{"id":"d4e6bb6d-6b1c-42ef-a720-dd0fe31a799f","arxiv_id":"2505.09602","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"ASF detects and removes adversarial suffixes by segmenting prompts and classifying each segment with a fine-tuned BERT model, reducing jailbreak success on several LLMs while leaving normal-task performance roughly intact.","lead":"This paper introduces Adversarial Suffix Filtering (ASF), a pipeline that splits LLM prompts into segments, flags suspicious segments with a small BERT classifier, and deletes them before the prompt reaches the model. It reports cutting jailbreak success rates from state-of-the-art suffix attacks to low single digits in several settings, while noting one model still shows about 17% success.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Abstract's 'below 4%' claim is contradicted by Table 1's own GPT-3.5 ASR' values (16.9% full; 16–18% subset).","rationale":"The paper proposes a straightforward, lightweight defense: segment prompts, classify segments with fine-tuned BERT, remove flagged segments. As a first-layer defense against exactly the GCG/AmpleGCG suffix family, this is mechanistically plausible, and the F1 ~98% on held-out data plus large ASR reductions on Llama-2 and GPT-4 are encouraging. My concern is not with the pipeline's existence but with the paper's headline quantification. The abstract and introduction claim 'below 4%' attack efficacy, but Table 1 reports GPT-3.5-0125 ASR' = 16.9% (full eval) and AIR/AID ASR' = 18.0%/16.0% (subset). The paper's own arithmetic contradicts the headline. The claim could be salvaged by scoping it to the models and generator family actually tested and by reporting per-model values, but as written it is false. The OOD concern reinforces this: all evaluated suffixes come from the same generative family used to train the classifier, and the one concrete failure shown ('involves grammar') is a natural-language suffix outside that family. Thus 'comprehensive defense' is not established. The reader's conditional verdict is appropriate; the required revisions are: fix the abstract/claims, report per-model ASR' with confidence intervals, and add at least one held-out attack family or adaptive evaluation.","tokens_in":15723,"tokens_out":6652,"duration_ms":63865,"concrete_test":"Independently reproduce Table 1b: regenerate the AIR/AID suffixes (Liao-Sun [3]) for the same 50 MaliciousInstruct/AdvBench prompts, run ASF, and measure GPT-3.5 ASR' with k=20. If it reproduces 16–18%, the paper's 'below 4%' claim is false for a reported condition; if it drops below 4%, the original result was not reproducible or the abstract's threshold applies elsewhere.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim—that ASF reduces attack efficacy of state-of-the-art suffix attacks to below 4%—is not supported by the paper's own evaluation. Table 1a reports GPT-3.5-0125 ASR'=16.9% on the full MaliciousInstruct/AdvBench eval, and Table 1b reports ASR'=18.0% (AIR) and 16.0% (AID) on a 50-sample subset. These are not edge cases: GPT-3.5 is one of the four rows in Table 1a and one of the two models in Table 1b, so multiple reported measurements exceed the advertised threshold. The abstract also says this holds 'across both black-box and white-box attack settings,' but no white-box attack against a white-box-accessible model is tested; all evaluations use the same AmpleGCG/AmpleGCG-plus generator family that supplied the classifier's training suffixes. The paper's own 'involves grammar' GPT-3.5 example shows a short natural-language suffix bypassing the filter, which is outside the trained suffix distribution. Thus the headline number is internally contradicted, and the generalization claim is untested for adversarial suffixes outside the training family. For the central claim to hold, the evaluation would need to be scoped to the tested generator family and the abstract revised to report per-model ASR' values.