Robust Harmful Features Under Jailbreak Attacks: Mechanistic Evidence from Attention Head Specialization in Large Language Models

New research posted to arXiv on 26 June 2026 finds that jailbreak attacks on large language models do not erase safety features but instead selectively suppress specific components called attention heads [1][2]. The study identifies two functionally distinct types of attention heads: Adversarially Compromised Heads (ACHs) and Safety-Aligned Heads (SAHs) [1][2]. ACHs are concentrated in the model's early layers and are suppressed when a jailbreak attack is applied. SAHs reside in mid-layers and maintain robust activations even when an attack succeeds in bypassing a model's refusal to answer [1][2]. Large language models, or LLMs, are neural networks trained on vast amounts of text and are the foundational technology behind modern chatbots [3]. They are typically based on the transformer architecture and are often fine-tuned to follow instructions and behave as assistants [3]. Safety alignment is a process meant to prevent these models from generating harmful content. The researchers conducted ablation studies to test the causal role of these heads. They found that suppressing a small number of ACHs was sufficient to induce jailbreak-like behavior on inputs the model would normally refuse [1][2]. Conversely, removing SAHs substantially weakened mid-layer safety activations [1][2]. A token-level analysis provided a mechanistic explanation for the phenomenon. The suppression of ACHs is driven specifically by the tokens that make up the attack template. This allows the attack to bypass the model's refusal decision by suppressing ACHs, while internal safety signals are kept alive by the SAHs. The authors term this finding "Robust Harmful Features" [1][2]. To demonstrate the practical significance of this robustness, the paper shows that simply reading the persistent activations from SAHs—without any additional training—yields competitive detection performance for jailbreak attempts with strong adversarial robustness [1][2]. The paper was submitted to arXiv, an open-access repository for electronic preprints that is not peer-reviewed, which hosts scientific papers in fields including computer science [7].