TERM: Entropy-Guided Residual Modulation for Untargeted Jailbreak Defense

1. 01What problem does this paper attempt to solve?

   The authors aim to solve the problem of input-adaptive inference-time jailbreak defense without a predefined representation target, while limiting over-refusal.

   Core question: how can an inference-time defense intervene adaptively per input without predefined representation targets (steering vectors, safe regions), blocking diverse jailbreak attacks without over-refusing benign requests.

   • Problem setting: jailbreak attacks take diverse forms—role-playing, nested scenarios, multilingual rewriting, cipher encoding, search optimization, and multi-turn inducement—which the authors argue requires defenses to be effective across different attack strategies.
   • Shortcomings of existing methods: the authors state that some inference-time defenses still rely on predefined representation targets, including precomputed steering vectors (Wang et al., 2024; Lee et al., 2025) and reference refusal regions (Wu et al., 2025a); the 3D PCA projection in Figure 1 shows that seven attack families occupy different positions in LLaMA-3.1-8B representations and partially overlap with benign inputs (including XSTest), from which the authors argue that visualization alone cannot prove that a shared safety direction exists in the original representation space.
   • Core observation: attention patterns vary with prompt and decoding step, and raw entropy values are difficult to use directly as a consistent intervention signal; the authors' approach compares attention entropy with each prompt's own prefill baseline to obtain an input-specific reference.
   • Proposed in the paper: Target-free Entropy-guided Residual Modulation (TERM), an inference-time defense framework that uses prompt-calibrated attention entropy deviation to guide bounded adaptive modulation of the model's own residual updates.
   • Threat model:
     • Attacker goal: use seven types of jailbreak prompts (AIM, AutoDAN, Cipher, GCG, Jailbroken, Multilingual, ReNeLLM) to make an aligned model generate harmful responses.
     • Defender setting: model weights are frozen; no external safety classifier, no safety fine-tuning, no predefined steering directions; observation and intervention use only the model's internal signals.
     • Victim systems: open-source instruction models from three families, Llama, Qwen, and Gemma (0.6B–32B).
     • Not covered: adaptive attacks and multi-turn attacks, which the authors list as future work.

   Collapse this answer

2. 02What related research exists?

   Related work is divided into three groups: jailbreak attacks, four types of defenses, and mechanistic interpretability and representation-level intervention; baselines are 7 inference-time defenses.

   Jailbreak attacks

   • Strategy-based attacks: role-playing and persona modulation (Shah et al., 2023), multilingual obfuscation (Deng et al., 2024), cipher encoding (Yuan et al., 2024), etc., which use carefully designed prompting strategies to bypass alignment.
   • Optimization-based attacks: GCG's gradient-based suffix optimization and AutoDAN's evolutionary prompt optimization (Zou et al., 2023; Liu et al., 2024), which automatically search for adversarial prompts.
   • Attacks beyond a single turn: Foot-In-The-Door multi-turn gradual escalation, adaptive attacks, and Chimera combining heterogeneous primitives (Weng et al., 2025; Andriushchenko et al., 2025; Park et al., 2026); the authors argue that the diversity of attack objectives, surface forms, and optimization mechanisms makes cross-family generalization a core challenge for defenses.

   Defense methods

   • Prompt augmentation and detection: self-reminders or demonstrations (Xie et al., 2023; Zhou et al., 2024a), and using model signals or auxiliary safety models to identify malicious inputs (Xie et al., 2024; Hu et al., 2024; Zhang et al., 2024; Inan et al., 2023); the authors state that the former relies on prompt design and adds context overhead, while the robustness of the latter may decline as attack forms increase.
   • Safety alignment: improving robustness through additional training and parameter updates (Qi et al., 2025; Cao et al., 2026); contrastive refinement methods focus on reducing over-refusal of benign sensitive requests (Lu et al., 2026).
   • Inference-time control: token selection, backtracking, speculative decoding, KV cache editing, and safety recovery across generation depth (Xu et al., 2024; Zhang et al., 2025; Wang et al., 2025b; Jiang et al., 2024; Zhang et al., 2026); the authors state that these methods may alter the original decoding process or introduce additional inference cost.

   Mechanistic interpretability and representation-level intervention

   • Safety feature research: studying how safety-related features in hidden states form and evolve with depth (Zhou et al., 2024b); such work has advanced representation-level defenses.
   • Steering and region methods: transferring safety activation differences, learning safety/refusal directions (including sparse, constrained, and feedback-controlled steering) (Wang et al., 2024; Shen et al., 2025; Sheng et al., 2026; Nguyen et al., 2026), or learning safe regions and boundary-constrained internal representations (Wu et al., 2025a; Lu et al., 2025).
   • Entropy signal detection: prior work uses entropy-based signals to detect jailbreaks and adversarial prompts (Pu et al., 2025; Nikolenko et al., 2026; Alshaalan & Rodrigues, 2026); this paper uses normalized attention entropy as a single-pass observation.

