FLASH: Focused Layer Attention Sink Hijacking

摘要

Despite advances in safety alignment, Large Language Models (LLMs) remain vulnerable to jailbreaking attacks. However, prevailing methods suffer from a dichotomy of limitations: they either rely on prohibitive iterative optimization in the input space (leading to high computational costs) or fail to penetrate the model’s internal decision-making processes. In this work, we identify a critical structural vulnerability: the ”Attention Sink” mechanism—originally designed to maintain generation stability by anchoring to initial tokens—unintentionally serves as a computational anchor for safety alignment. We hypothesize and empirically verify that safety guardrails are not globally distributed but are predominantly ”front-loaded” in specific attention heads of shallow layers. To audit this structural fragility, we propose FLASH (Focused Layer Attention Sink Hijacking), a novel diagnostic auditing framework that executes a surgical intervention. By precisely scaling attention scores in these vulnerable layers, we dismantle the model’s internal safety anchor. To ensure the attack’s robustness and coherence against the resulting internal noise, we synergize this intervention with multi-variant query rewriting and an adaptive dynamic decoding strategy. Extensive experiments on Llama-3, Qwen-3, and others demonstrate that FLASH achieves a state-of-the-art Attack Success Rate of over 77% with an unprecedented efficiency of 1.53 queries on average. This work marks a paradigm shift from brute-force optimization to mechanism-driven diagnostic auditing, exposing a fundamental trade-off between architectural stability and safety security.