Refusal-Escape Directions (RED) are local continuous perturbation directions near harmful inputs that shift model behavior from refusal to compliance while preserving harmful-semantics interpretation — giving a mechanistic, operator-level account of why jailbreaks structurally work. The framework proves that fine-tuning-based alignment cannot eliminate RED without capability loss, establishing a fundamental safety-utility trade-off that output-level defenses cannot resolve.

Grammar-Constrained Decoding (GCD) is a reliability tool that enforces syntactic validity in LLM code output — but the reliability mechanism is itself an attack surface. CodeSpear shows that applying a benign code grammar constraint shifts the generation distribution into a code-conditioned mode where safety guardrails are less active, enabling elicitation of malicious code from aligned models without modifying the harmful intent in the prompt. CodeShield defends by training the model to emit honeypot code (syntactically valid, functionally harmless) under attacker-controlled grammar constraints, robustly preserving safe behavior.