   Baselines and benchmarks: compared against 7 inference-time defenses—decoding-based ROSE and Self-CD, steering-based Jailbreak Antidote, Surgical, InferAligner, CAST, and AdaSteer (Appendix B.4); Appendix C.10 additionally compares with AlphaSteer on 6 shared attacks; benchmarks are 7 attack families plus XSTest, OKTest, and AlpacaEval.

   Positioning: the authors state that this paper intervenes during generation, requires no additional training or auxiliary models, uses signals observed by the model itself during generation for adaptive representation-level intervention, and does not rely on predefined safety targets.

   Collapse this answer

3. 03How does the paper address this problem?

   TERM uses prompt-calibrated attention entropy deviation, obtains a control signal through normalization and temporal accumulation, and applies bounded scaling to the model's own residual updates.

   Overall approach: TERM (Target-free Entropy-guided Residual Modulation) monitors online during generation the deviation of attention entropy relative to each prompt's prefill baseline, accumulates sustained deviations into a control signal, and uses it to perform bounded scaling of the model's own residual updates, without introducing an external safety direction. Observation and intervention are by default at the same layer ℓ, chosen from the stable high-separability region in the layer-wise separability analysis (Figure 5).

   Problem setting and observables

   • Setting: The aligned autoregressive model M has N layers; given a prompt X it generates Y step by step; the goal is to regulate at inference time using only M's own signals and transitions, without an external classifier or predefined steering direction.
   • Attention entropy observation: For the monitoring layer ℓ, for each head-query pair compute the normalized entropy H(p) = −1/(log|K|)∑_{i∈ K} p_i log p_i; values near 0 indicate concentrated attention, near 1 indicate diffuse attention; then average over the query set and all heads to obtain the layer-level observation Eℓ(Q).
   • Residual transition: Rℓ,t = Hout − Hin isolates the update contributed by layer ℓ; only residual updates at the most recent S sequence positions (set St) are modulated, earlier positions are unchanged.

   Prompt-calibrated entropy deviation (§3.2.1)

   • Dual windows: The fixed baseline window B takes the last min{Wb, n} query positions of the prefill and stays unchanged throughout generation; the online window Wt takes the most recent min{Wh, Lt} query positions and slides one step per generated token.
   • Deviation definition: ∆Ht = Ht − Hbase − δ, where Hbase = Eℓ(B), Ht = Eℓ(Wt), and δ ≥ 0 is a benign margin; ∆Ht > 0 indicates attention is more diffuse than the prompt reference by more than the margin.
   • Design rationale: The authors state that absolute entropy values are not a reliable risk signal—benign prompts may naturally produce diffuse attention, while short template or encoded malicious prompts may instead have concentrated attention, so a prompt-relative deviation is used; ∆Ht serves only as a control input, not as a harmfulness label.

   Adaptive temporal control signal (§3.2.2)

   • Scale normalization: An exponential sliding second moment vt = (1−α)vt−1 + α(∆Ht)² estimates the deviation scale, then a sigmoid gives the instantaneous activation η_t = σ(κ(Δ H_t)/(max(ϵ,√v_t)) − τ); the authors state that subtracting an adaptive mean would absorb persistent level shifts, so only the scale is normalized without re-centering.
   • Temporal accumulation: Ct = ρCt−1 + (1−ρ)ηt, C0 = 0; the activation weight j steps back is (1−ρ)ρ^j, and ηt ∈ (0,1) guarantees Ct is bounded in [0,1).
   • Positioning: The authors emphasize that benign generation also produces sustained deviations; Ct is a control signal for residual damping, not a harmfulness label.

   Adaptive residual damping (§3.2.3)

   • Scaling coefficient: ωt = clip(1 − βCt, ωmin, 1), ωmin = −1; when βCt ≪ 1, ωt ≈ 1 approximately preserves the original transition; as Ct grows the coefficient decreases until clipping; 0 ≤ ωt < 1 is attenuation, ωt < 0 is direction reversal.
   • Intervention method: The residual update Pt Rℓ,t of the selected rows is changed to ωt Pt Rℓ,t, and the layer output is replaced by Hout + Pt⊤[(ωt−1)Pt Rℓ,t]; the authors state that unlike additive activation steering, this introduces no external safety or refusal direction and only rescales the model's own transition according to the current accumulated signal.
   • Boundedness: Since |ωt| ≤ 1, the rescaling does not increase the Frobenius norm of the selected residual updates; Appendix A.2 gives non-expansiveness, a variational interpretation, and a conditional perturbation bound on the downstream token distribution, and notes that non-expansive residuals do not imply small output perturbation or semantic safety.

