AnchorKV: Safety-Aware KV Cache Compression via Soft Penalty with a Refusal Anchor

2026-06-16

AI Summary

Existing KV cache compression methods often compromise a model’s safety alignment capabilities while reducing memory overhead, rendering it vulnerable to jailbreaking attacks. This work introduces, for the first time, the concept of refusal anchors from representation engineering into KV cache compression, proposing a safety-aware token retention strategy. By constructing safety anchors offline based on mean differences and applying soft penalties in layer-specific key projection spaces, the method guides the compression process to preferentially retain tokens critical for safety alignment. The approach significantly enhances robustness against jailbreaking attacks while effectively preserving safety alignment performance, all with negligible degradation in model utility.

Abstract

Large language models (LLMs) outperform earlier architectures on generative inference and long-context tasks, but their large size introduces significant challenges in memory usage, energy cost, and on-device deployment. Since scaling pre-trained language models improves downstream capability \cite{zhao2023survey}, the key-value (KV) cache becomes a dominant inference bottleneck. Recent KV cache compression methods \cite{jo2025fastkv,li2024snapkv,zhou2024dynamickv} reduce this cost by retaining only a subset of attention-relevant tokens. However, while these approaches preserve accuracy on benign workloads, their compression policies either fail to defend against jailbreak attacks \cite{jiang2024robustkv} or degrade safety alignment under aggressive eviction. We propose AnchorKV, a drop-in modification to KV cache compression that biases token retention scores away from directions in key space associated with harmful prompts. AnchorKV constructs an offline safety anchor by adapting a difference-of-means representation engineering approach \cite{arditi2024refusal,zou2023representation} to the layer-specific key projection space used in KV caching. Based on this anchor, a soft penalty token selection rule trades a small amount of utility for substantially improved safety alignment, while reducing to the original compressor when the penalty is zero.

Problem

• KV cache compression
• safety alignment
• jailbreak attacks
• large language models
• memory efficiency

Innovation

• KV cache compression
• safety alignment
• refusal anchor
• soft penalty
• large language models