Elamur Research⌕
☰
home / papers / 2026 / Universal Jailbreak Suffixes Are Strong Attention Hijackers

Universal Jailbreak Suffixes Are Strong Attention Hijackers

Paper · 2026 · Matan Ben-Tov, Mor Geva and Mahmood Sharif

Summary

Optimized adversarial suffixes, such as those produced by GCG, can make safety-aligned LLMs answer harmful requests. Some of them also work on many requests they were never tuned for. The authors ask which internal mechanism makes these suffixes succeed and why certain ones transfer so widely.

Working mainly with Gemma2-2B-it, they generated a large pool of single-behavior GCG suffixes and paired them with harmful instructions from AdvBench and StrongReject. They then applied two interpretability tools:

  • attention knockout, to localize the critical information flow;
  • a dominance score, which measures how much each input segment contributes to the chat template tokens just before the answer.

The attack proves shallow. The flow from suffix to chat tokens is required and largely sufficient. GCG suffixes take over the attention output there while nearly erasing the instruction's contribution. Stronger takeover ("hijacking") goes with greater universality.

This insight is actionable. Rewarding hijacking during optimization yields more universal attacks at no extra cost, and suppressing it gives a cheap defense.

Key points

  • Setup: 1200 GCG suffixes were crafted on Gemma2-2B-it and combined with 741 harmful instructions, giving roughly 900K jailbreak prompts.
    • Checks were repeated on Qwen2.5-{0.5B,1.5B,32B}-Instruct and Llama-3.1-8B-Instruct, plus 30 BEAST suffixes.
  • Scoring: success is graded by StrongReject's fine-tuned classifier.
    • Scores ≥0.65 count as success and ≤0.35 as failure.
    • A suffix's universality is its success rate over all instructions.
  • Mechanism: cutting the suffix-to-chat information flow fully disables GCG. This supports earlier work that focused on the final token position (chat[-1]).
  • Offense: the hijacking-encouraging variant (GCG-Hij) raises universality up to about ×5 in some cases, without added compute.
  • Defense: suppressing hijacking cuts attack success by at least half with minimal utility loss, and monitoring hijacking strength is a strong detection baseline.
    • Code and data are released at github.com/matanbt/interp-jailbreak.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓Tel Aviv UniversityTel Aviv · Israel89 works · 11,326 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 18,614 worksArtificial Intelligence · 17,965 worksArts and Humanities · 17,450 worksLanguage and Linguistics · 17,296 works

🧭 Topics 1Research subjects and languages the work is about.Bias, fairness & safety · 587 works

Cite

Cite as Matan Ben-Tov, Mor Geva and Mahmood Sharif. 2026. Universal Jailbreak Suffixes Are Strong Attention Hijackers. Transactions of the Association for Computational Linguistics.

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.1162/tacl.a.695

@article{bentov2026universal,
  title = {{Universal Jailbreak Suffixes Are Strong Attention Hijackers}},
  author = {Matan Ben-Tov, Mor Geva and Mahmood Sharif},
  journal = {Transactions of the Association for Computational Linguistics},
  year = {2026},
  doi = {10.1162/tacl.a.695},
  url = {https://doi.org/10.1162/tacl.a.695}
}

