The Struggle Between Continuation and Refusal: A Mechanistic Analysis of the Continuation-Triggered Jailbreak in LLMs

The paper provides a rigorous mechanistic analysis of a specific vulnerability in large language models (LLMs) known as the continuation-triggered jailbreak. This research is critical because, despite extensive safety alignment efforts like RLHF and DPO, LLMs remain vulnerable to adversarial prompts. By focusing on the internal computational mechanisms—specifically at the level of attention heads—the authors aim to uncover why current safety defenses fail, offering a novel perspective for improving model robustness and provide practical guidance for future safety alignment strategies.

How it works

The continuation-triggered jailbreak is a method that bypasses existing safety constraints by manipulating prompt structure rather than changing the semantic intent of the malicious instruction. The vulnerability manifests when a specific continuation-triggered instruction suffix—such as Sure, here is a step-by-step guide: First—is placed outside the user prompt boundary. In this jailbreak prompt setting, this suffix is interpreted as part of the assistant’s continuation, prompting the model to generate harmful content. Conversely, under the clean prompt setting, where this instruction suffix remains within the user's input, models exhibit their built-in safety mechanisms and refuse to comply.

The Core Conflict

The researchers hypothesize that this jailbreak behavior arises from an inherent competition between the model’s intrinsic continuation drive and the safety defenses acquired through alignment training. The fundamental tension lies in the fact that LLMs are trained on a next-token prediction paradigm, which gives them an inherent tendency to generate coherent continuations aligned with input semantics. Alignment training attempts to redirect this tendency when safety is at risk, but this creates a structural conflict that allows the jailbreak attack to succeed.

Mechanistic Investigation

To validate their hypothesis, the authors employ advanced mechanistic interpretability techniques focused on attention heads. These methods include:

• Path Patching: This technique identifies behavior-critical attention heads by selectively transplanting internal activations across different input conditions and measuring the resulting change in model outputs. A large positive patching effect indicates a head lies on a causal path enabling the jailbreak.

• Ablation: The authors zero out the activations of identified key heads to assess their functional contribution to model behavior.

• Activation Scaling: This lightweight intervention modulates model behavior by applying a scaling coefficient (w) to internal activation vectors, allowing researchers to amplify or attenuate specific computational pathways without modifying parameters.

Functional Roles of Key Heads

The analysis reveals a clear functional dichotomy among the identified key heads:

1. Safety Heads: These heads are responsible for harmfulness recognition and refusal execution. When their activations are zeroed out (ablation), there is a substantial increase in Attack Success Rate (ASR). Furthermore, scaling these heads (w > 1) significantly enhances the model’s resistance to jailbreak attacks by decreasing ASR.

2. Continuation Heads: These heads primarily facilitate the generation and propagation of content. When ablated, they lead to a decrease in ASR. Conversely, increasing the scaling coefficient (w) for continuation heads leads to a monotonic and substantial rise in ASR on all benchmarks, confirming their role as drivers of harmful content generation.

Synthesis of Findings

The experimental results demonstrate that the sharp increase in ASR under jailbreak attacks is fundamentally rooted in this antagonistic interaction between safety heads and continuation heads. This conflict between the model’s safety enforcement and its intrinsic generative capabilities provides a detailed, mechanistic understanding of LLM failure modes. The study concludes that by identifying these specific head types, future development can be guided toward more robust and reliable LLMs through targeted activation-level modulation strategies.

As a fastidious AI researcher, I must emphasize that these proposed improvements are not merely fixes; they are mechanistic interventions derived from a deep understanding of the model's internal dynamics, specifically addressing the tension between its intrinsic generative drive and its safety constraints.

The core finding of this paper is that continuation-triggered jailbreak occurs because the model’s internal Continuation Heads are allowed to overpower the protective functions of its Safety Heads.

To improve AI systems based on this mechanism, we propose three specific, highly targeted improvements: two involving runtime intervention and one involving training refinement.

These methods leverage the principles of activation scaling (w) and ablation to modify model behavior without retraining the model. This provides immediate defensive capability.

1. Safety Head Amplification (Increasing Refusal Power)

• Mechanism: We apply targeted activation scaling (w > 1) to the identified Safety Heads. These are the heads proven by path patching and ablation to be responsible for recognizing harmful content or executing a refusal (e.g, those that show a substantial increase in ASR when zeroed out).

• Implementation: During inference, specifically target the identified layers and indices of these Safety Heads. We set w > 1 (where w is the scaling coefficient) to amplify their activation vectors.

• What the Improved System Can Do: The system's refusal mechanism becomes significantly more potent. It will detect dangerous instructions with higher confidence and execute a safety-aligned refusal, even if a continuation-triggered suffix is present, thus dramatically reducing the Attack Success Rate (ASR).

2. Continuation Head Attenuation (Suppressing Malicious Flow)

• Mechanism: We apply targeted activation scaling (w < 1) to the identified Continuation Heads. These are the heads proven to facilitate or propagate harmful content (e.g, those that lead to a decrease in ASR when zeroed out).

• Implementation: During inference, target these Continuation Heads and apply a low scaling coefficient (w < 1, approaching 0). This effectively suppresses their contribution to the residual stream.

• What the Improved System Can Do: The system’s ability to follow or extend a harmful instruction is attenuated. It will resist the flow of malicious content, preventing the model from generating text that aligns with a continuation-triggered prompt, thereby mitigating jailbreak success.

This approach addresses the fundamental conflict between the pre-training paradigm and safety alignment by modifying how we teach the model.

3. Safety-Aware Loss Function Integration

• Mechanism: We modify the Reinforcement Learning from Human Feedback (RLHF) or Direct Preference Optimization (DPO) objective to incorporate a penalty based on the activation patterns of Continuation Heads.

• Implementation: When training on preference data, we identify input prompts that contain continuation-triggered suffixes. We then monitor the activation magnitude of identified Continuation Heads during the forward pass. If these heads show high activity in conjunction with a potentially unsafe semantic intent, we apply an increased loss penalty to the resulting model weights.

• What the Improved System Can Do: This forces a systemic shift in model behavior. The system learns that high activation in its content generation circuits (Continuation Heads) is detrimental when safety is at risk. It will inherently prioritize safety alignment over semantic continuity, making it significantly more robust to subtle prompt manipulations like those studied here.

With the rapid advancement of large language models (LLMs), the safety of LLMs has become a critical concern. Despite significant efforts in safety alignment, current LLMs remain vulnerable to jailbreaking attacks. However, the root causes of such vulnerabilities are still poorly understood, necessitating a rigorous investigation into jailbreak mechanisms across both academic and industrial communities. In this work, we focus on a continuation-triggered jailbreak phenomenon, whereby simply relocating a continuation-triggered instruction suffix can substantially increase jailbreak success rates. To uncover the intrinsic mechanisms of this phenomenon, we conduct a comprehensive mechanistic interpretability analysis at the level of attention heads. Through causal interventions and activation scaling, we show that this jailbreak behavior primarily arises from an inherent competition between the model's intrinsic continuation drive and the safety defenses acquired through alignment training. Furthermore, we perform a detailed behavioral analysis of the identified safety-critical attention heads, revealing notable differences in the behaviors of safety heads across different model architectures. Grounded in these mechanistic findings, we propose Head Competition Steering (HCS), a mechanistically grounded inference-time strategy that explicitly leverages the competition between safety heads and continuation heads to suppress harmful generation, and further distill its behavioral signal into a student model via knowledge distillation, achieving inference-time safety improvements without additional computational overhead.