Large Language Models (LLMs) face increasing threats from jailbreak attacks that bypass safety alignment. While prompt-based defenses such as Role-Oriented Prompts (RoP) and Task-Oriented Prompts (ToP) have shown effectiveness, the role of few-shot demonstrations in these defense strategies remains unclear. Prior work suggests that few-shot examples may compromise safety, but lacks investigation into how few-shot interacts with different system prompt strategies. In this paper, we conduct a comprehensive evaluation on multiple mainstream LLMs across four safety benchmarks (AdvBench, HarmBench, SG-Bench, XSTest) using six jailbreak attack methods. Our key finding reveals that few-shot demonstrations produce opposite effects on RoP and ToP: few-shot enhances RoP's safety rate by up to 4.5% through reinforcing role identity, while it degrades ToP's effectiveness by up to 21.2% through distracting attention from task instructions. Based on these findings, we provide practical recommendations for deploying prompt-based defenses in real-world LLM applications.
Test-Time Immunization: A Universal Defense Framework Against Jailbreaks for (Multimodal) Large Language Models
NLPR & MAIS, Institute of Automation, Chinese Academy of Sciences（国家工程实验室与人工智能研究所，中国科学院）；School of Artificial Intelligence, University of Chinese Academy of Sciences（中国科学院大学人工智能学院）
ShieldLearner: A New Paradigm for Jailbreak Attack Defense in LLMs
Institute of Automation, Chinese Academy of Sciences（中国科学院自动化研究所）；Institute of Artificial Intelligence, Beijing University of Aeronautics and Astronautics（北京航空航天大学人工智能研究院）
Adversarial Tuning: Defending Against Jailbreak Attacks for LLMs
AI Thrust（AI 部）；The Hong Kong University of Science and Technology (Guangzhou)（香港科技大学（广州））；Guangzhou HKUST Fok Ying Tung Research Institute（广州香港科技大学霍英东研究院）；The Hong Kong University of Science and Technology（香港科技大学）
DELMAN: Dynamic Defense Against Large Language Model Jailbreaking with Model Editing
ShanghaiTech University（上海科技大学）；The State Key Laboratory of Blockchain and Data Security, Zhejiang University（浙江大学区块链与数据安全全国重点实验室）；The CoAI group, Tsinghua University（清华大学CoAI课题组）
Bag of Tricks: Benchmarking of Jailbreak Attacks on LLMs
The Hong Kong University of Science and Technology (Guangzhou)（香港科技大学（广州））；Guangzhou HKUST Fok Ying Tung Research Institute（广州香港科技大学霍英东研究院）；The Hong Kong University of Science and Technology（香港科技大学）；AI Thrust（AI 方向）
QueryAttack: Jailbreaking Aligned Large Language Models Using Structured Non-natural Query Language
Tsinghua Shenzhen International Graduate School（清华大学深圳国际研究生院）；Pengcheng Laboratory（鹏城实验室）；The Chinese University of Hong Kong（香港中文大学）；Jilin University（吉林大学）；Southwest University（西南大学）；University of Electronic Science and Technology of China（电子科技大学）；Shenzhen University（深圳大学）
Data to Defense: The Role of Curation in Customizing LLMs Against Jailbreaking Attacks
Stony Brook University（石溪大学）；Binghamton University（宾汉姆顿大学）；University of Iowa（爱荷华大学）；Dartmouth College（达特茅斯学院）；Georgia Institute of Technology（佐治亚理工学院）
CCFC: Core & Core-Full-Core Dual-Track Defense for LLM Jailbreak Protection
Department. of Math & Statistics, Boston University（数学与统计学系，波士顿大学）；Department. of Computer Science, University at Albany（计算机科学系，阿尔巴尼大学）；Department. of ECE & Systems Eng., Department. of Biomedical Eng., Faculty of Computing & Data Sciences, Boston University（电子工程与系统工程系，生物医学工程系，计算与数据科学学院，波士顿大学）
