PaperlayerView exact revision on arXiv

Source-linked AI summary

ASGuard: Activation-Scaling Guard to Mitigate Targeted Jailbreaking Attack

Yein Park, Jungwoo Park, Jaewoo Kang

arXiv:2509.25843v2cs.AI

TL;DR

LLMs can refuse direct harmful prompts yet remain vulnerable to tense-based jailbreaks, revealing a safety-training generalization gap. ASGuard uses circuit analysis, channel-wise activation scaling, and preventative fine-tuning to target the responsible attention heads. Across four LLMs, it reduces targeted-jailbreak ASR while preserving capabilities and improving the safety–utility balance.

  • Problem

    Current alignment methods remain vulnerable to tense jailbreaking and other semantic generalization gaps despite handling direct harmful prompts.

  • Method

    ASGuard identifies causally vulnerable attention heads with circuit analysis, trains a channel-wise scaling vector, and applies preventative fine-tuning.

  • Results

    ASGuard reduces targeted-jailbreak ASR across four LLMs, reaching 8% on Llama3.1 and Qwen2.5, 9% on Olmo2, and 19% on Gemma2.

  • Takeaways & Limitations

    ASGuard achieves a more balanced safety–utility trade-off and operates on the Pareto-optimal frontier without severe utility degradation.

  • Takeaways & Limitations

    ASGuard depends on localizable causal circuits and may transfer poorly across architectures with different internal computations; small models can also be sensitive to head intervention.

Abstract

from arXiv · show

Large language models (LLMs), despite being safety-aligned, exhibit brittle refusal behaviors that can be circumvented by simple linguistic changes. As tense jailbreaking demonstrates that models refusing harmful requests often comply when rephrased in past tense, a critical generalization gap is revealed in current alignment methods whose underlying mechanisms are poorly understood. In this work, we introduce Activation-Scaling Guard (ASGuard), an insightful, mechanistically-informed framework that surgically mitigates this specific vulnerability. In the first step, we use circuit analysis to identify the specific attention heads causally linked to the targeted jailbreaking such as a tense-changing attack. Second, we train a precise, channel-wise scaling vector to recalibrate the activation of tense vulnerable heads. Lastly, we apply it into a "preventative fine-tuning", forcing the model to learn a more robust refusal mechanism. Across four LLMs, ASGuard effectively reduces the attack success rate of targeted jailbreaking while preserving general capabilities and minimizing over refusal, achieving a Pareto-optimal balance between safety and utility. Our findings underscore how adversarial suffixes suppress the propagation of the refusal-mediating direction, based on mechanistic analysis. Furthermore, our work showcases how a deep understanding of model internals can be leveraged to develop practical, efficient, and targeted methods for adjusting model behavior, charting a course for more reliable and interpretable AI safety.

1 INTRODUCTION

Current alignment methods can handle direct harmful prompts but remain vulnerable to semantically preserving changes such as tense jailbreaking. ASGuard addresses this localized failure by combining circuit-based diagnosis, activation scaling, and preventative fine-tuning to improve the safety–utility balance.

  • Standard SFT, reinforcement learning, and DPO defend against direct harmful prompts but can miss deeper semantic loopholes and generalization gaps.
  • Tense jailbreaking changes a harmful request’s tense while preserving its meaning, exposing brittle refusal behavior.
  • ASGuard identifies attention heads causally implicated in tense attacks, learns a channel-wise scaling vector, and integrates the intervention through preventative fine-tuning.
  • Attack success rates in Llama fell from 42% to 8% for tense jailbreaking, from 15% to 1% for GCG, and from 30% to 13% for LogiBreak.
  • Empirical validation places ASGuard on the safety–utility Pareto front with less performance degradation than SFT, DPO, and other representation interventions.

2 PRELIMINARIES

The paper models transformer computation as a directed graph and uses circuit analysis to identify behavior-relevant pathways. It then introduces channel-wise activation scaling to recalibrate selected attention-head outputs without fully ablating them.

  • 2 PRELIMINARIES: A transformer is represented as a directed acyclic graph whose nodes include attention heads, MLP modules, input embeddings, and output logits.
  • 2 PRELIMINARIES: Graph edges encode how each component’s output contributes to later residual-stream inputs.
  • 2 PRELIMINARIES: A circuit is a subgraph selected to explain a specific model behavior, such as token influence on outputs or factual knowledge retrieval.
  • 2.1 CIRCUIT ANALYSIS: EAP-IG ranks edges using integrated gradients between clean and corrupted activations, then selects a sparse circuit and validates it by ablating non-circuit edges.
  • 2.2 SCALING ACTIVATION: Activation scaling recalibrates selected component outputs rather than removing them entirely.
  • 2.2 SCALING ACTIVATION: A learnable channel-wise vector scales each attention head’s output channels across all token positions before projection into the residual stream.
  • 2.2 SCALING ACTIVATION: Scaling a head is equivalent to inserting a diagonal scaling transformation into its output projection and can be fused without extra inference cost.

