TERM jailbreak defense modulates residuals from attention entropy
Original title: TERM: Target-Free Jailbreak Defense via Entropy-Guided Residual Modulation
Compared with seven defenses on seven attacks, it reports stronger robustness and low over-refusal at modest inference cost.
The paper proposes Target-free Entropy-guided Residual Modulation (TERM), an inference-time defense against jailbreak prompts. It calibrates attention entropy to each prompt's prefill baseline and uses that signal to bound scaling of the model's own residual updates, without a predefined safety direction. Tests cover seven defenses, seven jailbreak attacks, and two over-refusal benchmarks on Llama, Qwen, and Gemma models. The authors say robustness improves while over-refusal on benign safety-sensitive requests stays low.
Unconfirmed: Robustness and over-refusal gains are the authors' reported results, not independently confirmed here.
- Qwen3 models from 0.6B to 32B are included in the evaluation.
- Scale normalization and temporal accumulation set intervention strength.
- The method avoids predefined steering directions or learned safety regions.
- Authors report modest inference overhead.
From the original article
1 min read at arxiv.orgLarge language models (LLMs) have shown strong capabilities across diverse applications, making both safety and utility essential for reliable deployment. Jailbreak attacks use diverse forms of adversarial prompting to bypass alignment safeguards and induce LLMs to generate harmful responses.
By Yunkai Dang · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.