Large language models (LLMs) are increasingly being adopted in a wide range of real-world applications. Despite their impressive performance, recent studies have shown that LLMs are vulnerable to deliberately crafted adversarial prompts even when aligned via Reinforcement Learning from Human Feedback or supervised fine-tuning. While existing defense methods focus on either detecting harmful prompts or reducing the likelihood of harmful responses through various means, defending LLMs against jailbreak attacks based on the inner mechanisms of LLMs remains largely unexplored. In this work, we investigate how LLMs response to harmful prompts and propose a novel defense method termed \textbf{L}ayer-specific \textbf{Ed}iting (LED) to enhance the resilience of LLMs against jailbreak attacks. Through LED, we reveal that several critical \textit{safety layers} exist among the early layers of LLMs. We then show that realigning these safety layers (and some selected additional layers) with the decoded safe response from selected target layers can significantly improve the alignment of LLMs against jailbreak attacks. Extensive experiments across various LLMs (e.g., Llama2, Mistral) show the effectiveness of LED, which effectively defends against jailbreak attacks while maintaining performance on benign prompts. Our code is available at \url{https://github.com/ledllm/ledllm}.
Adversarial Tuning: Defending Against Jailbreak Attacks for LLMs
AI Thrust（AI 部）；The Hong Kong University of Science and Technology (Guangzhou)（香港科技大学（广州））；Guangzhou HKUST Fok Ying Tung Research Institute（广州香港科技大学霍英东研究院）；The Hong Kong University of Science and Technology（香港科技大学）
DELMAN: Dynamic Defense Against Large Language Model Jailbreaking with Model Editing
ShanghaiTech University（上海科技大学）；The State Key Laboratory of Blockchain and Data Security, Zhejiang University（浙江大学区块链与数据安全全国重点实验室）；The CoAI group, Tsinghua University（清华大学CoAI课题组）
EVA: Editing for Versatile Alignment against Jailbreaks
ShanghaiTech University（上海科技大学）；Sun Yat-sen University（中山大学）；State Key Laboratory of Blockchain and Data Security（区块链与数据安全国家重点实验室）；Tsinghua University（清华大学）
Jailbreak-AudioBench: In-Depth Evaluation and Analysis of Jailbreak Threats for Large Audio Language Models
Hong Kong University of Science and Technology (Guangzhou)（香港科技大学（广州））；University of Oxford（牛津大学）；Xi’an Jiaotong University（西安交通大学）；Hong Kong University of Science and Technology（香港科技大学）；Northeastern University（东北大学）；Beijing University of Technology（北京理工大学）
Strategic Deflection: Defending LLMs from Logit Manipulation
International Artificial Intelligence Center of Morocco（摩洛哥国际人工智能中心）；Mohammed VI Polytechnic University（摩洛哥穆莱·伊斯梅尔理工学院）；AgriEdge；Sorbonne University, LIP6 - UMR 7606 CNRS（索邦大学，LIP6 - UMR 7606 CNRS）
Fuzz-Testing Meets LLM-Based Agents: An Automated and Efficient Framework for Jailbreaking Text-To-Image Generation Models
School of Cyber Science and Technology, Shandong University（山东大学网络科学与技术学院）；Netflix Eyeline Studios；State Key Laboratory of Cryptography and Digital Economy Security, Shandong University（山东大学密码与数字经济安全国家重点实验室）；Shandong Key Laboratory of Artificial Intelligence Security, Shandong University（山东省人工智能安全重点实验室）
X-Boundary: Establishing Exact Safety Boundary to Shield LLMs from Multi-Turn Jailbreaks without Compromising Usability
School of Electronic Information and Electric Engineering, Shanghai Jiao Tong University（上海交通大学电子信息与电气工程学院）；Shanghai Artificial Intelligence Laboratory（上海人工智能实验室）
ArtPerception: ASCII Art-based Jailbreak on LLMs with Recognition Pre-test
Department of Electrical Engineering, National Taiwan University（国立台湾大学电子工程系）；GARMIN (ASIA) CORPORATION（GARMIN（亚洲）公司）；Institute of Artificial Intelligence Innovation, National Yang Ming Chiao Tung University（国家阳明交通大学人工智能创新研究所）；Department of Information Management, National Dong Hwa University（国立东吴大学资讯管理系）
Advancing the Robustness of Large Language Models through Self-Denoised Smoothing
UC Santa Barbara（加州大学圣巴巴拉分校）；Max Planck Institute for Intelligent Systems, Tübingen（马克斯·普朗克智能系统研究所（蒂宾根））；The Hong Kong Polytechnic University（香港理工大学）；MIT-IBM Watson AI Lab（麻省理工学院-IBM沃森人工智能实验室）；Cisco Research（思科研究院）；Michigan State University（密歇根州立大学）
Activation-Guided Local Editing for Jailbreaking Attacks
Beihang University（北航）；Hangzhou Innovation Institute（杭州创新研究院）；HKUST（香港科技大学）；South China University of Technology（华南理工大学）；Nanyang Technological University（南洋理工大学）；Kunming University of Science and Technology（昆明理工大学）
Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMs
Georgia Institute of Technology（佐治亚理工学院）；University of Bristol（布里斯托大学）；University of Maryland（马里兰大学）；University College London（伦敦大学学院）；MATS；Astra；MIT CSAIL（麻省理工学院计算机科学与人工智能实验室）
Chain-of-Jailbreak Attack for Image Generation Models via Editing Step by Step
Renmin University of China（中国人民大学）；Chinese University of Hong Kong（香港大学）；Chinese University of Hong Kong, Shenzhen（香港大学（深圳））；Johns Hopkins University（约翰霍普金斯大学）；Tencent（腾讯）；Hong Kong University of Science and Technology（香港科技大学）
Emerging Vulnerabilities in Frontier Models: Multi-Turn Jailbreak Attacks
University of California, Berkeley（加州大学伯克利分校）；Stanford University（斯坦福大学）；Georgia Institute of Technology（佐治亚理工学院）；Mohamed Bin Zayed University of Artificial Intelligence（穆罕默德·本·扎耶德人工智能大学）；McGill University（麦吉尔大学）；Mila（米拉研究所）
Safety Alignment via Constrained Knowledge Unlearning
Harbin Institute of Technology, Shenzhen, China（哈尔滨工业大学（深圳））；University of Macau, China（澳门大学）；Nankai University, China（南开大学）；Zhejiang University, China（浙江大学）；Peng Cheng Laboratory, China（鹏城实验室）；Shaqra University, Saudi Arabia（沙克拉大学）