3 ASGUARD: ACTIVATION-SCALING GUARD

ASGUARD identifies components causally linked to tense jailbreaking, rescales vulnerable-head activations, and integrates the intervention through preventative fine-tuning. Across this pipeline, targeted interventions reduce jailbreak success while aiming to preserve broader robustness and utility.

  • Framework overview: ASGUARD uses three stages: vulnerable-circuit construction, channel-wise activation scaling, and preventative fine-tuning.The framework follows an “Identify-then-Scale” protocol before integrating the safety patch into the model.
  • 3.1 Constructing target vulnerable circuit: Circuit construction analyzes paired present- and past-tense prompts, including False-to-True and Always-False behavior categories.The procedure uses 100 jailbreak prompts, 20 reformulations per prompt, and five refusal prompts for circuit construction.
  • 3.1 Constructing target vulnerable circuit: 4–13% ASR reductions across models from vulnerable-head ablation, versus approximately 1–2% for random heads, support their causal influence on tense jailbreaking.The authors caution that naive ablation can disrupt downstream refusal without changing upstream harmfulness assessment.
  • 3.2 Activation scaling for safety alignment: Activation scaling trains channel-wise vectors for identified vulnerable heads while freezing the original model weights.The vectors are optimized with cross-entropy on harmful prompts paired with predefined safe responses.
  • 3.2 Activation scaling for safety alignment: Up to 29% ASR reduction is obtained through lightweight scaling vectors that can be merged into model weights without additional inference cost.The intervention recalibrates information flow through selected channels rather than removing entire heads.
  • 3.3 Preventative fine-tuning: Preventative fine-tuning applies fixed scaling vectors during training, updates the base parameters, and then removes the intervention after the model learns the revised refusal mechanism.The method is motivated by post-hoc scaling’s possible degradation on unrelated tasks and increased over refusal.
  • 3.3 Preventative fine-tuning: Figure 2 compares normalized ASR reduction with R-Score across methods, connecting non-dominated points to show the safety–utility Pareto frontier.Dashed guide lines represent Overall scores, and axes and scales are identical across panels.

4 EXPERIMENTAL SETUP

The experiments evaluate ASGUARD across four instruction-tuned LLMs and measure targeted jailbreak resistance alongside general safety, over-refusal, and general capability. Comparisons include standard alignment, representation-based, and mechanistic safety interventions, with additional GCG and LogiBreak evaluations.

  • Models and dataset: Experiments evaluate ASGUARD on Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, gemma-2-9b-it, and OLMo-2-1124-7B-Instruct.Activation scaling and preventative fine-tuning are evaluated separately, using GPT-4.1 as the judge model.
  • Evaluation tasks: Targeted refusal is measured with past-tense JBB-Behaviors reformulations, while GCG and LogiBreak provide additional jailbreak evaluations.Lower ASR indicates greater jailbreak safety.
  • Evaluation tasks: General refusal uses OR-Bench-Toxic, where higher scores indicate better general safety.
  • Evaluation tasks: Over refusal uses OR-Bench-Hard-1K, where lower scores indicate greater utility and robustness on challenging benign prompts.
  • Evaluation tasks: MMLU measures general knowledge, with a significant score drop treated as evidence of catastrophic forgetting.
  • Baselines and comparisons: Comparisons include SFT, DPO, RepE, Circuit Breaker, and Representation Bending, alongside additional GCG and LogiBreak robustness results.Table 2 reports targeted ASR, R-Score, and Overall scores for the two additional attacks.

5 RESULTS

ASGUARD reduces targeted jailbreak success while preserving safety–utility balance across several models and attacks. Compared with naive fine-tuning and other baselines, it limits over-refusal and capability degradation.

  • Safety–Utility Frontier: ASGUARD reaches the Pareto-optimal safety–utility frontier, avoiding the severe utility losses associated with methods that drive ASR to zero.The frontier balances ASR reduction against model robustness measured by R-Score.
  • Targeted Jailbreak Mitigation: ASGUARD reduces tense-jailbreak ASR from as high as 51% to 8% on Qwen2.5, 9% on OLMo2, and 19% on Gemma2.
  • Out-of-Domain Evaluation: ASGUARD generalizes beyond tense jailbreaks, achieving 1% ASR on GCG and 13% or 15% ASR on LogiBreak in Llama3.1 evaluations.The reported LogiBreak values differ across the two supplied evaluations.
  • Safety–Utility Frontier: On Llama3.1, ASGUARD combines 34 ASRpp reduction with an R-Score of 71.8, whereas Circuit Breaker reaches 0% ASR with R-Score 30.6.
  • Cross-Model Results: On Qwen2.5, ASGUARD achieves the best Overall score with an R-Score of 74.6, while SFT’s 0% ASR is accompanied by near-total over-refusal.
  • Cross-Model Results: On Gemma2, ASGUARD achieves a 50% relative ASR reduction while preserving MMLU and maintaining a high R-Score.SFT and Only Scaling damage utility through catastrophic forgetting or MMLU degradation.