   Key parameters and implementation

   • Reference hyperparameters (Appendix C.8): β = 9, ρ = 0.5, α = 0.08, τ = 0.3, κ = 20; windows and intervention span are swept in Appendix C.5; under the main setting the prefill window is 16, the online window is 8, and the intervention token window is 8 (in Table 7 the 8-token intervention window has the highest Score).
   • Monitoring layer: Chosen per model, e.g., LLaMA-3.1-8B uses the 12th decoder block (Appendix C.8); the layer-wise AUROC analysis (Figure 5) shows the high-separability region is mainly in the early-to-middle layers, but the peak location varies by backbone.
   • Procedure: Algorithm 1 in Appendix A.1 gives the complete online procedure from prefill to each decoding step; all experiments are implemented with PyTorch on a single NVIDIA Tesla A100.

   Collapse this answer

4. 04What experiments did the paper conduct?

   Comparing 7 defenses and 7 attacks on 3 main backbones, TERM has the highest average DSR and lowest ORR; there are also generalization, ablation, efficiency, and mechanism analyses.

   Experimental setup

   • Models evaluated: main experiments use LLaMA-3.1-8B, Qwen2.5-7B-Instruct, and Gemma-2-9B-it; generalization experiments add Llama3.2-3B, Gemma3-4B-it, Qwen3.5-9B, and Qwen3-0.6B/1.7B/4B/8B/14B/32B (Appendix B.1).
   • Benchmarks: 7 jailbreak attacks (AIM, AutoDAN, Cipher, GCG, Jailbroken, Multilingual, ReNeLLM); benign benchmarks XSTest (250 items) and OKTest (300 test items); utility benchmarks AlpacaEval, GSM8K (1,319 questions), MMLU (14,042 questions) (Appendix B.2, B.3).
   • Baselines: No Defense plus 7 inference-time defenses (ROSE, Self-CD, Jailbreak Antidote, Surgical, InferAligner, CAST, AdaSteer); Appendix C.10 additionally compares AlphaSteer.
   • Metrics: DSR (proportion of harmful prompts successfully blocked), ORR (proportion of benign sensitive prompts that did not receive a substantive answer), Score = average DSR − average ORR; Defense is the unweighted average of DSR over the 7 attacks, ORR is the unweighted average of XSTest and OKTest (Appendix B.5).
   • Judging method: GPT-4o judges DSR and ORR (Appendix B.5); AlpacaEval reports pairwise win rates against the corresponding undefended model.
   • Comparison protocol: Base, TERM, and each defense on the same backbone use the same prompts, decoding settings, generation budget, and judging procedure; sample-level analysis uses 550 benign and 650 attack samples per model (Appendix C.7); the paper does not report the number of repetitions.

   Main results

   According to Table 1 (each cell is DSR; ORR is the mean of XSTest/OKTest):

   Swipe horizontally to read the table

   Model	Method	Defense↑	ORR↓	Score↑
   Llama3.1	No Defense	38.14	5.60	32.54
   Llama3.1	AdaSteer	91.86	2.13	89.73
   Llama3.1	TERM (Ours)	97.00	1.43	95.57
   Qwen2.5	No Defense	41.43	5.00	36.43
   Qwen2.5	AdaSteer	91.71	8.90	82.81
   Qwen2.5	TERM (Ours)	98.43	0.60	97.83
   Gemma-2	No Defense	30.29	13.73	16.56
   Gemma-2	AdaSteer	85.86	7.20	78.66
   Gemma-2	TERM (Ours)	89.29	6.77	82.52

   (The five rows for ROSE, Self-CD, Jailbreak Antidote, Surgical, and InferAligner, CAST are omitted; their Scores are all lower than AdaSteer and TERM; full data in Table 1.)

   • Authors' interpretation: the authors state that TERM has the highest average DSR and lowest ORR on the three backbones, 3.43–6.72 percentage points higher than the strongest baseline, indicating that the robustness gain is not bought by uniformly refusing more.
   • Single-attack counterexample: TERM is not highest on every attack; e.g., on Llama3.1 the DSR for AIM is 89.00, lower than the 100.00 of ROSE/Surgical/CAST/AdaSteer (Table 1).
   • Utility: AlpacaEval win rates against the undefended model are 50.50% (Llama3.1), 51.93% (Qwen2.5), and 48.76% (Gemma-2) (Table 5).

