跳转至

续写与拒绝的博弈：大语言模型中续写触发型越狱的机制分析

文章背景与核心概要

随着大语言模型（LLM）的飞速发展，安全性对齐依然至关重要，但模型仍经常成为复杂越狱技术的牺牲品——特别是“续写触发型越狱”（continuation-triggered jailbreaks），即通过改变特定指令后缀的位置，能大幅提高生成有害内容的成功率。

本文在注意力头（attention-head）层面上利用机制可解释性，深入探讨了该现象背后的底层机制。通过因果干预和激活缩放，作者证明了这种越狱行为根本上源于模型自身固有的文本续写驱动力与通过对齐注入的安全防御机制之间内部的“拔河”对抗。为了利用这些发现，该研究引入了头部竞争引导（Head Competition Steering, HCS）——这是一种基于机制的推理时策略，能够在平衡安全头和续写头的同时抑制恶意输出，且不会产生额外的计算成本。

license icon

Summary

As Large Language Models (LLMs) continue to advance, safety alignment remains critical, yet models still frequently fall victim to sophisticated jailbreaking techniques—specifically "continuation-triggered jailbreaks," where shifting a specialized instruction suffix drastically increases the success rate of producing harmful content.

This paper investigates the underlying mechanisms of this phenomenon using mechanistic interpretability at the attention-head level. Through causal interventions and activation scaling, the authors demonstrate that this jailbreak behavior fundamentally stems from an internal tug-of-war between the model's native text-continuation drive and the safety defenses instilled through alignment. To exploit these findings, the study introduces Head Competition Steering (HCS)—a mechanistic, inference-time strategy that balances safety and continuation heads to suppress malicious outputs without incurring extra computational costs.

Document Metadata

字段 详情
arXiv ID arXiv:2603.08234 [cs.AI]
Primary Subject Artificial Intelligence (cs.AI)
Secondary Subjects Machine Learning (cs.LG)
Authors Yonghong Deng, Zhen Yang, Ping Jian, Xinyue Zhang, Zhongbin Guo, Chengzhi Li, Junxi Yin
Submission History [v1] Mon, 9 Mar 2026
[v2] Fri, 4 Sep 2026 (Current Revision)
License Creative Commons Attribution 4.0 International
Field Details
arXiv ID arXiv:2603.08234 [cs.AI]
Primary Subject Artificial Intelligence (cs.AI)
Secondary Subjects Machine Learning (cs.LG)
Authors Yonghong Deng, Zhen Yang, Ping Jian, Xinyue Zhang, Zhongbin Guo, Chengzhi Li, Junxi Yin
Submission History [v1] Mon, 9 Mar 2026
[v2] Fri, 4 Sep 2026 (Current Revision)
License Creative Commons Attribution 4.0 International

Abstract

随着大语言模型（LLM）的快速发展，LLM的安全性已成为一个关键问题。尽管在安全对齐方面付出了巨大努力，但当前的LLM仍然容易受到越狱攻击。然而，此类漏洞的根本原因仍未得到充分理解，这使得学术界和工业界都有必要对越狱机制进行严谨的研究。

With the rapid advancement of large language models (LLMs), the safety of LLMs has become a critical concern. Despite significant efforts in safety alignment, current LLMs remain vulnerable to jailbreaking attacks. However, the root causes of such vulnerabilities are still poorly understood, necessitating a rigorous investigation into jailbreak mechanisms across both academic and industrial communities.

在这项工作中，我们关注一种续写触发型越狱现象，即简单地重新定位一个续写触发的指令后缀就可以大幅提高越狱的成功率。为了揭示该现象的内在机制，我们在注意力头的层面进行了全面的机制可解释性分析。通过因果干预和激活缩放，我们表明这种越狱行为主要源于模型内在的续写驱动力与通过对齐训练获得的安全防御之间的固有竞争。

In this work, we focus on a continuation-triggered jailbreak phenomenon, whereby simply relocating a continuation-triggered instruction suffix can substantially increase jailbreak success rates. To uncover the intrinsic mechanisms of this phenomenon, we conduct a comprehensive mechanistic interpretability analysis at the level of attention heads. Through causal interventions and activation scaling, we show that this jailbreak behavior primarily arises from an inherent competition between the model's intrinsic continuation drive and the safety defenses acquired through alignment training.

此外，我们对所识别出的对安全至关重要的注意力头进行了详细的行为分析，揭示了不同模型架构中安全头行为的显着差异。基于这些机制发现，我们提出了头部竞争引导（Head Competition Steering, HCS），这是一种基于机制的推理时策略，它明确利用安全头和续写头之间的竞争来抑制有害生成，并进一步通过知识蒸馏将行为信号蒸馏到学生模型中，在不增加额外计算开销的情况下实现推理时的安全性提升。

Furthermore, we perform a detailed behavioral analysis of the identified safety-critical attention heads, revealing notable differences in the behaviors of safety heads across different model architectures. Grounded in these mechanistic findings, we propose Head Competition Steering (HCS), a mechanistically grounded inference-time strategy that explicitly leverages the competition between safety heads and continuation heads to suppress harmful generation, and further distill its behavioral signal into a student model via knowledge distillation, achieving inference-time safety improvements without additional computational overhead.

Access & Full-Text Resources