{"id":"0be728e7-a74f-41ea-b3c8-52968c94e962","arxiv_id":"2504.13562","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Targeted attention-head modification, tuned on jailbreak data, lowers attack success rates across models and attacks without fine-tuning.","lead":"DETAM is a jailbreak defense that reweights attention inside a language model at inference time, steering the model back to the user's original request instead of the attack wording. The authors report very low attack success rates across several jailbreak methods and models, with only small losses in usefulness.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Eq. 8's mask modification is a no-op for a standard 0/-inf causal mask, so the described attention redistribution cannot explain the reported ASR numbers; the central mechanism must be corrected and reproduced.","rationale":"The reader's weakest assumption concerns the accuracy of prompt-based intent localization, which is indeed unvalidated in the paper. However, there is a prior and more basic problem: the formal description of the attention modification is a mathematical no-op under the standard transformer mask convention used in Eq. 1. Since M is the additive causal mask with entries in {0, -inf}, multiplying row k by β leaves every entry unchanged. Even under a nonstandard finite mask, the condition x_k ∈ IP applies to rows rather than to the key positions whose attention is supposedly amplified, so the equation does not implement the stated mechanism. This matters because the attention modification is the exact operation claimed to produce the defense; if Eq. 8 is literal, DETAM is identical to vanilla inference, and the headline numbers cannot be explained by the described method. My concern is not about benchmark tuning, missing error bars, or code release, though those remain secondary issues. The concrete test distinguishes a plausible typo from a substantive flaw: if the corrected additive rule (boost columns indexed by intention tokens by β) reproduces Table 1, the paper can be repaired; otherwise the central mechanism fails. Since no code is provided and the text is ambiguous, I would not outright reject the idea, but the verdict should move from CONDITIONAL to UNVERDICTED until Eq. 8 is corrected and the results are reproduced.","tokens_in":17114,"tokens_out":4808,"duration_ms":49046,"concrete_test":"Implement DETAM exactly as specified on LLaMA-2-7b-chat with GCG and DSN on JBB-Behaviors, using a standard additive causal mask and substituting Eq. 8 verbatim. If ASR equals vanilla (or changes only by intent-localization randomness), the described mechanism is vacuous. A companion analytical check: with M ∈ {0, -inf}, β·M = M. If the authors instead intend M'(k,l) = M(k,l) + β·1[x_l ∈ IP], rerun Table 1 with that corrected rule; if the reported numbers reproduce, the issue is a typographical error in Eq. 8 rather than a fatal flaw.","verdict_should_be":"UNVERDICTED","load_bearing_attack":"Eq. 8 updates the additive causal mask as M'(k,l) = β·M(k,l) if x_k ∈ IP, else M(k,l). Under the standard convention used in Eq. 1, M has entries 0 for allowed positions and -inf for masked positions; multiplying an entire row by β leaves every entry unchanged (0·β = 0, -inf·β = -inf). Hence the modified attention in Eq. 9 is identical to vanilla attention, and the mask update cannot implement \"emphasize the user's core intention.\" The paper gives no alternative definition of M or of the multiplication, and no code is released. This is more fundamental than intent-localization accuracy: if Eq. 8 is taken literally, the method is a no-op, and the reported ASR reductions in Tables 1–3 are unexplained by the stated mechanism. A corrected rule would need to add β to the mask entries for key positions l whose token lies in IP, or explicitly scale post-softmax attention, but that is not what Eq. 8 says. This must be resolved before the empirical claims can be assessed.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"DETAM proposes a fine-tuning-free, inference-time jailbreak defense. The authors first identify attention heads that behave differently under successful versus unsuccessful defenses by comparing attention allocated to query tokens versus attack tokens, and then, at generation time, modify the attention of those heads to emphasize the user's core intention as found by a prompt-based intent-localization step. The method is evaluated on JBB-Behaviors with five jailbreak attacks, on WildJailbreak, on Llama-3-family models, on utility/over-refusal datasets, and on backdoor attacks. The paper reports very low attack success rates (e.g., average ASRk/ASRa of 1.2%/0.8% on LLaMA-2-7b-chat and 4.0%/2.2% on Vicuna-13b-v1.5) and claims consistent superiority over baselines.","tokens_in":17329,"tokens_out":5295,"duration_ms":48421,"significance":"If the mechanism were correctly specified and the results reproducible, DETAM would be a useful contribution: it avoids fine-tuning and input modification, offers an interpretable head-level analysis, reports transfer of sensitive heads within a model family, evaluates over-refusal with XSTest and ORBench, and includes a backdoor-defense extension. The paper also gives credit for evaluating on WildJailbreak and recent Llama-3 models, which are partly independent of the tuning data. However, the central mechanism as written in Eq. (8) is a no-op under the standard causal-mask convention, and key experimental details are missing. The empirical claims therefore cannot be assessed as submitted.","major_comments":[{"comment":"As