@inproceedings{xu-zhao-2026-cavd,
title = "{CAVD}-Guard: Defending Against Token Fragmentation Jailbreaks via Attention Footprints",
author = "Xu, Junjie and
Zhao, Zicheng",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.emnlp-main.1146/",
pages = "26254--26281",
ISBN = "979-8-89176-459-0",
abstract = "Large language models remain vulnerable to jailbreaks that hide harmful intent from safety screening. A recent family of highly effective attacks exploits this weakness by splitting harmful keywords into recoverable fragments; we refer to this family as Token Fragmentation Jailbreaks. The success of these attacks stems from a mismatch between screening and generation: safety screening may no longer observe complete harmful keywords, while the target model can reconstruct them during generation. We show that instructions containing fragmented words leave a measurable attention footprint inside the model. Attention concentrates among the fragmented keyword pieces, while links from those pieces to complete words are weak. Based on this finding, we introduce Calibrated Attention-Void Detection (CAVD), a training-free detector that measures this footprint with length-conditioned calibration. We then combine guard models with CAVD in CAVD-Guard. When CAVD flags an instruction as unreliable for original-view safety screening, CAVD-Guard maps it to multiple canonical views and applies guard-based classification to the recovered views. Extensive experiments show that CAVD-Guard substantially reduces attack success and improves guard blocking while maintaining low false-positive rates on benign inputs. Code is available at https://github.com/serendipity098/CAVD-Guard."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="xu-zhao-2026-cavd">
<titleInfo>
<title>CAVD-Guard: Defending Against Token Fragmentation Jailbreaks via Attention Footprints</title>
</titleInfo>
<name type="personal">
<namePart type="given">Junjie</namePart>
<namePart type="family">Xu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Zicheng</namePart>
<namePart type="family">Zhao</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hung-Yi</namePart>
<namePart type="family">Lee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sunipa</namePart>
<namePart type="family">Dev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jessy</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Desmond</namePart>
<namePart type="family">Elliott</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-459-0</identifier>
</relatedItem>
<abstract>Large language models remain vulnerable to jailbreaks that hide harmful intent from safety screening. A recent family of highly effective attacks exploits this weakness by splitting harmful keywords into recoverable fragments; we refer to this family as Token Fragmentation Jailbreaks. The success of these attacks stems from a mismatch between screening and generation: safety screening may no longer observe complete harmful keywords, while the target model can reconstruct them during generation. We show that instructions containing fragmented words leave a measurable attention footprint inside the model. Attention concentrates among the fragmented keyword pieces, while links from those pieces to complete words are weak. Based on this finding, we introduce Calibrated Attention-Void Detection (CAVD), a training-free detector that measures this footprint with length-conditioned calibration. We then combine guard models with CAVD in CAVD-Guard. When CAVD flags an instruction as unreliable for original-view safety screening, CAVD-Guard maps it to multiple canonical views and applies guard-based classification to the recovered views. Extensive experiments show that CAVD-Guard substantially reduces attack success and improves guard blocking while maintaining low false-positive rates on benign inputs. Code is available at https://github.com/serendipity098/CAVD-Guard.</abstract>
<identifier type="citekey">xu-zhao-2026-cavd</identifier>
<location>
<url>https://aclanthology.org/2026.emnlp-main.1146/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>26254</start>
<end>26281</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T CAVD-Guard: Defending Against Token Fragmentation Jailbreaks via Attention Footprints
%A Xu, Junjie
%A Zhao, Zicheng
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-459-0
%F xu-zhao-2026-cavd
%X Large language models remain vulnerable to jailbreaks that hide harmful intent from safety screening. A recent family of highly effective attacks exploits this weakness by splitting harmful keywords into recoverable fragments; we refer to this family as Token Fragmentation Jailbreaks. The success of these attacks stems from a mismatch between screening and generation: safety screening may no longer observe complete harmful keywords, while the target model can reconstruct them during generation. We show that instructions containing fragmented words leave a measurable attention footprint inside the model. Attention concentrates among the fragmented keyword pieces, while links from those pieces to complete words are weak. Based on this finding, we introduce Calibrated Attention-Void Detection (CAVD), a training-free detector that measures this footprint with length-conditioned calibration. We then combine guard models with CAVD in CAVD-Guard. When CAVD flags an instruction as unreliable for original-view safety screening, CAVD-Guard maps it to multiple canonical views and applies guard-based classification to the recovered views. Extensive experiments show that CAVD-Guard substantially reduces attack success and improves guard blocking while maintaining low false-positive rates on benign inputs. Code is available at https://github.com/serendipity098/CAVD-Guard.
%U https://aclanthology.org/2026.emnlp-main.1146/
%P 26254-26281
Markdown (Informal)
[CAVD-Guard: Defending Against Token Fragmentation Jailbreaks via Attention Footprints](https://aclanthology.org/2026.emnlp-main.1146/) (Xu & Zhao, EMNLP 2026)
ACL