Search papers, labs, and topics across Lattice.
This paper introduces Activation-Scaling Guard (ASGuard), a method to mitigate tense-based jailbreaking attacks in LLMs by identifying and recalibrating specific attention heads responsible for the vulnerability. ASGuard uses circuit analysis to pinpoint these "tense vulnerable heads" and then trains a channel-wise scaling vector to adjust their activations, followed by preventative fine-tuning. Experiments across four LLMs demonstrate that ASGuard significantly reduces attack success rates while maintaining general capabilities and minimizing over-refusal, achieving a better balance between safety and utility.
Mechanistic analysis reveals how adversarial suffixes suppress the propagation of refusal-mediating directions in LLMs, and ASGuard offers a targeted intervention.
Large language models (LLMs), despite being safety-aligned, exhibit brittle refusal behaviors that can be circumvented by simple linguistic changes. As tense jailbreaking demonstrates that models refusing harmful requests often comply when rephrased in past tense, a critical generalization gap is revealed in current alignment methods whose underlying mechanisms are poorly understood. In this work, we introduce Activation-Scaling Guard (ASGuard), an insightful, mechanistically-informed framework that surgically mitigates this specific vulnerability. In the first step, we use circuit analysis to identify the specific attention heads causally linked to the targeted jailbreaking such as a tense-changing attack. Second, we train a precise, channel-wise scaling vector to recalibrate the activation of tense vulnerable heads. Lastly, we apply it into a"preventative fine-tuning", forcing the model to learn a more robust refusal mechanism. Across four LLMs, ASGuard effectively reduces the attack success rate of targeted jailbreaking while preserving general capabilities and minimizing over refusal, achieving a Pareto-optimal balance between safety and utility. Our findings underscore how adversarial suffixes suppress the propagation of the refusal-mediating direction, based on mechanistic analysis. Furthermore, our work showcases how a deep understanding of model internals can be leveraged to develop practical, efficient, and targeted methods for adjusting model behavior, charting a course for more reliable and interpretable AI safety.
