{"id":"https://openalex.org/W7166517370","doi":"https://doi.org/10.48550/arxiv.2606.28153","title":"Robust Harmful Features Under Jailbreak Attacks: Mechanistic Evidence from Attention Head Specialization in Large Language Models","display_name":"Robust Harmful Features Under Jailbreak Attacks: Mechanistic Evidence from Attention Head Specialization in Large Language Models","publication_year":2026,"publication_date":"2026-06-26","ids":{"openalex":"https://openalex.org/W7166517370","doi":"https://doi.org/10.48550/arxiv.2606.28153"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.28153","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.28153","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.28153","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5063472816","display_name":"Yanchen Yin","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yin, Yanchen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139549217","display_name":"Dongqi Han","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Han, Dongqi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5139554567","display_name":"Linghui Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Linghui","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9907000064849854,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9907000064849854,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.0017000000225380063,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10883","display_name":"Ethics and Social Impacts of AI","score":0.0006000000284984708,"subfield":{"id":"https://openalex.org/subfields/3311","display_name":"Safety Research"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.5268999934196472},{"id":"https://openalex.org/keywords/attribution","display_name":"Attribution","score":0.3508000075817108},{"id":"https://openalex.org/keywords/reading","display_name":"Reading (process)","score":0.32600000500679016},{"id":"https://openalex.org/keywords/selective-attention","display_name":"Selective attention","score":0.3176000118255615},{"id":"https://openalex.org/keywords/phenomenon","display_name":"Phenomenon","score":0.31690001487731934},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.310699999332428},{"id":"https://openalex.org/keywords/unexpected-events","display_name":"Unexpected events","score":0.2964000105857849}],"concepts":[{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.5268999934196472},{"id":"https://openalex.org/C180747234","wikidata":"https://www.wikidata.org/wiki/Q23373","display_name":"Cognitive psychology","level":1,"score":0.5264000296592712},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5109000205993652},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.4009000062942505},{"id":"https://openalex.org/C143299363","wikidata":"https://www.wikidata.org/wiki/Q900584","display_name":"Attribution","level":2,"score":0.3508000075817108},{"id":"https://openalex.org/C169760540","wikidata":"https://www.wikidata.org/wiki/Q207011","display_name":"Neuroscience","level":1,"score":0.34929999709129333},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.3391000032424927},{"id":"https://openalex.org/C554936623","wikidata":"https://www.wikidata.org/wiki/Q199657","display_name":"Reading (process)","level":2,"score":0.32600000500679016},{"id":"https://openalex.org/C2989146674","wikidata":"https://www.wikidata.org/wiki/Q4818236","display_name":"Selective attention","level":3,"score":0.3176000118255615},{"id":"https://openalex.org/C50335755","wikidata":"https://www.wikidata.org/wiki/Q483247","display_name":"Phenomenon","level":2,"score":0.31690001487731934},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.310699999332428},{"id":"https://openalex.org/C2776544517","wikidata":"https://www.wikidata.org/wiki/Q189447","display_name":"Unexpected events","level":2,"score":0.2964000105857849},{"id":"https://openalex.org/C4679612","wikidata":"https://www.wikidata.org/wiki/Q866298","display_name":"Aggregate (composite)","level":2,"score":0.2921000123023987},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.28600001335144043},{"id":"https://openalex.org/C3017944768","wikidata":"https://www.wikidata.org/wiki/Q1450463","display_name":"Poison control","level":2,"score":0.27799999713897705},{"id":"https://openalex.org/C89611455","wikidata":"https://www.wikidata.org/wiki/Q6804646","display_name":"Mechanism (biology)","level":2,"score":0.2759999930858612},{"id":"https://openalex.org/C2780312720","wikidata":"https://www.wikidata.org/wiki/Q5689100","display_name":"Head (geology)","level":2,"score":0.27379998564720154},{"id":"https://openalex.org/C61797465","wikidata":"https://www.wikidata.org/wiki/Q1188986","display_name":"Term (time)","level":2,"score":0.2711000144481659},{"id":"https://openalex.org/C2778348673","wikidata":"https://www.wikidata.org/wiki/Q739302","display_name":"Production (economics)","level":2,"score":0.25529998540878296},{"id":"https://openalex.org/C46312422","wikidata":"https://www.wikidata.org/wiki/Q11024","display_name":"Communication","level":1,"score":0.2531000077724457}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.28153","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.28153","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.28153","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.28153","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.6909366846084595,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Jailbreak":[0],"attacks":[1,16,61,122],"bypass":[2,124],"LLM":[3],"safety":[4,21,101,133],"alignment,":[5],"yet":[6],"their":[7],"mechanisms":[8],"remain":[9],"poorly":[10],"understood.":[11],"We":[12,30],"provide":[13],"evidence":[14],"that":[15,107,156],"do":[17],"not":[18],"comprehensively":[19],"eliminate":[20],"features,":[22],"but":[23],"instead":[24],"selectively":[25],"suppress":[26],"specific":[27],"attention":[28],"heads.":[29],"identify":[31],"two":[32],"functionally":[33],"differentiated":[34],"types:":[35],"Adversarially":[36],"Compromised":[37],"Heads":[38,51],"(ACHs)":[39],"concentrated":[40],"in":[41,53],"early":[42],"layers,":[43],"which":[44,55],"are":[45],"suppressed":[46],"under":[47],"attacks,":[48],"and":[49,71],"Safety-Aligned":[50],"(SAHs)":[52],"mid-layers,":[54],"maintain":[56],"robust":[57,77],"activations":[58,161],"even":[59],"when":[60],"succeed.":[62],"Ablation":[63],"studies":[64],"support":[65],"the":[66,72,148],"causal":[67],"role":[68],"of":[69,74,83,120,151],"ACHs":[70,84],"contribution":[73],"SAHs":[75,97,137],"to":[76,87],"activations:":[78],"suppressing":[79],"a":[80,117,139],"small":[81],"number":[82],"is":[85,110],"sufficient":[86],"induce":[88],"jailbreak-like":[89],"behavior":[90],"on":[91],"normally":[92],"refused":[93],"inputs,":[94],"while":[95,130],"removing":[96],"substantially":[98],"weakens":[99],"mid-layer":[100],"activations.":[102],"Token-level":[103],"attribution":[104],"further":[105],"shows":[106],"ACH":[108,128],"suppression":[109,129],"driven":[111],"specifically":[112],"by":[113,136],"attack-template":[114],"tokens,":[115],"providing":[116],"mechanistic":[118],"account":[119],"why":[121],"can":[123],"refusal":[125],"decisions":[126],"through":[127],"leaving":[131],"internal":[132],"signals":[134],"sustained":[135],"--":[138,162,166],"phenomenon":[140],"we":[141,154],"term":[142],"Robust":[143],"Harmful":[144],"Features.":[145],"To":[146],"validate":[147],"practical":[149],"significance":[150],"this":[152],"robustness,":[153],"show":[155],"simply":[157],"reading":[158],"these":[159],"persistent":[160],"without":[163],"any":[164],"training":[165],"yields":[167],"competitive":[168],"aggregate":[169],"detection":[170],"performance":[171],"with":[172],"strong":[173],"adversarial":[174],"robustness.":[175]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-06-30T00:00:00"}