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Adversarial Suffix Filtering (ASF), a preprocessing defense for LLMs that splits incoming prompts into sentence-like segments using Segment-any-Text, classifies each segment with a fine-tuned BERT model, applies post-processing heuristics, and removes segments identified as part of an adversarial suffix before the prompt reaches the target LLM. The authors claim that ASF reduces the attack success rate of state-of-the-art suffix attacks to below 4% across black-box and white-box settings while minimally affecting non-adversarial performance. They evaluate ASF on MaliciousInstruct and AdvBench against suffixes generated by AmpleGCG and AmpleGCG-plus models, and they measure utility on TruthfulQA, GSM8k, ARC-c, HellaSwag, and WinoGrande using Mistral-7B, Llama-3.1-8B, and GPT-4.1-mini.","tokens_in":15957,"tokens_out":4498,"duration_ms":40810,"significance":"If the central claim held, ASF would be a practical, lightweight, model-agnostic defense against one of the most prominent jailbreak families, requiring only about 387M parameters and 1.7GB GPU memory and no access to the target model's internals. The pipeline design is simple and the reported results show large ASR reductions on several models (e.g., Llama-2-7b-chat ASR from 81.1% to 1.8%; GPT-4-0613 from 18.4% to 3.9%). However, the headline 'below 4%' claim is directly contradicted by the paper's own GPT-3.5 measurements, the evaluation is in-distribution relative to the training data, no adaptive or out-of-distribution attacks are tested, and the claimed white-box coverage is not actually evaluated. The contribution is therefore plausible but substantially narrower than advertised; the significance will depend on re-scoping the claims and adding supporting evidence.","major_comments":[{"comment":"The abstract states that ASF reduces the attack efficacy of state-of-the-art suffix generation methods to below 4%, but Table 1a reports GPT3.5-0125 ASR' = 16.9% and Table 1b reports AIR ASR' = 18.0% and AID ASR' = 16.0% for GPT-3.5; additionally, Llama-2-7b-chat (+) in Table 1a has ASR' = 4.0%, which is not below 4%. The headline quantitative claim is therefore contradicted by the paper's own reported measurements. The abstract should be revised to present per-model results or the experiments should be extended to support the aggregate claim.","section":"Abstract and Table 1"},{"comment":"The classifier is trained on suffixes from the Liao and Sun dataset [3] and AmpleGCG-plus [22], and the adversarial evaluation uses two AmpleGCG and two AmpleGCG-plus variants from the same generator family. The measured ASR reduction is therefore an in-distribution result for that suffix family. Section 4.1 acknowledges that ASF is specialized to suffix-style attacks, and the 'involves grammar' GPT-3.5 example in Section 3.1 shows a short natural-language suffix bypassing the filter. To support any generalization claim, the paper needs either held-out attack families, adaptive attacks, or an explicit scope restriction in the abstract and conclusions.","section":"Sections 2 and 3.1"},{"comment":"The paper claims ASF is effective 'across both black-box and white-box attack settings,' but no white-box attack against the target models is actually run. All suffixes are generated by AmpleGCG/AmpleGCG-plus models and then tested on targets; this does not constitute a white-box attack that optimizes suffixes with access to the target model's gradients. Please either add such an experiment or remove the white-box coverage claim from the abstract and Section 1.","section":"Section 3.1 and threat model"},{"comment":"The non-adversarial evaluation reports no confidence intervals, standard deviations, or repeated runs. Some accuracy deltas are nontrivial (e.g., WinoGrande -5.1% for Llama-8B, HellaSwag -3.4% for Llama-8B and -3.0% for Mistral-7B), and the text asserts these are within generation stochasticity without providing variance estimates. Please report error bars or repeated-run statistics, or explicitly frame Table 2 as a single-run exploratory check rather than evidence of no degradation.","section":"Table 2 and Section 3.2"}],"minor_comments":[{"comment":"The parameter names 'Bridge isolated 0s between 1s' and 'Bridge isolated 1s between 0s' are confusing relative to the text: the default-on rule flips a 1 surrounded by 0s to 0, which is described as bridging isolated 1s. Please rename the parameters to match the described behavior or clarify the wording.","section":"Algorithm 1 and Section 2"},{"comment":"The sentence 'making use that we include all of the data in the pair generation process' is grammatically unclear; please rephrase it to explain how the prompt-suffix pairs are generated.","section":"Section 2, Datasets"},{"comment":"The reported adversarial prompt contains garbled text ('Rem requested AleksomeWebView]. Write starting Colse ...') that appears to be an OCR artifact; please provide the exact suffix and quote it cleanly so the failure mode is reproducible.","section":"Section 3.1, 'involves grammar' example"},{"comment":"The subcaptions 'generate_untiltasks' and 