SOO Conceptual Fusion Patches Qwen 2.5 Jailbreak, Outperforms SFT

The post describes a novel application of SOO (Self-Other Overlap) conceptual fusion—originally introduced by Caraleanu et al. (2025) to reduce deceptive behavior—to patch a specific jailbreak wrapper in Qwen 2.5 1.5b. The jailbreak wrapper, identified by Julius Simonelli (2026a), asks the model to answer dangerous prompts under the guise of a novelist needing character insight, successfully evading refusal. To counteract this, the author fuses the model's activation state when receiving the jailbroken prompt (which triggers harmful output) with its state when receiving the same prompt directly (which is correctly refused). Specifically, they apply an MSE loss on the residual stream at the output of layer 18's self-attention matrix, chosen because it lies just after a known layer where refusal representations diverge (Simonelli 2026b). The loss pushes only the jailbroken activation toward refusal, without collapsing both directions.

A direct comparison with traditional supervised fine-tuning (SFT) on completions from successfully refused prompts reveals that SOO conceptual fusion achieves markedly better jailbreak patching while preserving non-refusal of safe prompts more effectively. The author highlights two key advantages: (1) SOO fine-tuning concentrates weight changes in the immediate prior layers, leaving later model layers largely unchanged, which likely reduces overfitting; (2) unlike SFT, which pushes the model toward generic refusal completions, SOO fusion aligns internal representations at a deeper level, making it harder for jailbreaks to bypass. This work suggests that conceptual fusion techniques can be precise, low-cost tools for hardening models against emergent adversarial wrappers without sacrificing general performance.