   Generalization: cross-family and Qwen3 scale

   • Cross-family (Table 2 top block): Llama3.2-3B Score 89.30→90.20, Gemma3-4B 34.04→51.55, Qwen3.5-9B 86.74→87.90; the authors state that the target-free method generalizes beyond the three main backbones.
   • Counterexample: Gemma3-4B's DSR rises from 42.71% to 63.29%, but ORR also rises from 8.67% to 11.74%; the authors note that a higher composite score does not mean both metrics improve simultaneously.
   • Qwen3 scale (Table 2 bottom block): Score improves at all scales, but the magnitude does not grow monotonically with parameter count—Qwen3-1.7B rises from 32.00 to 74.87, while Qwen3-8B only rises from 61.97 to 64.46.

   Ablations and sample-level costs

   • Component ablation (Table 3, LLaMA-3.1-8B): full method DSR 97.00%, ORR 1.43%; removing adaptive RMS normalization or negative residual scaling drops DSR to 40.86% and 41.71% respectively; removing the prefill baseline or signal accumulation keeps DSR above 93% but raises ORR to 77.83% and 83.40%. The authors state that calibration and accumulation are responsible for benign selectivity, while normalization and signed scaling provide intervention strength.
   • Sample-level costs (Appendix C.7, Figure 10): both favorable and unfavorable transitions exist on all 5 Qwen3 models; e.g., on Qwen3-14B, 15.85% of attack prompts go from successful to blocked and 8.62% from blocked to successful, while 1.64% of benign prompts go from refusal to answer and 6.00% from answer to refusal (550 benign and 650 attack samples). The authors state that the net gain is a balance of the two types of transitions, not cost-free correction.
   • Input dependence (Figure 3): for decoding steps with similar Ct, the direction of change in projection onto the post-hoc refusal axis can be positive or negative; the authors state that the accumulated signal determines modulation strength rather than a fixed representation direction.

   Efficiency, layer selection, and monitoring signals

   • Inference efficiency (Figure 4a, 90 fixed prompts): TERM 45.03 tokens/s, 94.3% of the undefended model's 47.73; higher than Surgical (34.44), Self-CD (27.04), and ROSE (25.65), and close to CAST (44.46) and InferAligner (44.08).
   • Layer selection (Table 8, LLaMA-3.1-8B): moving the intervention layer to 32 raises XSTest ORR to 96.4%–98.8% (DSR still 96.0–100.0); the combination of detection 12 + intervention 12 has the lowest ORR (1.2%) and equal-weight DSR 99.0%.
   • Layer separability (Figure 5): on 9 backbones, attention entropy's AUROC for AdvBench/HarmBench vs. GSM8K peaks near 1.0; the highly separable region is mainly in the early-to-middle layers but does not align to the same depth; Appendix C.12 shows that when the benign reference is changed to Harmless Instructions, multi-layer AUROC is near or below 0.5.
   • Monitoring signal comparison (Table 13, Appendix C.13): the direction-aligned Ct variant has the highest early-detection TPR (64.86% at step 4 vs. 45.52% for attention entropy), and the two are close at step 32 (77.29% vs 75.10%); however, its false-positive persistence of 56.18% is the highest among the five signals (Table 14).

   Other ablations and analyses

   • Window sweep (Table 7): prefill windows 2–256 give unchanged results (DSR 99.0%, ORR 1.2%); online windows 4/8 have the highest Score (97.8); intervention windows ≥32 raise ORR to 10.0%–15.6%.
   • Hyperparameter sweep (Figure 4, Tables 9–11): for β∈{6,9,12,15}×ρ∈{0.3,0.5,0.7}, DSR 94.5%–100.0% and XSTest ORR 1.2%–6.0%; α and τ sweeps give DSR 94.5%–99.5%; κ from 5 to 40 gives DSR 97.5%–99.0%.
   • General capabilities (Table 6): GSM8K accuracy drops by 2.73, 3.79, and 0.08 percentage points respectively; on MMLU, Llama3.1 drops 0.73, Qwen2.5 drops 0.14, and Gemma-2 rises 0.04 percentage points.
   • AlphaSteer comparison (Table 12, 6 shared attacks): TERM's XSTest ORR is lower on all three backbones (1.2% vs 8.8%, 1.2% vs 4.4%, 5.2% vs 20.8%); on Qwen2.5, AlphaSteer's average DSR of 98.83 is higher than TERM's 98.33.
   • Hidden-state trajectories (Figure 6): the authors state that after intervention, the average direction of harmful prompts moves toward the refusal direction and that of XSTest benign prompts moves away from the refusal direction, and this remains visible at the last layer.