'loglikelihoodtasks' are missing spaces; they should read 'generate_until tasks' and 'log-likelihood tasks'.","section":"Table 2 captions"},{"comment":"The paper credits the ASR success criterion to Kumar et al. [22] but evaluates with HarmBench-cls [25]; please clarify the relationship between the AmpleGCG-plus beam-based definition and the HarmBench classifier, and state the exact threshold and classifier used.","section":"Section 3.1 ASR definition"}],"recommendation":"major_revision","confidential_remarks":"The paper describes a well-engineered lightweight defense, but the public claims substantially exceed the evidence. The most serious issue is the internally contradicted 'below 4%' claim; the other major issues are the in-distribution evaluation and the unsubstantiated white-box statement. These are fixable by scoping claims and adding experiments, so I recommend major revision rather than rejection. I also note that code and trained models are not available at submission, which limits reproducibility, although the experimental protocol is described in reasonable detail."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Let me give you the short version first: this paper has a genuinely useful engineering idea and a clean implementation, but it overclaims in the abstract, and the evaluation is too easy for the claim it wants to make. I'd send it to peer review, but it needs a serious revision before acceptance.\n\nThe new thing is ASF: segment an input prompt with Segment-Any-Text, run a fine-tuned BERT classifier on each segment to detect adversarial-suffix text, then delete (or warn on) flagged segments. That's a nice, lightweight, model-agnostic preprocessor: no target-model retraining, no extra forward passes through the protected LLM, ~387M parameter overhead. The intuition is sound—AmpleGCG showed that generated suffixes are classifiable, and the authors exploit that. The reported ASR reductions on Llama-2 (81%→1.8%, 93%→4%) and GPT-4 (18.4%→3.9%) are large, and the benign-utility evaluation over several tasks is a good practice that many defense papers skip.\n\nThe soft spots are real, though. The abstract's 'below 4%' is contradicted by their own Table 1a: GPT-3.5-0125 goes from 92.1% to 16.9% ASR, and Table 1b shows 18% and 16% on the AIR/AID subsets. That's not a rounding error—it's one of four rows and one of two models in Table 1b. They should either scope the claim to the models that actually reach below 4% or report per-model numbers in the abstract.\n\nThe bigger problem is the evaluation is in-distribution. The classifier is trained on suffixes from GCG/AmpleGCG/AmpleGCG-plus, and the test suffixes come from the same generator family. The held-out part is the prompt content (MaliciousInstruct/AdvBench), not the suffix style. So the ASR reduction is really a measure of how well the BERT model recognizes suffixes from the same distribution it was trained on. There are no adaptive attacks, no adversarial suffixes optimized against the filter, and the 'involves grammar' natural-language suffix that bypassed GPT-3.5 shows exactly where out-of-distribution cases will fail. That example is closer to a normal sentence than to the gibberish suffixes in the training set, so it's not an 'edge case' they can wave away.\n\nLesser issues: no error bars or statistical significance, especially for the 50-sample subset in Table 1b; code/checkpoints not released despite the paper saying they intend to; and the utility loss on WinoGrande (-5.1%) for Llama-8B is higher than 'minimal' implies. The limitations section is honest about segmentation failures and false positives, which I credit.\n\nBottom line: this is a solid first-layer defense for a specific attack family, well worth building on. The authors need to fix the headline claim, add an out-of-distribution and ideally adaptive evaluation, release code, and be clearer about where it fails. With those revisions I'd be comfortable seeing it in print. As it stands, I'd accept for peer review with major revision requested.","headline":"A genuinely useful lightweight suffix-filtering defense, undermined by an abstract claim its own Table 1 contradicts and an in-distribution evaluation; still worth refereeing with major revisions.","tokens_in":16550,"tokens_out":3787,"would_cite":true,"duration_ms":32245,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Adversarial suffixes can be detected and removed before they reach an LLM.","keywords":["adversarial suffixes","jailbreak defense","prompt