POEM: Output-Relative Block-Sparse Attention for Long-Context Prefilling

Summary

The paper proposes Target-free Entropy-guided Residual Modulation (TERM), an inference-time defense against jailbreak attacks on LLMs. TERM calibrates attention entropy against each prompt's own prefill baseline and uses adaptive scaling to bound changes to the model's residual updates, without a predefined safety direction. Tested against seven defenses, seven jailbreak attacks and two over-refusal benchmarks on Llama, Qwen and Gemma models (Qwen3 from 0.6B to 32B), it improves jailbreak robustness with low over-refusal and modest inference overhead.

Topics

• Prompt injection and jailbreaks

Related items

• MediumAI SAST Finding: Path Traversal in OpenClaw via LLM Guardrail Bypass | Endor LabsSimilar attack · Endor Labs Blog
• InfoTERM: Target-Free Jailbreak Defense via Entropy-Guided Residual ModulationSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoSuppression Is Not Erasure: Mechanistic Analysis and Reactivation Boundaries of Subspace Projection for LoRA Backdoor DefenseSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoAnyBreak: Towards Jailbreaking Any T2I Model for Any ConceptSimilar attack · Arxiv (cs.RO + cs.CV security)
• InfoHarness Matters: Measuring and Dissecting Security Resilience in Web AgentsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)