Large language models are trained to follow instructions while refusing harmful requests. Jailbreaks exploit this balance to elicit content a model would ordinarily reject. Roleplay jailbreaks are especially concerning: ordinary instructions defining a persona, scenario, and task can induce compliance while the harmful request remains plainly visible. We investigate which components drive this reversal and how they affect the computations leading to the response. Across two benchmarks, three model families, and four authored wrappers, we compare matched harmful and benign requests under controlled combinations of these components. We trace internal harmful--benign contrasts at the request and where generation begins, then evaluate selected internal interventions on held-out requests. A focused study examines influential attention heads and feed-forward computations, testing their functions and downstream connections. Our analysis yields three findings. (1) Successful attacks retain the measured harmful--benign distinction at the request, while its refusal-associated expression weakens where the answer begins, a pattern we call safety-relay attenuation. (2) The contributions of roleplay components depend on the other components present. (3) Reversing selected roleplay-associated internal changes restores refusal, demonstrating their causal influence. Together, these findings connect ordinary roleplay instructions to internal changes in refusal and motivate safeguards that preserve the influence of harm-related information on the response.

翻译：暂无翻译