REVIEW 27 cited by
AutoDefense: Multi-Agent LLM Defense against Jailbreak Attacks
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
Signed reviews
read the original abstract
Despite extensive pre-training in moral alignment to prevent generating harmful information, large language models (LLMs) remain vulnerable to jailbreak attacks. In this paper, we propose AutoDefense, a multi-agent defense framework that filters harmful responses from LLMs. With the response-filtering mechanism, our framework is robust against different jailbreak attack prompts, and can be used to defend different victim models. AutoDefense assigns different roles to LLM agents and employs them to complete the defense task collaboratively. The division in tasks enhances the overall instruction-following of LLMs and enables the integration of other defense components as tools. With AutoDefense, small open-source LMs can serve as agents and defend larger models against jailbreak attacks. Our experiments show that AutoDefense can effectively defense against different jailbreak attacks, while maintaining the performance at normal user request. For example, we reduce the attack success rate on GPT-3.5 from 55.74% to 7.95% using LLaMA-2-13b with a 3-agent system. Our code and data are publicly available at https://github.com/XHMY/AutoDefense.
Forward citations
Cited by 27 Pith papers
-
When Collaboration Becomes a Trigger: Collective Evidence-Threshold Backdoors in Multi-Agent Systems
Agent teams can be backdoored so that harmful behavior switches on only when peer evidence crosses a hidden threshold; a clean-data latent-transition filter can contain it.
-
SafeFlow: Semantic Information-Flow Control for Blocking Malicious Propagation in Multi-Agent Systems
A workflow-level taint-propagation defense blocks fragmented malicious multi-agent workflows, cutting average attack success from 69.3% to 12.7% on four benchmarks.
-
Mitigating Taint-Style Vulnerabilities in MCP Servers via Security-Aware Tool Descriptions
SPELLSMITH mitigates taint-style vulnerabilities in MCP servers by augmenting tool descriptions with security constraints and adding LLM self-reflection before tool invocation, reducing attack success rates to near zero.
-
Sparse Autoencoders are Capable LLM Jailbreak Mitigators
CC-Delta defends LLMs against jailbreaks by statistically selecting and steering sparse-SAEs features that change when harmful prompts are embedded in jailbreak contexts, outperforming dense activation steering across...
-
SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses
A systemization of LLM jailbreak security that adds linked taxonomies, an evaluation platform, and JailbreakDB, while its main attack–defense comparison results remain deferred.
-
Evaluating the Robustness of Retrieval-Augmented Generation to Adversarial Evidence in the Health Domain
Misleading health documents in RAG context sharply lower LLM accuracy, and heavily helpful-biased retrieval pools restore it.
-
MIND: A Multi-agent Framework for Zero-shot Harmful Meme Detection
MIND uses unlabeled similar memes, bidirectional AI insight derivation, and multi-agent debate to improve zero-shot harmful meme detection on HarM, FHM, and MAMI.
-
SecurityLingua: Efficient Defense of LLM Jailbreak Attacks via Security-Aware Prompt Compression
A security-aware prompt compressor that reveals the hidden intent of jailbreak prompts and injects it into the system prompt reduces average attack success from 35% to 1% with negligible overhead.
-
Revisiting Multi-Agent Debate as Test-Time Scaling: A Systematic Study of Conditional Effectiveness
A systematic benchmark shows multi-agent debate's value depends on task difficulty, model scale, and agent diversity: limited for math unless problems are hard or models weak, but useful for safety when agents are diverse.
-
DETAM: Defending LLMs Against Jailbreak Attacks via Targeted Attention Modification
Targeted attention-head modification, tuned on jailbreak data, lowers attack success rates across models and attacks without fine-tuning.
-
Look Before You Leap: Enhancing Attention and Vigilance Regarding Harmful Content with GuidelineLLM
A fine-tuned guideline generator that prepends risk summaries to prompts cuts jailbreak attack success by about 34 percentage points on average across three chatbots without altering the target models.
