Trajectory-Guided Rotation Steering for Jailbreak Defense in Audio Large Language Models

Audio Large Language Models (ALLMs) have demonstrated remarkable capabilities in audio understanding and reasoning tasks. Despite these capabilities, they remain vulnerable to jailbreak attacks, where adversaries craft malicious audio inputs to induce the models to generate harmful responses. Existing activation steering-based defense methods mitigate this issue by injecting refusal-related directions into intermediate-layer representations. However, these approaches typically rely on static layer-wise steering vectors and additive modification strategies, which fail to capture the dynamic evolution of refusal behavior across network layers and may introduce excessive interference into benign queries. In this paper, we propose TRAIL, a Trajectory-based Rotational Activation Intervention across Layers framework for jailbreak defense in ALLMs. We observe that refusal behaviors exhibit distinct cross-layer evolution patterns compared with normal responses, suggesting that refusal is not determined by a fixed direction but rather emerges as a dynamic representation trajectory. Based on this observation, we propose a layer-wise refusal trajectory modeling method to extract discriminative inter-layer refusal evolution features. We then leverage these trajectory features to construct a trajectory-guided rotation subspace, which enables fine-grained adjustment of intermediate representations while preserving the original semantic space. Furthermore, we find that refusal behaviors induced by harmful requests and those triggered by benign requests share partially overlapping components in the representation space. We therefore introduce a refusal trajectory disentanglement strategy to suppress the components that contribute to over-refusal on safe queries.