written, the mask modification is a no-op. Under the standard causal mask convention used in Eq. (1), M has entries 0 for allowed positions and -inf for masked positions. Multiplying an entire row by beta leaves every entry unchanged (0*beta=0 and -inf*beta=-inf), so the modified attention in Eq. (9) is identical to vanilla attention. The described mechanism therefore cannot explain the ASR reductions in Tables 1-3. Please clarify whether the intended operation is a column-wise addition of beta to mask entries for key positions l in IP, or an explicit post-softmax rescaling of attention to intention tokens, and reproduce the experiments with the corrected rule. Releasing code would help resolve this ambiguity.","section":"Section 3.3, Eq. (8)"},{"comment":"The sensitive-head selection and the hyperparameters alpha and beta are fitted on the same JBB benchmark used for the headline evaluation. The manuscript does not report N, the number of samples in D_success and D_unsuccess, the attack methods used to construct those sets, or the judgment criterion for success/failure. Consequently the JBB results include a potentially fitted component, and only the WildJailbreak and Llama-3 transfer results are independent. Please report N and the exact construction of the selection sets, and evaluate with a held-out split or cross-validation to separate genuine generalization from benchmark tuning.","section":"Sections 3.2, 4.1, and 4.4"},{"comment":"The intent-localization step is load-bearing: if localization mislabels attack tokens as intention tokens, the attention modification amplifies the adversarial wording instead of suppressing it. No accuracy evaluation of the localization step is reported on jailbreak inputs, and the prompt template is only validated indirectly through end-to-end ASR. Please provide localization accuracy or error statistics on the jailbreak evaluation sets, and include an ablation with an oracle localizer versus the actual prompt-based localizer to show how much of the defense depends on localization quality.","section":"Section 3.3 and Appendix E.2"},{"comment":"No variance or multiple-seed results are reported, although several differences between DETAM and the second-best method are small (e.g., LLaMA-2 average ASRk 1.2% versus 1.8% for SafeDecoding in Table 1; WildJailbreak ASRk 10% versus 12% for SafeDecoding in Table 3). Please report means and standard deviations over at least three seeds, or bootstrap confidence intervals over the 100/200 prompts, to support the claim that DETAM consistently outperforms baselines.","section":"Tables 1-3"},{"comment":"There is a direct contradiction in the head-selection criterion. Section 3.2 selects heads with Delta S_bar_i,j < -alpha, but the caption of Figure 4(b) says red regions (Delta S_bar_i,j > alpha) represent the selected heads. This makes the selection rule and the visualization ambiguous. Please align the text, equation, and figure, and state clearly which sign convention is correct.","section":"Section 5.1 and Figure 4(b)"}],"minor_comments":[{"comment":"The phrase 'we are the first to analysis' should be 'we are the first to analyze'.","section":"Abstract and Section 1"},{"comment":"The reference '(Yu et al., 2023; ?)' contains a dangling '?', and PAIR is described in Appendix A but does not appear in the main evaluation results.","section":"Section 2 and Appendix A"},{"comment":"The method name is inconsistently typeset as 'D ETAM' in the Figure 3 caption and 'DeTAM' in Appendix F.1; please unify to DETAM.","section":"Figure 3 and Appendix F.1"},{"comment":"The control-group comparison in Figure 4(c) is described only qualitatively; please specify the statistical test used and report the resulting p-value or effect size.","section":"Section 5.1, Figure 4(c)"},{"comment":"The statement that prompt-based intent identification doubles inference time should be stated in the main experimental discussion, not only in the appendix, since it is a practical cost of the defense.","section":"Appendix E.3"}],"recommendation":"major_revision","confidential_remarks":"The no-op equation in Eq. (8) is the primary blocker. I would ask the authors to correct the mechanism, rerun the experiments, and release code before any further review. In addition, because alpha and beta are tuned on the evaluation benchmark and no variance is reported, the empirical claims need a held-out evaluation protocol. The paper is salvageable in principle, but the current submission cannot be accepted as is."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The thing you need to know is that the stress-test note is right. Equation 8 defines M'(k,l) = beta*M(k,l) for rows in the intention span, otherwise M(k,l). Given Eq. 1's M is the standard 0/-inf causal mask, multiplying by beta changes nothing: 0*beta=0 and -inf*beta=-inf. So Eq. 9 is identical to vanilla attention. The paper's central claim, that the mask modification amplifies intention tokens and suppresses attack tokens, is not implemented by the equation. This is not a minor gap; it means Tables 1-3, as written, have no supporting mechanism.\n\nWhat is genuinely useful here is the diagnostic idea: comparing attention between successful and unsuccessful defenses to locate sensitive heads is new, and the reported transfer of selected heads to Llama-3 models is worth pursuing. The WildJailbreak and backdoor experiments broaden the story, and the authors at least try to measure false-refusal rates, which many defenses ignore. If a corrected rule were specified—adding beta to mask entries for keys in the intention span, or scaling post-softmax attention—the approach could be evaluated fairly.