← Back to Library

Attention Slipping: A Mechanistic Understanding of Jailbreak Attacks and Defenses in LLMs

Authors: Xiaomeng Hu, Pin-Yu Chen, Tsung-Yi Ho

Published: 2025-07-06

arXiv ID: 2507.04365v1

Added to Library: 2025-07-08 04:01 UTC

Red Teaming Safety

📄 Abstract

As large language models (LLMs) become more integral to society and technology, ensuring their safety becomes essential. Jailbreak attacks exploit vulnerabilities to bypass safety guardrails, posing a significant threat. However, the mechanisms enabling these attacks are not well understood. In this paper, we reveal a universal phenomenon that occurs during jailbreak attacks: Attention Slipping. During this phenomenon, the model gradually reduces the attention it allocates to unsafe requests in a user query during the attack process, ultimately causing a jailbreak. We show Attention Slipping is consistent across various jailbreak methods, including gradient-based token replacement, prompt-level template refinement, and in-context learning. Additionally, we evaluate two defenses based on query perturbation, Token Highlighter and SmoothLLM, and find they indirectly mitigate Attention Slipping, with their effectiveness positively correlated with the degree of mitigation achieved. Inspired by this finding, we propose Attention Sharpening, a new defense that directly counters Attention Slipping by sharpening the attention score distribution using temperature scaling. Experiments on four leading LLMs (Gemma2-9B-It, Llama3.1-8B-It, Qwen2.5-7B-It, Mistral-7B-It v0.2) show that our method effectively resists various jailbreak attacks while maintaining performance on benign tasks on AlpacaEval. Importantly, Attention Sharpening introduces no additional computational or memory overhead, making it an efficient and practical solution for real-world deployment.

🔍 Key Points

  • The paper introduces 'Attention Slipping' as a universal phenomenon that occurs during jailbreak attacks, where models gradually reduce attention to unsafe requests, enabling successful bypassing of safety mechanisms.
  • The authors evaluate existing defenses, including Token Highlighter and SmoothLLM, and determine that these defenses indirectly mitigate Attention Slipping by restoring focus on unsafe prototypes.
  • A novel defense mechanism, 'Attention Sharpening', is proposed, which uses temperature scaling to sharpen the attention score distribution and directly counteract Attention Slipping, effectively reducing the success rate of jailbreak attacks without incurring additional computational costs.
  • Extensive experimental results demonstrate that Attention Sharpening maintains performance on benign tasks while robustly resisting various jailbreak attacks across multiple large language models.

💡 Why This Paper Matters

This paper significantly contributes to the understanding of how large language models can be exploited through jailbreak attacks and presents a novel defense mechanism that is both effective and efficient. By addressing the root cause of such vulnerabilities (Attention Slipping), the authors advance the field of AI safety and provide actionable solutions to enhance the robustness of LLMs in real-world applications.

🎯 Why It's Interesting for AI Security Researchers

AI security researchers will find this paper of great interest as it not only identifies critical vulnerabilities in the widely used large language models but also proposes a scientifically grounded defense strategy. The exploration of 'Attention Slipping' adds a new dimension to the understanding of adversarial behavior in LLMs, providing insights that could inform future research on improving model resilience against various types of attacks.

📚 Read the Full Paper