An Immune System for LLMs: Entropy-Based Defense That Doesn't Need to Know What 'Safe' Looks Like

TERM defends LLMs against jailbreaks at inference time by measuring how much a prompt distorts the model's own attention patterns, avoiding the brittle predefined safety directions that plague existing defenses.

Imagine you're a bouncer at a nightclub, but instead of checking IDs against a list of banned patrons, you watch how the crowd reacts when someone walks in. If conversations go quiet, people stiffen, the ambient energy shifts — something's off, even if you've never seen this person before. That's TERM's core mechanism: it doesn't need a pre-built profile of what 'dangerous' looks like. It watches the model's own attention entropy shift when processing a prompt and intervenes when the deviation pattern says something unusual is happening. The committed claim: an inference-time jailbreak defense that uses no predefined safety direction, adapts to each input via calibrated attention entropy deviations, and achieves strong robustness without the over-refusal problem that cripples most representation-based defenses. This is not a new alignment technique — it's a runtime anomaly detector that modulates the model's own residual stream. The distinction matters because it means TERM doesn't require retraining and doesn't impose a fixed notion of 'safe' representation space. The mechanism works in three stages. First, during prefill (processing the prompt before generation begins), TERM computes baseline attention entropy statistics per layer. Second, during decoding, it measures how each step's attention entropy deviates from that prompt-specific baseline. Third, adaptive scale normalization and temporal accumulation convert those deviations into a bounded scaling factor applied to the model's residual updates. The key insight is that raw entropy values are meaningless across different prompts — a long technical prompt naturally has different entropy than a short conversational one — so calibration against each prompt's own prefill baseline is what makes the signal interpretable. The evaluation covers serious ground: seven defense baselines, seven jailbreak attack methods, two over-refusal benchmarks, and three model families (Llama, Qwen, Gemma) including Qwen3 models from 0.6B to 32B parameters. The paper claims improved jailbreak robustness with low over-refusal and modest inference overhead. The breadth across model families and scales is genuinely useful — most defense papers test on one or two models and call it a day. However, the abstract doesn't name specific attack success rate numbers or quantify the overhead, which means we're trusting 'improved' and 'modest' without anchors. Architecturally, this belongs to the representation-intervention family of LLM defenses, distinct from input-filtering (perplexity-based detection), output-filtering (safety classifiers on generated text), or training-time approaches (RLHF, DPO). Within representation-intervention, it's specifically a residual-stream modulation method — it scales the model's own update vectors rather than adding or subtracting a learned direction. The closest relatives are activation steering (Representation Engineering) and safety-region methods, but TERM's target-free design is what separates it: no offline computation of a 'refusal direction' needed. The integrity picture is mixed. Testing across seven attacks and three model families with over-refusal measurement is above average for the defense literature, where cherry-picking favorable attack-defense matchups is rampant. But the validation is entirely same-team evaluation — no independent red-teaming, no adaptive adversary explicitly targeting the entropy-based signal. The obvious attack surface is an adversary who crafts prompts that maintain normal attention entropy while still jailbreaking, and the paper's silence on this is notable. The next milestone for this line of work is clear: surviving adaptive adversaries who specifically target the entropy signal. If an attacker can construct prompts that keep attention entropy within the calibrated baseline while still eliciting harmful outputs, the defense collapses. The gap between 'robust against known attacks' and 'robust against adversaries who know your defense mechanism' is where most LLM defenses die, and TERM hasn't crossed it yet.