\n\nThe other soft spots are secondary but real: alpha and beta are tuned on the same JBB benchmark used for the main tables; the size and source of D_success/D_unsuccess for head selection are not given; the intent-localization step has no accuracy check; no error bars or multiple seeds; no code. Any one of those would be fixable in revision, but together with the no-op equation they undercut confidence in the numbers.\n\nI checked the reader's take, which called the weaknesses structural rather than fatal. I disagree. The mask no-op is fatal to the stated mechanism; the others are structural. If the authors can correct the rule and reproduce the numbers, this could become a decent inference-time defense paper. As it stands, the empirical claim is detached from the method.\n\nWho is this for? People working on LLM safety or interpretability might find the head-selection analysis useful, but only after the mechanism is fixed. I would not cite it in the next year. For peer review: I would not send this to referees as-is. I would desk-reject with a clear, encouraging note inviting resubmission with a corrected equation, released code, and error bars. If a corrected version appears, then yes, put it through serious review.","headline":"The stress-test finding is correct: the mask update in Eq. 8 is a no-op under the paper's own convention, so DETAM's reported results are unexplained by the stated mechanism.","tokens_in":17861,"tokens_out":2900,"would_cite":false,"duration_ms":28937,"reading_group":"no","serious_thinker":"no","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that jailbreak attacks on aligned LLMs can be blocked at inference time by reallocating attention inside a few sensitive attention heads, without fine-tuning or input rewriting.","keywords":["jailbreak defense","attention modification","inference-time defense","safety alignment","attention heads","attack success rate","over-refusal","LLM safety"],"falsifier":"Collect the jailbreak prompts on which DETAM reports low ASR, run the same intent-localization prompt, and compare the predicted core-intention span with the tokens that actually carry the harmful request. If the localizer frequently misses the harmful request or includes the attack template, then the defense's success cannot be attributed to amplifying the true intention; alternatively, compare DETAM with oracle intention spans against DETAM with predicted spans: if ASR is unchanged, the localization mechanism is not load-bearing.","tokens_in":16903,"feed_emoji":"🛡️","tokens_out":10165,"duration_ms":79755,"temperature":0.7,"pith_summary":"This paper aims to show that jailbreak defenses can be built without fine-tuning or input rewriting: by identifying the attention heads whose allocation of attention distinguishes successful from unsuccessful defenses, and then amplifying attention to the user's core intention tokens during generation, an aligned model can block attacks while preserving normal behavior. Across five jailbreak methods (GCG, DeepInception, DSN, RS, and ReNeLLM) on LLaMA-2-7b-chat, the reported average attack success rate falls to 1.2% by keyword matching and 0.8% by an LLM judge, with 4.0% and 2.2% on Vicuna-13b-v1.5, beating the tested baselines. The method also generalizes to unseen in-the-wild jailbreak prompts, transfers sensitive heads across same-family models, and keeps false refusals low on XSTest and ORBench. A sympathetic reader would care because the approach points to an interpretable, training-free lever on safety: attention itself, rather than input sanitization or fine-tuning.","feed_headline":"Attention tweak blocks jailbreaks at inference, no retraining","feed_subtitle":"Targeted head-level attention shift in LLaMA-2 and Vicuna cuts average attack success to 1.2% and 4.0%.","key_machinery":"The load-bearing object is the set of 'sensitive attention heads', defined as heads whose average relative attention difference $S_{i,j} = (A_{i,j}(P) - A_{i,j}(T))/A_{i,j}(P)$ between query tokens $P$ and attack tokens $T$ shifts most between successful and unsuccessful defenses. Heads with sensitivity score $\\Delta\\bar{S}_{i,j}$ below $-\\alpha$ are selected. During generation, DETAM modifies the causal mask $M$ so that entries at the positions of the localized core-intention tokens are multiplied by $\\beta > 1$; after softmax, attention to intention tokens rises and attention to attack tokens falls. The correction is applied only in the selected heads and only for the first few generated tokens, which keeps utility impact low. The intent localization step is done with a prompt (with few-shot examples for LLaMA-2-7b-chat), and the paper notes an SLM or a single-pass variant as alternatives.","core_discovery":"The central discovery is that defense success is visible in the attention distribution before the model decides to refuse or comply. On certain heads, when a defense succeeds the model allocates relatively more attention to the user's actual query tokens and less to the jailbreak template tokens; when it fails, the pattern reverses. DETAM formalizes this as a sensitivity score per head and, at inference, scales up the mask entries at the localized core-intention positions in the selected heads, so the softmax reallocates weight toward the intention and away from the attack text. The paper reports that this reduces average attack success to near zero across five attacks on LLaMA-2-7b-chat and Vicuna-13b-v1.5 