Writing study: Robust Harmful Features Under Jailbreak Attacks: Mechanistic Evidence from Attention Head Specialization in Large Language Models

ICML overviewCorpus atlasBy contribution typeVisual galleryRules & templateWriting patternsPaper studies

← ICML 2026 oral writing corpus

Yanchen Yin, Dongqi Han, Linghui Li · Official ICML 2026 oral record

Observed writing choices, not acceptance rules. This study examines the inspected manuscript version. It does not establish why the paper was accepted or that its presentation choices should be copied unchanged.

Figure, table and section ledger

Editorial contribution type: Empirical analysis, diagnosis & auditing (primary).

Layout extraction, not a required paper template. Counts are distinct caption labels; a multi-panel figure counts once. Section spans are estimated from heading positions, including floats and whitespace. Method and limitations.

Canonical PDF

33 physical pages

Before references / appendix

≈ 8.7 page-equivalents

Main figures / tables

8 / 2

Attached appendix figures / tables

9 / 11

Attached appendix span

≈ 20.47 page-equivalents

Before references / appendix: ≈ 26.36%References / intervening material: ≈ 11.61%Attached appendix: ≈ 62.03%Estimated layout envelopes, not text/artwork area. Unresolved appendix boundaries remain within the undivided post-body material.

Section-by-section lengths and source pages

The title/abstract/front matter precede the first numbered heading. A span ends at the next detected top-level heading, not at the last sentence; end-page whitespace is included. References and statements are listed separately. These are not measurements of text-only or artwork area.

Top-level heading	Starts on PDF page	Estimated span	Share of entire PDF
1. Introduction	1	≈ 1.19 pp.	3.61%
2. Related Work	2	≈ 0.78 pp.	2.36%
3. Method	3	≈ 2 pp.	6.06%
4. Experiments	5	≈ 2.58 pp.	7.82%
5. Practical Validation via Detection	7	≈ 0.8 pp.	2.42%
6. Conclusion	8	≈ 0.5 pp.	1.52%
Acknowledgements	9	≈ 0.05 pp.	0.15%
Impact Statement	9	≈ 0.43 pp.	1.3%
References	9	≈ 3.83 pp.	11.61%
A. Robustness of Distribution Estimation	13	≈ 4.23 pp.	12.82%
B. Justifying the Exclusion of MLP Blocks and LayerNorm	17	≈ 3.04 pp.	9.21%
C. Qualitative Examples of ACH Ablation	20	≈ 2.95 pp.	8.94%
D. Detection Method Details	23	≈ 3.6 pp.	10.91%
E. Scaling Analysis on Llama-3-70B	27	≈ 6.65 pp.	20.15%

All detected figure and table locations

Main text

• Figure 1 · p. 1
• Figure 2 · p. 4
• Figure 3 · p. 6
• Figure 4 · p. 6
• Figure 5 · p. 6
• Figure 6 · p. 7
• Table 1 · p. 7
• Figure 7 · p. 7
• Table 2 · p. 9
• Figure A1 · p. 13

Attached appendix

• Table A1 · p. 14
• Table A2 · p. 15
• Table A3 · p. 16
• Figure A2 · p. 17
• Figure A3 · p. 18
• Table A4 · p. 23
• Table A5 · p. 25
• Table A6 · p. 26
• Table A7 · p. 26
• Table A8 · p. 27
• Table A9 · p. 27
• Table A10 · p. 28
• Table A11 · p. 29
• Figure A4 · p. 30
• Figure A5 · p. 31
• Figure A6 · p. 31
• Figure A7 · p. 31
• Figure A8 · p. 32
• Figure A9 · p. 32
• Figure A10 · p. 33

Argument and organization

1. 1 Introduction; 2 Related Work

   Turns persistent activations during successful attacks into a mechanistic question.

2. 3 Method; 4 Experiments

   Defines head categories, establishes associations, then tests interventions and token attribution.

3. 5 Practical Validation; 6 Conclusion

   Separates the detection application from the mechanistic explanation and its limits.

Problem, claim and contribution

A visible residual safety signal motivates two questions about attack success and representation persistence rather than an undifferentiated defense claim.

Abstract and Figure 1, p.1 · Main paper

Argument and section order

The text explicitly marks the transition from statistical association to intervention before making its causal argument.

Sections 4.2-4.3, p.6 · Main paper

Figures, captions and visual explanation

The overview compresses classification and detection into a schematic, while the analytical page uses heatmaps, a random-control table and token-group violin plots for distinct claims.

Figure 2, p.4; Figures 6-7 and Table 1, p.7 · Main paper

Tables, comparisons and evidence

Interventions are compared with random heads and repeated-run intervals; the detector later uses a broader component set rather than only the two named head categories.

Section 4.3, p.6; Section 5, p.8 · Main paper

Appendix and reproducibility

Threshold sensitivity exposes changing category sizes, and the larger-model extension explicitly retains a small-sample caveat.

Appendices A.2 and E.6, pp.14,28 · Main paper

Clarity and writing conventions

The authors call the proposed pathway sufficient, not exclusive, and delimit the single-direction approximation and white-box deployment requirement.

Section 4.3, p.6; Conclusion, p.8 · Main paper

What to reuse—and what not to infer

Transferable lesson: Distinguish correlation, intervention evidence and an engineering application, and preserve the logical difference between sufficient and exclusive explanations.

Boundary: The selected successful-attack pairs and attention-only, single-direction analysis limit generalization; the writing scan does not verify the mechanistic derivation.

Apply this lesson using the argument and evidence worksheet.

Inspection record and sources

Checked

2026-10-07

Reading status

Writing-focused manuscript scan + selected visuals inspected

Main text

Writing-oriented scan of the main argument through physical p.9, with focused physical-page text inspection on 1, 3, 5, 6, 7, 8, 9. Framing, section progression, mechanism/proof explanation, displays, comparison conditions and conclusions were inspected. This is not exhaustive technical reading, proof verification or reproduction.

Appendix / supplement

Appendix organization and main-text pointers were checked; focused text inspection of physical pages 14, 28. Remaining appendix proofs and details were not exhaustively read. No separately linked supplement inspected.

Visually inspected PDF pages

4, 7

This is a writing-focused scan of the manuscript and the stated supplementary scope: framing, organization, visual explanation, evidence presentation and wording. It is not a line-by-line proof audit, reproduction of results or exhaustive scientific review.

• Published proceedings PDF, PMLR volume 306, retrieved 2026-10-07 · 33 pages