Attention Is Where You Attack

Abstract

Safety-aligned large language models rely on RLHF and instruction tuning to refuse harmful requests, yet the internal mechanisms implementing safety behavior remain poorly understood. We introduce the Attention Redistribution Attack (ARA), a white-box adversarial attack that identifies safety-critical attention heads and crafts nonsemantic adversarial tokens that redirect attention away from safety-relevant positions. Unlike prior jailbreak methods operating at the semantic or output-logit level

Categories

Framework mappings

Suggested from the entry's categories.

@misc{srivastava2026attention,
  title = {{Attention Is Where You Attack}},
  author = {Aviral Srivastava and Sourav Panda},
  year = {2026},
  month = apr,
  eprint = {2605.00236},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.00236}
}