6 IN-DEPTH ANALYSIS

Mechanistic analyses identify tense-sensitive attention heads and connect them to the jailbreak pathway. Preventative fine-tuning alters this circuitry through both sharper tense representations and functional realignment.

  • Mechanistic Verification: Linear probes classify tense from vulnerable-head activations with 73.44% accuracy for L10H25 and 76.56% for L13H25.
  • Mechanistic Verification: L13H25 shows separated dot-product distributions for past- and present-tense prompts, confirming systematic tense-dependent activation patterns.
  • Jailbreak Circuit: Tense-vulnerable heads act as upstream feature extractors whose past-tense signal appears to bypass or override standard refusal logic.The findings distinguish harmfulness recognition from refusal activation.
  • Post-Intervention Circuit: After preventative fine-tuning, most original tense-vulnerable heads disappear from reconstructed jailbreak circuits.
  • Post-Intervention Circuit: Preventative fine-tuning sharpens tense representations in some heads while functionally realigning others, including L10H19 and L13H25.

7 CONCLUSION AND LIMITATION

The paper presents ASGUARD as a mechanistically informed approach for targeted safety repair that balances safety and utility. Its applicability remains bounded by architectural and circuit-localization requirements.

  • Conclusion: ASGUARD identifies vulnerable attention heads with transformer circuits, then combines attention-head scaling with preventative fine-tuning to repair targeted safety failures.
  • Conclusion: Across models and comparative alignment techniques, ASGUARD achieves Pareto-optimal safety–utility performance.
  • Limitations: ASGUARD depends on localizable causal circuits, and its use for more compositional representations requires further investigation.
  • Limitations: Direct transfer is limited for architectures shaped by distillation, MoE routing, synthetic pretraining, or small-model sensitivity to attention-head intervention.

A.1.1 THE LANDSCAPE OF LLM JAILBREAKING

LLM jailbreaks include prompt-based and model-based attacks, with prompt attacks evolving from simple role-play and prefix injection toward more sophisticated semantic exploitation. Tense jailbreaking preserves harmful intent while changing natural linguistic form.

  • Attack Landscape: Jailbreaking attacks are broadly categorized into prompt-based and model-based attacks.
  • Prompt-Based Attacks: Prompt-based attacks manipulate inputs to elicit harmful responses, evolving from role-playing and prefix injections to more sophisticated methods.
  • Tense Jailbreaking: Tense jailbreaking is a semantic attack that exploits natural linguistic variations while preserving the prompt’s core intent.

A.1.2 MECHANISTIC INTERPRETABILITY FOR AI SAFETY

Mechanistic interpretability analyzes internal computations to connect model components with safety behavior and jailbreak vulnerabilities. Circuit-level analysis complements broader safety-head identification by targeting causal pathways implicated in attacks.

  • Mechanistic interpretability reverse-engineers neural-network computations into human-understandable concepts for analyzing alignment.
  • Safety capabilities are largely attributed to a small set of critical safety attention heads, whose ablation can compromise model guardrails.
  • Circuit discovery can detect jailbreak attacks and motivates analysis of attention-head-level safety mechanisms.
  • Circuit-based interventions complement representation-level defenses such as Circuit Breakers, which redirect harmful-output representations toward refusal or orthogonal directions during decoding.

A.2 EXPERIMENT DETAILS

The experiments compare safety methods under a unified evaluation pipeline across four instruction-tuned LLMs and multiple jailbreak settings. ASGUARD targets circuit-identified heads, scales their activations, and applies preventative fine-tuning, with controls testing whether targeting specific heads matters.

  • Baselines and evaluation: Baselines include SFT, DPO, RepE, Circuit Breakers, and RepBend, evaluated alongside ASGUARD under a unified safety pipeline.The pipeline includes past-tense jailbreak prompts, GCG, and LogiBreak evaluations, with jailbreak success judged using a threshold of 10.
  • ASGUARD procedure: ASGUARD uses circuit construction, channel-wise activation scaling, and preventative fine-tuning to repair localized safety vulnerabilities.The scaling vectors are learned for vulnerable heads while the original model weights remain frozen during activation scaling.
  • Random-head controls: Ablating EAP-IG-identified vulnerable heads reduces past-tense ASR by 4–13%, compared with 1–2% for the same number of randomly chosen heads.Scaling or ablating conceptually related Temporal Heads has negligible impact on ASR and utility, supporting the specificity of the selected heads.
  • Representation analysis: ASGUARD changes tense-feature representations unevenly across models, increasing accuracy for selected heads in Llama, Qwen2.5, and Gemma2 while reducing some below-chance correlations.The paper interprets these changes as a representational shift toward more direct safety-critical functions rather than degradation.
  • Circuit and Sahara comparison: Sahara often identifies broadly safety-related heads but less frequently finds heads specific to targeted linguistic manipulations such as past-tense jailbreaking.The authors describe circuits as more diagnostic for attack-specific mechanisms, while Sahara remains suited to global safety heads.
Loading 2509.25843v2…