Jailbreak Attacks and Defenses against Multimodal Generative Models: A Survey
School of Artificial Intelligence, Beijing University of Posts and Telecommunications（北京邮电大学人工智能学院）；School of Computer Science, University of California, Santa Barbara（加利福尼亚大学圣巴巴拉分校计算机科学学院）；State Key Laboratory of Multimodal Artificial Intelligence Systems, CASIA（中国科学院自动化研究所多模态人工智能系统国家重点实验室）；New Laboratory of Pattern Recognition, CASIA（中国科学院自动化研究所新模式识别实验室）；School of Artificial Intelligence, University of Chinese Academy of Sciences（中国科学院大学人工智能学院）
PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks
Beijing Institute of AI Safety and Governance (Beijing-AISI)（北京人工智能安全与治理研究院）；Beijing Key Laboratory of Safe AI and Superalignment（北京安全人工智能与超对齐重点实验室）；BrainCog Lab, CASIA（CASIA脑认知实验室）
SAID: Safety-Aware Intent Defense via Prefix Probing for Large Language Models
Shenzhen Key Laboratory of Visual Object Detection and Recognition, Harbin Institute of Technology, Harbin Institute of Technology, Shenzhen, Shenzhen, China（深圳视觉目标检测与识别重点实验室，哈尔滨工业大学，哈尔滨工业大学，深圳，深圳，中国）
Jailbreaking Large Language Models through Iterative Tool-Disguised Attacks via Reinforcement Learning
School of Cyberspace Science and Technology, Beijing Institute of Technology（信息科学与技术学院，北京理工大学）；School of Computer Science and Technology, Beijing Institute of Technology（计算机科学与技术学院，北京理工大学）；School of Computer Science, University of Auckland（计算机科学学院，奥克兰大学）；QAX Security Center, Qi-AnXin Technology Group Inc.（QAX安全中心，启安新科技集团）；Qi-AnXin Technology Group Inc.（启安新科技集团）；Zhongguancun Laboratory（中关村实验室）
Activation-Guided Local Editing for Jailbreaking Attacks
Beihang University（北航）；Hangzhou Innovation Institute（杭州创新研究院）；HKUST（香港科技大学）；South China University of Technology（华南理工大学）；Nanyang Technological University（南洋理工大学）；Kunming University of Science and Technology（昆明理工大学）
Jailbreaking Large Vision Language Models in Intelligent Transportation Systems
KFSCIS, Florida International University（凯斯-西储大学信息科学学院）；Knight Foundation School of Computing and Information Sciences（骑士基金会计算与信息科学学院）；Learning for InterDependent Networks Laboratory (solid lab)（依赖网络学习实验室）
JAILJUDGE: A Comprehensive Jailbreak Judge Benchmark with Multi-Agent Enhanced Explanation Evaluation Framework
The Hong Kong University of Science and Technology (Guangzhou)（香港科技大学（广州））；Baidu Inc.（百度公司）；The Hong Kong University of Science and Technology（香港科技大学）；University of Birmingham（伯明翰大学）
E$^2$AT: Multimodal Jailbreak Defense via Dynamic Joint Optimization for Multimodal Large Language Models
School of Cyber Science and Engineering, Nanjing University of Science and Technology, China（南京理工大学信息科学与工程学院）；HKUST(GZ) and INSAIT, Sofia University St. Kliment Ohridski（香港科技大学（广州）及INSAIT，索菲亚大学圣克莱门特·奥赫里迪斯学院）；College of Computing and Data Science, Nanyang Technological University, Singapore（南洋理工大学计算与数据科学学院）
Immune: Improving Safety Against Jailbreaks in Multi-modal LLMs via Inference-Time Alignment
University of Maryland（马里兰大学）；Indian Institute of Technology Bombay（印度班加罗尔理工学院）；Princeton University（普林斯顿大学）；University of Colorado Boulder（科罗拉多大学博尔德分校）；Capital One（Capital One公司）；University of Central Florida（佛罗里达中央大学）
