Depth Charge: Jailbreak Large Language Models from Deep Safety Attention Heads

Currently, open-sourced large language models (OSLLMs) have demonstrated remarkable generative performance. However, as their structure and weights are made public, they are exposed to jailbreak attacks even after alignment. Existing attacks operate primarily at shallow levels, such as the prompt or embedding level, and often fail to expose vulnerabilities rooted in deeper model components, which creates a false sense of security for successful defense. In this paper, we propose $\underset{‾}{\mathbf{\text{S}}}$afety $\underset{‾}{\mathbf{\text{A}}}$ttention $\underset{‾}{\mathbf{\text{H}}}$ead $\underset{‾}{\mathbf{\text{A}}}$ttack ($\mathbf{\text{SAHA}}$), an attention-head-level jailbreak framework that explores the vulnerability in deeper but insufficiently aligned attention heads. SAHA contains two novel designs. Firstly, we reveal that deeper attention layers introduce more vulnerability against jailbreak attacks. Based on this finding, $\mathbf{\text{SAHA}}$ introduces $\mathit{\text{Ablation-Impact}}\mathit{\text{Ranking}}$ head selection strategy to effectively locate the most vital layer for unsafe output. Secondly, we introduce a boundary-aware perturbation method, $\mathit{\text{i.e.}}\mathit{\text{Layer-Wise}}\mathit{\text{Perturbation}}$, to probe the generation of unsafe content with minimal perturbation to the attention. This constrained perturbation guarantees higher semantic relevance with the target intent while ensuring evasion. Extensive experiments show the superiority of our method: SAHA improves ASR by 14% over SOTA baselines, revealing the vulnerability of the attack surface on the attention head. Our code is available at https://anonymous.4open.science/r/SAHA.