Mid-Generation Jailbreaks in Open-Source LLMs Using a Pause-and-Edit Attack

Large Language Models (LLMs) often rely on safety-aligned system prompts to prevent harmful responses, yet most defenses assume that safety must hold only at the start of generation. We examine a mid-generation jailbreak, called pause-and-edit, that interrupts a refusal, removes the partially generated text, and resumes generation with a cooperative continuation prefix. Because LLMs decode autoregressively, this recontextualization leads the model to reconsider the request and often disregard its earlier safety decision. We test the attack on 390 harmful prompts across 13 categories using three open-source models: Mistral-7B-Instruct-v0.2, Qwen3-14B, and CodeLlama-7B-Instruct. All three models overturned nearly all initial refusals, producing harmful outputs at rates of 99.7%, 85.67%, and 62.56%, respectively. Limited tests on Gemma-27B-IT and Phi-14B-Reasoning show that robustness is influenced more by training and reasoning behavior than by model size.These results indicate that refusal at the start of generation does not guarantee safety. Defenses that operate throughout the decoding process are needed to address this mid-generation vulnerability.