The Activation-Cone Blind Spot, or Why Your Jailbreak Defense Can’t See Prefilling

Prompt-time activation defenses stop GCG and AutoDAN cold, then fail half the time against prefilling. New paper: why that blind spot is structural, and how a linear probe on the first generated tokens closes it - AUROC 0.97-1.00 across seven models, zero prefilling success when composed with steering.