   Collapse this answer

5. 05What are some points that can be further explored?

   The authors state that future work needs to study real-world deployment and stronger threat models such as adaptive and multi-turn attacks; experiments cover single-turn attacks and open-source models.

   Limitations and future directions noted by the authors

   • Stronger threat models: The authors say future work will examine robustness against stronger threat models, including adaptive attacks and multi-turn attacks (Conclusion).
   • Practical deployment: The authors say future work will study practical deployment scenarios (Conclusion).
   • Dependence on benign references: The layer-wise analysis shows that separability depends on the benign reference set—after switching to Harmless Instructions, AUROC drops in many layers, with some approaching or falling below 0.5; the authors say this is a reminder that absolute attention entropy cannot be treated as a general-purpose harmfulness discriminator (Appendix C.12).
   • False-positive cost of the monitoring signal: Although the direction-aligned Ct variant has a lower benign FPR (4.36%), its false-positive persistence of 56.18% is the highest among the five signals; the authors say stronger alert continuity comes with a benign-side cost (Appendix C.13).
   • Sample-level cost: The authors say the intervention produces both favorable and unfavorable shifts on all 5 Qwen3 models; the aggregate gain is a balance of the two types of shifts rather than cost-free correction (Appendix C.7).

   Experimental coverage

   • Models tested: 12 open-source models across the Llama, Qwen and Gemma families (0.6B–32B), with weights frozen; closed-source models were not involved.
   • Attack coverage: 7 single-turn jailbreak families; multi-turn and adaptive attacks are discussed only in related work and were not tested experimentally.
   • Benign and utility evaluations: XSTest (250 items), OKTest (300 test items), AlpacaEval, GSM8K (1,319 questions), MMLU (14,042 questions).
   • Evaluation method: DSR and ORR were judged by GPT-4o (Appendix B.5); the paper does not report agreement between the evaluator and humans.
   • Experimental protocol: The paper does not report the number of repetitions or statistical significance tests; efficiency measurements used 90 fixed prompts (Appendix C.9).

   Collapse this answer

6. 06Summarize the main content of the paper

   TERM uses prompt-calibrated attention entropy deviation to guide residual modulation, achieving the highest average DSR and lowest ORR on three backbones.

   An inference-time jailbreak defense paper, aimed at aligned open-source LLMs.

   • Problem addressed: the authors argue that some representation-level defenses rely on predefined steering vectors or safe regions, making it difficult to intervene adaptively per input without predefined representation targets while limiting over-refusal; the PCA projection in Figure 1 shows that seven attack families are distributed differently and partially overlap with benign inputs.
   • Method highlights: TERM uses each prompt's prefill attention entropy as a baseline, computes the online entropy deviation ∆Ht, obtains a control signal Ct through adaptive RMS normalization and exponential accumulation, and then scales the model's own residual updates by a bounded coefficient ωt = clip(1−βCt, −1, 1), without introducing external safety directions; model weights are frozen and no auxiliary classifier is used.
   • Main results (Table 1, GPT-4o judging): on Llama3.1, Qwen2.5, and Gemma-2, average DSR is 97.00%, 98.43%, and 89.29% respectively, and average ORR is 1.43%, 0.60%, and 6.77% respectively, which the authors state outperforms 7 inference-time baselines; however, there are counterexamples on individual attacks (Llama3.1's AIM is 89.00, lower than the 100.00 of several baselines).
   • Generalization and costs: Table 2 shows that composite scores improve across families and Qwen3 scales, but Gemma3-4B's ORR rises from 8.67% to 11.74%, and gains do not grow monotonically with scale; Appendix C.7 shows unfavorable transitions on all 5 Qwen3 models (e.g., on Qwen3-14B, 6.00% of benign prompts go from answer to refusal).
   • Ablations and efficiency: removing signal accumulation or the prefill baseline pushes ORR up to 83.40% and 77.83% (Table 3); throughput is 45.03 tokens/s, 94.3% of the undefended model (Figure 4a).
   • Authors' conclusion: the authors state that prompt calibration, temporal accumulation, and input-dependent residual modulation together support the defense and low over-refusal; future work will examine real-world deployment and stronger threat models such as adaptive and multi-turn attacks.

   Collapse this answer

Related papers