SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks

By Alexander Robey, Eric Wong, Hamed Hassani, George Pappas. Trans. Mach. Learn. Res., 2023

521 citations recorded by the source corpus.

Despite efforts to align large language models (LLMs) with human intentions, widely-used LLMs such as GPT, Llama, and Claude are susceptible to jailbreaking attacks, wherein an adversary fools a targeted LLM into generating objectionable content. To address this vulnerability, we propose SmoothLLM, the first algorithm designed to mitigate jailbreaking attacks. Based on our finding that adversarially-generated prompts are brittle to character-level changes, our defense randomly perturbs multiple copies of a given input prompt, and then aggregates the corresponding predictions to detect adversarial inputs. Across a range of popular LLMs, SmoothLLM sets the state-of-the-art for robustness against the GCG, PAIR, RandomSearch, and AmpleGCG jailbreaks. SmoothLLM is also resistant against adaptive GCG attacks, exhibits a small, though non-negligible trade-off between robustness and nominal performance, and is compatible with any LLM. Our code is publicly available at \url{https://github.com/arobey1/smooth-llm}.

Subfields: Artificial Intelligence

View Paper: https://www.semanticscholar.org/paper/8cf9b49698fdb1b754df2556576412a7b44929f6

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Qiusi Zhan
2. Daniel Kang
3. Zifan Ying
4. Zhixiang Liang

Citations in the corpus

• How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs (2024, unknown): “…include Rand-Drop (Cao et al., 2023), which drops tokens randomly to observe the change in responses; RAIN (Li et al., 2023), which relies on in-context introspection; and Rand-Insert , Rand-Swap , and Rand-Patch (Robey et al., 2023), which also alter the inputs and inspects the change in outputs.”
• Jailbreak and Guard Aligned Language Models With Only Few In-Context Demonstrations (2023, unknown): “Pre-processing methods detect or purify the potential harmful prompts before generation, like perplexity filter [16], harmful string detection [17], [38], retokenization [19], and prompt smoothing [39], [40].”
• A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Ugly (2023, background): “Jin et al. [121] conducted a comprehensive study on LLMs’ understanding of binary code semantics [122] across different architectures and optimization levels, providing key insights for future research in this area.”
• A StrongREJECT for Empty Jailbreaks (2024, unknown): “For example, most prior work uses a binary indicator to measure if a jailbreak was successful [18, 43, 38, 40, 19, 33, 29, 39, 7, 30, 25, 42, 27, 44, 31, 20], ignoring gradations in the extent to which a victim model’s response provides useful information related to an attacker’s query.”
• InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents (2024, methodology): “Following previous work in the evaluation of prompt injection attacks (Zou et al., 2023; Robey et al., 2023; Tian et al., 2023), we utilize the attack success rate (ASR) as the primary metric to evaluate the LLM agent’s resilience to the attacks.”
• Jailbreaking Black Box Large Language Models in Twenty Queries (2023, unknown): “However, token-level attacks can be mitigated via randomization [27] or filtering [14].”
• Improving Alignment and Robustness with Circuit Breakers (2024, unknown): “Inference-time defenses, such as perplexity filters [1, 26], x s ∼ D s , x r ∼ D r ▷ Sample Batch Elements 3: Loss to be Optimized 7: end for are effective only against non-adaptive attacks [36], while erase-and-check and SmoothLLM [56] incur high computational costs.”
• Jailbreak susceptibility prediction and mitigation via the behavioral geometry of models (2026, unknown): “Most jailbreak defenses (safety system prompts [42, 45], in-context refusal demonstrations [40, 31], input perturbation [34], and input/output classifiers [20, 44, 6]) are designed and validated on a single model.”
• Jailbreaking LLMs' Safeguard with Universal Magic Words for Text Embedding Models (2025, unknown): “…approach to attack LLMs’ safeguards based on text embedding models: to find universal “magic words” (i.e., adversarial suffixes) that would increase or decrease the embedding similarity between any pair of texts so as to mislead the safeguards in classifying within the text embedding space.”