TERM: Target-Free Jailbreak Defense via Entropy-Guided Residual Modulation

Summary

This paper proposes Target-free Entropy-guided Residual Modulation (TERM), an inference-time defense against jailbreak attacks on LLMs. TERM calibrates attention entropy against each prompt's own prefill baseline and uses the result to bound-scale the model's own residual updates, without a predefined safety direction. The authors report improved jailbreak robustness with low over-refusal across Llama, Qwen, and Gemma models from 0.6B to 32B parameters, with modest inference overhead.

Topics

• Prompt injection and jailbreaks

Related items

• MediumAI SAST Finding: Path Traversal in OpenClaw via LLM Guardrail Bypass | Endor LabsSimilar attack · Endor Labs Blog
• InfoSuppression Is Not Erasure: Mechanistic Analysis and Reactivation Boundaries of Subspace Projection for LoRA Backdoor DefenseSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoAnyBreak: Towards Jailbreaking Any T2I Model for Any ConceptSimilar attack · Arxiv (cs.RO + cs.CV security)
• InfoHarness Matters: Measuring and Dissecting Security Resilience in Web AgentsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoA Layer-wise Study of How Style Rewriting Breaks the Calibration of Zero-Shot LLM Fake-News DetectorsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)