Uncovering the mechanisms behind "jailbreaks" in large language models (LLMs) is crucial for enhancing their safety and reliability, yet these mechanisms remain poorly understood. Existing studies predominantly analyze jailbreak prompts by probing latent representations, often overlooking the causal relationships between interpretable prompt features and jailbreak occurrences. In this work, we propose Causal Analyst, a framework that integrates LLMs into data-driven causal discovery to identify the direct causes of jailbreaks and leverage them for both attack and defense. We introduce a comprehensive dataset comprising 35k jailbreak attempts across seven LLMs, systematically constructed from 100 attack templates and 50 harmful queries, annotated with 37 meticulously designed human-readable prompt features. By jointly training LLM-based prompt encoding and GNN-based causal graph learning, we reconstruct causal pathways linking prompt features to jailbreak responses. Our analysis reveals that specific features, such as "Positive Character" and "Number of Task Steps", act as direct causal drivers of jailbreaks. We demonstrate the practical utility of these insights through two applications: (1) a Jailbreaking Enhancer that targets identified causal features to significantly boost attack success rates on public benchmarks, and (2) a Guardrail Advisor that utilizes the learned causal graph to extract true malicious intent from obfuscated queries. Extensive experiments, including baseline comparisons and causal structure validation, confirm the robustness of our causal analysis and its superiority over non-causal approaches. Our results suggest that analyzing jailbreak features from a causal perspective is an effective and interpretable approach for improving LLM reliability. Our code is available at https://github.com/Master-PLC/Causal-Analyst.
Scalable Defense against In-the-wild Jailbreaking Attacks with Safety Context Retrieval
School of EECS, Peking University（电子工程系，北京大学）；School of Mathematical Sciences, Peking University（数学系，北京大学）；State Key Lab of General Artificial Intelligence, School of Intelligence Science and Technology, Peking University（通用人工智能国家重点实验室，智能科学与技术学校，北京大学）；Institute for Artificial Intelligence, Peking University（人工智能研究院，北京大学）
Enhancing Model Defense Against Jailbreaks with Proactive Safety Reasoning
School of Computing（计算学院）；National University of Singapore（新加坡国立大学）；School of Computer Science and Engineering（计算机科学与工程学院）；Nanyang Technological University（南洋理工大学）；Department of Computing（计算系）；The Hong Kong Polytechnic University（香港理工大学）
GUARD-SLM: Token Activation-Based Defense Against Jailbreak Attacks for Small Language Models
Knight Foundation School of Computing and Information Sciences（奈特基金会计算与信息科学学院）；Security, Optimization, and Learning for InterDependent networks laboratory (solid lab)（安全、优化与相互依赖网络学习实验室）；Florida International University（佛罗里达国际大学）
SelfDefend: LLMs Can Defend Themselves against Jailbreaking in a Practical Manner
The Hong Kong University of Science and Technology（香港科技大学）；University of Oregon（俄勒冈大学）；Nanyang Technological University（南洋理工大学）；City University of Hong Kong（香港城市大学）；HSBC（汇丰银行）
East China Normal University（东华大学）；Shanghai Innovation Institute（上海创新研究院）；University of Southampton（南安普顿大学）；Shanghai Jiao Tong University（上海交通大学）；Software Engineering Institute, East China Normal University（东华大学软件工程研究院）
FRACTURED-SORRY-Bench: Framework for Revealing Attacks in Conversational Turns Undermining Refusal Efficacy and Defenses over SORRY-Bench (Automated Multi-shot Jailbreaks)
Activation-Guided Local Editing for Jailbreaking Attacks
Beihang University（北航）；Hangzhou Innovation Institute（杭州创新研究院）；HKUST（香港科技大学）；South China University of Technology（华南理工大学）；Nanyang Technological University（南洋理工大学）；Kunming University of Science and Technology（昆明理工大学）
Mind the Trojan Horse: Image Prompt Adapter Enabling Scalable and Deceptive Jailbreaking
School of Computer Science and Engineering, Sun Yat-Sen University（中山大学计算机科学与工程学院）；Nanyang Technological University（南洋理工大学）；Guangdong Province Key Laboratory of Information Security Technology（广东省信息安全技术重点实验室）
Immune: Improving Safety Against Jailbreaks in Multi-modal LLMs via Inference-Time Alignment
University of Maryland（马里兰大学）；Indian Institute of Technology Bombay（印度班加罗尔理工学院）；Princeton University（普林斯顿大学）；University of Colorado Boulder（科罗拉多大学博尔德分校）；Capital One（Capital One公司）；University of Central Florida（佛罗里达中央大学）
Jailbreaking and Mitigation of Vulnerabilities in Large Language Models
Hunan University Changsha, PRC；Georgia Institute of Technology Atlanta, USA；Kyoto University Kyoto, Japan；Purdue University West Lafayette, USA；National Taiwan Normal University Taipei, ROC；University of Liverpool Suzhou, PRC；Hong Kong University of Science；University of Hawaii Honolulu, USA；The University of Texas at Dallas Dallas, USA；University of Wisconsin-Madison Madison, USA；Emory University Atlanta, USA；College of William \& Mary Williamsburg, USA
