mlsanityData to 7 Oct 2026

Defending Large Language Models against Jailbreak Attacks via Semantic Smoothing

arXiv 2402.16192 ↗First posted 25 Feb 2024cs.CLcited by 68

On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks

also in 1 more
Abstract (arXiv)

Aligned large language models (LLMs) are vulnerable to jailbreaking attacks, which bypass the safeguards of targeted LLMs and fool them into generating objectionable content. While initial defenses show promise against token-based threat models, there do not exist defenses that provide robustness against semantic attacks and avoid unfavorable trade-offs between robustness and nominal performance. To meet this need, we propose SEMANTICSMOOTH, a smoothing-based defense that aggregates the predictions of multiple semantically transformed copies of a given input prompt. Experimental results demonstrate that SEMANTICSMOOTH achieves state-of-the-art robustness against GCG, PAIR, and AutoDAN attacks while maintaining strong nominal performance on instruction following benchmarks such as InstructionFollowing and AlpacaEval. The codes will be publicly available at https://github.com/UCSB-NLP-Chang/SemanticSmooth.

Key facts. Cited by 68 papers in the map (data through 7 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 45 of its 67 references that are in the map. First posted on arXiv 25 Feb 2024.

Builds on

45 of 67 references.

Closest ancestors · 6

Same direction, newest first

  1. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations10 Oct
  2. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models3 Oct
  3. 2023Defending Against Alignment-Breaking Attacks via Robustly Aligned LLM18 Sep
  4. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Models1 Sep
  5. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
  6. 2023Are aligned neural networks adversarially aligned?26 Jun

Other references · 39

  1. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  2. 2022Training language models to follow instructions with human feedbackcited by 15,712
  3. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
  4. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 7,916
  5. 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,634
  6. 2019PIQA: Reasoning about Physical Commonsense in Natural Languagecited by 2,818
  7. 2018Can a Suit of Armor Conduct Electricity? A New Dataset for Open Book Question Answeringcited by 2,114
  8. 2023Code Llama: Open Foundation Models for Codecited by 2,105
  9. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
  10. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  11. 2023Instruction-Following Evaluation for Large Language Modelscited by 1,143
  12. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
27 more
  1. 2023BloombergGPT: A Large Language Model for Financecited by 923
  2. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 619
  3. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMscited by 533
  4. 2022Improving alignment of dialogue agents via targeted human judgementscited by 527
  5. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Promptscited by 520
  6. 2023"Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Modelscited by 457
  7. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 434
  8. 2023Detecting Language Model Attacks with Perplexitycited by 411
  9. 2023A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Uglycited by 380
  10. 2022A Holistic Approach to Undesired Content Detection in the Real Worldcited by 337
  11. 2023Hard Prompts Made Easy: Gradient-Based Discrete Optimization for Prompt Tuning and Discoverycited by 329
  12. 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
  13. 2023Low-Resource Languages Jailbreak GPT-4cited by 290
  14. 2023AI Alignment: A Comprehensive Surveycited by 256
  15. 2023Certifying LLM Safety against Adversarial Promptingcited by 248
  16. 2023LLM Self Defense: By Self Examination, LLMs Know They Are Being Trickedcited by 226
  17. 2023Multilingual Jailbreak Challenges in Large Language Modelscited by 222
  18. 2023Scalable and Transferable Black-Box Jailbreaks for Language Models via Persona Modulationcited by 202
  19. 2023Automatically Auditing Large Language Models via Discrete Optimizationcited by 187
  20. 2020Randomized Smoothing of All Shapes and Sizescited by 146
  21. 2022(Certified!!) Adversarial Robustness for Free!cited by 130
  22. 2023Open Sesame! Universal Black Box Jailbreaking of Large Language Modelscited by 128
  23. 2023Combating Misinformation in the Age of LLMs: Opportunities and Challengescited by 94
  24. 2020SAFER: A Structure-free Approach for Certified Robustness to Adversarial Word Substitutionscited by 72
  25. 2021Certified Robustness to Text Adversarial Attacks by Randomized [MASK]cited by 57
  26. 2024Break the Breakout: Reinventing LM Defense Against Jailbreak Attacks with Self-Refinementcited by 25
  27. 2023Certified Robustness for Large Language Models with Self-Denoisingcited by 23

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 23; 2025: 30; 2026: 15.

68 papers.

Sort:

By area:

