Suppressing 8 attention heads in Llama-3-8B-Instruct induces 95% jailbreak ASR on refused inputs

Auto-published from arXiv:2606.28153 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.83, flags: [no-prompt-excerpt])

Category

jailbreak

Model

Llama-3-8B-Instruct

Surface

API (white-box activation intervention)

Setup

Researchers identified 21 Adversarially Compromised Heads (ACHs) concentrated in early layers 0–3 of Llama-3-8B-Instruct via kernel density estimation on harmful vs. benign activation distributions. They suppressed these heads by subtracting a scaled refusal-direction vector from their output activations (oEOI^(l,h) ← oEOI^(l,h) − α·rv^(l,h), α=0.8) on normally-refused harmful inputs — with no jailbreak prompt template. Harmful inputs drawn from Zou et al. (2023) and Mazeika et al. (2024) datasets. No literal prompt excerpts are provided in the paper.

Observed behavior

Suppressing k=8 ACHs achieves 95.0% Attack Success Rate (ASR) on Llama-3-8B-Instruct and 81.6% on Llama-2-7B-Chat at the same threshold. Full suppression of all identified ACHs reaches 99.5% and 83.7% respectively. Random head controls achieve only 4.0% (Llama-3) and 10.2% (Llama-2) ASR, confirming the specificity of ACHs.

Expected behavior

A safety-aligned model should refuse harmful inputs regardless of internal activation interventions; no small subset of attention heads should be sufficient to fully bypass refusal.

Reproducibility

medium

Threat model

An adversary with white-box access to open-weights models (e.g., operators running Llama-3 on their own infrastructure or researchers with activation-level API access) can surgically suppress a handful of early-layer attention heads to bypass safety alignment without crafting any adversarial prompt. Relevant to fine-tuning providers and red-teamers testing open-weights deployments.

Novelty

First causal demonstration that Llama-class safety alignment is mediated by a small identifiable set of early-layer attention heads — suppressing as few as 8 suffices for near-complete jailbreak, providing a mechanistic bypass recipe distinct from all prompt-level attacks.

Source

• arXiv: 2606.28153
• PDF: https://arxiv.org/pdf/2606.28153
• Categories: cs.CR, cs.AI
• Authors: Yanchen Yin, Dongqi Han, Linghui Li

Triage notes (auto)

• paperType: theory
• estimatedCaseCount: 1
• triage reason: Mechanistic analysis demonstrating jailbreak failure mode via attention head suppression; includes ablation studies showing ACH suppression causes safety bypass while SAHs persist robustly.

─────────────────────────────────────────────────────────────────────