Abstract:Modern large language models (LLMs) rely on system prompts to establish behavioral constraints and safety rules. Standard causal self-attention treats privileged instructions and untrusted user content with equal structural priority -- a mismatch that leaves models vulnerable to prompt injection and instruction erosion over extended contexts. We propose CALYREX (Cross-Attention LaYeR EXtended transformers), which utilizes cross-attention between input and system prompt to structurally isolate and anchor the rule. A placement ablation on a 1.5B backbone identifies insertion at the final eighth of layers as optimal, confirmed by mechanistic activation analysis showing behavioral constraints are naturally concentrated there. At 8B scale, controlling for training data, backbone, and parameter budget, CALYREX yields $+7.4\%$ on instruction-following (IFEval) and $+16.3\%$ on multi-turn instruction adherence, while reducing many-shot jailbreaking attack success rate by $13\%$. This advantage appears to widen with model scale, consistent with larger models more effectively utilizing the dedicated routing pathway.
| Comments: | Preprint. 25 pages, 4 figures, 9 tables |
| Subjects: | Machine Learning (cs.LG) |
| Cite as: | arXiv:2605.09737 [cs.LG] |
| (or arXiv:2605.09737v1 [cs.LG] for this version) | |
| https://doi.org/10.48550/arXiv.2605.09737 arXiv-issued DOI via DataCite (pending registration) |
From: Lixing Li [view email]
[v1]
Sun, 10 May 2026 20:12:39 UTC (890 KB)
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。