Large language models can be tricked into generating harmful content through carefully crafted prompts, known as jailbreak attacks. Existing defenses often require knowing in advance what a "safe" internal state looks like, which can cause the model to refuse harmless requests too often. A new approach called TERM avoids this by using the model's own attention patterns, how it focuses on parts of the input, to detect attacks without any predefined safety target.
TERM works by first measuring attention entropy, a measure of how spread out or focused the model's attention is, for every input prompt. It compares this to the prompt's own early baseline to decide if an attack is happening. A signal is then built that controls how much the model's internal updates are scaled down, limiting harmful outputs while preserving normal responses.
In tests across multiple models and attack types, TERM blocked nearly all jailbreak attempts while only refusing about 5% of harmless questions that are safety-sensitive, a much lower rate than existing methods. This offers a practical defense that does not compromise the model's usefulness on everyday requests.