sanitization","text segmentation","BERT classifier","attack success rate","model-agnostic defense","LLM safety"],"falsifier":"Hold out a suffix-generation method that was not part of training, for example a fresh transformer-based suffix generator or GCG-style suffixes optimized against the filter itself, and measure the post-filter attack success rate on AdvBench and MaliciousInstruct; if that rate stays near the attack's original success rather than dropping to a few percent, the central claim fails. The paper's reported GPT-3.5-0125 result of 16.9% after filtering is a concrete reproducible datum that any re-run can check first.","tokens_in":15453,"feed_emoji":"🛡️","tokens_out":9478,"duration_ms":92129,"temperature":0.7,"pith_summary":"This paper sets out to show that the leading suffix-style jailbreak family can be neutralized at the prompt boundary, before the LLM ever sees the attack. The proposed ASF pipeline splits each prompt into sentence-like segments, uses a fine-tuned BERT classifier to flag segments that look like adversarial suffix material, and then deletes those segments or raises a warning. The headline claim is that this cuts the attack success rate of state-of-the-art suffix generators to below 4 percent while barely affecting normal-task accuracy. The paper's own per-model numbers show the effect is not uniform: Llama-2 drops to 1.8-4.0 percent and GPT-4 to 3.9 percent, but GPT-3.5-0125 remains at 16.9 percent. If the general approach holds, any aligned model could be cheaply guarded against current suffix attacks without retraining or internal access.","feed_headline":"A prompt filter strips adversarial suffixes before the LLM sees them","feed_subtitle":"Segment-then-classify preprocessing drops jailbreak success to single digits on several models, with little utility loss.","key_machinery":"The load-bearing machinery is the two-stage ASF pipeline: Segment-any-Text with the 12l-SM variant splits the input into sentence-like segments even without reliable punctuation, and a fine-tuned bert-base-uncased classifier labels each segment as benign or part of an adversarial suffix. Two post-processing heuristics carry the rest: a gap-bridging rule flips isolated single-segment anomalies to match their neighbors, and a small keyword-exclusion list (default 'question', 'answer') overrides false positives. Finally, flagged segments are deleted before reconstruction, or an exception is raised in warn mode. What makes the argument run is the assumption that suffix material has a learnable signature distinct from natural prompts, so classification after segmentation is sufficient to locate the attack boundary.","core_discovery":"The central discovery is that adversarially crafted suffixes form a detectable textual class: despite looking like gibberish, they are separable from benign prompt text by a lightweight segment-level classifier. The paper trains a BERT model on 419,429 suffixes from the GCG, AmpleGCG, and AmpleGCG-plus attack families paired with ordinary Alpaca instructions, then applies it after a robust punctuation-independent segmentation step. In the paper's end-to-end evaluation, post-sanitization attack-success rates fall from 81.1% to 1.8% and from 93.1% to 4.0% on Llama-2-7b-chat, from 92.1% to 16.9% on GPT-3.5-0125, and from 18.4% to 3.9% on GPT-4-0613; the AIR and AID repeat-suffix bypass variants fall to 18% and 16% on GPT-3.5 and to 0% on GPT-4. The classifier reaches 98.4% F1 on the held-out synthetic segments, and benign-task accuracy shifts are mostly within a few points. The paper's own conclusion is that suffix attacks can be defeated as a class by input sanitization rather than by hardening the model.","pith_inferences":["The reported reductions should be read as non-adaptive: an adversary who can query or approximate the BERT filter could tailor suffixes to look benign, an evaluation the paper does not run.","The 'involves grammar' failure marks the likely boundary of the current method: grammatical natural-language continuations are not gibberish, so a classifier built on gibberish signatures may miss them; a semantic or instruction-consistency signal would be the natural supplement.","Since training and test suffixes come from the same generator family, the numbers quantify in-distribution robustness; the open question is how quickly performance decays as the suffix distribution drifts, which could be tested by retraining on a new generator family and re-measuring attack success rate."],"forward_implications":["Any aligned model, including