How it works

Researchers built 2,304 paired prompts tested in both chat and agent mode across five models, then probed internal activations to find where the refusal signal degrades.