-
On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models
A PRISMA-based survey of 85 papers shows agentic LLM security research is attack-heavy and perception-focused, leaving action-layer and code-execution risks understudied.
-
Adversarial Attacks in Multi-Agent LLM Pipelines: Unveiling Structural Vulnerabilities in Agentic AI Architectures
The paper argues that multi-agent LLM pipelines are vulnerable because inter-agent boundaries lack verification, and claims that attack success is an architectural property rather than a model property.
-
A Real-Time, Self-Tuning Moderator Framework for Adversarial Prompt Detection
RTST, a two-agent moderator with an explainable Behavior ledger and per-prompt weight updates, reduced attack success rate from 12-63% to 0-17% on three jailbreak benchmarks with Gemini 2.5 Flash.
-
Multi-Actor Generative Artificial Intelligence as a Game Engine
Generative multi-actor AI platforms can be built on the Entity-Component pattern, treating the environment (Game Master) as a composable entity, so that one library serves simulation, storytelling, and evaluation goals.
-
SV-LLM: An Agentic Approach for SoC Security Verification using Large Language Models
SV-LLM automates SoC security verification with six cooperating LLM agents, reaching 84.8% vulnerability detection accuracy and 82% to 89% bug validation rates on benchmarks the paper does not disclose.
-
Three Minds, One Legend: Jailbreak Large Reasoning Model with Adaptive Stacked Ciphers
A stacked-cipher jailbreak with adaptive code selection achieves 80.8% to 100% attack success on commercial large reasoning models.
-
T2VShield: Model-Agnostic Jailbreak Defense for Text-to-Video Models
T2VShield combines LLM-based prompt rewriting with multi-scale video risk detection and reports large reductions in jailbreak success across five text-to-video platforms.
-
Latent-space adversarial training with post-aware calibration for defending large language models against jailbreak attacks
LATPC combines variance-based selection of refusal features for adversarial training with an inference-time embedding calibrator, reducing jailbreak success while curbing over-refusal across several LLMs.
-
Boundless Socratic Learning with Language Games
A position paper claiming recursive self-improvement in a closed language-only system can reach arbitrary capability, and proposing language games as the mechanism.
-
Evaluating Multi-Agent Defences Against Jailbreaking Attacks on Large Language Models
Multi-agent defenses reduce false negatives but increase false positives, and optimal agent count varies by jailbreak attack type.
-
A Red Teaming Roadmap Towards System-Level Safety
A position paper from Scale AI argues that red teaming research should prioritize product-level safety specifications, realistic attacker models, and system-level monitoring over abstract model-level harm benchmarks.
-
SoK: The Privacy Paradox of Large Language Models: Advancements, Privacy Risks, and Mitigation
A systematization-of-knowledge survey that categorizes LLM privacy risks into training data, prompts, outputs, and agents, and reviews limitations of current mitigations.
-
The Scales of Justitia: A Comprehensive Survey on Safety Evaluation of LLMs
A structured survey of LLM safety evaluation that proposes a why/what/where/how taxonomy and catalogs metrics, datasets, benchmarks, evaluators, and frameworks.
-
LLM Security: Vulnerabilities, Attacks, Defenses, and Countermeasures
This survey categorizes attacks on large language models by lifecycle phase and maps them to prevention and detection defenses, concluding that only a few defenses are highly effective.
-
Preventing Jailbreak Prompts as Malicious Tools for Cybercriminals: A Cyber Defense Perspective
A structured survey of jailbreak prompts and layered defenses for large language models, with six illustrative case studies and no empirical evaluation.
-
Attack and defense techniques in large language models: A survey and new perspectives
A survey taxonomizing LLM attacks into prompt, optimized, application-level, and model-theft categories, and defenses into prevention and detection categories, with no new empirical results.
Discussion (0). Continue with ORCID to comment.