Thank you for your thoughtful review and accurate summary of our paper. We appreciate your recognition that our "claims are supported by the evidence" and that "SaP indeed addresses the problem of learning safety constraints automatically for LLMs."

Regarding Scalability

We appreciate your question about the scalability of our approach. We acknowledge that polytope learning presents inherent scalability challenges, which is precisely why we adopted the Convex Polytope Machine (CPM) algorithm instead of traditional methods like QuickHull. This design choice was deliberate to address the computational complexity issues in high-dimensional representation spaces.

Our empirical results demonstrate CPM's effectiveness at scale:

On the BeaverTails dataset (330K examples), our method achieves performance comparable to MLPs with similar parameter counts (Appendix D.3, Table 12). For the HarmBench defense task with ~890K data points, SaP achieves an average safety classification accuracy of 91.3% and maintains attack success rates below 5%, further validating its effectiveness at scale.

Based on these results, we expect CPM to perform robustly (on par with MLP) on datasets of similar or even larger scale. In Section 6, we discuss future directions for improving beyond CPM, including references to promising work like Hashimoto et al. (2023) on neural polytope learning.

For practical applications, the inference-time steering mechanism remains efficient regardless of training data size, as it only requires a forward pass through the concept encoder followed by verification against the learned polytope facets.

Regarding Missing References

Thank you for suggesting the valuable references (Li et al., 2023 and Song et al., 2024) on MDP modeling for LLMs. We will incorporate these references in our revised manuscript to strengthen the discussion on using MDPs as a theoretical foundation for language model behavior. These papers provide important context for our approach to modeling language generation as a constrained MDP.

We greatly appreciate your feedback and we are happy to address any further questions or comments.

Having addressed your concerns, we would appreciate your feedback during this discussion period. Let us know if there are any further questions that we can clarify, otherwise, we would appreciate it if you would consider increasing your score.

We sincerely thank you for your thoughtful review. We particularly appreciate your recognition of our paper's key strengths:

• The "novel method to steer model activations from harmful regions to safe regions"
• Our "several ablation studies to investigate the individual components of [our] mechanism"
• The comprehensive evaluation across "several adversarial attacks" and "multiple models"

Clarification on Paper Focus and Contributions

We would like to first clarify that SaP is not primarily a jailbreak defense paper. Our key contribution is reformulating safety as a geometric constraint learning problem in representation space, which provides both interpretable insights (through facet specialization) and an effective control mechanism (which includes but is not limited to defense). This geometric perspective offers a principled framework for conceptualizing and controlling model safety behaviors. Throughout the paper, we consistently frame our approach in terms of "safety" and "constraints" in their general sense:

1. In Section 2, we discuss how "safe and ethical language not only tries to maximize a reward function, but is also subject to some constraints. For instance, humans naturally avoid using language that would hurt someone's feelings, incite harm, or solicit unlawful actions."
2. Our extensive experiments on BeaverTails (Sections 4.2-4.3) span 14 distinct safety categories, including animal abuse, discrimination, privacy violations, and misinformation—far beyond just jailbreak prevention.

That said, we agree that stronger defense performance can better support our perspective of geometric constraint learning. We therefore conducted the additional experiments you requested.

Regarding Stronger and Adaptive Attacks As you suggested, we have evaluated our defense against stronger and more recent attacks. In our response to Reviewer FoeD, we report results on AutoDAN and adaptive attacks. Please refer to it for detailed setting and discussions. Notably:

1. For AutoDAN, our method reduces ASR from 66.75% to 1.35% on Ministral-8B, from 1.77% to 0% on Llama2-7B, and from 45% to 0.80% on Qwen2-1.5B.
2. For adaptive attacks (on AdvBench), our method achieves 0% ASR for Llama2-7B by directly transferring our trained polytope and hyperparameter settings. With a slight increase in unsafe penalty, Ministral-8B can be steered from 100% ASR to 12%.

