Robust Harmful Features Under Jailbreak Attacks: Mechanistic Evidence from Attention Head Specialization in Large Language Models

Abstract

Jailbreak attacks bypass LLM safety alignment, yet their mechanisms remain poorly understood. We provide evidence that attacks do not comprehensively eliminate safety features, but instead selectively suppress specific attention heads. We identify two functionally differentiated types: Adversarially Compromised Heads (ACHs) concentrated in early layers, which are suppressed under attacks, and Safety-Aligned Heads (SAHs) in mid-layers, which maintain robust activations even when attacks succeed.

Categories

Framework mappings

Suggested from the entry's categories.

@misc{yin2026robust,
  title = {{Robust Harmful Features Under Jailbreak Attacks: Mechanistic Evidence from Attention Head Specialization in Large Language Models}},
  author = {Yanchen Yin and Dongqi Han and Linghui Li},
  year = {2026},
  month = jun,
  eprint = {2606.28153},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.28153}
}