A new paper pinpoints why moving a few words in a prompt can blow past an LLM's safety training.
Researchers studied the continuation-triggered jailbreak, where relocating an instruction suffix that tells a model to keep generating text substantially raises jailbreak success rates. Using mechanistic interpretability - causal interventions and activation scaling on individual attention heads - they trace the effect to a straightforward conflict: the model's built-in drive to continue text competes with the safety behaviors instilled during alignment training. The team also mapped which attention heads act as safety gatekeepers versus continuation drivers, and found that this behavior differs notably across model architectures. From those findings, they built Head Competition Steering, an inference-time method that tips that internal competition toward the safety heads, then distilled the technique into a smaller student model so the fix adds no extra compute cost at run time.
This is one of the more concrete looks yet at jailbreaks as a wiring problem rather than a prompt-phrasing trick, and that framing matters because most jailbreak patches treat symptoms - blocking phrases, filtering outputs - without touching the underlying cause. If safety really is just one signal losing a tug-of-war with a keep-going signal inside the model, prompt-level defenses were always going to be a patch, not a fix.
Distilling the fix into a student model with no added compute cost is the detail worth watching - free safety improvements are rare, and rarer still do they survive contact with the next jailbreak technique.