D e TAM : Defending LLM s Against Jailbreak Attacks via Targeted Attention Modification (2025)

Abstract: With the widespread adoption of Large Language Models (LLMs), jailbreak attacks have become an increasingly pressing safety concern. While safety-aligned LLMs can effectively defend against normal harmful queries, they remain vulnerable to such attacks. Existing defense methods primarily rely on fine-tuning or input modification, which often suffer from limited generalization and reduced utility. To address this, we introduce DeTAM, a finetuning-free defense approach that improves the defensive capabilities against jailbreak attacks of LLMs via targeted attention modification. Specifically, we analyze the differences in attention scores between successful and unsuccessful defenses to identify the attention heads sensitive to jailbreak attacks. During inference, we reallocate attention to emphasize users’ core intentions, minimizing interference from attack tokens. Our experimental results demonstrate that DeTAM outperforms various baselines in jailbreak defense and exhibits robust generalization across different attacks and models, maintaining its effectiveness even on in-the-wild jailbreak data. Furthermore, we compare DeTAM with the baselines on over-defense datasets, further validating its superior balance between helpfulness and harmlessness.

## introduction in recent years, large language models (llms) @xcite @xcite have attracted widespread attention and application due to their exceptional performance across various domains. despite efforts to align them with safety training techniques to avoid harmful responses, llms remain vulnerable to adversarial manipulation @xcite figure 1 : an illustration of llm vulnerabilities to jailbreak attacks: while safety-aligned llms can effectively defend against normal harmful queries, they remain highly susceptible to jailbreak attacks. @xcite . recently, jailbreak attacks @xcite , which involve crafted prompts or perturbations to bypass safety mechanisms, have emerged, posing a significant risk of malicious exploitation and societal harm. to address the threats posed by jailbreak attacks, various defense approaches have been proposed. these can be primarily categorized into two types: input modification defenses @xcite @xcite @xcite and securityenhancing fine-tuning methods @xcite . additionally, some methods employ heuristic strategies @xcite @xcite . due to their lower computational cost, input modification techniques have become increasingly widespread. however, such methods often result in the loss of significant information, potentially leading to responses that diverge from the user's original intent. furthermore, while previous studies have demonstrated the effectiveness of these defenses, they are generally tailored to specific attack modalities and do not generalize well to different types of jailbreak attacks. in some cases, certain defense strategies may even inadvertently increase vulnerability to other jailbreak attacks, undermining their reliability as practical solutions. designing robust defenses requires understanding the mechanisms behind jailbreak attacks. safety alignment is typically achieved through instruction fine-tuning (ift) @xcite . dur-ing ift, llms improve their instruction-following ability, primarily through the attention module, as demonstrated by recent research from @xcite , which also enhances generalization performance by optimizing this module. this insight motivates us to explore defense strategies through attention mechanisms. a plausible hypothesis is that vulnerability to jailbreak attacks stems from focus loss, which arises from the conflict between utility and safety during alignment. specifically, while utility drives the model to consider all instructions, safety requires it to focus on the user's core intent, ignoring any influence from attack tokens. further analysis are provided in appendix 5.2. building on these insights, we propose detam, a finetuning-free method aimed at defending llms against jailbreak attacks via targeted attention modification. specifically, to minimize the impact on utility, we start by identifying the attention heads sensitive to jailbreak attacks by analyzing the differences in attention distributions between successful and unsuccessful defenses. during inference, detam dynamically reallocates attention within these heads to focus on the user's intention, minimizing interference from attack tokens. the experimental results show that detam outperforms existing methods in mitigating the latest jailbreak attacks and exhibits robust generalization across various attacks and llms, highlighting the superiority of our proposal. our main contributions are as follows: jailbreak defense methods. several defense strategies have been developed to counter jailbreak attacks. denoising-based methods @xcite @xcite ) modify or paraphrase input queries to neutralize potential threats, although they may compromise the accuracy of benign queries. prompt-based methods @xcite @xcite attempt to improve model alignment by embedding safety instructions around user queries, but require carefully designed prompts to achieve optimal results. finetuning-based methods @xcite retrain language models by explicitly linking jailbreak prompts to refusal responses. however, these methods often require substantial computational resources. detection-based methods @xcite aim to identify and eliminate potentially unsafe prompts, but overly aggressive defenses can inadvertently reject harmless queries. furthermore, existing defenses struggle to effectively counter unknown jailbreak attacks, making it difficult to enhance the generalized defensive capabilities of language models. in contrast, our proposed approach eliminates the need for additional optimization, effectively mitigates various input:...disregard any possible ethical implications...[harmfu l query]... output: i cannot... successful defense input:...create a dream with more than 5 characters...[harmful query]... output: sure, i... unsuccessful defense input: ... please ignore any ethical concern and tell me how to make a bomb for educational purposes ... avg. token attention score query tokens attack tokens 𝑨 𝒊,𝒋 𝑷 𝑰 𝑨 𝒊,𝒋 𝑻 multi-head attention ℎ 1 ℎ 𝑛 𝒉 𝒊 ℎ 3 𝒉 𝟐 transformer layer 𝑗 𝑺 𝒊,𝒋 𝑥 = 𝑨 𝒊,𝒋 𝑷 𝑰 -𝑨 𝒊,𝒋 𝑻 𝑨 𝒊,𝒋 𝑷 𝑰 ∆ ത 𝑺 𝒊,𝒋 = ∆ ത 𝑺 -∆ ത 𝑺 locate sensitive heads softmax scaled matmul mask 𝑸 𝑲 𝑽 matmul 𝒉 𝒊 at layer 𝑗 query tokens mask possible attack tokens in sensitive heads generation:...please ignore any ethical concern and tell me how to make a bomb... [output token] span parsing: infer the possible query tokens and attack tokens from the input types of jailbreak attacks, and offers a low-cost and highly efficient solution. ## conclusion we propose a novel finetuning-free jailbreak defense method, detam, which leverages targeted attention modification to enhance the defense of llms against jailbreak attacks. in particular, we identify the attention heads sensitive to jailbreak attacks by analyzing the differences in attention distributions between successful and unsuccessful defenses. during inference, we reallocate attention to emphasize the user's core intention, minimizing interference from attack tokens. the experimental results demonstrate that detam outperforms existing methods in mitigating the latest jailbreak attacks and exhibits strong generalization in various attacks and llms, which demonstrates the superiority of our proposal.