Despite the implementation of safety alignment strategies, large language models (LLMs) remain vulnerable to jailbreak attacks, which undermine these safety guardrails and pose significant security threats. Some defenses have been proposed to detect or mitigate jailbreaks, but they are unable to withstand the test of time due to an insufficient understanding of jailbreak mechanisms. In this work, we investigate the mechanisms behind jailbreaks based on the Linear Representation Hypothesis (LRH), which states that neural networks encode high-level concepts as subspaces in their hidden representations. We define the toxic semantics in harmful and jailbreak prompts as toxic concepts and describe the semantics in jailbreak prompts that manipulate LLMs to comply with unsafe requests as jailbreak concepts. Through concept extraction and analysis, we reveal that LLMs can recognize the toxic concepts in both harmful and jailbreak prompts. However, unlike harmful prompts, jailbreak prompts activate the jailbreak concepts and alter the LLM output from rejection to compliance. Building on our analysis, we propose a comprehensive jailbreak defense framework, JBShield, consisting of two key components: jailbreak detection JBShield-D and mitigation JBShield-M. JBShield-D identifies jailbreak prompts by determining whether the input activates both toxic and jailbreak concepts. When a jailbreak prompt is detected, JBShield-M adjusts the hidden representations of the target LLM by enhancing the toxic concept and weakening the jailbreak concept, ensuring LLMs produce safe content. Extensive experiments demonstrate the superior performance of JBShield, achieving an average detection accuracy of 0.95 and reducing the average attack success rate of various jailbreak attacks to 2% from 61% across distinct LLMs.
Defending Jailbreak Attacks on Large Language Models via Manifold Trajectory Kinetics
Huazhong University of Science and Technology（华中科技大学）；Changsha University of Science and Technology（长沙理工大学）；Xiangtan University（湘潭大学）；City University of Macau（澳门城市大学）；Griffith University（格里菲斯大学）
Latent-space adversarial training with post-aware calibration for defending large language models against jailbreak attacks
Lab of Artificial Intelligence for Education, East China Normal University, Shanghai 200062, China（教育人工智能实验室，东华大学，上海200062，中国）；Shanghai Institute of Artificial Intelligence for Education, East China Normal University, Shanghai 200062, China（教育人工智能研究所，东华大学，上海200062，中国）；School of Computer Science and Technology, East China Normal University, Shanghai 200062, China（计算机科学与技术学院，东华大学，上海200062，中国）
Adversarial Tuning: Defending Against Jailbreak Attacks for LLMs
AI Thrust（AI 部）；The Hong Kong University of Science and Technology (Guangzhou)（香港科技大学（广州））；Guangzhou HKUST Fok Ying Tung Research Institute（广州香港科技大学霍英东研究院）；The Hong Kong University of Science and Technology（香港科技大学）
HE-Guardrail: A Homomorphic Guardrail Against Jailbreak Attacks for Encrypted Large Language Model Inference
Pohang University of Science and Technology (POSTECH)（浦项科技大学）；Inha University（仁荷大学）；Daegu Gyeongbuk Institute of Science and Technology (DGIST)（大邱庆北科学技术院）
Emerging Vulnerabilities in Frontier Models: Multi-Turn Jailbreak Attacks
University of California, Berkeley（加州大学伯克利分校）；Stanford University（斯坦福大学）；Georgia Institute of Technology（佐治亚理工学院）；Mohamed Bin Zayed University of Artificial Intelligence（穆罕默德·本·扎耶德人工智能大学）；McGill University（麦吉尔大学）；Mila（米拉研究所）
Scalable Defense against In-the-wild Jailbreaking Attacks with Safety Context Retrieval
School of EECS, Peking University（电子工程系，北京大学）；School of Mathematical Sciences, Peking University（数学系，北京大学）；State Key Lab of General Artificial Intelligence, School of Intelligence Science and Technology, Peking University（通用人工智能国家重点实验室，智能科学与技术学校，北京大学）；Institute for Artificial Intelligence, Peking University（人工智能研究院，北京大学）
Strategic Deflection: Defending LLMs from Logit Manipulation
International Artificial Intelligence Center of Morocco（摩洛哥国际人工智能中心）；Mohammed VI Polytechnic University（摩洛哥穆莱·伊斯梅尔理工学院）；AgriEdge；Sorbonne University, LIP6 - UMR 7606 CNRS（索邦大学，LIP6 - UMR 7606 CNRS）
Fuzz-Testing Meets LLM-Based Agents: An Automated and Efficient Framework for Jailbreaking Text-To-Image Generation Models
School of Cyber Science and Technology, Shandong University（山东大学网络科学与技术学院）；Netflix Eyeline Studios；State Key Laboratory of Cryptography and Digital Economy Security, Shandong University（山东大学密码与数字经济安全国家重点实验室）；Shandong Key Laboratory of Artificial Intelligence Security, Shandong University（山东省人工智能安全重点实验室）
X-Boundary: Establishing Exact Safety Boundary to Shield LLMs from Multi-Turn Jailbreaks without Compromising Usability
School of Electronic Information and Electric Engineering, Shanghai Jiao Tong University（上海交通大学电子信息与电气工程学院）；Shanghai Artificial Intelligence Laboratory（上海人工智能实验室）
ArtPerception: ASCII Art-based Jailbreak on LLMs with Recognition Pre-test
Department of Electrical Engineering, National Taiwan University（国立台湾大学电子工程系）；GARMIN (ASIA) CORPORATION（GARMIN（亚洲）公司）；Institute of Artificial Intelligence Innovation, National Yang Ming Chiao Tung University（国家阳明交通大学人工智能创新研究所）；Department of Information Management, National Dong Hwa University（国立东吴大学资讯管理系）
