Safety heads are lightweight classifiers attached to pretrained language models to flag potentially harmful inputs before text generation. While extensive empirical studies have examined their detection performance, formal robustness guarantees remain largely unexplored. This work investigates safety heads built on State Space Models (SSMs) and asks whether they can be certified to produce identical predictions for all inputs within a bounded perturbation in the embedding space. We prove that certification hinges on a single condition: the $l_\infty$ norm of the state transition matrix $A$ must satisfy $$\|A\|_\infty \le 1.$$ If this inequality holds, any perturbation confined to an $\epsilon$‑ball in the embedding space cannot alter the safety head’s output, thereby providing a formal defense against jailbreak attacks. The finding offers a clear mathematical guideline for constructing language models with provable safety.
Review