Rethinking Inference-Time Safety Alignment via Attention Routing

Despite extensive safety alignment, large language models remain vulnerable to jailbreak attacks. Activation steering offers a training-free defense, but conditional steering still needs a reliable signal for deciding $\text{when}$ to intervene. Existing gates often read residual stream projections, yet jailbreak transformations can move these projections toward the benign regime. We instead examine attention routing at the assistant header, where refusal-related activation concentrates. A jailbreak alters how a small set of heads route the preceding context at these tokens, whereas benign and directly harmful prompts exhibit similar routing patterns. We aggregate the signed deviations of these heads from their benign routing pattern into the $\text{Routing Deviation Index}$ (RDI), which captures jailbreak-induced routing changes rather than the surface form of the rewrite or the harmfulness of the underlying request. We build $\text{RISA}$ ($\text{R}$outing-$\text{I}$ndexed $\text{S}$afety $\text{A}$lignment) on this routing measurement. In $\text{RISA-D}$, a jailbreak is detected once that deviation passes a threshold set on benign prompts. In $\text{RISA-S}$, the excess above that threshold sets the strength of a bounded refusal update, which is applied in a second prefill pass only when the gate is triggered. Across three open-weight aligned chat models and seven jailbreak families, RISA-D achieves the highest average detection accuracy on all three models, while RISA-S raises the global mean defense success rate from 40.0% to 95.0%. The routing signal also remains effective when individual attack families are excluded from calibration. These results suggest that attention routing offers a new perspective on safety alignment at inference time.