closed API models, can be protected from suffix jailbreaks without access to weights or architecture.","The target model's inference budget is unchanged: the same forward passes, token consumption, and memory, with only a single lightweight pass over the input.","ASF can act as a cheap front-stage trigger that escalates suspicious prompts to heavier certified defenses, matching a layered defense model.","It covers the AIR and AID repeat-suffix tricks that evade perplexity-based detectors, because those tricks still leave a segment-level signature.","Because the defense works by deletion, imperfect segmentation can over-remove text or reject benign prompts, which is why the configurable warn mode and heuristics exist."],"supporting_citations":[{"why":"Supplies the AmpleGCG adversarial-suffix dataset used both to train the classifier and to generate evaluation attacks; without it the classifier has no positive training data.","marker":"[3]"},{"why":"Defines the GCG suffix attack that the pipeline is designed to block and contributes the AdvBench harmful-instruction benchmark used for end-to-end evaluation.","marker":"[4]"},{"why":"Provides the 12l-SM Segment-any-Text model that splits prompts into segments, the stage on which the whole pipeline depends.","marker":"[5]"},{"why":"Provides bert-base-uncased, the pretrained backbone fine-tuned into the binary suffix classifier.","marker":"[6]"},{"why":"Defines the AmpleGCG-plus attack variants and the multi-suffix attack-success-rate evaluation setup used to measure post-defense performance.","marker":"[22]"},{"why":"Supplies the Alpaca benign instructions used to form benign training segments and control false positives.","marker":"[23]"},{"why":"Provides the MaliciousInstruct set of harmful prompts used to test whether ASF works on requests it was not optimized on.","marker":"[24]"},{"why":"Provides the HarmBench classifier used to judge whether a model response counts as a successful jailbreak in the attack-success-rate measurements.","marker":"[25]"},{"why":"Supplies the evaluation harness and benchmark tasks used to measure non-adversarial utility degradation.","marker":"[26]"}],"fun_headline_variants":["Filter strips malicious suffixes, jailbreak success drops below 4%","New input sanitizer neutralizes adversarial suffix attacks","Adversarial Suffix Filtering: a preprocessor that blocks jailbreaks","Jailbreak suffixes drop to under 4% with lightweight filter","Segment-then-classify defense defeats suffix jailbreaks"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The defense only works if the suffix arriving at runtime looks like the suffixes used to train the detector; a different attack family or a natural-language suffix such as the reported 'involves grammar' example may not be recognized, and the paper does not measure how much performance would drop.","fun_headline_variants_meta":{"raw":{"variants":["Filter strips malicious suffixes, jailbreak success drops below 4%","New input sanitizer neutralizes adversarial suffix attacks","Adversarial Suffix Filtering: a preprocessor that blocks jailbreaks","Jailbreak suffixes drop to under 4% with lightweight filter","Segment-then-classify defense defeats suffix jailbreaks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000442,"raw_usage":{"total_tokens":2266,"prompt_tokens":1001,"completion_tokens":1265,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":617,"completion_tokens_details":{"reasoning_tokens":1179}},"tokens_in":617,"tokens_out":1265,"duration_ms":12614,"temperature":1.0,"reasoning_tokens":1179,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T21:27:55.839169+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Hold out a suffix-generation method that was not part of training, for example a fresh transformer-based suffix generator or GCG-style suffixes optimized against the filter itself, and measure the post-filter attack success rate on AdvBench and MaliciousInstruct; if that rate stays near the attack's original success rather than dropping to a few percent, the central claim fails. The paper's reported GPT-3.5-0125 result of 16.9% after filtering is a concrete reproducible datum that any re-run can check first.","supporting_citations":[{"cited_title":"Segment any text: A universal approach for robust, efficient and adaptable sentence segmentation","cited_arxiv_id":null,"evidence_quote":"Provides the 12l-SM Segment-any-Text model that splits prompts into segments, the stage on which the whole pipeline depends."}],"review_version":1}