikidata.org/wiki/Q1207505","display_name":"Quality (philosophy)","level":2,"score":0.334199994802475},{"id":"https://openalex.org/C29230964","wikidata":"https://www.wikidata.org/wiki/Q5164376","display_name":"Constraint learning","level":5,"score":0.3197999894618988},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.29159998893737793},{"id":"https://openalex.org/C24756922","wikidata":"https://www.wikidata.org/wiki/Q1757694","display_name":"Data quality","level":3,"score":0.27379998564720154},{"id":"https://openalex.org/C110121322","wikidata":"https://www.wikidata.org/wiki/Q865811","display_name":"Distribution (mathematics)","level":2,"score":0.2646999955177307}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.24552","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.24552","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.24552","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.24552","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.8066291809082031,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Representation":[0],"engineering":[1],"(RepE)":[2],"defenses":[3,46,72,79],"have":[4],"shown":[5],"strong":[6],"robustness":[7],"against":[8],"jailbreak":[9,32,216,240],"attacks":[10],"on":[11,21,113,172],"large":[12],"language":[13],"models":[14,60],"(LLMs).":[15],"However,":[16],"these":[17],"methods":[18],"fundamentally":[19],"rely":[20],"black-list":[22],"supervision:":[23],"they":[24],"learn":[25],"jailbreak-to-refusal":[26],"activation":[27],"transformations":[28],"from":[29,190],"harmful":[30,57,76,89],"or":[31],"data":[33,193],"that":[34,73,80,118,142,168],"are":[35,121],"inherently":[36],"incomplete":[37],"and":[38,53,78,102,220],"continuously":[39],"evolving.":[40],"Hence,":[41],"the":[42,51,69,88,93,95,100,127,143,181,196,202,233,236],"performance":[43],"of":[44,55,104,201,235],"RepE-based":[45],"becomes":[47],"tightly":[48],"coupled":[49],"to":[50,62,110,176,194,198],"quality":[52],"coverage":[54],"collected":[56],"samples,":[58],"leaving":[59],"vulnerable":[61],"unseen":[63],"attacks.":[64],"This":[65,125,206],"reliance":[66],"also":[67],"obscures":[68],"distinction":[70],"between":[71],"fit":[74],"known":[75],"distributions":[77],"protect":[81],"a":[82,136,160],"benign":[83,105,144,192,203,218],"latent":[84,145,204],"region":[85],"without":[86],"estimating":[87],"distribution.":[90],"We":[91],"adopt":[92],"opposite,":[94],"white-list":[96,237],"perspective,":[97],"by":[98],"leveraging":[99],"accessibility":[101],"abundance":[103],"data.":[106],"The":[107],"goal":[108],"is":[109,151,188],"elicit":[111,170],"refusal":[112,150,171],"arbitrary":[114,173],"inputs":[115,120],"while":[116,149,228],"ensuring":[117],"harmless":[119],"not":[122],"falsely":[123],"rejected.":[124],"shifts":[126],"core":[128],"research":[129],"question":[130],"to:":[131],"How":[132],"can":[133,169],"we":[134,156],"design":[135],"robust":[137],"benign-latent":[138],"preservation":[139],"mechanism":[140],"such":[141],"distribution":[146],"remains":[147],"intact":[148],"elicited?":[152],"To":[153],"answer":[154],"this,":[155],"propose":[157],"Ellipsoid":[158,223],"Control,":[159],"test-time":[161],"defense.":[162],"It":[163],"performs":[164],"projected":[165],"gradient":[166],"descent":[167],"inputs,":[174],"aiming":[175],"improve":[177],"defense":[178,241],"effectiveness.":[179],"At":[180],"same":[182],"time,":[183],"an":[184],"anisotropic":[185],"benign-geometry":[186],"ellipsoid":[187],"fitted":[189],"abundant":[191],"constrain":[195],"update":[197],"minimize":[199],"distortion":[200],"geometry.":[205],"tight":[207],"constraint":[208],"helps":[209],"preserve":[210],"model":[211],"utility.":[212],"Across":[213],"multiple":[214],"LLMs,":[215],"attacks,":[217],"tasks,":[219],"safety-boundary":[221],"evaluations,":[222],"Control":[224],"consistently":[225],"enhances":[226],"safety":[227],"better":[229],"preserving":[230],"utility,":[231],"demonstrating":[232],"effectiveness":[234],"approach":[238],"for":[239]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-05-27T00:00:00"}