References

51 references, 24 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Maksym Andriushchenko, Francesco Croce, and Nicolas Flammarion. 2025. Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks. In ICLR.
  2. Andy Arditi, Oscar Balcells Obeso, Aaquib Syed, Daniel Paleka, Nina Rimsky, Wes Gurnee, and Neel Nanda. 2024. Refusal in Language Models Is Mediated by a Single Direction. In NeurIPS.
  3. Yuntao Bai, Andy Jones, Kamal Ndousse, Amanda Askell, Anna Chen, Nova DasSarma, Dawn Drain, Stanislav Fort, Deep Ganguli, Tom Henighan, Nicholas Joseph, Saurav Kadavath, Jackson Kernion, Tom Conerly, Sheer El-Showk, Nelson Elhage, Zac Hatfield-Dodds, Danny Hernandez, Tristan Hume, Scott Johnston, Sh… find
  4. Sarah Ball, Frauke Kreuter, and Nina Panickssery. 2024. Understanding Jailbreak Success: A Study of Latent Space Dynamics in Large Language Models. arXiv.
  5. Yupeng Chang, Xu Wang, Jindong Wang, Yuan Wu, Linyi Yang, Kaijie Zhu, Hao Chen, Xiaoyuan Yi, Cunxiang Wang, Yidong Wang, Wei Ye, Yue Zhang, Yi Chang, Philip S. Yu, Qiang Yang, and Xing Xie. 2024. A Survey on Evaluation of Large Language Models. ACM TIST.
  6. Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J. Pappas, Florian Tramer, Hamed Hassani, and Eric Wong. 2024a. JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models. I…
  7. Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J. Pappas, and Eric Wong. 2024b. Jailbreaking Black Box Large Language Models in Twenty Queries. In SaTML.
  8. Tri Dao, Daniel Y. Fu, Stefano Ermon, Atri Rudra, and Christopher Ré. 2022. FlashAttention: Fast and Memory-Efficient Exact Attention with IO-Awareness. In NeurIPS. find
  9. Nelson Elhage, Tristan Hume, Catherine Olsson, Neel Nanda, Tom Henighan, Scott Johnston, Sheer ElShowk, Nicholas Joseph, Nova Das-Sarma, Ben Mann, Danny Hernandez, Amanda Askell, Kamal Ndousse, Andy Jones, Dawn Drain, Anna Chen, Yuntao Bai, Deep Ganguli, Liane Lovitt, Zac Hatfield-Dodds, Jackson Ker… find
  10. Javier Ferrando, Gabriele Sarti, Arianna Bisazza, and Marta R. Costa-jussà. 2024. A Primer on the Inner Workings of Transformer-based Language Models. arXiv.
  11. Edgar C Fieller, Herman O Hartley, and Egon S Pearson. 1957. Tests for Rank Correlation Coefficients. I. Biometrika. find
  12. Mor Geva, Jasmijn Bastings, Katja Filippova, and Amir Globerson. 2023. Dissecting Recall of Factual Associations in Auto-Regressive Language Models. In EMNLP. find
  13. Google. 2024. Gemma 2: Improving Open Language Models at a Practical Size. arXiv. find
  14. Jonathan Hayase, Ema Borevkovic, Nicholas Carlini, Florian Tramèr, and Milad Nasr. 2024. Query-Based Adversarial Prompt Generation. In NeurIPS. find
  15. Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. 2021. Measuring Massive Multitask Language Understanding. In ICLR.
  16. David Huang, Avidan Shah, Alexandre Araujo, David Wagner, and Chawin Sitawarin. 2025. Stronger Universal and Transferable Attacks by Suppressing Refusals. In NAACL. find
  17. Kuo-Han Hung, Ching-Yun Ko, Ambrish Rawat, I-Hsin Chung, Winston H. Hsu, and Pin-Yu Chen. 2025. Attention Tracker: Detecting Prompt Injection Attacks in LLMs. In Findings of NAACL. find
  18. Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. 2023. Baseline Defenses for Adversarial Attacks Against Aligned Language Models. arXiv.
  19. Samyak Jain, Ekdeep Singh Lubana, Kemal Ok-suz, Tom Joy, Philip Torr, Amartya Sanyal, and Puneet K. Dokania. 2024. What Makes and Breaks Safety Fine-tuning? A Mechanistic Study. In NeurIPS. find
  20. Xiaojun Jia, Tianyu Pang, Chao Du, Yihao Huang, Jindong Gu, Yang Liu, Xiaochun Cao, and Min Lin. 2025. Improved Techniques for Optimization-Based Jailbreaking on Large Language Models. In ICLR. find
  21. Nathalie Maria Kirch, Severin Field, and Stephen Casper. 2024. What Features in Prompts Jailbreak LLMs? Investigating the Mechanisms Behind Attacks. In BlackboxNLP Workshop. find
  22. Goro Kobayashi, Tatsuki Kuribayashi, Sho Yokoi, and Kentaro Inui. 2020. Attention is Not Only a Weight: Analyzing Transformers with Vector Norms. In EMNLP.
  23. Goro Kobayashi, Tatsuki Kuribayashi, Sho Yokoi, and Kentaro Inui. 2021. Incorporating Residual and Normalization Layers into Analysis of Masked Language Models. In EMNLP. find
  24. Andrew Lee, Xiaoyan Bai, Itamar Pres, Martin Wattenberg, Jonathan K Kummerfeld, and Rada Mihalcea. 2024. A Mechanistic Understanding of Alignment Algorithms: A Case Study on DPO and Toxicity. In ICML.