Regarding Utility Evaluation

Reviewer concern: "Could the authors add more suitable utility evaluation benchmarks to investigate model capability? E.g., MT-Bench and over-refusal benchmarks"

We agree that MMLU alone may not fully represent model capabilities. Following your suggestion, we conducted additional evaluations on MT-Bench:

While the results suggest that models with SaP maintain performance and can generate coherent sentences without over-refusing on MT-Bench, we do not intend to claim that SaP improves performance. The slight differences observed might be due to the inherent noise in GPT-based evaluations and the limited sample size (80 evaluation examples). We manually inspected the outputs and did not find any nonsensical or rejection responses. The results are attached in the following URL: https://limewire.com/d/asA5e#Rlx4uqoGNp

Regarding your suggestion to evaluate on benchmarks like OR-Bench, we see this as a valuable future direction. In our preliminary investigations with sensitive but benign prompts, we observe that SaP maintains high performance with minimal false positives. We would like to highlight again that the main contribution of this paper does not directly concern with proposing a new SoTA defense method, but rather to propose a new framework for explicit modeling of safety in LLMs.

Conclusion We thank you for your constructive feedback. The additional experiments have strengthened our confidence in SaP's learned safety knowledge, which supports our central contribution: reformulating language model safety as a geometric constraint learning problem in representation space. We believe this geometric perspective offers a principled framework for conceptualizing and controlling model safety behaviors beyond just jailbreak defense.

We hope our response addresses the reviewer’s remaining concerns, and given that we could address all the other concerns raised in the review, we would appreciate it if the reviewer would consider increasing our score. We are happy to answer any other open questions. Thanks again for your active engagement!

We sincerely thank the reviewer for their thoughtful analysis and valuable feedback.

We would like to first clarify that SaP is not primarily a jailbreak defense paper. Our key contribution is reformulating safety as a geometric constraint learning problem in representation space, which provides both interpretable insights and an effective control mechanisms. Throughout the paper, we consistently frame our approach in terms of "safety" and "constraints" in their general sense. Please see our reply to Reviewer aHnQ for an expanded explanation on this.

Specific Responses to Concerns

"Overfit Problem"

We thank you for this insightful comment. We agree that only training on GCG will cause SaP to overfit to its specific attack pattern. However, this is not directly a weakness of SaP, as it can be easily mitigated by training it with data collected from diverse sources. This is to be expected, as machine learning models, SaP being no exception, are generally only as good as their training data (no free lunch).

To address the concern about overfitting to specific attack patterns, we conducted additional experiments with attacks not seen during training. The polytopes used in the following experiments are the same ones we trained for reporting the main results in the paper, with no access to any new information.

AutoDAN ASR (5 seeds):

Adaptive attack:

The adaptive attack experiments were conducted on AdvBench, following the original released code implementation, which contains requests not seen in HarmBench. To the best of our knowledge, three papers to date report defense performance on adaptive attacks, and the most comparable result is from Yi et al., 2025, where they also train their defense methods on HarmBench and test on AdvBench for adaptive attacks. Their best reported performance across 9 defense methods on Llama3-8B is 61% ASR (Table 2 of Yi et al.), while our method achieves 0% ASR for Llama2-7B. For Ministral, we found that a direct transfer of SaP hyperparameters trained on HarmBench doesn't defend well against adaptive attacks (98% ASR), but increasing $\lambda$ (the unsafe penalty) can substantially reduce this to 12% ASR. For Qwen2, we discovered that adaptive attack learns to induce harmful responses in Chinese, which our English-trained SaP can't effectively counter. This highlights an interesting direction for future work on multi-lingual adversarial defense through geometric constraints.

"Refusal Pattern After Training"

Throughout numerous adversarial inputs, the polytope learns to steer models toward safety in a nuanced way. We observe that it guides models to incorporate common refusal phrases like "Sorry", "can't answer this question", "I'm just an AI", etc. We are happy to include qualitative examples in the revised manuscript, if requested.

"Unfair Baseline Comparison"

We appreciate this concern. Our additional experiments with AutoDAN and adaptive attacks address this by testing on both attack types and adversarial requests not seen during training (generalization from HarmBench to AdvBench). These results strongly support the generalization capabilities of SaP beyond specific patterns used in training.

