Bounded Reachability & Jailbreak Detection via Contraction-Constrained State Space Models
The paper studies when lightweight SSM-based safety heads for LLMs can be formally certified to give the same harmful/benign prediction under bounded embedding-space perturbations, showing that robust reachability certification hinges on the state transition matrix being contractive in l∞ norm. Its neat contribution is tying jailbreak-detector robustness to a sharp, empirically validated phase transition at ||A||∞ = 1 and using contraction regularization to improve certified robustness, though the practical upside is more about certification than better detection since simple linear probes on pretrained embeddings match or beat the S4 head, and the guarantees live in embedding space rather than over natural-language edits.
Abstract
Safety heads are lightweight classifiers attached to pretrained language models for flagging harmful inputs before generation. Their empirical detection performance has been studied, but their formal robustness properties remain largely unexplored. We ask when a State Space Model (SSM)-based safety head can be certified to produce the same prediction for all inputs within a bounded embedding-space perturbation. We prove that the answer turns on a single condition: the $l_\infty$ norm of the state transition matrix must satisfy $\norm{A}_\infty<1$ (the \emph{contraction condition}), which enables exact interval bound propagation (IBP) certification for linear time-invariant classifiers. When the contraction condition holds, the reachable output interval has bounded steady-state width and examples can be certified as robustly classified. When it fails, the interval grows exponentially with sequence length and certification is impossible at any practical perturbation radius. We enforce contraction with a hinge penalty and show on toxic comment data that certified fraction improves from 41\% to 59\%, with a sharp empirical phase transition at $\norm{A}_\infty=1$ matching the theory. Applying a contraction-regularized S4 head to jailbreak detection on JailbreakBench, we achieve a zero-shot transfer to AdvBench (DR=0.994) and HarmBench (DR=0.988). A logistic regression on mean-pooled Mamba-130M embeddings matches or exceeds the S4 head on every detection metric, confirming that harmful intent is already linearly separable in the embedding space. The S4 safety head's contribution is not superior discrimination but the formal certification that no probe-based approach provides.