← Back to Library

ASGuard: Activation-Scaling Guard to Mitigate Targeted Jailbreaking Attack

Authors: Yein Park, Jungwoo Park, Jaewoo Kang

Published: 2025-09-30

arXiv ID: 2509.25843v1

Added to Library: 2025-10-01 04:01 UTC

Red Teaming

📄 Abstract

Large language models (LLMs), despite being safety-aligned, exhibit brittle refusal behaviors that can be circumvented by simple linguistic changes. As tense jailbreaking demonstrates that models refusing harmful requests often comply when rephrased in past tense, a critical generalization gap is revealed in current alignment methods whose underlying mechanisms are poorly understood. In this work, we introduce Activation-Scaling Guard (ASGuard), an insightful, mechanistically-informed framework that surgically mitigates this specific vulnerability. For the first step, we use circuit analysis to identify the specific attention heads causally linked to the targeted jailbreaking, the tense-changing attack. Second, we train a precise, channel-wise scaling vector to recalibrate the activation of tense vulnerable heads. Lastly, we apply it into a "preventative fine-tuning", forcing the model to learn a more robust refusal mechanism. Across three LLMs, ASGuard effectively reduces the attack success rate of targeted jailbreaking while preserving general capabilities and minimizing over refusal, achieving a Pareto-optimal balance between safety and utility. Our findings underscore how adversarial suffixes suppress the propagation of the refusal-mediating direction, based on mechanistic analysis. Furthermore, our work showcases how a deep understanding of model internals can be leveraged to develop practical, efficient, and targeted methods for adjusting model behavior, charting a course for more reliable and interpretable AI safety.

🔍 Key Points

  • Introduction of ASGuard, a targeted framework aimed at addressing the specific vulnerability of tense jailbreaking in LLMs through meticulous circuit analysis.
  • Identification of tense vulnerable attention heads within LLMs, effectively linking certain heads to compromised safety behaviors during tense rephrasing of harmful prompts.
  • Implementation of a two-step intervention process consisting of activation scaling and preventative fine-tuning, which collectively result in a significant reduction in jailbreak susceptibility while preserving model performance.
  • Empirical validation demonstrates that ASGuard achieves a balance between safety and utility on the Pareto-optimal frontier, outperforming existing methods like Supervised Fine-Tuning and Direct Preference Optimization without incurring severe reductions in utility or performance.
  • The research emphasizes mechanistic interpretability as a powerful tool to enhance AI safety, providing actionable insights for safeguarding LLMs against adversarial manipulations.

💡 Why This Paper Matters

This paper presents a novel and practical solution to a pressing issue in AI safety involving the susceptibility of large language models to adversarial jailbreak attacks. By employing circuit analysis and targeted interventions, ASGuard significantly mitigates vulnerabilities while maintaining the general capability of the models. The work highlights the importance of understanding model internals for developing effective safety mechanisms and offers a framework that may guide future efforts in enhancing AI robustness against manipulative attacks.

🎯 Why It's Interesting for AI Security Researchers

The findings from this study are highly relevant for AI security researchers because they address critical vulnerabilities in large language models that could be exploited in malicious scenarios. The methodologies introduced for identifying and mitigating specific model weaknesses provide a blueprint for improving model safety in real-world applications. Furthermore, the emphasis on mechanistic interpretability opens avenues for researchers to develop more nuanced and effective defenses against evolving adversarial attacks in AI systems.

📚 Read the Full Paper