Jailbreaking Jailbreaks: A Proactive Defense for LLMs

Wei-Liang Zhao Daniel Ben-Levi Jinjun Peng Zhou Yu Jun-Feng Yang Lin Ai Tharindu Kumarage Amrita Bhattacharjee Zizhou Liu Zheng Hui Michael Davinroy James Cook Laura Cassani K. Trapeznikov Cem Anil Esin Durmus Nina Rimsky Mrinank Sharma Joe Benton Sandipan Kundu Joshua Batson Meg Tong Jesse Mu D. Ford Francesco Mosconi Rajashree Agrawal Rylan Schaeffer Naomi Bashkansky Samuel Svenningsen Mike Lambert Ansh Radhakrishnan Carson Denison Federico Bianchi M. Suzgun Giuseppe Attanasio Paul Röttger D. Jurafsky Tatsunori B. Hashimoto James Zou Nicholas Carlini Milad Nasr Christopher A. Choquette-Choo Matthew Jagielski Pang Irena Gao Wei Koh Daphne Ippolito Florian Tramèr Ludwig Schmidt Patrick Chao Edoardo Debenedetti Alexander Robey Maksym Andriushchenko Francesco Croce Vikash Sehwag Edgar Dobriban Nicolas Flammarion George Pappas Hamed Hassani Eric Wong Jailbreakbench Mark Chen Jerry Tworek Heewoo Jun Qim-ing Yuan Henrique Pondé Oliveira Pinto J. Kaplan Harri Edwards Yuri Burda Nicholas Joseph Greg Brockman A. Ray Raul Puri G. Krueger Michael Petrov H. Khlaaf Girish Sas-try Pamela Mishkin Brooke Chan K. Cobbe V. Kosaraju Mohammad Bavarian L. Kaiser Matthias Plappert Jacob Hilton Reiichiro Nakano Christopher Hesse Deep Ganguli Liane Lovitt John Kernion A. Askell Yuntao Bai Saurav Kadavath Benjamin Mann Ethan Perez Nicholas Schiefer Kamal Ndousse Neel Jain Avi Schwarzschild Yuxin Wen Gowthami Somepalli John Kirchenbauer Ping-Yeh Chiang Micah Goldblum Aniruddha Saha Jonas Geiping Tom Goldstein Mantas Mazeika Long Phan Xu-Wang Yin Andy Zou Zi-Fan Wang Norman Mu Elham Sakhaee Nathaniel Li Steven Basart Bo Li David Forsyth Long Ouyang Jeffrey Wu Xu Jiang Diogo M. Almeida Carroll L. Wainwright Chong Zhang Julien Piet Maha Alrashed Chawin Sitawarin Si-Zhe Chen Ze-Ming Wei Elizabeth Sun Basel Alomair David A. Wagner Jatmo Salman Rahman Li-Wei Jiang James A. Shiffer Sheriff Issaka Genglin Liu Md. Rizwan Parvez Hamid Palangi Kai-Wei Chang Ye-Jin Choi Qi-Bing Ren Hao Li Dong-Rui Liu Zhan-Xu Xie Xiao-Ya Lu Yu Qiao Lei Sha Jun-Chi Yan Li-Zhuang Ma Jing Shao Marco Tulio Ribeiro Tong Wu C. Guestrin Sameer Singh Yu-Bo Wang Xue-Guang Ma Ge Zhang Yuansheng Ni

· 1 citation · 47 references

TL;DR

P RO A CT represents an orthogonal defense strategy that serves as an additional guardrail to enhance LLM safety against the most effective attacks.

Semantic Scholar

View source

Similar papers

#natural language process... Preprint Sep 2026

CASCADE Against Jailbreaks: Combination Across Stages with Controlled Attack-Defense Evaluation

Defenses against jailbreak attacks on Large Language Models (LLMs) operate at different pipeline stages, such as input modification or output guard, but it remains unclear which defenses to deploy at each stage and how to combine them. Prior empirical studies, fragmented by inconsistent attack-success-rate definitions...

Jia-Le Luo, Eric Han · 1 citation

Preprint Sep 2026

AlcaTRAz - Anchored Tree-Rule Defense Against Jailbreaks

AlcaTRAz (Anchored Tree-Rule defense Against jailbreaks), a prompt-level defense based on rule trees that operates exclusively on the input text and requires no modification or retraining of the target model, is proposed.

J. Res, Petr Kaska, Martin Perešíni et al. · 0 citations

#artificial intelligence Preprint Sep 2026

SoK: Rethinking Jailbreaking in the Era of Agentic AI: Attacks, Defenses, and Practical Consideration

A Systematization of Knowledge (SoK) that reframes jailbreak security around the full agentic execution pipeline, and develops unified taxonomies of attacks and defenses spanning user interaction, planning and reasoning, memory, tool use, and inter-agent communication, introduces a security--utility--efficiency evaluat...

Md. Jueal Mia, Yanzhao Wu, S. Uluagac et al. · 0 citations

#artificial intelligence Preprint Sep 2026

Universal Defenses for Tool-Integrated LLM Agents Against Adversarial Attacks

Two universal tool-based defenses are introduced: Attacker Tool Filtering, which uses anomaly detection to identify and remove suspicious tools, and Normal Tool Recalling, a white-box method that restores the agent's original toolset prior to planning.

Xiao-Yan Li, Yun-Li Wang · 0 citations

Preprint Aug 2026

Circuit Discovery Helps Detect LLM Jailbreaking: A Mechanistic Interpretability Study

A mechanistic analysis of the jailbreaking behavior in a large-scale, safety-aligned LLM, focusing on LLaMA-2-7B-chat-hf identifies computational circuits responsible for generating affirmative responses to jailbreak prompts and uncovers key attention heads and MLP pathways that mediate adversarial prompt exploitation.

Paria Mehrbod, Boris Knyazev, Guy Wolf et al. · 0 citations

Preprint Aug 2026

A Self-Evolving Multi-Agent Framework Defense against LLM Jailbreak Attacks

This work proposes a self-evolving test-time defense built around a persistent, cross-interaction rule memory that substantially reduces attack success rates while preserving benign utility, remains robust under an adaptive composite-wrapper attack, and does not increase over-refusal as the memory grows.

Tongshen Hu, Bryan Hooi · 0 citations