Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense (2025)

Abstract: As large language models (LLMs) are increasingly deployed in diverse applications, including chatbot assistants and code generation, aligning their behavior with safety and ethical standards has become paramount. However, jailbreak attacks, which exploit vulnerabilities to elicit unintended or harmful outputs, threaten LLMs safety significantly. In this paper, we introduce Layer-AdvPatcher, a novel methodology designed to defend against jailbreak attacks by utilizing an unlearning strategy to patch specific layers within LLMs through self-augmented datasets. Our insight is that certain layer(s), tend to produce affirmative tokens when faced with harmful prompts. By identifying these layers and adversarially exposing them to generate more harmful data, one can understand their inherent and diverse vulnerabilities to attacks. With these exposures, we then “unlearn” these issues, reducing the impact of affirmative tokens and hence minimizing jailbreak risks while keeping the model’s responses to safe queries intact.We conduct extensive experiments on two models, four benchmark datasets, and multiple state-of-the-art jailbreak attacks to demonstrate the efficacy of our approach. Results indicate that our framework reduces the harmfulness and attack success rate of jailbreak attacks without compromising utility for benign queries compared to recent defense methods. Our code is publicly available at: https://github.com/oyy2000/LayerAdvPatcher

## introduction large language models (llms) have showcased impressive capabilities across a wide range of natural language tasks. despite these advancements, ensuring their safety and alignment with human values remains a critical challenge. numerous reports highlight that llms can generate unauthentic @xcite , privacy-leaking figure 1 : layer-wise toxic scores for mistral-7b-instruct-v0.3 (top) and llama2-7b-chat (bottom), highlighting a significant spike in toxicity at layer 28 (0indexed) for mistral-7b and across layers 21-24 for llama2-7b model. after applying layer-advpatcher, the toxic scores around these unlearned layers drop significantly, leading to an overall reduction in final layer toxicity. @xcite , and even harmful outputs @xcite , hindering their deployment in realworld applications such as education that demand precise and ethical responses. among these potential risks, one prominent challenge is that llms remain particularly vulnerable to "jailbreak attack", @xcite @xcite @xcite @xcite @xcite , a type of adversarial prompt that provokes the model to produce harmful responses that violate usage policies and societal norms. current defense techniques tailored for jailbreak attacks generally fall into three categories @xcite : processing defenses @xcite @xcite ; 2) additional helper defenses @xcite ; and 3) input permutation defenses @xcite . these methods, leveraging full fine-tuning or few-shot prompting to indiscriminately suppress harmful outputs from llms, often face a suboptimal trade-off between defense success and general performance retention. recent studies on underlying mechanisms of jailbreak attacks have uncovered an interesting fact about toxic generative distribution. during the inference process of successful jailbreak attacks, the harmful contents are often induced by affirmative tokens such as "sure", "absolute", and "certain" @xcite . in addition, there exists a region of toxic layers @xcite within llms that exhibit disproportionately strong preferences for producing these affirmative tokens. the preliminary understanding indicates that the toxic region is particularly susceptible to following unsafe instructions in the prompt, which significantly increases the likelihood of producing harmful or undesirable responses. based on this observation, we conjecture that a simple solution for jailbreak defense is to re-align the small toxic region, which could promisingly reduce the generation tendency of affirmative tokens while preserving the overall performance. the intuition is the toxic layers that contribute most to unsafe behaviors, while fine-tuning in other relatively safe areas can significantly alter the model's general knowledge. on the other side, targeting the toxic layers makes interventions more efficient for the evolutionary and unpredictable jailbreak prompts. however, it is challenging to eliminate harmful output by only editing the key toxic regions. first, there usually exists a cluster of toxic layers preventing the precise and efficient re-alignment. second, the defense strategies developed for fixed benchmark datasets cannot ensure the generalization to diverse and stronger jailbreak prompts. to bridge gaps, we introduce a novel jailbreak defense paradigm named layer-advpatcher, which first exposes the identified toxic layer to generate adversarial examples comprising diverse prompts and harmful contents, and then performs localized and precise toxicity editing. particularly, this pipeline involves three successive steps. i) toxic layer locating: we identify the key toxic layers via decoding hidden states at each layer and accumulating the probability of affirmative tokens. the toxic regions are the layers associated with significantly higher probability values. ii) adversarial augmentation: we maximize exposure to jailbreak vulnerabilities by adversarially fine-tuning the toxic layers to generate harmful outputs. starting from a standard dataset, we introduce perturbations to the original prompts and replace affirma-tive tokens to trigger adversarial fine-tuning, which produces a diverse set of harmful examples. this process exposes the inherent vulnerabilities in the toxic layers and expands the training dataset, enhancing the model's ability to generalize and resist unsafe instructions iii) toxic layer editing: we apply an unlearning method @xcite to update the model's initialization parameters based upon the augmented training set, specifically mitigating the exposed vulnerabilities within the identified toxic layers. we assess the performance, efficiency, usability, and adaptability of layer-advpatcher across different llms. in summary, this paper presents the following key contributions: y harm contains harmful or inappropriate content. jailbreak defense. the objective of jailbreak defense is to modify model m or use extra safety prompts to prevent the generation of harmful responses, even when presented with adversarial prompts. in this work, we focus on altering model parameters θ. the defense aims to ensure that for any input x, including adversarial prompts, the model's output y adheres to safety guidelines: ## layer-advpatcher as illustrated in figure 2 , our framework consists of three interacted steps, each of which is experimentally shown effective to the precise and effective defense against jailbreak attacks. ## experiments this section assesses the effectiveness, helpfulness, efficiency, and compatibility of layer-advpatcher. ## conclusion in this work, we propose layer-advpatcher, a novel jailbreak defense framework that precisely targets and mitigates toxic behaviors in llms by adversarially exposing and editing the identified toxic layers. by following a three-step pipeline-toxic layer locating, adversarial augmentation, and toxic layer editing-our approach successfully identifies the model layers responsible for generating harmful outputs and addresses their vulnerabilities through adversarial exposure and localized unlearning on the augmented harmful dataset. the targeted nature of our framework ensures both effectiveness in reducing jailbreak susceptibility and maintaining model performance. extensive evaluations across multiple advanced attack methods and utility benchmarks demonstrate the superiority of layer-advpatcher in achieving robust defense compared to recent defense strategies.