A Jailbreak Success Coordinate Outside the Refusal Subspace: Decodable Before Generation, Reachable from the Input

Refusal directions are known to alter a language model's behavior under intervention, but whether they also identify which jailbreak variant will succeed has not been tested: probes for jailbreak success choose their own read-out axis and are never tied to them. In this paper, we ask whether success is decodable before generation from a coordinate outside an evaluated refusal subspace, whether intervention on that coordinate moves the behavior, and whether it can guide input search. Across ten open-weight models, two datasets, and four augmentation families, we compare successful and failed variants of the same harmful request within a family. Using representations at the last prompt position, we estimate success-failure directions on behavior-blocked folds and project out the span of eleven published refusal-direction estimates. The resulting orthogonal direction reaches a median paired AUC of 0.903, against 0.826 for the in-span projection of the same success-fitted direction, and exceeds the best individual refusal direction in 69 of 80 model-dataset-family combinations; with model and family held fixed, cross-dataset transfer reaches 0.872. Intervention oppositely separates the two components: the same projection removal, applied at every layer and position and held through generation, opens the behavior further on the evaluated refusal subspace than on the orthogonal coordinate in nine of the ten models. The coordinate is nevertheless reachable from the input, yielding working suffix, template, and rephrase attacks on the four models of the search grid, with candidate fitness computed from pre-generation activations alone, without generating responses or invoking a response judge. What representation-level intervention acts on does not tell which attack gets through.