"Simple MLP may also work"

From our experiments on BeaverTails, we do see that SaP performs similarly to an MLP with comparable parameter count. However, rejecting based on binary classification might result in over-rejection, which we experimented with and reported in Figure 2, Rejection Sampling (RJ). It reduces Ministral's MMLU performance from 63.4% to 28.5%. Furthermore, polytope constraints offer interpretability benefits that are not possible with a standard MLP, as discussed in our paper's Section 4.2.

"MMLU does not prove that standard performance is maintained"

Regarding your suggestion to evaluate on benchmarks like OR-Bench, we see this as a valuable future direction. In our preliminary investigations with sensitive but benign prompts, we observe that SaP maintains high performance with minimal false positives. We would like to highlight again that the main contribution of this paper does not directly concern proposing a new SoTA defense method, but rather to propose a new framework for explicit modeling of safety in LLMs.

We thank you once again for your feedback and hope our responses adequately address your concerns. We'd be happy if you would consider revising our score, and we are happy to answer any other open questions. Thanks again for your feedback and active engagement in the review process.

We sincerely thank the reviewer for their thoughtful analysis and constructive feedback. We appreciate your recognition of our paper's key contributions:

1. The novel geometric approach to LLM safety through representation space constraints.

2. The effectiveness of SaP in defending against adversarial attacks while maintaining model capabilities

3. The interpretability insights provided by our analysis showing how different safety constraints specialize in detecting specific types of unsafe content.

Below, we address your specific questions and suggestions:

Regarding experimental methodology:

Question: "Could you clarify the number of seeded runs of the different experiments?"

We apologize for the confusion. This is indeed a typo in Appendix C.2. All methods (including baselines) were evaluated over 5 seeds. As shown in Tables 1-4 in the appendix, we report means and standard deviations calculated over 5 seeds for all methods. We will correct this inconsistency in the revised manuscript.

Regarding computational overhead during inference:

Question: "While the authors state that 'our approach scales efficiently to large batches via existing tools for vectorized computation' the computational overhead during inference is unclear. Therefore some uncertainty of the approach's practicability remains."

Thank you for raising this important point. We have conducted additional experiments to quantify the inference cost of SaP. First, we measured the average per-token processing time with and without SaP across all three model architectures:

While SaP adds approximately 8-35% overhead at the per-token level, this efficiency advantage becomes even more significant when comparing end-to-end runtime for practical tasks. For the MMLU benchmark, all runs conducted on A100 40GB GPUs via clean slurm jobs with no other program interference. For these baselines, we use the implementation from the llm-jailbreaking-defense benchmark.

These results demonstrate that SaP provides a dramatically more efficient safety mechanism compared to prompt-based alternatives, requiring only 1.6× the baseline runtime while other methods require 26-29× more time. This substantial efficiency advantage stems from SaP's direct manipulation of model representations rather than relying on multiple forward passes or additional inference steps that characterize most prompt-based approaches.

Regarding additional comparisons with related methods:

Concern: "[...] lacks a comparison to related inference time steering methods such as 1) steering vectors and 2) especially SAEs."

We appreciate this valuable suggestion. Our concept encoder indeed shares implementation similarities with Sparse Autoencoders (SAEs), and we view the polytope constraint mechanism as offering a complementary geometric perspective compared to steering vectors.

We agree these comparisons would strengthen our paper and plan to:

1. Provide a more thorough analysis of how our concept encoder relates to and differs from SAEs and steering vectors
2. Incorporate the suggested references and Wu et al. (2025) in our revised manuscript
3. Expand our discussion of related inference-time approaches to better position our work within this literature

We believe these additions will address your concerns and enhance the paper's contribution to the field of LLM safety. Having addressed your concerns, we would appreciate your feedback during this discussion period. Let us know if there are any further questions that we can clarify, otherwise, we would appreciate it if you would consider increasing your score.