  1. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 494
  2. 2024Jailbreak Attacks and Defenses Against Large Language Models: A Surveycited by 215
  3. 2024Know Your Limits: A Survey of Abstention in Large Language Modelscited by 116
  4. 2024FlipAttack: Jailbreak LLMs via Flippingcited by 73
  5. 2024Improved Few-Shot Jailbreaking Can Circumvent Aligned Language Models and Their Defensescited by 68
  6. 2024JailbreakZoo: Survey, Landscapes, and Horizons in Jailbreaking Large Language and Vision-Language Modelscited by 67
  7. 2024Defending LLMs against Jailbreaking Attacks via Backtranslationcited by 65
  8. 2024Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agentscited by 63
  9. 2025Safety at Scale: A Comprehensive Survey of Large Model and Agent Safetycited by 63
  10. 2024SelfDefend: LLMs Can Defend Themselves against Jailbreaking in a Practical Mannercited by 57
  11. 2024Bag of Tricks: Benchmarking of Jailbreak Attacks on LLMscited by 47
  12. 2024Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)cited by 44
38 more
  1. 2024JAILJUDGE: A Comprehensive Jailbreak Judge Benchmark with Multi-Agent Enhanced Explanation Evaluation Frameworkcited by 44
  2. 2024JailbreakEval: An Integrated Toolkit for Evaluating Jailbreak Attempts Against Large Language Modelscited by 28
  3. 2024Protecting Your LLMs with Information Bottleneckcited by 26
  4. 2024Adversarial Tuning: Defending Against Jailbreak Attacks for LLMscited by 23
  5. 2024From LLMs to MLLMs: Exploring the Landscape of Multimodal Jailbreakingcited by 22
  6. 2024Mission Impossible: A Statistical Perspective on Jailbreaking LLMscited by 21
  7. 2024Jailbreak Antidote: Runtime Safety-Utility Balance via Sparse Representation Adjustment in Large Language Modelscited by 21
  8. 2025SoK: Evaluating Jailbreak Guardrails for Large Language Modelscited by 17
  9. 2024You Know What I'm Saying: Jailbreak Attack via Implicit Referencecited by 13
  10. 2025UniGuardian: A Unified Defense for Detecting Prompt Injection, Backdoor Attacks and Adversarial Attacks in Large Language Modelscited by 12
  11. 2025One Model Transfer to All: On Robust Jailbreak Prompts Generation against LLMscited by 12
  12. 2025SecurityLingua: Efficient Defense of LLM Jailbreak Attacks via Security-Aware Prompt Compressioncited by 12
  13. 2025Robust Answers, Fragile Logic: Probing the Decoupling Hypothesis in LLM Reasoningcited by 11
  14. 2025JALMBench: Benchmarking Jailbreak Vulnerabilities in Audio Language Modelscited by 11
  15. 2025Single-pass Detection of Jailbreaking Input in Large Language Modelscited by 10
  16. 2025DETAM: Defending LLMs Against Jailbreak Attacks via Targeted Attention Modificationcited by 10
  17. 2025Detoxifying Large Language Models via Autoregressive Reward Guided Representation Editingcited by 9
  18. 2025Smoothed Embeddings for Robust Language Modelscited by 8
  19. 2025Evolving Security in LLMs: A Study of Jailbreak Attacks and Defensescited by 8
  20. 2025Proactive defense against LLM Jailbreakcited by 6
  21. 2024Enhancing the Capability and Robustness of Large Language Models through Reinforcement Learning-Driven Query Refinementcited by 5
  22. 2024LLM Safeguard is a Double-Edged Sword: Exploiting False Positives for Denial-of-Service Attackscited by 5
  23. 2024Stochastic Monkeys at Play: Random Augmentations Cheaply Break LLM Safety Alignmentcited by 5
  24. 2024Jailbreaking LLM-Controlled Robotscited by 4
  25. 2025Geneshift: Impact of different scenario shift on Jailbreaking LLMcited by 4
  26. 2025PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attackscited by 4
  27. 2026StealthGraph: Exposing Domain-Specific Risks in LLMs through Knowledge-Graph-Guided Harmful Prompt Generationcited by 4
  28. 2025STShield: Single-Token Sentinel for Real-Time Jailbreak Detection in Large Language Modelscited by 3
  29. 2026Towards Multimodal Time Series Anomaly Detection with Semantic Alignment and Condensed Interactioncited by 3
  30. 2026MT-JailBench: A Modular Benchmark for Understanding Multi-Turn Jailbreak Attackscited by 3
  31. 2025Helping Large Language Models Protect Themselves: An Enhanced Filtering and Summarization Systemcited by 2
  32. 2025Checkpoint-GCG: Auditing and Attacking Fine-Tuning-Based Prompt Injection Defensescited by 2
  33. 2025ReasoningGuard: Safeguarding Large Reasoning Models with Inference-time Safety Aha Momentscited by 2
  34. 2026Test-Time Safety Alignmentcited by 2
  35. 2025How Jailbreak Defenses Work and Ensemble? A Mechanistic Investigationcited by 1
  36. 2025LiteLMGuard: Seamless and Lightweight On-Device Prompt Filtering for Safeguarding Small Language Models against Quantization-induced Risks and Vulnerabilitiescited by 1
  37. 2025LLM in the Middle: A Systematic Review of Threats and Mitigations to Real-World LLM-based Systemscited by 1
  38. 2025Bidirectional Intention Inference Enhances LLMs' Defense Against Multi-Turn Jailbreak Attackscited by 1

50 most cited of 68 All 68 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2025CCJA: Context-Coherent Jailbreak Attack for Aligned Large Language Models
  2. 2026Provable Defense Framework for LLM Jailbreaks via Noise-Augumented Alignment
  3. 2024Defending Large Language Models Against Jailbreak Attacks via Layer-specific Editing
  4. 2026TAO-Attack: Toward Advanced Optimization-Based Jailbreak Attacks for Large Language Models
  5. 2024Jailbreaking Large Language Models Through Alignment Vulnerabilities in Out-of-Distribution Settings
  6. 2026LASH: Adaptive Semantic Hybridization for Black-Box Jailbreaking of Large Language Models
  7. 2026Text-Anchored Semantic Perturbations for Transferable Jailbreak Attacks on Multimodal Large Language Models
  8. 2024Defensive Prompt Patch: A Robust and Interpretable Defense of LLMs against Jailbreak Attacks