REVIEW 21 cited by
SafeDecoding: Defending against Jailbreak Attacks via Safety-Aware Decoding
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
Signed reviews
read the original abstract
As large language models (LLMs) become increasingly integrated into real-world applications such as code generation and chatbot assistance, extensive efforts have been made to align LLM behavior with human values, including safety. Jailbreak attacks, aiming to provoke unintended and unsafe behaviors from LLMs, remain a significant/leading LLM safety threat. In this paper, we aim to defend LLMs against jailbreak attacks by introducing SafeDecoding, a safety-aware decoding strategy for LLMs to generate helpful and harmless responses to user queries. Our insight in developing SafeDecoding is based on the observation that, even though probabilities of tokens representing harmful contents outweigh those representing harmless responses, safety disclaimers still appear among the top tokens after sorting tokens by probability in descending order. This allows us to mitigate jailbreak attacks by identifying safety disclaimers and amplifying their token probabilities, while simultaneously attenuating the probabilities of token sequences that are aligned with the objectives of jailbreak attacks. We perform extensive experiments on five LLMs using six state-of-the-art jailbreak attacks and four benchmark datasets. Our results show that SafeDecoding significantly reduces the attack success rate and harmfulness of jailbreak attacks without compromising the helpfulness of responses to benign user queries. SafeDecoding outperforms six defense methods.
Forward citations
Cited by 21 Pith papers
-
PUZZLED: Jailbreaking LLMs through Word-Based Puzzles
PUZZLED masks harmful keywords as word-search, anagram, or crossword puzzles and achieves a reported 88.8% average attack success rate across five leading LLMs.
-
Just Enough Shifts: Mitigating Over-Refusal in Aligned Language Models with Targeted Representation Fine-Tuning
Fine-tuning a single transformer layer with activation targets scaled by each query's projection onto a refusal direction reduces over-refusal on four benchmarks while preserving safety and general capability.
-
GloSS over Toxicity: Understanding and Mitigating Toxicity in LLMs via Global Toxic Subspace
Detoxifying LLMs by deleting a global, cross-layer 'toxic subspace' from feed-forward weights reduces toxic outputs more than layer-local subspace methods.
-
Adversarial Suffix Filtering: a Defense Pipeline for LLMs
ASF detects and removes adversarial suffixes by segmenting prompts and classifying each segment with a fine-tuned BERT model, reducing jailbreak success on several LLMs while leaving normal-task performance roughly intact.
-
The Hidden Dimensions of LLM Alignment: A Multi-Dimensional Analysis of Orthogonal Safety Directions
Safety refusal in Llama 3.1 8B is governed by a dominant activation direction plus smaller interpretable directions, and removing prompt tokens that activate these secondary directions can bypass fine-tuned safety.
-
JBShield: Defending Large Language Models from Jailbreak Attacks through Activated Concept Analysis and Manipulation
JBShield detects jailbreaks by checking whether a prompt activates both a toxic concept and a jailbreak concept inside an LLM, then steers those concepts to produce a safe refusal.
-
Vulnerability Mitigation for Safety-Aligned Language Models via Debiasing
A decoding-time method called TSDI estimates and removes the context-free refusal bias caused by safety alignment, improving helpfulness while keeping safety.
-
On Almost Surely Safe Alignment of Large Language Models at Inference-Time
An inference-time beam-search method with a safety-state tracker and latent critic enforces a user-supplied safety cost model, with an almost-sure guarantee only relative to that model.
-
Stream Aligner: Efficient Sentence-Level Alignment via Distribution Induction
A sentence-level iterative correction method is claimed to improve large language model alignment and math reasoning, but the evidence is compromised by GPT-4 serving as both trainer and judge.
-
SaLoRA: Safety-Alignment Preserved Low-Rank Adaptation
SaLoRA preserves LLM safety alignment during low-rank fine-tuning by projecting adapter updates away from a harmful-prompt-derived safety subspace and initializing adapters from task data.
-
DYNASHIELD: A Black-Box Moving Target Defense for LLMs via Dynamic Decoding Customization
Randomizing decoding hyperparameters and system prompts per query lowers jailbreak attack success on five 7B LLMs, from 74% down to 0% in the best reported case, but the evaluation uses the same benchmark that selecte...
-
DIESEL -- Dynamic Inference-Guidance via Evasion of Semantic Embeddings in LLMs
Reranking an LLM's top-k candidate tokens by cosine similarity to predefined negative concept embeddings reduces unsafe responses and jailbreak success without retraining, but the reported gains are partly tuned to th...
-
MoGU V2: Toward a Higher Pareto Frontier Between Model Usability and Security
MoGUv2 embeds small routers in the deeper layers of LLMs to dynamically blend a helpful variant and a refusal variant, improving safety against jailbreak and fine-tuning attacks while preserving usability.
-
CCFC: Core & Core-Full-Core Dual-Track Defense for LLM Jailbreak Protection
A dual-track core-extraction defense reports near-zero jailbreak success on four attacks with preserved benign utility, but its safety-classifier component is undisclosed.
-
Beyond Surface-Level Detection: Towards Cognitive-Driven Defense Against Jailbreak Attacks via Meta-Operations Reasoning
A jailbreak defense that reasons about hidden manipulations in attack prompts, trained with supervised fine-tuning plus entropy-guided reinforcement learning, generalizes to attacks never seen in training.
-
Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense
Layer-AdvPatcher edits 'toxic' transformer layers using self-generated harmful examples to block jailbreaks, but its reported attack-success rates worsen on several benchmarks.
-
A Comprehensive Survey on Trustworthiness in Reasoning with Large Language Models
A structured literature survey concluding that reasoning capabilities do not automatically make LLMs more trustworthy and can introduce new vulnerabilities in safety, robustness, and privacy.
-
A Survey on Training-free Alignment of Large Language Models
A survey that catalogs and categorizes training-free LLM alignment methods into pre-decoding, in-decoding, and post-decoding, with a limited experimental comparison on one model.
-
Improving LLM Outputs Against Jailbreak Attacks with Expert Model Integration
Injecting a fine-tuned BERT classifier's category label into LLM prompts improves accuracy on a 150-question automotive jailbreak benchmark, but the evaluation is self-referential and lacks external validation.
-
Global Challenge for Safe and Secure LLMs Track 1
In a two-phase red-team challenge, top automated jailbreak methods reached 0.96 to 0.98 attack success on Llama-2 and Vicuna, with evidence of transfer across models.
-
Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agents
A survey proposing a source-and-impact taxonomy (input, model, combined; security, privacy, ethics) for threats to LLM-based agents, with feature analysis and four case studies.
Discussion (0). Continue with ORCID to comment.