  25. Chak Tou Leong, Qingyu Yin, Jian Wang, and Wenjie Li. 2025. Why Safeguarded Ships Run Aground? Aligned Large Language Models’ Safety Mechanisms Tend to Be Anchored in The Template Region. In ACL. find
  26. Tianlong Li, Zhenghua Wang, Wenhao Liu, Muling Wu, Shihan Dou, Changze Lv, Xiaohua Wang, Xiaoqing Zheng, and Xuanjing Huang. 2025. Revisiting Jailbreaking for Large Language Models: A Representation Engineering Perspective. In COLING.
  27. Xuechen Li, Tianyi Zhang, Yann Dubois, Rohan Taori, Ishaan Gulrajani, Carlos Guestrin, Percy Liang, and Tatsunori B. Hashimoto. 2023. AlpacaEval: An Automatic Evaluator of Instruction-following Models. https://github.com/tatsu-lab/alpaca_eval. ↗
  28. Zeyi Liao and Huan Sun. 2024. AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMs. In COLM. find
  29. Chin-Yew Lin. 2004. ROUGE: A Package for Automatic Evaluation of Summaries. In ACL.
  30. Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. 2024. AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models. In ICLR.
  31. Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, David Forsyth, and Dan Hendrycks. 2024. Harm-Bench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal. In ICML. find
  32. Nicholas Meade, Arkil Patel, and Siva Reddy. 2025. Investigating adversarial trigger transfer in large language models. TACL. find
  33. Meta. 2024. The Llama 3 Herd of Models. arXiv.
  34. Timothee Mickus, Denis Paperno, and Mathieu Constant. 2022. How to Dissect a Muppet: The Structure of Transformer Embedding Spaces. TACL.
  35. Xiangyu Qi, Ashwinee Panda, Kaifeng Lyu, Xiao Ma, Subhrajit Roy, Ahmad Beirami, Prateek Mittal, and Peter Henderson. 2025. Safety Alignment Should Be Made More Than Just a Few Tokens Deep. In ICLR.
  36. Qwen. 2025. Qwen2.5 Technical Report. arXiv. find
  37. Rafael Rafailov, Archit Sharma, Eric Mitchell, Stefano Ermon, Christopher D. Manning, and Chelsea Finn. 2024. Direct Preference Optimization: Your Language Model is Secretly a Reward Model. In NeurIPS.
  38. Vinu Sankar Sadasivan, Shoumik Saha, Gau-rang Sriramanan, Priyatham Kattakinda, Atoosa Chegini, and Soheil Feizi. 2024. Fast Adversarial Attacks on Language Models In One GPU Minute. In ICML. find
  39. Patrick Schober, Christa Boer, and Lothar A Schwarte. 2018. Correlation Coefficients: Appropriate Use and Interpretation. Anesthesia & Analgesia. find
  40. Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. 2024. “Do Anything Now”: Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models. In CCS.
  41. Alexandra Souly, Qingyuan Lu, Dillon Bowen, Tu Trinh, Elvis Hsieh, Sana Pandey, Pieter Abbeel, Justin Svegliato, Scott Emmons, Olivia Watkins, and Sam Toyer. 2024. A StrongRE-JECT for Empty Jailbreaks. In NeurIPS. find
  42. Leonard Tang. 2024. A Trivial Jailbreak Against Llama 3. https://github.com/haizelabs/ llama3-jailbreak. ↗
  43. T. Ben Thompson and Michael Sklar. 2024. FLRT: Fluent Student-Teacher Redteaming. arXiv. find
  44. Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. 2017. Attention Is All You Need. In NeurIPS.
  45. Jesse Vig, Sebastian Gehrmann, Yonatan Belinkov, Sharon Qian, Daniel Nevo, Simas Sakenis, Jason Huang, Yaron Singer, and Stuart Shieber. 2020. Causal Mediation Analysis for Interpreting Neural NLP: The Case of Gender Bias. In NeurIPS. find
  46. Kevin Ro Wang, Alexandre Variengien, Arthur Conmy, Buck Shlegeris, and Jacob Steinhardt. 2023. Interpretability in the Wild: a Circuit for Indirect Object Identification in GPT-2 Small. In ICLR. find
  47. Zijun Wang, Haoqin Tu, Jieru Mei, Bingchen Zhao, Yisen Wang, and Cihang Xie. 2024. AttnGCG: Enhancing Jailbreaking Attacks on LLMs with Attention Manipulation. arXiv. find
  48. Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2023. Jailbroken: How Does LLM Safety Training Fail? In NeurIPS.
  49. Fred Zhang and Neel Nanda. 2024. Towards Best Practices of Activation Patching in Language Models: Metrics and Methods. In ICLR.
  50. Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, Ann-Kathrin Dombrowski, Shashwat Goel, Nathaniel Li, Michael J. Byun, Zifan Wang, Alex Mallen, Steven Basart, Sanmi Koyejo, Dawn Song, Matt Fredrikson, J. Zico Kolter, and Dan Hendry… — Representation Engineering: A Top-Down Approach to AI Transparency
  51. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. 2023b. Universal and Transferable Adversarial Attacks on Aligned Language Models. arXiv.

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/tov-2026-universal-jailbreak-suffixes-are-strong/