while maintaining utility, and that the identified heads transfer across models in the same family without retraining. It also reports that the same head-level intervention partially mitigates backdoor triggers, suggesting injected backdoors also operate by shifting attention.","pith_inferences":["Inference: If the prompt-based intent localizer is the weak link, then attacks that make the harmful request span many tokens without a single 'core intention' span could evade DETAM, because the amplification would have no clean target; this is a testable failure mode not analyzed in the paper.","Inference: The reported head transferability across same-family models suggests these heads encode a general safety-relevant attention pattern; one could probe this by checking whether the same heads are implicated in refusal behavior on benign sensitive queries.","Inference: DETAM's success on backdoor triggers hints that a unified attention-level defense might cover several manipulation classes; a direct test would be whether the same selected heads mitigate prompt-injection attacks that instruct the model to override system priorities.","Inference: The single-pass variant (having the model state its intent before answering) could make the method nearly cost-free in practice, but it trades off against the risk that the stated intent itself becomes a target for manipulation; that tradeoff is worth measuring."],"forward_implications":["If DETAM works as reported, jailbreak defense can be applied to any decoder-only transformer at inference time with no training, so deployments can update defenses without retraining.","Sensitive heads identified on one model of a family can be reused on sibling models, making the one-time identification cost amortizable across model versions.","Because the intervention is localized to a few heads and early decoding steps, it offers a path to safety that does not degrade instruction-following as much as input rewriting or decoding-side baselines.","The same mechanism partially blocks backdoor triggers, indicating that backdoor and jailbreak attacks share an attention-level effect that one head-level correction can counter.","DETAM's generalization to WildJailbreak suggests the head-level signal is not an artifact of the five benchmark attack families, but a common property of how attack text diverts attention."],"supporting_citations":[{"why":"Supplies the JBB-Behaviors dataset of 100 misuse behaviors used as the testbed for all five attacks.","marker":"(Chao et al., 2024)"},{"why":"Supplies the GCG attack, one of the five attacks in the main evaluation.","marker":"(Zou et al., 2023)"},{"why":"Supplies the DeepInception attack, one of the five attacks.","marker":"(Li et al., 2023)"},{"why":"Supplies the DSN attack, one of the five attacks.","marker":"(Zhou et al., 2024b)"},{"why":"Supplies the RS attack, one of the five attacks, and the RS data used in the transferability experiment.","marker":"(Andriushchenko et al., 2024)"},{"why":"Supplies the ReNeLLM attack, one of the five attacks.","marker":"(Ding et al., 2024)"},{"why":"Supplies the SmoothLLM baseline, a perturbation-based defense that DETAM must beat.","marker":"(Robey et al., 2023)"},{"why":"Supplies the SafeDecoding baseline, the strongest decoding-side defense DETAM compares against.","marker":"(Xu et al., 2024)"},{"why":"Supplies the XSTest dataset used to measure false refusals and utility preservation.","marker":"(Röttger et al., 2024)"},{"why":"Supplies the ORBench-Hard dataset used to measure over-refusal and utility preservation.","marker":"(Cui et al., 2024)"}],"fun_headline_variants":["Attention reallocation blocks jailbreaks at inference","No retraining: shift attention to stop jailbreak attacks","Inference-only attention tweak cuts jailbreak success to 1.2%","Targeted attention modification: finetuning-free jailbreak defense"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole procedure depends on the intent localizer correctly identifying the user's core intention tokens; if it labels attack phrasing as intention, the amplification strengthens the attack, and the paper reports no accuracy evaluation of the localization step on the jailbreak inputs it defends.","fun_headline_variants_meta":{"raw":{"variants":["Attention reallocation blocks jailbreaks at inference","No retraining: shift attention to stop jailbreak attacks","Inference-only attention tweak cuts jailbreak success to 1.2%","Targeted attention modification: finetuning-free jailbreak defense"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000709,"raw_usage":{"total_tokens":3188,"prompt_tokens":938,"completion_tokens":2250,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":554,"completion_tokens_details":{"reasoning_tokens":2179}},"tokens_in":554,"tokens_out":2250,"duration_ms":15845,"temperature":1.0,"reasoning_tokens":2179,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T12:04:50.863277+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Collect the jailbreak prompts on which DETAM reports low ASR, run the same intent-localization prompt, and compare the predicted core-intention span with the tokens that actually carry the harmful request. If the localizer frequently misses the harmful request or includes the attack template, then the defense's success cannot be attributed to amplifying the true intention; alternatively, compare DETAM with oracle intention spans against DETAM with predicted spans: if ASR is unchanged, the localization mechanism is not load-bearing.","supporting_citations":[],"review_version":1}