{
  "docId": "019dd923-5e88-73ef-bd5d-0d0f98caffe1",
  "docSlug": "5df6bd1b0447b5f6",
  "documentTitle": "2025 Air Street Capital The State of AI Report 2025",
  "authorId": "AirStreetCapital",
  "authorName": "Air Street Capital",
  "documentKindSlug": "consulting-deck",
  "documentKindLabel": "Consulting deck",
  "sourceTypeSlug": "vc_research",
  "sourceTypeLabel": "VC research",
  "presentationDate": null,
  "orientation": "landscape",
  "aspectRatio": 1.777,
  "pageNumber": 262,
  "pageCount": 313,
  "prevPage": 261,
  "nextPage": 263,
  "slideType": "diagnosis",
  "function": "diagnose",
  "density": "overcrowded",
  "nDataPoints": 26,
  "notes": "The slide highlights a vulnerability in open-source LLMs where safety mechanisms are isolated and easily bypassed.",
  "elementsJson": [
    "headline_text",
    "action_title",
    "paragraph",
    "bullet_list",
    "bar_chart_grouped"
  ],
  "metadataConfidence": 1,
  "imagePath": null,
  "slideHref": "/slides/019dd923-5e88-73ef-bd5d-0d0f98caffe1/262",
  "deckHref": "/decks/019dd923-5e88-73ef-bd5d-0d0f98caffe1",
  "deckJsonHref": "/decks/019dd923-5e88-73ef-bd5d-0d0f98caffe1.json",
  "deckAnchorHref": "/decks/019dd923-5e88-73ef-bd5d-0d0f98caffe1#slide-262",
  "components": [
    {
      "bbox": null,
      "kind": "callout",
      "text": "Refusal behavior in 13 major chat models is controlled by a single direction in the model's internal representation space.",
      "attrs": null,
      "subkind": null,
      "toolName": "Visual emphasis",
      "toolSlug": "visual-emphasis",
      "confidence": null,
      "componentId": "019dd952-47c3-7407-8d07-b61cd254054f",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.3,
        "w": 0.4,
        "x": 0.55,
        "y": 0.4
      },
      "kind": "chart",
      "text": "Figure 3: Adding the \"refusal direction\" induces refusal on 100 harmless instructions from ALPACA.",
      "attrs": null,
      "subkind": "bar-grouped",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "347b4203-636b-4a6c-8cd5-adac5f58f01d",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.15,
        "w": 0.5,
        "x": 0.02,
        "y": 0.7
      },
      "kind": "list",
      "text": "Models maintain 99%+ accuracy on standard benchmarks (MMLU, ARC, GSM8K) after modification, with only TruthfulQA showing degradation. This suggests refusal is surprisingly isolated from core capabilities. Note that this method requires changing the weights and therefore is not applicable to closed source models.",
      "attrs": null,
      "subkind": "bullet",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "075661fd-a5ec-470b-a8e5-4d728e4326a5",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.1,
        "w": 0.5,
        "x": 0.02,
        "y": 0.58
      },
      "kind": "list",
      "text": "Adversarial suffixes work by suppressing this same direction. Seemingly random jailbreak prompts succeed by redirecting attention heads away from harmful content and suppressing the refusal direction by ~75%.",
      "attrs": null,
      "subkind": "bullet",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "3c86e048-0f37-4795-a02b-94fa7e7b951e",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.2,
        "w": 0.5,
        "x": 0.02,
        "y": 0.22
      },
      "kind": "list",
      "text": "Refusal behavior in 13 major chat models is controlled by a single direction in the model's internal representation space. This demonstrates how embarrassingly fragile current safeguards are: if you have access to the weights (i.e. with open source models) it's possible to identify and remove this direction through a simple operation, allowing you to completely disable safety guardrails.",
      "attrs": null,
      "subkind": "bullet",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "55413594-ed34-4e9f-99a5-37d470429652",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.15,
        "w": 0.5,
        "x": 0.02,
        "y": 0.42
      },
      "kind": "list",
      "text": "Minimal compute is required: jailbreaking a 70B parameter model costs <$5 and no training data or gradient optimization, only just matrix multiplication to orthogonalize weights against the refusal direction.",
      "attrs": null,
      "subkind": "bullet",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "5f69080a-97e3-47d2-bf32-4e16e854fc64",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": null,
      "kind": "metric",
      "text": "Refusal score: 99%",
      "attrs": null,
      "subkind": "primary",
      "toolName": "Quantification",
      "toolSlug": "quantification",
      "confidence": null,
      "componentId": "019dd952-47c3-7407-8d07-bb71ca311dab",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.05,
        "w": 0.75,
        "x": 0.02,
        "y": 0.14
      },
      "kind": "title",
      "text": "Single point of failure: how LLM safety mechanisms can be directly disabled",
      "attrs": null,
      "subkind": "headline",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "457f2294-6d39-4c0b-a8bc-3cfd31091fdb",
      "frameworkName": null,
      "frameworkSlug": null
    }
  ],
  "metrics": [],
  "tools": [
    {
      "name": "Logical chain",
      "slug": "logical-chain",
      "agent": null,
      "layer": "slide",
      "matchId": "347b7187-4f43-4c15-838b-dd1a2720f57e",
      "evidence": "Refusal behavior in 13 major chat models is controlled by a single direction in the model's internal representation space.",
      "confidence": 0.7
    }
  ],
  "frameworks": [],
  "arcBeats": [
    {
      "to": 282,
      "from": 190,
      "beatId": "019dd95a-0682-776c-8e35-a256fe16ea9c",
      "arcName": "The Triple Take",
      "arcSlug": "triple-take",
      "beatName": "The Implications (So What)",
      "beatSlug": "triple-take-the-implications-so-what",
      "evidence": "Sections 3-4 frame political and safety consequences of the technical/industry trends.",
      "position": 2,
      "confidence": 70,
      "parentBeatName": "Reflection",
      "parentBeatSlug": "reflection"
    },
    {
      "to": 282,
      "from": 190,
      "beatId": "019dd95a-0682-776c-8e35-b713af60bf88",
      "arcName": "The Onion",
      "arcSlug": "onion",
      "beatName": "Core Insight",
      "beatSlug": "onion-core-insight",
      "evidence": "Politics and Safety reveal the structural risks at the core.",
      "position": 4,
      "confidence": 45,
      "parentBeatName": "Turn",
      "parentBeatSlug": "turn"
    }
  ],
  "loops": [
    {
      "to": 282,
      "from": 247,
      "name": "Pre Mortem",
      "slug": "19-pre-mortem",
      "bestFor": "Project kick-offs, risk management, building trust with skeptical stakeholders",
      "matchId": "019dd95a-07fe-70ce-8d3e-bb4d43115ab4",
      "evidence": "Vibe hacking, AI psychosis, alignment faking, scheming, prompt injection — what could go wrong + mitigations.",
      "position": 12,
      "objective": "Surface AI safety failure modes before they become catastrophic",
      "structure": "The Future Disaster (Hypothetical) -> What Went Wrong -> The Prevention Plan",
      "confidence": 75,
      "description": "Build trust by anticipating failure modes before they happen and solving them in advance"
    }
  ],
  "imagePathAlt": null,
  "thumbSrc": null,
  "thumbSrcAlt": null,
  "locked": true
}